We Thought We Had No PHP. We Were Wrong.

Описание и применение

Организации могут ошибочно считать, что их веб‑инфраструктура не использует PHP, но скрытые обработчики PHP могут раскрывать критические уязвимости, как php2shell. В примере cl0q обнаружил и исправил незакрытые PHP‑обработчики, применив обновления и перезапустив сервисы.

Задача

Organizations may assume their web infrastructure does not use PHP, yet hidden PHP handlers can expose critical RCE vulnerabilities such as php2shell (CVE‑2026‑109618/109619).

Результат

By systematically inventorying and patching hidden PHP handlers, the cl0q team eliminated the php2shell vulnerability on two critical servers while maintaining site functionality.

Рабочий процесс

• Inventory all web servers, PHP packages, FPM services, Apache modules, containers, and legacy virtual hosts.
• Determine where PHP can execute—distinguish between installed packages and active handlers.
• Patch PHP using distribution or upstream releases; avoid workarounds.
• Restart the specific service that loaded the old PHP code (FPM, Apache, or containers).
• Re‑test from both outside (internet) and inside (local) to verify the patch and detect hidden handlers.
• Document findings for future reference.

Доказательства

CVE-2026-109618 and CVE-2026-109619 are critical unauthenticated remote code execution flaws in PHP itself.

Источник

PHP‑FPM was installed and active, wired behind Apache for cl0q and other virtual hosts.

Источник

We patched the PHP 8.3 packages to the Ubuntu security backport and restarted FPM.

Источник

We upgraded the PHP 8.1 packages to the jammy-security build and restarted Apache on the patched module.

Источник

Patch the interpreter. Restart the service. Then prove the public site still works.

Источник