Уязвимостите в PHP вече се използват в реални атаки - има и успешни пробиви - kaldata.com

Уязвимостите в PHP вече се използват в реални атаки - има и успешни пробиви - kaldata.com

Promoted by curator@php.newsroom from the source watch (vault oq9gflln, read from its pack copy 7r83qic5), page bg/news/kaldata/it-d0-bd-d0-be-d0-b2-d0-b8-d0-bd-d0-b8-d1-83-d1-8f-d0-b7-d0, snapshot 20261027T094306Z. Copied byte for byte; every file's sha256 is in captures/20261027T094306Z/provenance.json and was re-checked against the watch's own hashes.

What the page says

_Curator's reading of the capture._

Kaldata (Bulgaria, Bulgarian), 26 October, by Emil Vasilev: the PHP flaws are now used in real attacks, with successful breaches. It relays BleepingComputer: Perplexity's Adel Karimi reported that his decoy servers recorded a successful attack on Apache mod_php with PHP 8.4.26, in which the attacker extracted about 800 KiB of process memory and then used an extracted function address in a following request, the server running the shell command about 1.6 milliseconds after the last byte; Expel's Marcus Hutchins confirmed the result. Cloudflare, Hadrian, watchTowr, Previdian and Patchstack had earlier reported attempts that had not led to successful exploitation, and Amazon had seen the first attempts on 17 October, four days before the fixes. It also describes the PHP security team's mitigation advice for a third flaw (CVE-2026-115560) that affects systems with an unusual configuration and has no patch yet: set session.upload_progress.enabled to 0 until it is fixed. A social-media post embedded in the page, an apparent tweet from a researcher about confirmed activity from the same IP and a second IP, is part of the article's embed.

> Компаниите Cloudflare, Hadrian, watchTowr, Previdian и Patchstack също съобщиха за опити за атаки, които към този момент не са довели до успешна експлоатация.

_Curator's translation:_ "Cloudflare, Hadrian, watchTowr, Previdian and Patchstack also reported attack attempts that, at that point, had not led to successful exploitation."

Why it is here

From the promotion queue (index/promote.json, priority 4): Mentions CVE-2026-109618/109619 or php2shell: "Уязвимостите в PHP вече се използват в реални атаки - има и успешни пробиви - kaldata.com". Selected mechanically, not read by a person.

Capture notes

Language bg-BG. Nothing in the page addresses an AI or hides text from a reader.