安全研究机构Wiz Research监测显示，针对PHP重大漏洞“PHP2Shell”（CVE-2026-109618、CVE-2026-109619）的公开攻击尝试目前尚未实现端到端利用 1。尽管部分私有工具声称具备有效攻击能力，但公开概念验证代码（PoC）在不同部署环境中难以复现成功攻击 1。主要阻碍在于PoC在触发内存耗尽后，无法稳定泄露内存地址或保持同一工作进程（Worker Pinning） 1。
自该漏洞于2026年10月21日披露以来，互联网上易受攻击机器的暴露数量呈现显著下降趋势，每日减少约67% 1。同时，拥有至少一个暴露且易受攻击实例的组织数量下降了约47.9% 1。数据显示，运行PHP 7.3或更早版本的易受攻击机器比例在5天内从8.3%降至5.7%，而数据集中65%的组织仍在使用PHP技术栈 1。值得注意的是，已有特定案例显示Adel Karimi的蜜罐被成功利用，这一情况可能促使美国网络安全和基础设施安全局（CISA）将PHP2Shell列入已知被利用漏洞（KEV）列表 1。专家建议，尽管公开利用尚不普遍，相关机构仍需尽快修补漏洞以消除潜在风险 1。
Security researchers at Wiz have not observed any successful end-to-end exploitation attempts against the recently disclosed PHP vulnerability known as "PHP2Shell," despite widespread public proof-of-concept code. 1 The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, were initially made public on October 21, 2026. 1 Monitoring data indicates that the number of internet-exposed machines vulnerable to these flaws has decreased by approximately 67% since the disclosure date. 1 Similarly, the count of organizations possessing at least one exposed and vulnerable instance has dropped by roughly 47.9%. 1
The primary technical barrier preventing successful attacks is the instability of memory address leakage following a memory exhaustion trigger in public exploit codes. 1 Researchers noted that current methods fail to maintain consistent worker process pinning, which hinders reliable execution across different deployment environments. 1 Although some private tools claim effectiveness, they remain difficult to reproduce successfully with public proofs of concept. 1 Data shows that among affected organizations, 65% utilize PHP, while the proportion of vulnerable servers running PHP version 7.3 or earlier fell from 8.3% to 5.7% within five days. 1 Despite the lack of confirmed mass exploitation, experts advise immediate patching, particularly because a honeypot operated by Adel Karimi was reportedly compromised, a factor that may influence CISA’s decision to include PHP2Shell in its Known Exploited Vulnerabilities list. 1
评论
还没有评论，欢迎留下第一条。