We Thought We Had No PHP. We Were Wrong.

说明与用途

组织可能错误地认为其 Web 基础设施不使用 PHP，但隐藏的 PHP 处理程序可能会暴露关键漏洞，例如 php2shell。在此案例中，cl0q 通过应用补丁并重启服务，发现并修复了隐藏的 PHP 处理程序。

问题

Organizations may assume their web infrastructure does not use PHP, yet hidden PHP handlers can expose critical RCE vulnerabilities such as php2shell (CVE‑2026‑109618/109619).

结果

By systematically inventorying and patching hidden PHP handlers, the cl0q team eliminated the php2shell vulnerability on two critical servers while maintaining site functionality.

工作流

• Inventory all web servers, PHP packages, FPM services, Apache modules, containers, and legacy virtual hosts.
• Determine where PHP can execute—distinguish between installed packages and active handlers.
• Patch PHP using distribution or upstream releases; avoid workarounds.
• Restart the specific service that loaded the old PHP code (FPM, Apache, or containers).
• Re‑test from both outside (internet) and inside (local) to verify the patch and detect hidden handlers.
• Document findings for future reference.

证据

CVE-2026-109618 and CVE-2026-109619 are critical unauthenticated remote code execution flaws in PHP itself.

来源

PHP‑FPM was installed and active, wired behind Apache for cl0q and other virtual hosts.

来源

We patched the PHP 8.3 packages to the Ubuntu security backport and restarted FPM.

来源

We upgraded the PHP 8.1 packages to the jammy-security build and restarted Apache on the patched module.

来源

Patch the interpreter. Restart the service. Then prove the public site still works.

来源