{"id":183970,"date":"2026-10-23T11:41:04","date_gmt":"2026-10-23T09:41:04","guid":{"rendered":"https:\/\/prohoster.info\/blog\/news\/dlya-uyazvimostej-php2shell-anonsirovan-pervyj-eksploit-obhodyashhij-randomizacziyu-adresov"},"modified":"2026-10-23T11:41:09","modified_gmt":"2026-10-23T09:41:09","slug":"first-exploit-bypassing-address-randomization-announced-for-php2shell-vulnerabilities","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/first-exploit-bypassing-address-randomization-announced-for-php2shell-vulnerabilities","title":{"rendered":"PHP2Shell haavatavuste jaoks on v\u00e4lja kuulutatud esimene eksploit, mis m\u00f6\u00f6dub aadresside randomiseerimisest","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

VulnCheck'i teadlased teatasid, et nad on saanud esmakordselt PHP2Shell (CVE-2026-109618b) haavatavuse jaoks exploiti, mis suudab \u00fcletada aadresside aadresside randomiseerimise (ASLR) mehhanismi x86-64 s\u00fcsteemides, millel on t\u00fc\u00fcpiline PHP konfiguratsioon. Exploit v\u00f5imaldab r\u00fcnnata s\u00fcsteeme, millel on PHP 8.4.10-8.4.26 vaikeseadistuses. Varasemalt takistas m\u00e4lulayouti kindlakstegemine mod_php moodulis exploiti teostamist, mis v\u00f5imaldaks koodi t\u00e4itmist reaalsetes s\u00fcsteemides. ASLR-i \u00fcletamiseks kasutatakse exploitis aadresside lekkeid vigade kuvamise kodeeringus. <\/p>\n

On v\u00e4idetud, et juurdep\u00e4\u00e4s t\u00f6\u00f6tavale eksploitile on antud ainult teabe kaitsega tegelevatele klientidele, kuid kurjategijad saavad kasutada AI-d, et taastada kasutatud tehnikaid. Teabe lekkimise blokeerimise m\u00f6\u00f6da hiilimiseks tuleks php.ini failis seada parameeter \"display_errors=off\", lisaks varasematele soovitustele. VulnCheck mainib ka, et GitHubis on ilmunud sadu eksploitide protot\u00fc\u00fcpe, kuid ainult k\u00e4put\u00e4is on hinnatud kui t\u00f6\u00f6tavad ning vaid \u00fcks protot\u00fc\u00fcp suutis bypassida ASLR-i.<\/p>\n

Lisaks teatas Cloudflare'i direktor, et ettev\u00f5te on tuvastanud miljoneid katseid PHP2Shell haavatavuste \u00e4rakasutamiseks, samas kui 10 tundi enne haavatavuse avastamisest teavitamist oli selliseid katseid juba tuhandeid ning 2 tundi p\u00e4rast ametlikku teavitamist j\u00f5udsid need sadadesse tuhandetesse. N\u00e4ib, et r\u00fcnnakutes kasutatakse exploiti protot\u00fc\u00fcpe, mis lihtsalt tuvastavad haavatavaid PHP versioone, kuna praegu pole kinnitatud andmeid PHP2Shell haavatavuste kaudu toimuva r\u00fcnnaku kohta.<\/p>\n

Amazon'i andmetel registreeriti esimesed exploiti katsetused juba 17. oktoobril rakendatud honeypot-s\u00fcsteemide kaudu, st 3 p\u00e4eva enne esialgsete CVE identifikaatorite lekkeid. Aktiivsus kasvas 21. oktoobril, 12 tundi enne PHP paranduste avaldamist, sel ajal tuvastati r\u00fcnnakukatsed, mis h\u00f5lmasid mitmeid exploiti protot\u00fc\u00fcpe. Hadrian'i ettev\u00f5te registreeris r\u00fcnnakukatsed enne ametlikku teavitamist.
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 VulnCheck \u0437\u0430\u044f\u0432\u0438\u043b\u0438 \u043e \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u0438 \u043f\u0435\u0440\u0432\u043e\u0433\u043e \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u0430 \u0434\u043b\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 PHP2Shell (CVE-2026-109618\u0431), \u043e\u0431\u0445\u043e\u0434\u044f\u0449\u0435\u0433\u043e \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c \u0440\u0430\u043d\u0434\u043e\u043c\u0438\u0437\u0430\u0446\u0438\u0438 \u0430\u0434\u0440\u0435\u0441\u043e\u0432 (ASLR) \u043d\u0430 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 x86-64 \u0441 \u0442\u0438\u043f\u043e\u0432\u043e\u0439 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0435\u0439 PHP. \u042d\u043a\u0441\u043f\u043b\u043e\u0438\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0430\u0442\u0430\u043a\u043e\u0432\u0430\u0442\u044c \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0441 PHP 8.4.10-8.4.26 \u0432 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e. \u0420\u0430\u043d\u0435\u0435 \u0442\u0440\u0443\u0434\u043d\u043e\u0441\u0442\u044c \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u0438\u044f \u0440\u0430\u0441\u043a\u043b\u0430\u0434\u043a\u0438 \u043f\u0430\u043c\u044f\u0442\u0438 \u0432 \u043c\u043e\u0434\u0443\u043b\u0435 mod_php \u043c\u0435\u0448\u0430\u043b\u0430 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u0430, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0433\u043e \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u043d\u0430 \u0440\u0435\u0430\u043b\u044c\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445. \u0414\u043b\u044f […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":10,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-183970","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47PHP2Shell haavatustele on v\u00e4lja kuulutatud esimene eksploiteerimine, mis \u00fcletab aadresside randomiseerimise | ProHoster","description":"VulnCheck'i teadlased teatasid, et nad on saanud esmakordselt PHP2Shell (CVE-2026-109618b) haavatavuse jaoks exploiti, mis suudab \u00fcletada aadresside randomiseerimise (ASLR) mehhanismi x86-64 s\u00fcsteemides, millel on t\u00fc\u00fcpiline PHP konfiguratsioon.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/first-exploit-bypassing-address-randomization-announced-for-php2shell-vulnerabilities","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0414\u043b\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 PHP2Shell \u0430\u043d\u043e\u043d\u0441\u0438\u0440\u043e\u0432\u0430\u043d \u043f\u0435\u0440\u0432\u044b\u0439 \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442, \u043e\u0431\u0445\u043e\u0434\u044f\u0449\u0438\u0439 \u0440\u0430\u043d\u0434\u043e\u043c\u0438\u0437\u0430\u0446\u0438\u044e \u0430\u0434\u0440\u0435\u0441\u043e\u0432 | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 VulnCheck \u0437\u0430\u044f\u0432\u0438\u043b\u0438 \u043e \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u0438 \u043f\u0435\u0440\u0432\u043e\u0433\u043e \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u0430 \u0434\u043b\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 PHP2Shell (CVE-2026-109618\u0431), \u043e\u0431\u0445\u043e\u0434\u044f\u0449\u0435\u0433\u043e \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c \u0440\u0430\u043d\u0434\u043e\u043c\u0438\u0437\u0430\u0446\u0438\u0438 \u0430\u0434\u0440\u0435\u0441\u043e\u0432 (ASLR) \u043d\u0430 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 x86-64 \u0441 \u0442\u0438\u043f\u043e\u0432\u043e\u0439 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0435\u0439 PHP.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/first-exploit-bypassing-address-randomization-announced-for-php2shell-vulnerabilities","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-10-23T09:41:04+00:00","article:modified_time":"2026-10-23T09:41:09+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/183970","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/10"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=183970"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/183970\/revisions"}],"predecessor-version":[{"id":183971,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/183970\/revisions\/183971"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=183970"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=183970"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=183970"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}