Special edition: CVE-2926-109618 (Update #5)

This is a special edition of It's Probably Nothing on PHP2Shell, the two PHP-core flaws. Exploit claims have broadened, and several appliance fixes are still pending. This assessment is current to 8:26am New Zealand daylight time on 25 October.

Since our last edition, VulnCheck has expanded its commercial mod_php exploit claim. Its 23 October update adds PHP 8.5.10 and 8.5.11, AMD64 and ARM64, and supported default WordPress Docker deployments. Previously, it listed PHP 8.4.10 through 8.4.26. That's vendor testing, not independent validation across production builds. We've also learned of more affected products and a qualified Unit 42 compromise account.

The underlying bugs leave incompletely initialised or freed request state for later code to consume. PHP puts all web-serving installations in scope.

mod_php has demonstrated remote code execution before application code runs. FPM has validated code execution for the second flaw, dependent on application behaviour, but no complete FPM exploit is demonstrated for the first. Execution is as the web worker, not automatically root.

AWS reports an attempt against MadPot on 17 October, before the public leak on 20 October, and recommends investigating from at least 17 October. Success against real systems remains unclear. Sophos's 22 October correction still stands: failed attempts, with no evidence of successful compromise in its telemetry.

Unit 42's 23 October revision reports access to password hashes and MFA secrets at an unnamed European government entity, plus attempted Domain Admin escalation. It doesn't establish which flaw provided initial access, or the attack date. This isn't a confirmed PHP2Shell victim.

On supplier exposure, Cloud Software Group's 24 October statement identifies NetScaler ADC, NetScaler Gateway and TIBCO Fulfillment Provisioning as affected. NetScaler fixes are planned for 27 October; TIBCO remediation is being prepared.

AWS lists EMR on EC2 4.2 through 5.29, and 5.30 through 6.15 with Ganglia, as affected. EMR 7, EMR on EKS and EMR Serverless aren't affected.

Palo Alto Networks' PAN-OS and Panorama exposure remains limited to management web interfaces, not GlobalProtect. The 26 to 30 October hotfix dates are still estimates, not released fixes.

PHP's fixes released on 21 October remain 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Verify the full distribution package build and replace running workers. Forge's automatic security updates exclude PHP.

There's also a separate vector involving session upload progress, not a failure of the original fixes. It requires upload progress enabled, the php_binary or php_serialize session handler configured, and application code switching to php before starting the session. For that combination, PHP recommends setting session.upload_progress.enabled to zero until the next regular bugfix release.

Patching remains urgent. The broader exploit claims and newly identified product exposure don't establish widespread successful compromise.

Don't forget, all our threat intelligence comes from Mallory dot A I and open sources. If you want intelligence your team can act on, reach out for a chat.