Key takeaways

  • A week after PHP fixed the two critical PHP2Shell flaws on October 21, exploitation is confirmed. The US CISA added both to its catalog of known exploited vulnerabilities on October 26, and Palo Alto Networks says attackers are targeting the management interfaces of its firewalls, which run PHP inside, where they are exposed to the internet.
  • Exploitation is not trivial, but it is practical. JPCERT/CC says success depends on the PHP version and environment. A public contest offering about US$2,000 in Bitcoin was won about three hours after its organizer added a page that actually ran PHP. In our view, there is no proof of concept that simply works everywhere, but a skilled attacker who targets a system deliberately can exploit it.
  • The hardest question for many operators was not how to patch, but where PHP was running: inside firewalls and other products, in services run by vendors, and in builds from several sources. NEC had to reassure users that its routers, whose settings page ends in ".php", do not use PHP at all.
  • In our view, attack surface management (ASM) tools, which map what a company exposes to the internet, were of little help. From the outside, they cannot reliably tell whether a site runs PHP, let alone whether it is patched. What worked was knowing your assets from the inside: asset management, including software bills of materials (SBOMs).

The week in brief#

Date (JST) What happened
Oct 17 Amazon's honeypots record an exploitation attempt, four days before disclosure
Oct 21, 22:38 PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 released. Many Japanese services had already paused
Oct 22 Most paused services back by morning
Oct 23 PHP discloses a third flaw, CVE-2026-115560, which needs specific settings; a fix will follow in the normal cycle
Oct 25–26 A public "Steal My Bitcoin" contest on a PHP server is won at 00:47 on October 26
Oct 26 JPCERT/CC updates its alert. CISA adds both flaws to its KEV catalog, with a federal deadline of October 29 and a forensic triage requirement. NEC says its Aterm routers are not affected
Oct 27 CISA adds a flaw in Brotli, a compression library bundled with PHP on Windows among others
Oct 28 Palo Alto Networks reports active exploitation against internet-exposed PAN-OS management interfaces; some fixes due by October 30
Oct 29 Value Design plans to fully restore its online charge service, paused since October 22

Exploitation: confirmed, but not push-button#

CISA's catalog entry is the clearest signal. It lists both flaws as exploited, asks US federal agencies to fix them by October 29, and, unusually, flags them for forensic triage: agencies must check for compromise, not only patch. It also notes that the flaws sit in an open-source component that other products use, and that each organization is responsible for evaluating every asset's internet exposure.

JPCERT/CC's update on October 26 adds a useful caution. Many proof-of-concept exploits have been published and exploitation attempts are widely observed, but whether an attacker can actually run code depends on the PHP version, the environment and how memory is laid out, and usually takes adjustment. It expects more targeted attacks to follow.

The "Steal My Bitcoin" contest showed what that means in practice. An individual put a server online with a Bitcoin key on it and invited anyone to take it. For most of its first day, the site did not actually serve any PHP pages; about 2 hours and 47 minutes after the organizer added one, a penetration tester took the key, according to piyolog's account and The Register. A deliberately exposed target is not a typical company server, but it is a reminder that "hard to exploit" can mean hours, not weeks.

In our view, the two pictures fit together. There is no proof of concept that simply works against any PHP server, and most of the code circulating will fail without adjustment. But a skilled attacker who picks a target and works on it can get code running. That is the threat model for anything valuable: a payment platform, a customer database, a firewall's management interface. Unpatched systems should not take comfort from the failed attempts in their logs.

PHP where you cannot see it#

The fixes came out on October 21. For many operators, the hard part was knowing which of their systems needed them.

Inside products. Palo Alto Networks' PAN-OS, the operating system of its firewalls and of its Panorama management platform, uses PHP in its management web interface and XML API. The company says no special configuration is needed to be affected, and that it has seen attacks on management interfaces exposed to the internet. Its cloud services Cortex XCORE and WildFire were patched on October 21 and 22. Customers of the appliances had to wait for hotfixes branch by branch, some due as late as October 30. The same is true of any product that bundles PHP: JPCERT/CC reminds operators to check with the vendors of products and Linux distributions that include it.

Behind a ".php" that is not PHP. NEC's Aterm home and mobile routers show "/index.php" in the address of their settings page. NEC had to announce that they do not use PHP at all and are not affected. Anyone who searched their network for ".php" would have flagged them.

At vendors. Several Japanese services paused because a vendor they rely on did. Value Design, which runs prepaid card and cashless platforms for retailers, stopped two services on October 22 and planned to fully restore its online charge service only on October 29. Studio, the website builder, paused its editor overnight. Its customers could do nothing but wait.

From several sources. As we reported, the childcare app Codmon found that it took PHP from four places: the official Docker image, a third-party repository, Amazon Linux and Ubuntu, each publishing fixes on a different schedule.

Why attack surface management did not help much#

In our view, attack surface management (ASM) tools, which scan a company's internet-facing assets from the outside, were of little use this time. The reasons are structural:

  • PHP does not announce itself. Well-configured servers hide the X-Powered-By header, rewrite URLs so that ".php" never appears, and sit behind reverse proxies and CDNs. Meanwhile, devices like Aterm show ".php" without using PHP. Outside-in detection produces both misses and false alarms.
  • Version numbers mislead. Linux distributions backport security fixes into older version numbers. Even where a version is visible, it does not tell you whether the fix is in.
  • Products hide their components. That PAN-OS runs PHP in its management interface is something you learn from the vendor's advisory, not from a scan.
  • Vendors and SaaS are out of scope. The systems that stopped Value Design's and Studio's customers belong to someone else. A company's ASM does not cover them.
  • Internal systems are invisible from outside by design.

ASM still has a job: finding what should not be on the internet. Palo Alto Networks says restricting management access to a jump box or trusted internal addresses lowers the severity from critical to medium. An ASM tool that flags an exposed firewall management page is doing exactly what it should. But it answers "what do we expose?", not "what is running inside?".

It comes down to asset management#

The question PHP2Shell posed, "where do we run this component, and is it fixed?", is an inventory question. In our view, the answer is asset management that goes down to the software components:

  • Servers and containers: query package managers and image manifests for PHP, not banners. Record where each build comes from, as Codmon learned to.
  • Products and appliances: keep a list of products by vendor and version, and follow vendors' advisories. A software bill of materials (SBOM) from the vendor, where available, tells you which components are inside.
  • Vendors and SaaS: know which services your operations depend on, and ask them directly whether they use the affected component and when they will fix it.

IDC Frontier, whose IDCF Cloud was hit by ransomware this month through a flaw in open-source software, now says it will keep a company-wide SBOM and match it automatically against vulnerability information. That is the capability that would have answered PHP2Shell's question in minutes rather than days.

What operators should do now#

  • Confirm the fix at package level, not by version banners, on every server, container and build source. Our earlier checklist covers how.
  • Patch appliances. If you run PAN-OS or Panorama, apply the hotfix for your branch and restrict the management interface to trusted internal addresses now. Check other vendors' advisories for products that bundle PHP.
  • Look for compromise, as CISA requires of US agencies. JPCERT/CC's points to check include unusual PHPSESSID cookies, suspicious multipart form posts, memory errors and PHP worker crashes, going back to October 17. Finding nothing is not proof.
  • Apply the mitigation for CVE-2026-115560 until PHP releases a fix: set session.upload_progress.enabled=0 and restart all workers.
  • Ask your vendors whether their services use PHP and whether they are fixed.
  • Start the inventory you wish you had. List components, build sources and the vendors you depend on, so the next "where do we run this?" can be answered from records.

Japanese terms at a glance#

Japanese Reading Meaning
脆弱性 zeijakusei Vulnerability
悪用 akuyō Exploitation
実証コード jisshō kōdo Proof-of-concept code
資産管理 shisan kanri Asset management
管理画面 kanri gamen Management interface
侵害調査 shingai chōsa Compromise investigation
緩和策 kanwasaku Mitigation