Special edition: CVE-2926-109618 (Update #4)

This is a special edition of It's Probably Nothing on PHP2Shell, the two PHP-core flaws. Patches remain urgent, but the live-attack evidence is narrower than we last reported. This assessment is current to 7:04am New Zealand daylight time on 24 October.

First, a correction to our last edition. In its 22 October correction, Sophos withdrew its successful-compromise report. It now reports scanning and failed attempts, with no evidence of successful compromise in its telemetry. The suspected Mirai-variant payload wasn't delivered because the attempt was blocked. That's a correction to our lead, not an all-clear elsewhere.

PHP's 23 October notice adds a separate remote-code-execution vector, not a failure of the original fixes. With upload progress enabled, exposure requires an application configured with the php_binary or php_serialize session handler to switch to php at runtime, before starting the session. PHP recommends setting session.upload_progress.enabled to zero until the next regular bugfix release. Applications that never change handlers at runtime can keep the feature.

The underlying risk from the original pair hasn't disappeared. These PHP-core bugs leave incompletely initialised or freed request state available for later code to consume. PHP puts all web-serving installations in scope.

mod_php has the highest demonstrated risk, including remote code execution before application code runs. FPM has validated code execution for the second flaw, requiring suitable application behaviour. PHP hasn't demonstrated a complete FPM exploit for the first. Code runs as the web worker, not automatically as root.

The earlier investigation window still matters. AWS reports an exploitation attempt against its MadPot system on 17 October, before the public leak on 20 October. That doesn't establish success against real systems, or how the actor obtained exploit information. AWS's investigation window still starts from at least 17 October.

VulnCheck now claims commercial exploit support for PHP 8.4.10 through 8.4.26. That's vendor testing, not proof of portability across arbitrary production deployments.

PHP released fixes on 21 October. The fixed upstream releases are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Distribution backports can look older, so verify the full package build. Minimal source backports exist for PHP 7.4, 8.0 and 8.1, without restoring normal support.

Installing the package isn't necessarily the end of it: replace running workers too. Forge's automatic security updates exclude PHP, so update every installed version and restart long-running processes. Configuration workarounds don't fully fix the original pair.

Supplier fixes aren't interchangeable, either. Palo Alto Networks limits PAN-OS and Panorama exposure to management web interfaces, not GlobalProtect. Its 26 to 30 October hotfix dates are estimates, not released fixes. AWS has completed WorkMail's upgrade, but new Lightsail blueprints don't update existing instances.

New Zealand's NCSC says it's too early to determine national impact. Its question for providers is whether compromise checks were done, not just updates. Patching doesn't remove an existing compromise, and New Zealand and Australian victim totals remain unresolved.

Don't forget, all our threat intelligence comes from Mallory dot A I and open sources. If you want intelligence your team can act on, reach out for a chat.