PHP2Shell

2026.10.22

PHP2Shellに関して、Description: Ubuntu 24.04.5 LTS での確認を行いました。これは、その作業内容です。

PHP2Shell（ピーエイチピー・ツー・シェル）（CVE-2026-109618、CVE-2026-109619）
https://ja.wikipedia.org/wiki/PHP2Shell

PHP2Shell、何が起こっているのか？
お恥ずかしながら、ニュースで知りました。それだけ影響が大きいでようです。

PHP（PHP: Hypertext Preprocessor)：とは？
広く使われているオープンソースの汎用スクリプト言語です。Web 開発に適しており、HTML に埋め込むことができます。

PHPをWebサーバで動作させると、
HTML を出力したり、画像やPDFファイルを出力したり、データを暗号化したり、メール送信ができます。テキスト処理を行い、さらにデータベースも扱えます。

多くのサイトがPHPを用いて、そのサービスをしています。ここもそうです。

悪意を意図した命令をサーバーに送ることで、サーバー改ざん、情報の漏洩、マルウェアを入れられてしまうことがあります。

パッチを確認します。

脆弱性に対応したアップデートに更新するために、

sudo apt update
sudo apt upgrade

PHP更新を確認します。

apt-cache policy php8.3
php8.3:
  インストールされているバージョン: 8.3.6-0ubuntu0.24.04.13
  候補:               8.3.6-0ubuntu0.24.04.13
  バージョンテーブル:
 *** 8.3.6-0ubuntu0.24.04.13 500
        500 http://ports.ubuntu.com/ubuntu-ports noble-updates/main arm64 Packages
        500 http://ports.ubuntu.com/ubuntu-ports noble-security/main arm64 Packages
        100 /var/lib/dpkg/status
     8.3.6-0ubuntu0.24.04.12 500
        500 http://ports.ubuntu.com/ubuntu-ports noble-updates/main arm64 Packages
        500 http://ports.ubuntu.com/ubuntu-ports noble-security/main arm64 Packages
     8.3.6-0maysync1 500
        500 http://ports.ubuntu.com/ubuntu-ports noble/main arm64 Packages

“/usr/share” ディレクトリには、アーキテクチャに依存しないファイルが置かれています。
“/usr/share/doc”には、ソフトウェアに関するドキュメントが置かれています。

PHP8.3ドキュメントを見てみます。

cd /usr/share/doc/php8.3-common
合計 116
drwxr-xr-x   2 root root  4096 10月 22 06:57 ./
drwxr-xr-x 926 root root 24576  9月 25 06:28 ../
-rw-r--r--   1 root root  3045  4月 12  2024 EXTENSIONS.gz
-rw-r--r--   1 root root  3165 10月 20 00:16 README.Debian.gz
-rw-r--r--   1 root root  1102  3月 19  2026 README.Debian.security
-rw-r--r--   1 root root  2240  4月 12  2024 README.md.gz
-rw-r--r--   1 root root  3108  4月 12  2024 UPGRADING.INTERNALS.gz
-rw-r--r--   1 root root 10180  4月 12  2024 UPGRADING.gz
-rw-r--r--   1 root root 14167 10月 20 00:16 changelog.Debian.gz
-rw-r--r--   1 root root 33969  3月 19  2026 copyright

内容を見るには、

zcat /usr/share/doc/php8.3-common/changelog.Debian.gz

該当箇所前後の10行を含めて表示させます。

zcat /usr/share/doc/php8.3-common/changelog.Debian.gz | grep -C 10 CVE-2026-109618
php8.3 (8.3.6-0ubuntu0.24.04.13) noble-security; urgency=medium

  * SECURITY UPDATE: Remote RCE via state corruption issue
    - debian/patches/CVE-2026-109618_109619.patch: Avoid state corruption via
      bailout in Zend/tests/bug40770.phpt, Zend/tests/bug54268.phpt,
      Zend/tests/bug76846.phpt,
      Zend/tests/debug_backtrace_sensitive_named_variadic.phpt,
      Zend/tests/fibers/get-return-after-bailout.phpt, Zend/tests/gh11189.phpt,
      Zend/tests/gh11189_1.phpt,
      Zend/tests/oom_SplFixedArray___unserialize.phpt,
      Zend/tests/oom_SplFixedArray___wakeup.phpt,
      Zend/tests/oom_SplFixedArray_copy_ctor.phpt,
      Zend/tests/oom_SplFixedArray_fromArray_001.phpt,
      Zend/tests/oom_SplFixedArray_fromArray_002.phpt,
--
      tests/basic/oom_rfc1867_header_continuation.phpt,
      tests/basic/oom_rfc1867_header_count.phpt,
      tests/basic/oom_rfc1867_long_header_line.phpt,
      tests/basic/oom_rfc1867_mb_encoding.phpt,
      tests/basic/oom_rfc1867_mb_skipif.inc,
      tests/basic/oom_rfc1867_post_vars.phpt,
      tests/basic/oom_rfc1867_session_skipif.inc,
      tests/basic/oom_rfc1867_skipif.inc, tests/basic/oom_rfc1867_target.inc,
      tests/basic/oom_rfc1867_upload_progress.phpt,
      tests/output/oom_in_internal_output_handler.phpt.
    - CVE-2026-109618
    - CVE-2026-109619

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Mon, 19 Oct 2026 11:16:58 -0400

php8.3 (8.3.6-0ubuntu0.24.04.12) noble-security; urgency=medium

  * SECURITY UPDATE: heap buffer over-read in stream filter line-break-chars option
    - debian/patches/CVE-2026-92842.patch: Fix heap-buffer-overflow in convert
      stream filters with NUL in line-break-chars in ext/standard/filters.c,
      ext/standard/tests/filters/ghsa-88hq-2827-7pg6.phpt.
zcat /usr/share/doc/php8.3-common/changelog.Debian.gz | grep -C 10 CVE-2026-109619

Apache, PHP-FPM 再起動させます。

sudo systemctl restart php8.3-fpm
sudo systemctl status php8.3-fpm --no-pager
sudo systemctl restart apache2

Security advisory: Critical remote code execution vulnerabilities, update now

PHPからの、RCE via OOM corruption、RCE via stale global stateに関しての案内

Security advisory: Critical remote code execution vulnerabilities, update now

21 Oct 2026

PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities that can allow unauthenticated remote code execution. All PHP users are strongly encouraged to update immediately.

Who is at risk: all PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. We consider the risk highest for mod_php, with a demonstrated exploit where an unauthenticated request can trigger the attack before any application code runs.

The vulnerabilities:

  • RCE via OOM corruption, CVE-2026-109618 (GHSA-w8hw-w9fx-j79w): out-of-memory handling can interrupt PHP while internal request data is only partially initialized. Request cleanup may then treat the invalid data as valid.
  • RCE via stale global state, CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp): request-owned internal state can survive after its backing memory has been freed. A later request handled by the same worker may use that stale state before normal initialization resets it.

How to update:

  • Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35. Source downloads are on our downloads page. Windows source and binaries are on the same page.
  • Linux distributions and LTS vendors received the patches in advance, so check your vendor for updated packages.
  • PHP 8.1 and older no longer receive updates from the PHP project. Some distributions and LTS vendors provide backported fixes, so contact your vendor for details, or upgrade to a supported version.
  • Given the severity of these vulnerabilities, the PHP security team provided minimal source-backports for PHP 7.4, PHP 8.0, and PHP 8.1 to help people building from source or without access to an LTS vendor.

If you cannot update immediately: while only an update is a complete solution, the following measures reduce exposure to specific attack paths but do not make an installation safe.

RCE via OOM corruption (CVE-2026-109618):

  • Set memory_limit=-1, preferably in a way applications can’t override, such as php_admin_value in the FPM pool or Apache configuration, and check that no pool, directory or application setting puts a finite limit back. This removes the controllable PHP memory limit failure, but an underlying allocation failure can still reach the vulnerable path.
  • Set a low post_max_size. For applications that don’t require file uploads, set post_max_size = 8M. If file uploads are necessary, set post_max_size = 32M. Keep upload_max_filesize below post_max_size. Consider enforcing limits at the web server or proxy level for decoded request size, input field count, multipart part count, header count, and nesting depth. These limits must also cover requests without a usable Content-Length.
  • Use a container or cgroup limit as an availability boundary, preferably with a policy that kills only the affected worker. Do not substitute RLIMIT_AS or RLIMIT_DATA, as these can cause the vulnerable allocation failure.

RCE via stale global state (CVE-2026-109619):

  • Set session.upload_progress.enabled=0 and restart every worker. Use php.ini, an FPM pool or server configuration that applies before request parsing. Do not rely on ini_set() or FPM .user.ini. This blocks the confirmed session paths but not other variants.
  • On PHP 8.5, set fatal_error_backtraces=0 and restart every worker. This blocks the confirmed fatal backtrace path only.
  • Remove invalid or deprecated settings applied per request that emit diagnostics before initialization. Hiding diagnostics with error_reporting, display_errors or @ does not help.
  • Fix attacker-reachable fatal errors and execution timeouts, including failures in callbacks, upload or import processing and cleanup.

The advisories linked above have the full technical details.

コメント