Nangabe iwebhusayithi nobe sitolo se-inthanethi senkampani yakho sisebenta nge-WordPress, Magento, Laravel nobe nangabe nguluphi luhlelo lolwakhiwe nge-PHP, cela umhlinzeki wakho we-hosting nobe licembu lakho letebuchwepheshe namuhla kutsi libuyekete i-PHP iye kunguculo 8.5.12, 8.4.27, 8.3.36 nobe 8.2.35, bese liphindze licalise iseva. Iphrojekthi ye-PHP yakhipha letinguculo mhla ti-21 Imphala 2026 kuze ivale tikhala letimbili letibucayi letatiwa ngekutsi yi-PHP2Shell, ngasinye silinganiswe nga-9.2 kulokungu-10, letivumela umhlaseli kutsi asebentise imiyalo kuseva yakho ngaphandle kwanobe nguyiphi iphasiwedi. Siphatsimandla Savelonkhe Sekuphepha kwe-Inthanethi saseSaudi Arabia (NCA) sakhipha secwayiso «lesibucayi» ngalelo langa lesincoma kubuyeketa, futsi tinkampani tekuphepha tabona imetamo yekusebentisa letikhala emahora ambalwa ngaphambi kwekutsi kulungiswa kushicilelwe.
Kwenteke ini ngco?
Letikhala letimbili ngu-CVE-2026-109618 na-CVE-2026-109619, futsi tikhona elulwimini lwe-PHP ngalo, hhayi ku-plugin nobe ku-theme. Lena yindzaba lebalulekile: esihlokweni setfu sangaphambilini mayelana nekulungiswa kwe-WordPress lokwaba ngumephu webahlaseli, liphutsa belisesofthiweni lesebenta ngetulu kwe-PHP. Lapha liphutsa lisesisekelweni lekuma kuso yonkhe lesofthiwe. Ngako-ke i-WordPress lebuyeketiwe nobe ema-plugin lambalwa akukuvikeli.
Ngekusho kwesecwayiso sekucala sekuphepha se-PHP, sikhala sekucala sivela nangabe sicelo siphelelwa yinkhumbulo ngesikhatsi silungiswa, i-PHP ishiye idatha lengakaceli kuphela bese kamuva iyiphatsa ngatsi ilungile. Ngekusho kwesecwayiso sesibili, lesinye sikhala sishiya idatha yesicelo sangaphambilini ilenga ngemuva kwekukhululwa kwayo, bese sicelo lesilandzelako kulenchubo yinye siyayisebentisa. Umphumela uyafana kuto tombili: sicelo sinye se-web lesakhiwe ngekucaphela sanele kusebentisa imiyalo kuseva.
I-Wiz Research yatfola letikhala ngelusito lwemamodeli e-AI. Umbiko wayo utsi licembu latitfola mhla ti-19 Ingci 2026, labika kulicembu le-PHP mhla ti-24 Ingci, nekutsi yonkhe inguculo ye-PHP kusukela ku-5.4 itsintseka lokungenani ngulesinye saletikhala. I-Wiz ilinganisela kutsi i-PHP isebentisa cishe ema-70% emawebhusayithi.
Iwebhusayithi yami itsintsekile yini?
Kungenteka kakhulu kutsi yebo, nangabe isebenta nge-PHP futsi inguculo yayo indzala kunaleto letibalwe ngenhla. I-Wiz yakhombisa kusebentisa ikhodi ukudze ngaphandle kwekungena ku-WordPress, Drupal na-Joomla tinemisetho yato lejwayelekile. I-Sansec yandisa luhlu ekuhlatiyeni kwayo lwaba tinkhundla letingu-11, lokufaka ekhatsi Magento 2.4.9, WordPress 7.1.2, Laravel 13.11, Symfony 8.1, phpMyAdmin, Nextcloud na-WHMCS.
Kuze wati inguculo yakho ye-PHP, vula iphaneli yakho ye-hosting (cPanel, Plesk nobe lokufanako) bese ufuna «PHP Version», nobe ubute licembu lakho. Naka tintfo letimbili:
- Inguculo 8.1 naletindzala kunayo atisasekelwa futsi angeke titfole kulungiswa. Ngekusho kwelithebula letinguculo letisekelwako te-PHP, emagatja lasekelwako nyalo ngu-8.2, 8.3, 8.4 na-8.5 kuphela.
- Ligatja le-8.2 ngalo lilahlekelwa kusekelwa kwekuphepha mhla ti-31 Ingongoni 2026, etinyangeni letimbili nesigamu letitako. Nangabe ubuyeketa nyalo, yiya ku-8.4 nobe ku-8.5 kuze ugweme kuphindze ubuyekete masinyane.
Lokufanele ukwente namuhla: tinyatselo letisihlanu
- Tfola tonkhe tindzawo lapho i-PHP isebenta khona. Iwebhusayithi, sitolo, iphaneli yekuphatsa, nanobe nguluphi luhlelo lwangekhatsi nobe liphothali lemakhasimende. Tinkampani letinyenti tikhohlwa iwebhusayithi lendzala lesolo isebenta.
- Buyeketa uye kunguculo lelungisiwe. 8.5.12, 8.4.27, 8.3.36 nobe 8.2.35. Nangabe usebentisa i-hosting lehlanganyelwe, bute umhlinzeki wakho ngekubhala: senifake kubuyeketa kwamhla ti-21 Imphala yini?
- Phindze ucalise i-PHP ngemuva kwekubuyeketa. Secwayiso se-PHP sitsi inchubo lengakaphindzi icaliswe ihlala kukhodi lendzala, ngako kulayisha kubuyeketa kuphela akwanele.
- Nangabe iwebhusayithi yakho iku-8.1 nobe indzala kunaloko, hlela kubuyeketa ngalelisonto bese ukuhlola kucala kukhophi yekuhlola, ngobe lamanye ema-plugin lamadzala angahle ayeke kusebenta.
- Hlola ema-log. I-Wiz itsi funa ticelo tekulayisha letingakavami letilandzelwa ngemaphutsa ekuphelelwa yinkhumbulo, emaphutsa e-HTTP 500 laphindzaphindzwako, nobe ema-cookie e-session (PHPSESSID) lamakhulu kakhulu nobe lonakele.
Nangabe ungeke ukhone kubuyeketa namuhla
Tecwayiso te-PHP tiphakamisa tinyatselo tesikhashana letehlisa ingoti kodvwa letingakuvali sikhundla kubuyeketa: cisha session.upload_progress.enabled ngekuyibeka ku-0 bese uphindze ucalise tonkhe tinchubo, futsi kunguculo 8.5 beka fatal_error_backtraces ku-0. Nangabe iwebhusayithi yakho ayikaze yamukele kulayishwa kwemafayela, ungavimba nalokucelwa kwe-multipart kuseva yangaphambili.
Nangabe iwebhusayithi yakho ingemuva kwe-Cloudflare, lenkampani itsi ku-bhulogi yayo yafaka imitsetfo ye-firewall yaletikhala kusukela nga-3:02 ekuseni nge-UTC mhla ti-21 Imphala, cishe emahora langu-9 ngaphambi kwekwembulwa, kuto tonkhe tinhlelo kufaka ekhatsi lesimahhala. Kodvwa i-Cloudflare ngayo iyeluleka kutsi ubuyekete i-PHP noma unalesivikelo, ngobe bahlaseli bachubeka bashintja tindlela tabo.
Umbono we-Origami
Lesikhala sisikhumbuta kutsi kuphepha kwewebhusayithi akupheleli ekubuyeketeni i-WordPress nema-plugin ayo. Ngaphansi kwayo yonkhe iwebhusayithi kunelulwimi lwekuhlela, iseva nemisetho, futsi konkhe loku kudzinga umuntfu lokubukako. Lesivame kusibona etinkampanini yiwebhusayithi leyakhiwa eminyakeni leyendlulile, lekungasekho muntfu lowatiko kutsi isebenta ngayiphi inguculo ye-PHP nobe ngubani lonemvume yekuyibuyeketa. Nangabe kunjalo kuwe, umbuto awusiwo «sibuyekete yini?» kodvwa «ngubani lotabuyeketa namuhla?». Ku-Origami sakha emawebhusayithi netinhlelo futsi silandzelela kubuyeketwa kwato kusukela ngelilanga lekucala. Nangabe ufuna kuhlolwa kwewebhusayithi yakho nobe kubuyeketa i-PHP ngaphandle kwekuma kwemsebenti, sitsintse.
Imitfombo
- Siphatsimandla Savelonkhe Sekuphepha kwe-Inthanethi saseSaudi Arabia (NCA): secwayiso se-PHP inombolo 2026-7949
- PHP: simemetelo setinguculo 8.5.12, 8.4.27, 8.3.36 na-8.2.35, 21 Imphala 2026
- I-PHP ku-GitHub: secwayiso se-CVE-2026-109618
- I-PHP ku-GitHub: secwayiso se-CVE-2026-109619
- PHP: lithebula letinguculo letisekelwako
- Wiz Research: umbiko we-PHP2Shell
- Cloudflare: kuvikela kwe-WAF ku-PHP2Shell
- Sansec: kuhlatiywa kwe-PHP2Shell netinkhundla letitsintsekile
Imibuto lejwayelekile
I-PHP2Shell iyayisongela yini iwebhusayithi yenkampani yami nangabe i-WordPress ibuyeketiwe?
Yebo. Letikhala letimbili tikhona elulwimini lwe-PHP ngalo, hhayi ku-WordPress, futsi bacwaningi basebentisa imiyalo ngaphandle kwekungena ku-WordPress lenemisetho lejwayelekile. Kuvikeleka kukubuyeketa i-PHP iye ku-8.5.12, 8.4.27, 8.3.36 nobe 8.2.35, bese uphindze ucalise iseva.
Ngutiphi tinguculo te-PHP letilungisa i-PHP2Shell?
Tinguculo 8.5.12, 8.4.27, 8.3.36 na-8.2.35, letakhishwa mhla ti-21 Imphala 2026. Inguculo 8.1 naletindzala kunayo atisasekelwa futsi angeke titfole kulungiswa, ngako kufanele tibuyeketwe tiye eligatjeni lelisekelwako.
Ngingayati njani inguculo ye-PHP yewebhusayithi yami?
Kuphaneli ye-hosting lefana ne-cPanel nobe i-Plesk ngaphansi kwa-«PHP Version», nobe ngekubuta umhlinzeki wakho we-hosting nobe licembu letebuchwepheshe. Bacele kutsi bakuciniseke ngekubhala kutsi bafaka kubuyeketa kwamhla ti-21 Imphala futsi baphindze bacalisa i-PHP.
Iwebhusayithi yami ingemuva kwe-Cloudflare. Loko kwanele yini?
Hhayi kuphela loko. I-Cloudflare yafaka imitsetfo yekuvikela kuto tonkhe tinhlelo kufaka ekhatsi lesimahhala, kodvwa iyeluleka nekubuyeketa i-PHP, ngobe bahlaseli bahlala bashintja tindlela tabo.
