Дэлхий даяарх вэб админууд PHP хэлний эмзэг байдлыг засах яаралтай шинэчлэлтийг хийхээр ажиллаж байгаа бөгөөд халдлагад өртөх магадлал өндөр байна.
PHP Foundation байгууллага вэб серверийн ажиллагаанд нөлөөлдөг CVE-2026-109618 болон CVE-2026-109619 гэсэн хоёр ноцтой эмзэг байдлыг илрүүлснээ мэдэгдлээ. Эдгээр цоорхой нь 2004 оны долдугаар сараас хойшхи PHP-ийн бүх хувилбарт нөлөөлж байгаа ч зөвхөн 8.2 болон түүнээс хойших хувилбаруудад албан ёсны засвар хийгдэх юм. Мэргэжилтнүүд хуучин хувилбар ашиглаж буй системүүд халдлагад өртөх эрсдэлтэйг анхааруулж, яаралтай шинэчлэлт хийхийг зөвлөж байна.
Лукаш Олейник тэргүүтэй аюулгүй байдлын шинжээчид энэхүү асуудлыг интернэтийн дэд бүтцэд учирч буй томоохон аюул хэмээн тодорхойлж байна. WordPress, Drupal, Magento зэрэг өргөн хүрээнд ашиглагддаг платформууд PHP хэл дээр суурилдаг тул сая сая системд нөлөөлөх, улмаар хортой програм тархах нөхцөл бүрдээд байна. Аюулгүй байдлын зөвлөх Дави Оттенхаймерын үзэж буйгаар, энэхүү цоорхой нь файл байршуулах интерфэйстэй холбоотой бөгөөд халдагчид ямар ч серверийг хялбархан хяналтдаа авах боломжтой юм.
Cloudflare компани засвар гарахаас өмнө халдлагын шинж тэмдгүүд ажиглагдсаныг мэдээлсэн бол Sansec фирм шинэчлэлт гарснаас хойш 15 минутын дотор массын халдлага эхлэх өндөр магадлалтайг анхааруулж байв. Одоогоор бүрэн хамгаалалт байхгүй тул програм хангамжаа шинэчлэх нь цорын ганц аюулгүй сонголт болоод байна.
Дэлгэрэнгүйг эх сурвалжаас харах
↓Эх сурвалжийг нээх ↓
Internet security and web administration teams around the world are scrambling to prevent widespread disaster. On Wednesday, the developers behind the much-used PHP programming language released emergency security updates designed to fix critical flaws that could be exploited to allow attackers to gain dangerous remote control of victim systems.
The PHP Foundation detailed the two critical vulnerabilities—CVE-2026-109618 and CVE-2026-109619—which impact “all PHP installations serving web requests” going back to PHP version 5, released in July 2004. However, only PHP 8.2 and newer are still supported and will receive patches, according to the alert. The PHP Foundation noted, though, that some PHP distributions and third-party vendors still produce legacy fixes. The caveat is significant, because ubiquitous and foundational web layers like PHP can persist forgotten and un-updated in historic internet infrastructure.
“There are no complete mitigations, updating is the only safe choice,” the PHP Foundation wrote in its advisories. Security experts warn of the potential dire consequences of overlooking unpatched systems.
“This is not a drill,” says Lukasz Olejnik, an independent security consultant and visiting senior research fellow at King’s College London. Since its development in the 1990s, PHP has evolved into an essential scripting language for web development and is used across vast swaths of the internet in websites and software. Everything from publishing systems like WordPress and Drupal to e-commerce platforms like Adobe’s Magento are built on PHP.
Olejnik likens the widespread use of the programming language to critical infrastructure.
“The impact is enormous,” he says of PHP’s security flaws, adding that millions of systems could be impacted. “Especially if attackers would turn to exploiting these vulnerabilities fast. Worst case is wormable malware affecting big chunks of the internet.”
The overriding fear for security teams and developers is that malicious hackers could quickly jump upon the vulnerabilities and begin exploiting deployments before they are fixed. Internet infrastructure company Cloudflare reported it was “seeing early attacks emerging” before the PHP Foundation had detailed the vulnerabilities and released fixes. “We expect mass attacks to start within 15 minutes of the release,” security firm Sansec wrote ahead of the fixes, which were released just before 10 am ET on Wednesday.
“Most of the web runs on PHP and this bug is in a file upload interface that’s like a front door with no lock,” says longtime security and compliance consultant Davi Ottenheimer. “An attacker does not need to know which site they are hitting or even the actual software it runs. They send one crafted upload to any server they can find, and that is the entire attack.”
