최초 보도 10/26 09:59 · 최근 10/26 18:42
긴급PHP2Shell(CVE-2026-109618·109619) 인증 없는 RCE, 긴급 패치
PHP 엔진의 원격 코드 실행 취약점 2건으로, 인증 없이 원격에서 코드를 실행할 수 있다. PHP 보안팀이 21일 지원 중인 8.2~8.5 버전의 패치(8.2.35, 8.3.36, 8.4.27, 8.5.12)를 배포했다. 과기정통부와 KISA는 FAQ로 긴급 점검을 당부했고, 로그프레소, 펜타시큐리티, 에프원시큐리티, 케이디시스가 진단·점검 도구를 내놨다.
조치 PHP 기반 웹 자산을 전수 식별해 패치 버전으로 올리고 서비스를 재시작한다. 업데이트 후에도 기존 침투 악성코드가 남을 수 있으므로 웹셸과 침해 흔적을 점검하고 인증정보를 교체한다.
보도 10건
- 아이뉴스24 — [PHP 취약점 파장] AI가 바꾼 보안 환경…패치 속도·노후 시스템·AI 관제 '3대 과제'
- 보안뉴스 — [PHP 파장] 세계 웹사이트 70% 쓰는 PHP, 치명적 보안 결함 발견... 정부·기업 '비상'
- 디지털투데이 — 정부, PHP 취약점 긴급 점검 당부…"업데이트 후 침해 흔적도 확인해야"
- 뉴시스 — "패치 후 서비스 재시작 필수"…정부가 밝힌 'PHP투쉘' 취약점 대응 지침
- 아이티데일리 — URL로 위험 진단…로그프레소, ‘PHP투셸 스캐너’ 공개
- BBC — PHP 보안 비상사태 최전선에 선 IT 기술자들...'쉴 틈이 없습니다'
- 아이티데일리 — 케이디시스, 런제로 통해 PHP 보안 취약점 대응
- 데이터넷 — 펜타시큐리티, ‘PHP2Shell’ 취약점 대비 웹사이트 점검 서비스·대응 룰 제공
- 데일리시큐 — 에프원시큐리티, UWSS로 ‘PHP2Shell’ 공격 차단 검증…무료 웹 진단 도구 공개
- 데이터넷 — 로그프레소, PHP2Shell 취약점 진단 스캐너 공개
CVE-2026-109618Snort 룰 11
룰 원문 펼치기
alert http $EXTERNAL_NET any -> $HOME_NET any ( msg:"SERVER-WEBAPP PHP serialized integer key collision remote code execution attempt"; flow:to_server,established; http_client_body; content:"i:4294967296|3B|"; content:"i:8589934592|3B|",within 48; content:"i:12884901888|3B|",within 48; metadata:policy balanced-ips drop,policy max-detect-ips drop,policy security-ips drop,ruleset community; reference:cve,2026-109618; reference:cve,2026-109619; classtype:web-application-attack; gid:1; sid:67359; rev:2; )
alert http ( msg:"SERVER-WEBAPP PHP PHPSESSID memory leak attempt"; flow:to_client,established; http_cookie; content:"PHPSESSID="; content:"|00 00|",distance 0,fast_pattern; http_raw_cookie; pcre:"/PHPSESSID=[^\x3b\r\n]*?(?:%00){2}/"; metadata:policy balanced-ips drop,policy connectivity-ips drop,policy max-detect-ips drop,policy security-ips drop,ruleset community; reference:cve,2026-109618; reference:cve,2026-109619; classtype:web-application-attack; gid:1; sid:67375; rev:1; )alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"SERVER-WEBAPP PHP serialized integer key collision remote code execution attempt"; flow:to_server,established; content:"i:4294967296|3B|"; http_client_body; content:"i:8589934592|3B|"; within:48; http_client_body; content:"i:12884901888|3B|"; within:48; http_client_body; metadata:policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, ruleset community, service http; reference:cve,2026-109618; reference:cve,2026-109619; classtype:web-application-attack; sid:67359; rev:2;)
alert tcp any $HTTP_PORTS -> any any (msg:"SERVER-WEBAPP PHP PHPSESSID memory leak attempt"; flow:to_client,established; content:"PHPSESSID="; fast_pattern:only; content:"PHPSESSID="; http_raw_cookie; content:"%00%00"; distance:0; http_raw_cookie; pcre:"/PHPSESSID=[^\x3b\r\n]*?(?:%00){2}/K"; metadata:policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, ruleset community, service http; reference:cve,2026-109618; reference:cve,2026-109619; classtype:web-application-attack; sid:67375; rev:1;)alert tcp any any -> [$HOME_NET,$HTTP_SERVERS] $HTTP_PORTS (msg:"ET EXPLOIT PHP php2shell Multipart Header Amplification OOM (CVE-2026-109618)"; flow:established,to_server; content:"content-type|3a 20|multipart/form-data|3b|"; http_header; nocase; content:"Content-Disposition|3a 20|form-data|3b|"; http_client_body; fast_pattern; pcre:"/^(?:(?:(?!\x0d\x0a\x2d{2}).)+[\x0d\x0a]+[a-zA-Z0-9-]+\x3a){100,}/R"; content:"POST"; http_method; reference:url,github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w; reference:cve,2026-109618; classtype:misc-attack; sid:2072549; rev:1; metadata:affected_product PHP, attack_target Web_Server, tls_state TLSDecrypt, created_at 2026_10_22, cve CVE_2026_109618, deployment Perimeter, deployment Internal, confidence Low, signature_severity Major, updated_at 2026_10_22;)alert tcp any any -> [$HOME_NET,$HTTP_SERVERS] $HTTP_PORTS (msg:"ET EXPLOIT PHP php2shell Nested Empty File Control OOM (CVE-2026-109618)"; flow:established,to_server; content:"content-type|3a 20|multipart/form-data|3b|"; http_header; nocase; content:"Content-Disposition|3a 20|form-data|3b|"; http_client_body; content:"name|3d|"; http_client_body; pcre:"/^[\x22\x27][^\x22\x27]+(?:\x5b[^\x5b\x0d\x0a]*?){3,}/R"; content:"filename|3d 22 22|"; http_client_body; fast_pattern; content:"POST"; http_method; reference:url,github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w; reference:cve,2026-109618; classtype:misc-attack; sid:2072550; rev:1; metadata:affected_product PHP, attack_target Web_Server, tls_state TLSDecrypt, created_at 2026_10_22, cve CVE_2026_109618, deployment Perimeter, deployment Internal, performance_impact Moderate, confidence Low, signature_severity Major, updated_at 2026_10_22;)alert tcp any any -> [$HOME_NET,$HTTP_SERVERS] $HTTP_PORTS (msg:"ET EXPLOIT PHP php2shell Chunked Multipart Request without Content-Length (CVE-2026-109618)"; flow:established,to_server; content:"content-type|3a 20|multipart/form-data|3b|"; http_header; nocase; content:"transfer-encoding: chunked"; http_header; fast_pattern; nocase; content:!"content-length|0d 0a|"; http_header; nocase; content:"POST"; http_method; reference:url,github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w; reference:cve,2026-109618; classtype:misc-attack; sid:2072551; rev:1; metadata:affected_product PHP, attack_target Web_Server, tls_state TLSDecrypt, created_at 2026_10_22, cve CVE_2026_109618, deployment Perimeter, deployment Internal, performance_impact Low, confidence Low, signature_severity Major, updated_at 2026_10_22, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1189, mitre_technique_name Drive_by_Compromise;)
alert tcp any any -> [$HOME_NET,$HTTP_SERVERS] $HTTP_PORTS (msg:"ET EXPLOIT PHP php2shell Binary URL-Encoded POST for $_POST Corruption (CVE-2026-109618)"; flow:established,to_server; content:"content-type|3a 20|application/x-www-form-urlencoded"; http_header; fast_pattern; nocase; pcre:"/^\x3d[^&]*?[\x00-\x1f\x7f-\xff]+[^&]*?\x26/Ps"; content:"POST"; http_method; reference:url,github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w; reference:cve,2026-109618; classtype:misc-attack; sid:2072552; rev:1; metadata:affected_product PHP, attack_target Web_Server, tls_state TLSDecrypt, created_at 2026_10_22, cve CVE_2026_109618, deployment Perimeter, deployment Internal, performance_impact Significant, confidence Low, signature_severity Major, updated_at 2026_10_22;)
alert tcp any any -> [$HOME_NET,$HTTP_SERVERS] $HTTP_PORTS (msg:"ET EXPLOIT PHP php2shell Multipart Request without Content-Length (CVE-2026-109618)"; flow:established,to_server; content:"content-type|3a 20|multipart/form-data|3b|"; fast_pattern; nocase; content:!"content-length|3a 20|"; http_header; nocase; content:"POST"; http_method; reference:url,github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w; reference:cve,2026-109618; classtype:misc-attack; sid:2072553; rev:1; metadata:affected_product PHP, attack_target Web_Server, tls_state TLSDecrypt, created_at 2026_10_22, cve CVE_2026_109618, deployment Perimeter, deployment Internal, performance_impact Moderate, confidence Low, signature_severity Major, updated_at 2026_10_22;)
alert tcp any any -> [$HOME_NET,$HTTP_SERVERS] $HTTP_PORTS (msg:"ET EXPLOIT PHP php2shell Excessive Multipart Part Count (CVE-2026-109618)"; flow:established,to_server; content:"content-type|3a 20|multipart/form-data|3b|"; http_header; nocase; content:"Content-Disposition|3a 20|form-data"; http_client_body; fast_pattern; pcre:"/(?:Content-Disposition\x3a\x20form-data.{,4096}){100,}/Ps"; content:"POST"; http_method; reference:url,github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w; reference:cve,2026-109618; classtype:misc-attack; sid:2072556; rev:1; metadata:affected_product PHP, attack_target Web_Server, tls_state TLSDecrypt, created_at 2026_10_22, cve CVE_2026_109618, deployment Perimeter, deployment Internal, performance_impact Moderate, confidence Low, signature_severity Major, updated_at 2026_10_22;)외 1개 생략
CVE-2026-109619Snort 룰 9
룰 원문 펼치기
alert http $EXTERNAL_NET any -> $HOME_NET any ( msg:"SERVER-WEBAPP PHP serialized integer key collision remote code execution attempt"; flow:to_server,established; http_client_body; content:"i:4294967296|3B|"; content:"i:8589934592|3B|",within 48; content:"i:12884901888|3B|",within 48; metadata:policy balanced-ips drop,policy max-detect-ips drop,policy security-ips drop,ruleset community; reference:cve,2026-109618; reference:cve,2026-109619; classtype:web-application-attack; gid:1; sid:67359; rev:2; )
alert http $EXTERNAL_NET any -> $HOME_NET any ( msg:"SERVER-WEBAPP PHP session upload progress remote code execution attempt"; flow:to_server,established; http_header:field content-type; content:"multipart/form-data",nocase; http_client_body; content:"Content-Disposition",nocase; content:"PHP_SESSION_UPLOAD_PROGRESS",distance 0,fast_pattern; detection_filter:track by_src,count 10,seconds 5; metadata:policy balanced-ips drop,policy max-detect-ips drop,policy security-ips drop,ruleset community; reference:cve,2026-109619; classtype:web-application-attack; gid:1; sid:67360; rev:2; )
alert http ( msg:"SERVER-WEBAPP PHP PHPSESSID memory leak attempt"; flow:to_client,established; http_cookie; content:"PHPSESSID="; content:"|00 00|",distance 0,fast_pattern; http_raw_cookie; pcre:"/PHPSESSID=[^\x3b\r\n]*?(?:%00){2}/"; metadata:policy balanced-ips drop,policy connectivity-ips drop,policy max-detect-ips drop,policy security-ips drop,ruleset community; reference:cve,2026-109618; reference:cve,2026-109619; classtype:web-application-attack; gid:1; sid:67375; rev:1; )alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"SERVER-WEBAPP PHP serialized integer key collision remote code execution attempt"; flow:to_server,established; content:"i:4294967296|3B|"; http_client_body; content:"i:8589934592|3B|"; within:48; http_client_body; content:"i:12884901888|3B|"; within:48; http_client_body; metadata:policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, ruleset community, service http; reference:cve,2026-109618; reference:cve,2026-109619; classtype:web-application-attack; sid:67359; rev:2;)
alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"SERVER-WEBAPP PHP session upload progress remote code execution attempt"; flow:to_server,established; content:"multipart/form-data"; nocase; http_header; content:"Content-Disposition"; nocase; http_client_body; content:"PHP_SESSION_UPLOAD_PROGRESS"; distance:0; fast_pattern; http_client_body; detection_filter:track by_src, count 10, seconds 5; metadata:policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, ruleset community, service http; reference:cve,2026-109619; classtype:web-application-attack; sid:67360; rev:2;)
alert tcp any $HTTP_PORTS -> any any (msg:"SERVER-WEBAPP PHP PHPSESSID memory leak attempt"; flow:to_client,established; content:"PHPSESSID="; fast_pattern:only; content:"PHPSESSID="; http_raw_cookie; content:"%00%00"; distance:0; http_raw_cookie; pcre:"/PHPSESSID=[^\x3b\r\n]*?(?:%00){2}/K"; metadata:policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, ruleset community, service http; reference:cve,2026-109618; reference:cve,2026-109619; classtype:web-application-attack; sid:67375; rev:1;)alert tcp any any -> [$HOME_NET,$HTTP_SERVERS] $HTTP_PORTS (msg:"ET EXPLOIT PHP php2shell Handler-mismatch Session Injection (CVE-2026-109619)"; flow:established,to_server; content:"content-type|3a 20|multipart/form-data|3b|"; http_header; nocase; content:"name|3d 22|PHP_SESSION_UPLOAD_PROGRESS|22|"; http_client_body; fast_pattern; content:"filename|3d|"; http_client_body; pcre:"/^[\x22\x27][^\x22\x27\x0d\x0a]*?\x7c[OrC]\x3a\d+\x3a/R"; content:"POST"; http_method; reference:url,github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp; reference:cve,2026-109619; classtype:misc-attack; sid:2072548; rev:1; metadata:affected_product PHP, attack_target Client_and_Server, tls_state TLSDecrypt, created_at 2026_10_22, cve CVE_2026_109619, deployment Perimeter, deployment Internal, confidence Low, signature_severity Major, updated_at 2026_10_22;)
alert tcp any any -> [$HOME_NET,$HTTP_SERVERS] $HTTP_PORTS (msg:"ET EXPLOIT PHP php2shell Code Injection in Filename (CVE-2026-109619)"; flow:established,to_server; content:"content-type|3a 20|multipart/form-data|3b|"; http_header; nocase; content:"name|3d 22|PHP_SESSION_UPLOAD_PROGRESS|22|"; http_client_body; fast_pattern; content:"filename|3d|"; http_client_body; pcre:"/^[\x22\x27][^\x22\x27\x0d\x0a]*?\x3c\x3f(?:php|\x3b)/R"; content:"POST"; http_method; reference:url,github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp; reference:cve,2026-109619; classtype:misc-attack; sid:2072554; rev:1; metadata:affected_product PHP, attack_target Web_Server, tls_state TLSDecrypt, created_at 2026_10_22, cve CVE_2026_109619, deployment Perimeter, deployment Internal, confidence Low, signature_severity Major, updated_at 2026_10_22;)
alert tcp any any -> [$HOME_NET,$HTTP_SERVERS] $HTTP_PORTS (msg:"ET INFO PHP Generic Upload Progress Session Manipulation"; flow:established,to_server; content:"cookie|3a 20|phpsessid|3d|"; http_header; nocase; content:"content-type|3a 20|multipart/form-data|3b|"; http_header; nocase; content:"name|3d 22|PHP_SESSION_UPLOAD_PROGRESS|22|"; http_client_body; fast_pattern; content:"filename|3d|"; http_client_body; content:"POST"; http_method; reference:url,github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp; reference:cve,2026-109619; classtype:misc-attack; sid:2072555; rev:1; metadata:affected_product PHP, attack_target Web_Server, tls_state TLSDecrypt, created_at 2026_10_22, cve CVE_2026_109619, deployment Perimeter, deployment Internal, confidence Low, signature_severity Major, updated_at 2026_10_22;)