Lỗ hổng PHP2Shell đã bị khai thác thật, và tắt upload progress là chưa đủ

php-fpm8.3 -v              # đổi 8.3 thành nhánh bạn dùng
apache2ctl -M | grep php   # có dòng php_module là đang dùng mod_php

apt changelog php8.3-fpm 2>/dev/null | grep -m2 "CVE-2026-10961"

sudo systemctl restart php8.3-fpm   # hoặc apache2 nếu dùng mod_php
ps -o lstart=,cmd= -C php-fpm8.3 | head -3

sudo grep -rh "Allowed memory size.*Unknown on line 0" /var/log/php* /var/log/nginx /var/log/apache2 2>/dev/null | tail
sudo grep -h "AH00052" /var/log/apache2/error.log* 2>/dev/null | tail

ps -ef --forest | grep -B1 -A3 "php-fpm\|apache2" | grep -E "sh -c|bash|curl|wget"
sudo find /var/www -name "*.php" -newermt 2026-10-17 -ls
crontab -l -u www-data

Lo hong PHP2Shell da bi khai thac that, va tat upload progress la chua du Hai lo hong PHP CVE-2026-109618 va CVE-2026-109619 (CVSS 9,2) dang bi do quet va khai thac tren dien rong, co lan thu tu 17/10, truoc khi ban va ra. Khong cai dat php.ini nao chan duoc het. Kiem tra ban PHP ma web dang chay, va, khoi dong lai va xem log co dau bi tan cong khong. PHP lo hong may chu Ngay 17/10, mot may chu moi (honeypot) cua Amazon nhan duoc mot request la nham vao PHP. Bon ngay sau PHP moi phat hanh ban va. Nghia la da co nguoi cam cach khai thac trong tay truoc khi phan lon chung ta biet lo hong ton tai.  Toi 21/10 blog da co bai ve [hai lo hong chay ma tu xa trong PHP](/php-va-2-lo-hong-rce), CVE-2026-109618 va CVE-2026-109619, moi loi 9,2/10 theo CVSS v4. Luc do PHP Foundation noi chua thay ban khai thac nao chay duoc, CISA cung chua ghi nhan vu tan cong nao. Ba ngay sau, tinh hinh da khac, va co mot loi khuyen trong bai truoc can noi lai cho ro. ## Da co tan cong that Nhung gi da duoc cac ben cong bo den chieu 24/10: - **Amazon** ghi nhan lan thu khai thac dau tien vao may chu moi MadPot ngay 17/10, them nhieu lan nua tu 21/10, va noi vu nay (gioi bao mat goi la PHP2Shell) gio "dang bi khai thac tren dien rong" (theo Tenable). - **watchTowr** thay khai thac ca hai loi tren mang may chu moi cua ho tu ngay 21/10. - **Cloudflare**, qua loi CTO Dane Knecht, noi ngay 21/10 da thay nhung dot tan cong dau tien va bat luat tuong lua (WAF) chan tam. - Datadog noi co do quet hang loat, khong chon muc tieu. Chua ro bao nhieu lan tan cong thanh cong. Toi 23/10, CISA van chua dua hai loi vao danh sach dang bi khai thac (KEV). Ma khai thac thi dang duoc chia nhau tren mang, Tenable chua kiem chung duoc ban nao chay that va canh bao mot so ban co the chua ma doc. Dung tai ve chay thu tren may minh. Mot nha nghien cuu uoc tinh hon 1,3 trieu may chu PHP mo ra internet co the dang dinh loi. Bi do quet khong chon muc tieu co nghia la cai VPS chay WordPress cua khach cung nam trong danh sach, khong can ai biet toi no. ## Cai dat php.ini khong thay duoc ban va Bai truoc co khuyen dat `session.upload_progress.enabled=0`. Loi khuyen do van dung, nhung de khien nguoi doc nghi tat no la xong. Khong phai vay. Cai dat nay chi bit mot duong cua CVE-2026-109619. Loi con lai, CVE-2026-109618, di qua duong lam can bo nho luc PHP doc request, va upload progress khong lien quan gi toi no. Chinh PHP noi ro khong co thay doi cau hinh nao chan duoc hoan toan hai loi nay. Datadog cung viet rang cac cach giam rui ro dang lan truyen trong cong dong "khong bao ve tron ven". Mot diem nua: bai truoc noi PHP-FPM chua ai dung duoc ban khai thac hoan chinh. Cac khuyen cao cap nhat sau do deu xep moi cach chay PHP phuc vu web vao dien bi anh huong, gom PHP-FPM, Apache mod_php, php-cgi, FrankenPHP va LiteSpeed. Mod_php van la nguy hiem nhat vi tan cong xong truoc khi code cua ban chay dong nao. Nhung dung nginx voi PHP-FPM thi cung phai va nhu moi nguoi. Theo watchTowr, PHP 5 cung dinh. PHP 7.4, 8.0, 8.1 chi co ban sua ma nguon toi thieu (backport) de nha phan phoi tu dong goi, PHP 7.3 tro xuong khong co gi. CISA khuyen tat han nhung may chay PHP 8.1 tro xuong neu khong va duoc. ## Kiem tra may chu cua ban **Xem ban PHP ma web dang chay, khong phai ban dong lenh.** Hai cai co the khac nhau. Tren Ubuntu, Debian: ```bash php-fpm8.3 -v # doi 8.3 thanh nhanh ban dung apache2ctl -M | grep php # co dong php_module la dang dung mod_php ``` Can dat **8.5.12, 8.4.27, 8.3.36 hoac 8.2.35** tro len. Goi cua distro doi khi va ma giu nguyen so phien ban, khi do xem changelog co nhac ma CVE khong: ```bash apt changelog php8.3-fpm 2>/dev/null | grep -m2 "CVE-2026-10961" ``` Chay PHP trong Docker thi keo image moi, build lai va deploy lai container. Sua trong container dang chay khong tinh. **Va xong phai khoi dong lai.** Tien trinh cu con song thi van chay code loi: ```bash sudo systemctl restart php8.3-fpm # hoac apache2 neu dung mod_php ps -o lstart=,cmd= -C php-fpm8.3 | head -3 ``` Gio khoi dong o dong thu hai phai la sau luc ban va. **Xem co dau bi tan cong khong.** Datadog goi y vai dau hieu trong log. Loi het bo nho voi dong `Unknown on line 0` cho thay PHP chet ngay luc doc request, chua toi code cua ban: ```bash sudo grep -rh "Allowed memory size.*Unknown on line 0" /var/log/php* /var/log/nginx /var/log/apache2 2>/dev/null | tail sudo grep -h "AH00052" /var/log/apache2/error.log* 2>/dev/null | tail ``` `AH00052` la tien trinh Apache bi loi phan doan (segfault). Mot hai dong le te chua noi len gi, vi app binh thuong cung co luc het bo nho. Dang lo la mot chum dong nhu vay don trong vai phut. Dau chac chan nhat la co shell hay lenh tai file chay duoi tien trinh PHP, va file PHP la moi xuat hien trong thu muc web: ```bash ps -ef --forest | grep -B1 -A3 "php-fpm\|apache2" | grep -E "sh -c|bash|curl|wget" sudo find /var/www -name "*.php" -newermt 2026-10-17 -ls crontab -l -u www-data ``` Luu y tan cong thanh cong co the tra ve ma 200 binh thuong ma khong lam sap gi, nen log sach chua co nghia la an toan. Thay file la hay cron la thi chep log va file do ra cho khac truoc khi xoa, roi doi het mat khau database, key API trong `.env` cua site, vi ke da chay duoc lenh tren may thi doc duoc file do. **Chua va duoc ngay** thi dung de may mo ra internet. Dat site sau Cloudflare chi co tac dung khi moi luu luong that su di qua Cloudflare, neu IP goc cua may chu van truy cap thang duoc thi luat WAF khong giup gi. --- May chu cua ban da len ban va chua, va goi cua distro ban dung ra ban va luc nao? Vao [cong dong Vibe Code & Bao Mat](https://www.facebook.com/groups/1867387324580254) ke cho moi nguoi cung biet nhe. ## Nguon - [PHP2Shell (CVE-2026-109618, CVE-2026-109619): Frequently Asked Questions](https://www.tenable.com/blog/php2shell-cve-2026-109618-cve-2026-109619-frequently-asked-questions-about-critical-php-remote), Tenable, cap nhat 23/10/2026 - [PHP Remote Code Execution (PHP2Shell)](https://watchtowr.com/intelligence/php-remote-code-execution-php2shell/), watchTowr, cap nhat 22/10/2026 - [PHP2Shell FAQ](https://watchtowr.com/intelligence/php-cve-2026-109618-faq/), watchTowr, cap nhat 23/10/2026 - [PHP2Shell: critical vulnerabilities in PHP](https://securitylabs.datadoghq.com/articles/php2shell-critical-vulnerabilities-in-php/), Datadog Security Labs, cap nhat 23/10/2026 - [RCE via OOM corruption (CVE-2026-109618)](https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w), khuyen cao bao mat cua PHP tren GitHub - [RCE via stale global state (CVE-2026-109619)](https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp), khuyen cao bao mat cua PHP tren GitHub - [PHP va hai lo hong chiem may chu tu xa, diem 9,2](/php-va-2-lo-hong-rce), bai truoc tren Bao Mat AI