“The search for ways to break in came first”... Interest in “attack tools” surges as PHP vulnerability emerges

[Financial News] A critical security vulnerability has been disclosed in PHP, a programming language widely used on websites around the world, and attack code that can exploit it is spreading rapidly. On GitHub, where related source code is shared, 85% of user interest was found to be concentrated on repositories related to attacks. The security industry warned that unverified defense tools, as well as attack code, could pose new security threats.■ Attack code spreads after PHP vulnerability disclosure... 85% of user interest focused on attack-related repositoriesAccording to the security industry on the 26th, AhnLab, Inc. analyzed the 100 top repositories displayed in order of relevance after searching for “php2shell” on GitHub, a source-code-sharing platform, on the 22nd. The analysis found that 96 of them had been created on the 21st, when the PHP vulnerability was disclosed. Of the 100 repositories, 99 contained material related to the two recently disclosed PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619). GitHub repositories are spaces where developers store and manage program code and related files.
Of the 100 repositories, 46 were related to defense, more than the 36 related to attacks, but users’ interest was focused on the attack-related repositories. Of the 1,394 “stars,” GitHub’s measure of interest, 1,178 went to attack-related repositories. In particular, 1,158 stars went to 27 proof-of-concept (PoC) and exploit repositories that verify the possibility of an attack, while defense-related repositories received only 148 stars.
This analysis covered only the top 100 repositories, and the number of PHP-related repositories was found to be higher than that. In addition, further PHP vulnerabilities are being disclosed. The PHP development team disclosed a third vulnerability (CVE-2026-115560) on the 23rd. Although it is a limited vulnerability that occurs only in environments where specific settings are in place, the possibility cannot be ruled out that additional vulnerabilities will be found or that attack code exploiting them will spread.■ AhnLab, Inc. reproduces attacks exploiting PHP vulnerabilities... warns against indiscriminate installation of defense toolsAhnLab, Inc. was the only security company in South Korea to confirm the possibility of remote command execution related to the two PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) through reproduction tests based on publicly released PoC code. The tests verified that the target server could connect to the attacker’s PC and execute commands with the privileges of the web service account.
AhnLab, Inc. said its endpoint threat detection and response (EDR) solution and extended threat detection and response (XDR) solution can detect suspicious activity occurring in PHP services, helping security administrators develop response measures and prevent recurrence.
With the possibility of exploiting the vulnerabilities confirmed, the need for security measures has grown, but concerns have also been raised that using defense tools indiscriminately can be risky. Some temporary security mitigation programs require “root” privileges—the highest administrator privileges—to change PHP settings across the entire server. If tools are run without thoroughly verifying their functions, work intended to improve security could create a new attack vector.
Experts stressed the need to apply official security patches and take additional measures, such as restricting server access. An AhnLab, Inc. representative explained, “The first measure to take is to update PHP to a patched version,” adding, “If applying the patch is difficult, consider restricting direct access from the internet and minimizing external exposure.”
The representative added, “It is necessary to detect and block attack attempts using a web application firewall (WAF), continuously monitor web server and WAF logs, and check for signs of compromise such as out-of-memory (OOM) errors and unexpected process execution,” and said, “Basic security controls should also be applied, including minimizing database access privileges, segmenting internal networks, and strengthening access controls for critical assets, so that damage does not spread even if a web server is compromised.”
[email protected] Choi Hye-rim Reporter