Searchlight Cyber Scanner Targets PHP Flaws With Unauthenticated RCE Risk

En bref

• Two PHP CVEs allow unauthenticated remote code execution.
• Searchlight Cyber's php2shell-scanner checks mod_php and PHP-FPM installations for susceptibility.
• Popular CMS and admin tools including WordPress, Drupal, Joomla, phpMyAdmin, Nextcloud, and Magento may be affected.
• Fixes are available, but active exploitation has been confirmed.

On 21 and 22 October 2026, Searchlight Cyber released a tool named php2shell-scanner, which determines whether PHP installations are susceptible to CVE-2026-109618 and CVE-2026-109619. Both vulnerabilities permit an attacker to achieve remote code execution before any authentication occurs. Help Net Security covered the scanner’s launch, noting that it enables defenders to assess their exposure instead of waiting for exploitation.

The affected surface is broad. The bugs involve PHP when it is deployed through Apache's mod_php module or the PHP-FPM process manager. A vast array of web applications—such as WordPress, Drupal, Joomla, phpMyAdmin, Nextcloud, and Magento—relies on these components. A vulnerable application can therefore expose the underlying host, not merely the website or CMS.

Unauthenticated remote code execution is among the most serious web-facing issues because it requires no stolen credentials and can lead directly to server compromise. The software involved is installed on a vast number of systems, so opportunistic scanning and exploitation are likely. Searchlight Cyber's tool is defensive, but it also signals that attackers have a reliable way to identify targets.

Fixes have been issued for the two CVEs, and evidence of active exploitation has been confirmed. Organizations should treat any unpatched PHP, mod_php, or PHP-FPM deployment as urgent. Watch for abnormal PHP-FPM child processes, unexpected files in web roots, and outbound connections from web servers. The October 21–22 disclosure window is a reminder to verify patch levels and scan both internet-facing and internal hosts.

À faire maintenant

1. Inventory PHP, Apache mod_php, and PHP-FPM versions across all web servers; prioritize internet-facing WordPress, Drupal, Joomla, phpMyAdmin, Nextcloud, and Magento systems.
2. Apply vendor fixes for CVE-2026-109618 and CVE-2026-109619 immediately, then restart affected web services and confirm the patched version is active.
3. Run Searchlight Cyber's php2shell-scanner against external and internal hosts to identify remaining exposure.
4. Review web server, PHP-FPM, and application logs for exploitation attempts, webshells, unexpected child processes, and suspicious outbound connections.
5. Temporarily restrict administrative interfaces and deploy virtual patching or WAF rules for the affected PHP paths while patching is completed.
6. Rotate credentials and rebuild any host that shows signs of compromise rather than relying on cleanup alone.

Références CVE

• CVE-2026-109618
• CVE-2026-109619

Source originale

Help Net Security