关于 PHP2Shell (CVSS 9.2) 核心级 RCE 漏洞的修复指南
<div class="ce-block ce-block--focused" data-id="WAXBv6VNLz" ><div class="ce-block__content">
<div class="ce-paragraph cdx-block ce-paragraph--left"><span class="text-element text-element--other"><span class="text-normal">尊敬的客户：
您好！针对即将在北京时间 10 月 21 日（周三）22:00 公开的 PHP 核心严重安全漏洞，我们在此向您发布最高级别的安全预警。
</span></span></div>
</div>
</div><div class="ce-block ce-block--focused" data-id="ShWlqEXB4o" >
<div class="ce-block__content">
<div class="ce-paragraph cdx-block ce-paragraph--left"><span class="text-element text-element--other"><span class="text-normal">
据国际安全机构 Sansec 披露，此次爆发的漏洞被称为 PHP2Shell。目前该漏洞的自动化利用工具截图已在安全社区泄露，预计官方补丁发布后 15 分钟内，全网将出现大规模的无差别扫描与攻击。</span></span></div>
</div>
</div><div class="ce-block" data-id="yoIcXKYcXv" >
<div class="ce-block__content" style="">
<h2 class="ce-header ce-header--left">
漏洞核心情报</h2>
</div>
</div><div class="ce-block ce-block--focused" data-id="m_wFR2ggLt" >
<div class="ce-block__content">
<ol class="cdx-list-ordered" style="list-style-type:none; margin-left: -15px;"><li class="cdx-list__item">1. <span class="text-element text-element--other"><span class="text-normal">漏洞代号/编号： PHP2Shell (CVE-2026-109618, CVE-2026-109619)</span></span></li><li class="cdx-list__item">2. <span class="text-element text-element--other"><span class="text-normal"></span></span><span class="text-element text-element--other"><span class="text-normal">危险等级： CVSS 9.2（极度危险）</span></span></li><li class="cdx-list__item">3. <span class="text-element text-element--other"><span class="text-normal"></span></span><span class="text-element text-element--other"><span class="text-normal">漏洞类型： 远程代码执行（RCE），攻击者可直接接管服务器获取 Shell。</span></span></li><li class="cdx-list__item">4. <span class="text-element text-element--other"><span class="text-normal"></span></span><span class="text-element text-element--other"><span class="text-normal">受影响版本： PHP 5.4 及以上所有版本。Magento、Shopware、WooCommerce 等电商系统及各类 CMS 将受严重威胁。</span></span></li><li class="cdx-list__item">5. <span class="text-element text-element--other"><span class="text-normal"></span></span><span class="text-element text-element--other"><span class="text-normal">补丁发布时间： 北京时间 10 月 21 日（周三）22:00（14:00 UTC）</span></span></li></ol>
</div>
</div><div class="ce-block ce-block--focused" data-id="R8otZyzhOs" >
<div class="ce-block__content">
<div class="ce-paragraph cdx-block ce-paragraph--left"><span class="text-element text-element--other"><span class="text-normal">
</span></span><span class="text-element text-element--other"><span class="text-normal">⚠️</span></span><span class="text-element text-element--other"><span class="text-normal"> 核心警告：无法在代码层防御
该漏洞存在于 PHP 的底层架构中。这意味着任何代码级别的修改、面板加固或常规的应用层防护插件都无法拦截此攻击。防御的唯一有效方式是在服务器基础设施层面（环境底层）直接更新 PHP 版本。
</span></span></div>
</div>
</div><div class="ce-block" data-id="Bp2TZSzp0D" >
<div class="ce-block__content" style="">
<h2 class="ce-header ce-header--left">
紧急应对与修复建议</h2>
</div>
</div><div class="ce-block ce-block--focused" data-id="VeRCdLJ9gI" >
<div class="ce-block__content">
<div class="ce-paragraph cdx-block ce-paragraph--left"><span class="text-element text-element--other"><span class="text-normal">官方将仅为 PHP 8.2、8.3、8.4 和 8.5 发布修复补丁。请您立即采取以下行动：
</span></span></div>
</div>
</div><div class="ce-block ce-block--focused" data-id="6aeUdnzpo2" >
<div class="ce-block__content">
<ol class="cdx-list-ordered" style="list-style-type:none; margin-left: -15px;"><li class="cdx-list__item">1. <span class="text-element text-element--other"><span class="text-normal">正在使用 PHP 8.2 - 8.5 的用户（需今晚紧急操作）：
随时待命： 请通知您的运维团队在今晚 22:00 前做好准备。
抢占黄金 15 分钟： 补丁一旦发布，请务必在第一波自动化攻击到来前，通过包管理器（apt/yum）或重新编译升级 PHP，并立刻重启相关服务（Nginx/Apache/PHP-FPM）。</span></span></li><li class="cdx-list__item">2. <span class="text-element text-element--other"><span class="text-normal"></span></span><span class="text-element text-element--other"><span class="text-normal">正在使用 PHP 8.1 及以下旧版本（含 5.6、7.x 等）的用户：
</span></span></li></ol>
</div>
</div><div class="ce-block ce-block--focused" data-id="A43R_lwt_n" >
<div class="ce-block__content">
<div class="ce-paragraph cdx-block ce-paragraph--left"><span class="text-element text-element--other"><span class="text-normal">
官方已明确不会为这些版本发布补丁。继续使用这些版本将让您的服务器完全裸露在 PHP2Shell 的攻击火力之下。</span></span></div>
</div>
</div><div class="ce-block ce-block--focused" data-id="t4YAfap6mJ" >
<div class="ce-block__content">
<div class="ce-paragraph cdx-block ce-paragraph--left"><span class="text-element text-element--other"><span class="text-normal"><b>
短期缓解：</b> 立即排查并收紧服务器安全组及防火墙（iptables/firewalld）策略，开启高级别 WAF，并在 php.ini 中禁用高风险命令执行函数。
</span></span></div>
</div>
</div><div class="ce-block ce-block--focused" data-id="-eMQcXHD4I" >
<div class="ce-block__content">
<div class="ce-paragraph cdx-block ce-paragraph--left"><span class="text-element text-element--other"><span class="text-normal"><b>
长期建议： </b>请即刻安排业务环境迁移，将底层升级至受官方支持的 PHP 8.2+ 版本。</span></span></div>
</div>
</div><div class="ce-block ce-block--focused" data-id="Kfip3x-R17" >
<div class="ce-block__content">
<div class="ce-paragraph cdx-block ce-paragraph--left"><span class="text-element text-element--other"><span class="text-normal"><b>
Update:
</b>
据说在 php.ini 设置 session.upload_progress.enabled = Off 可以缓解 （未正式是否有效）
</span></span></div>
</div>
</div><div class="ce-block ce-block--focused" data-id="w3U7spgVsn" >
<div class="ce-block__content">
<div class="ce-paragraph cdx-block ce-paragraph--left"><span class="text-element text-element--other"><span class="text-normal"><b>
Update2:
</b>漏洞利用工具已经发布</span></span></div>
</div>
</div><style type="text/css">
.ce-block {
margin-bottom: 20px;
}
.ce-block__content,.ce-toolbar__content {
/* max-width:calc(100% - 50px) */
margin-left: auto;
margin-right: auto;
}
.ce-paragraph {
line-height: 1.6em;
outline: none;
text-indent: 2em;
font-size: 16px;
}
.ce-paragraph--right {
text-align: right;
}
.ce-paragraph--center {
text-align: center;
}
.ce-paragraph--left {
text-align: left;
}
.ce-paragraph--justify {
text-align: justify;
}
.ce-paragraph-text-indent {
text-align: justify;
}
.ce-paragraph:empty::before{
content: attr(data-placeholder);
color: #707684;
font-weight: normal;
opacity: 0;
}
/** Show placeholder at the first paragraph if Editor is empty */
.codex-editor--empty .ce-block:first-child .ce-paragraph:empty::before {
opacity: 1;
}
.codex-editor--toolbox-opened .ce-block:first-child .ce-paragraph:empty::before,
.codex-editor--empty .ce-block:first-child .ce-paragraph:empty:focus::before {
opacity: 0;
}
.ce-paragraph p:first-of-type{
margin-top: 0;
}
.ce-paragraph p:last-of-type{
margin-bottom: 0;
}
.svg-icon {
width: 1em;
height: 1em;
}
.svg-icon path,
.svg-icon polygon,
.svg-icon rect {
fill: #4691f6;
}
.svg-icon circle {
stroke: #4691f6;
stroke-width: 1;
}
</style><style type="text/css">
.ce-block {
margin-top: 20px;
margin-bottom: 20px;
}
.ce-block__content,.ce-toolbar__content {
/* max-width:calc(100% - 50px) */
margin-left: auto;
margin-right: auto;
}
/**
* Plugin styles
*/
.ce-header {
position: relative;
padding: 1px 0px 1px 15px;
margin: 0;
line-height: 1.25em;
outline: none;
margin-bottom: 10px;
}
.ce-header p,
.ce-header div {
padding: 0 !important;
margin: 0 !important;
}
.ce-header::before {
content: "";
background-color: #3e8fe3;
width: 6px;
height: 100%;
position: absolute;
left: 0;
-webkit-border-radius: 3px;
-moz-border-radius: 3px;
border-radius: 3px;
}
/**
* Styles for Plugin icon in Toolbar
*/
.ce-header__icon {
}
.ce-header::before {
position: absolute;
content: attr(data-placeholder);
color: #707684;
font-weight: normal;
display: none;
cursor: text;
}
.ce-header:empty::before {
display: block;
}
.ce-header:empty:focus::before {
display: none;
}
/* FontSize */
h1.ce-header {
font-size: 2.0em;
}
h2.ce-header {
font-size: 1.7em;
}
h3.ce-header {
font-size: 1.4em;
}
h4.ce-header {
font-size: 1.15em;
}
h5.ce-header {
font-size: 0.95em;
}
h6.ce-header {
font-size: 0.8em;
}
/* Alignment*/
.ce-header--right {
text-align: right;
}
.ce-header--center {
text-align: center;
}
.ce-header--left {
text-align: left;
}
.ce-header--justify {
text-align: justify;
}
</style><style type="text/css">
.ce-block {
margin-bottom: 20px;
}
.ce-block__content,.ce-toolbar__content {
/* max-width:calc(100% - 50px) */
margin-left: auto;
margin-right: auto;
}
.cdx-list {
margin:0;
outline:none;
display:block;
counter-reset:item;
padding:6px;
}
.cdx-list__item {
line-height:1.45em;
display:block;
padding-top:8px;
margin-left: 2em;
}
.cdx-list__item-children {
display:block;
}
.cdx-list__item {
outline:none
}
.cdx-list__item-content {
word-break:break-word;
white-space:pre-wrap;
grid-area:content;
padding-left:8px
}
.cdx-list__item:before {
counter-increment:item;
white-space:nowrap
}
.cdx-list-li-container {
display: flex;
}
.cdx-list-ordered .cdx-list__item:before {
/* content:counters(item,".",numeric) "." */
}
.cdx-list-ordered {
list-style-type: none;
margin-left: -15px;
counter-reset:item;
font-size: 16px;
}
.cdx-list-unordered {
font-size: 16px;
}
.cdx-list-unordered .cdx-list__item:before {
content:"•"
}
.cdx-list-checklist .cdx-list__item:before {
content:""
}
.cdx-list__settings .cdx-settings-button {
width:50%
}
.cdx-list__checkbox {
padding-top:calc((1.45em - 1.2em) / 2);
grid-area:checkbox;
width:1.2em;
height:1.2em;
display:flex;
cursor:pointer;
font-size: 16px;
}
.cdx-list__checkbox svg {
opacity:0;
height:1.2em;
width:1.2em;
left:-1px;
top:-1px;
position:absolute
}
@media (hover:hover) {
.cdx-list__checkbox:not(.cdx-list__checkbox--no-hover):hover .cdx-list__checkbox-check svg {
opacity:1
}
}.cdx-list__checkbox--checked-1 {
line-height:1.45em
}
@media (hover:hover) {
.cdx-list__checkbox--checked-1:not(.cdx-list__checkbox--checked-1--no-hover):hover .cdx-checklist__checkbox-check {
background:#0059AB;
border-color:#0059AB
}
}.cdx-list__checkbox--checked-1 .cdx-list__checkbox-check {
background:#369FFF;
border-color:#369FFF
}
.cdx-list__checkbox--checked-1 .cdx-list__checkbox-check svg {
opacity:1
}
.cdx-list__checkbox--checked-1 .cdx-list__checkbox-check svg path {
stroke:#fff
}
.cdx-list__checkbox--checked-1 .cdx-list__checkbox-check:before {
opacity:0;
visibility:visible;
transform:scale(2.5)
}
.cdx-list__checkbox-check {
cursor:pointer;
display:inline-block;
position:relative;
margin:0 auto;
width:1.2em;
height:1.2em;
box-sizing:border-box;
border-radius:5px;
border:1px solid #C9C9C9;
background:#fff
}
.cdx-list__checkbox-check:before {
content:"";
position:absolute;
top:0;
right:0;
bottom:0;
left:0;
border-radius:100%;
background-color:#369FFF;
visibility:hidden;
pointer-events:none;
transform:scale(1);
transition:transform .4s ease-out,opacity .4s
}
.cdx-list__checkbox-check--disabled {
pointer-events:none
}
.cdx-list-start-with-field {
background:#F8F8F8;
border:1px solid rgba(226,226,229,.2);
border-radius:6px;
padding:2px;
display:grid;
grid-template-columns:auto auto 1fr;
grid-template-rows:auto
}
.cdx-list-start-with-field--invalid {
background:#FFECED;
border:1px solid #E13F3F
}
.cdx-list-start-with-field--invalid .cdx-list-start-with-field__input {
color:#e13f3f
}
.cdx-list-start-with-field__input {
font-size:16px;
outline:none;
font-weight:500;
font-family:inherit;
border:0;
background:transparent;
margin:0;
padding:0;
line-height:22px;
min-width:calc(100% - 10px)
}
.cdx-list-start-with-field__input::placeholder {
color:#797979;
font-weight:500
}
</style><style type="text/css">
.inline-code {
background: rgba(250, 239, 240, 0.78);
color: #b44437;
padding: 3px 4px;
border-radius: 5px;
margin: 0 1px;
font-family: inherit;
font-size: 0.86em;
font-weight: 500;
letter-spacing: 0.3px;
}
</style> <div class="ce-block ce-block--focused" data-id="nqvjMPw8pj" >
<div class="ce-block__content">
<div class="ce-paragraph cdx-block ce-paragraph--left"> ⚠️ PHP 核心级 RCE 漏洞「PHP2Shell」——今晚 22:00 补丁发布，务必提前准备
</div>
</div>
</div><div class="ce-block ce-block--focused" data-id="OFFYDtkWNF" >
<div class="ce-block__content">
<div class="ce-paragraph cdx-block ce-paragraph--left">
【是什么】
CVE-2026-109618 / CVE-2026-109619，CVSS 9.2（极度危险）
</div>
</div>
</div><div class="ce-block ce-block--focused" data-id="UBGQ99p7KL" >
<div class="ce-block__content">
<div class="ce-paragraph cdx-block ce-paragraph--left">漏洞在 PHP 引擎层，攻击者可直接远程执行代码、拿到服务器 shell。
</div>
</div>
</div><div class="ce-block ce-block--focused" data-id="-JJBLISZhL" >
<div class="ce-block__content">
<div class="ce-paragraph cdx-block ce-paragraph--left">
【影响范围】</div>
</div>
</div><div class="ce-block ce-block--focused" data-id="4nHM7P9Pia" >
<div class="ce-block__content">
<div class="ce-paragraph cdx-block ce-paragraph--left">
PHP 5.4 及以上所有版本 —— 也就是市面上几乎所有在用的 PHP 站点。
</div>
</div>
</div><div class="ce-block ce-block--focused" data-id="8iY2-GNJCq" >
<div class="ce-block__content">
<div class="ce-paragraph cdx-block ce-paragraph--left">Magento / Shopware / WooCommerce 等电商系统首当其冲。
</div>
</div>
</div><div class="ce-block ce-block--focused" data-id="dIfKHvZ2R-" >
<div class="ce-block__content">
<div class="ce-paragraph cdx-block ce-paragraph--left">
【补丁时间】</div>
</div>
</div><div class="ce-block ce-block--focused" data-id="AveCCND-tf" >
<div class="ce-block__content">
<div class="ce-paragraph cdx-block ce-paragraph--left">
北京时间 2026-10-21（今晚）22:00，全球同步发布
</div>
</div>
</div><div class="ce-block ce-block--focused" data-id="j-HbO5Hxc1" >
<div class="ce-block__content">
<div class="ce-paragraph cdx-block ce-paragraph--left">只发 4 个分支：PHP 8.2 / 8.3 / 8.4 / 8.5
</div>
</div>
</div><div class="ce-block ce-block--focused" data-id="G4wGnt3Z9k" >
<div class="ce-block__content">
<div class="ce-paragraph cdx-block ce-paragraph--left">预期版本：8.2.35 / 8.3.36 / 8.4.27 / 8.5.12</div>
</div>
</div><div class="ce-block ce-block--focused" data-id="0W5SlYTZC6" >
<div class="ce-block__content">
<div class="ce-paragraph cdx-block ce-paragraph--left">
⚠️ 8.1 及以下（含 7.x / 5.6）官方明确不发补丁
</div>
</div>
</div><div class="ce-block ce-block--focused" data-id="n4i8IGN-rl" >
<div class="ce-block__content">
<div class="ce-paragraph cdx-block ce-paragraph--left">
【今晚必须做的三件事】
</div>
</div>
</div><div class="ce-block ce-block--focused" data-id="0Gcts71_BU" >
<div class="ce-block__content">
<div class="ce-paragraph cdx-block ce-paragraph--left">1. 现在就查版本：php -v
<br>2. 22:00 后立刻升级：
Debian/Ubuntu: apt update && apt upgrade
<br> （注意：Debian 可能不是涨到 8.4.27，而是 8.4.26-1~deb13u2 这种回补版本，
别死等版本号，看 apt list --upgradable 里有没有 php）
</div>
</div>
</div><div class="ce-block ce-block--focused" data-id="K9NfRUfuop" >
<div class="ce-block__content">
<div class="ce-paragraph cdx-block ce-paragraph--left">3. 升级后重启 php-fpm 和 nginx：
<br> systemctl restart php8.4-fpm && systemctl reload nginx
<br> 然后 php -v 确认版本已变、站点能正常打开
</div>
</div>
</div><div class="ce-block ce-block--focused" data-id="ZrT5Ar4gDy" >
<div class="ce-block__content">
<div class="ce-paragraph cdx-block ce-paragraph--left">
【两个常见误区】</div>
</div>
</div><div class="ce-block ce-block--focused" data-id="p-VMbCkhVb" >
<div class="ce-block__content">
<div class="ce-paragraph cdx-block ce-paragraph--left">
❌ "禁用 exec/system 函数就能防" —— 无效。
<br> 这是引擎层漏洞，不走 disable_functions，php.ini 改不防。</div>
</div>
</div><div class="ce-block ce-block--focused" data-id="6aQthSM4vk" >
<div class="ce-block__content">
<div class="ce-paragraph cdx-block ce-paragraph--left">
❌ "装个 WAF 插件就行" —— 跑在 PHP 里的插件同样无效。
<br> 但网络层 WAF（Cloudflare 等）能拦已知利用特征，可以作为止损失段，
前提是站点已经套在 CF 后面、并且 WAF 规则开着。
</div>
</div>
</div><div class="ce-block ce-block--focused" data-id="DIhmQF6fzD" >
<div class="ce-block__content">
<div class="ce-paragraph cdx-block ce-paragraph--left">
【还没升级前能做的】
· 收紧防火墙：只允许 CDN 回源，别让源站 IP 直接暴露
<br>· 确认 Cloudflare / WAF 的托管规则集是开启状态<br> · 备份 /etc/php 和数据库，升级出问题能快速回滚</div>
</div>
</div><style type="text/css">
.ce-block {
margin-bottom: 20px;
}
.ce-block__content,.ce-toolbar__content {
/* max-width:calc(100% - 50px) */
margin-left: auto;
margin-right: auto;
}
.ce-paragraph {
line-height: 1.6em;
outline: none;
text-indent: 2em;
font-size: 16px;
}
.ce-paragraph--right {
text-align: right;
}
.ce-paragraph--center {
text-align: center;
}
.ce-paragraph--left {
text-align: left;
}
.ce-paragraph--justify {
text-align: justify;
}
.ce-paragraph-text-indent {
text-align: justify;
}
.ce-paragraph:empty::before{
content: attr(data-placeholder);
color: #707684;
font-weight: normal;
opacity: 0;
}
/** Show placeholder at the first paragraph if Editor is empty */
.codex-editor--empty .ce-block:first-child .ce-paragraph:empty::before {
opacity: 1;
}
.codex-editor--toolbox-opened .ce-block:first-child .ce-paragraph:empty::before,
.codex-editor--empty .ce-block:first-child .ce-paragraph:empty:focus::before {
opacity: 0;
}
.ce-paragraph p:first-of-type{
margin-top: 0;
}
.ce-paragraph p:last-of-type{
margin-bottom: 0;
}
.svg-icon {
width: 1em;
height: 1em;
}
.svg-icon path,
.svg-icon polygon,
.svg-icon rect {
fill: #4691f6;
}
.svg-icon circle {
stroke: #4691f6;
stroke-width: 1;
}
</style><style type="text/css">
.inline-code {
background: rgba(250, 239, 240, 0.78);
color: #b44437;
padding: 3px 4px;
border-radius: 5px;
margin: 0 1px;
font-family: inherit;
font-size: 0.86em;
font-weight: 500;
letter-spacing: 0.3px;
}
</style>
页:
[1]