News
Real Problem
I have documented with the help of AI, and this is what I managed to come up with.
It’s about some critical vulnerabilities PHP2Shell (CVE-2026-109618 and CVE-2026-109619), which allow PHP memory exploitation, and execute remote code (RCE) without authentication.
This is done by POST requests, which inject malicious code, which through heap corruption tricks memory pointers into accepting the payload instead of real files. Once the payload bypasses this threshold, instructions are fed to the processor for execution. And then PHP files are installed which act as backdoors, through which the hacker can login later using these endpoints.
PHP is written in C and uses the Zend Engine to manage pointers, which in the end executes php scripts. Surprisingly PHP is Open-Source, which means everyone can access Zend Engine, even the attackers.
WordPress and the LAMP stack are the main targets, because they are omnipresent on the internet and an automated scanner finds them in seconds.
How I solved it
Firstly, I identified the applications from the micro-services which use php, and then I checked in the verssion through php -v.
Then I have asked AI, which are the correction versions which contains the patch.
| PHP branch | Vulnerable Version | Secure Version (patched) | Branch Status |
|---|---|---|---|
PHP 8.2 |
< 8.2.35 |
8.2.35 (or newer) |
Security Support |
PHP 8.3 |
< 8.3.36 |
8.3.36 (or newer) |
Active |
PHP 8.4 |
< 8.4.27 |
8.4.27 (or newer) |
Active |
PHP 8.5 |
< 8.5.12 |
8.5.12 (or newer) |
Current Version |
• For Firefly I used
docker compose pull && docker compose up -d
for updating my own instance, and now I am up to date.
• For the LAMP stack I used generic images like php:8.3-apache / php:8.4-apache / php:8.5-apache, and of course updated with pull image and prune within the Portainer.
At Wordpress I didn’t reach yet with my website, but I would do the modification in Portainer as well.
Infiltration Checks
After I closed up the vulnerability, I started a system check, to see what files had been uploaded or which are the damages, if any.
In the containers which runs PHP, I searched in Portainer by terms:
• PHPSESSID
• multipart/form-data
Future improvements
I am still thinking if I want to use a service like WatchTower for automatically updating containers, and so closing the window of vulnerability. The reason it’s that not all updates are good, like it happened with Windows, and I rather prefer more control.
CrowdSec seems the best approach to these PHP attacks.
Top comments (0)