PHP2Shell and UpdraftCentral Keys: Two PHP Threats to Fix Now

This blog was originally published by Jason Taylor on the Raxis blog October 21, 2026. Two separate threats hit PHP websites this week, and each needs its own fix. On October 21, the PHP project released emergency patches for two remote code execution flaws in the PHP runtime, nicknamed PHP2Shell and tracked as CVE-2026-109618 and CVE-2026-109619. Both carry a CVSS v4.0 score of 9.2 and let an unauthenticated attacker run code on a web server. Because the bugs live in PHP itself, a site can be exposed even when its own application code is secure.

本博客最初由 Jason Taylor 于 2026 年 10 月 21 日在 Raxis 博客上发布。本周有两个独立的威胁袭击了 PHP 网站，每个威胁都需要单独的修复方案。10 月 21 日，PHP 项目针对 PHP 运行时中的两个远程代码执行漏洞发布了紧急补丁，这些漏洞被命名为 PHP2Shell，编号为 CVE-2026-109618 和 CVE-2026-109619。两者的 CVSS v4.0 评分均为 9.2，允许未经身份验证的攻击者在 Web 服务器上运行代码。由于这些漏洞存在于 PHP 本身，即使网站自身的应用程序代码是安全的，也可能面临风险。

The second threat targets WordPress. Attackers breached TeamUpdraft, the developer of the UpdraftPlus backup plugin, and are now using stolen UpdraftCentral connection keys to send signed commands that install backdoor plugins on connected sites. Those plugins create hidden accounts that stay in place even after the plugin is deleted.

第二个威胁针对的是 WordPress。攻击者入侵了 UpdraftPlus 备份插件的开发商 TeamUpdraft，目前正在利用窃取的 UpdraftCentral 连接密钥发送签名命令，在已连接的网站上安装后门插件。这些插件会创建隐藏账户，即使在插件被删除后，这些账户依然存在。

PHP2Shell: Check Your Versions and Patch. According to The Hacker News, nearly every PHP version back to 5.4 is affected, including servers running Apache mod_php or PHP-FPM. Apache mod_php carries the highest risk, since a single request can trigger the attack before any application code runs. Researchers also showed the flaws can leak live worker memory, which may expose passwords and API keys from other users’ requests.

PHP2Shell：检查版本并打补丁。据《黑客新闻》（The Hacker News）报道，几乎所有追溯至 5.4 版本的 PHP 版本都受到影响，包括运行 Apache mod_php 或 PHP-FPM 的服务器。Apache mod_php 的风险最高，因为单个请求即可在任何应用程序代码运行之前触发攻击。研究人员还表明，这些漏洞可能会泄露实时工作进程内存，从而可能导致其他用户的请求中的密码和 API 密钥被泄露。

Cloudflare reported exploit attempts before the patch was public. To see whether you are exposed, run php -v on each server and compare the result against the fixed releases: 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Some Linux distributions backport fixes under older version numbers, so search the package changelog for the CVE numbers instead of relying on the version string. Include container images and appliances that bundle their own PHP. If your site runs on shared hosting, ask your provider whether they have applied the update.

Cloudflare 在补丁公开之前就报告了漏洞利用尝试。要查看您是否受到影响，请在每台服务器上运行 php -v，并将结果与已修复的版本进行对比：8.5.12、8.4.27、8.3.36 和 8.2.35。一些 Linux 发行版会在旧版本号下向后移植修复程序，因此请搜索软件包更新日志中的 CVE 编号，而不是仅依赖版本字符串。请务必检查包含自身 PHP 的容器镜像和设备。如果您的网站运行在共享主机上，请询问服务提供商是否已应用更新。

The Dutch NCSC maintains a PHP2Shell GitHub page with operational guidance. In the short term, patch and then restart every web server and PHP worker process so the new runtime actually loads. If you cannot patch right away, The Hacker News describes interim settings such as disabling session.upload_progress and enforcing request size limits at the web server or proxy. These stopgaps reduce exposure but do not make a server safe. The patch also adds a hard memory limit, so review memory_limit and post_max_size against your application’s needs.

荷兰国家网络安全中心（NCSC）维护着一个包含操作指南的 PHP2Shell GitHub 页面。短期内，请打补丁并重启所有 Web 服务器和 PHP 工作进程，以确保加载新的运行时。如果您无法立即打补丁，《黑客新闻》建议了一些临时设置，例如禁用 session.upload_progress 以及在 Web 服务器或代理上强制执行请求大小限制。这些权宜之计可以降低风险，但不能使服务器变得绝对安全。补丁还增加了硬内存限制，因此请根据应用程序的需求检查 memory_limit 和 post_max_size。

The long term issue is version support. PHP 8.1 and older receive no fix from the PHP project, and PHP 8.2 reaches end of life on December 31, 2026. Moving to PHP 8.3 or newer and keeping an inventory of where PHP runs will make the next emergency release a routine update.

长期问题在于版本支持。PHP 8.1 及更早版本将不再获得 PHP 项目的修复，而 PHP 8.2 将于 2026 年 12 月 31 日停止支持。迁移到 PHP 8.3 或更新版本，并对 PHP 的运行位置进行盘点，将使下一次紧急发布变成常规更新。

UpdraftCentral Keys: Review Every Connected Site. The Hacker News reports that Wordfence considers a site possibly affected if UpdraftPlus was active while a compromised UpdraftCentral key was present. Self-hosted UpdraftCentral is not affected. TeamUpdraft still advises every site owner to look for unexpected plugins and new administrators. For immediate cleanup, follow the steps on the TeamUpdraft incident page.

UpdraftCentral 密钥：检查每个已连接的网站。据《黑客新闻》报道，Wordfence 认为，如果 UpdraftPlus 在被泄露的 UpdraftCentral 密钥存在期间处于活动状态，则该网站可能受到影响。自托管的 UpdraftCentral 不受影响。TeamUpdraft 仍建议每位网站所有者检查是否存在异常插件和新管理员。如需立即清理，请按照 TeamUpdraft 事件页面上的步骤操作。

Log in to each site directly instead of through UpdraftCentral and update UpdraftPlus to 1.26.13 (free) or 2.26.13 (Premium) or later. Next, delete the connection key under Settings > UpdraftPlus > Advanced Tools > UpdraftCentral. Then review your Users list and your Plugins, including the Must-Use tab. Patchstack counted 99 different backdoor plugin names, and each sample carries the description “Small maintenance toolkit: keeps option storage tidy.” Change administrator passwords, and, if anything looks wrong, restore from a backup taken before October 17. Account holders should also change their teamupdraft.com password.

请直接登录每个网站，而不是通过 UpdraftCentral，并将 UpdraftPlus 更新至 1.26.13（免费版）或 2.26.13（高级版）及更高版本。接下来，在“设置”>“UpdraftPlus”>“高级工具”>“UpdraftCentral”下删除连接密钥。然后检查您的用户列表和插件，包括“必须使用”（Must-Use）选项卡。Patchstack 统计了 99 个不同的后门插件名称，每个样本的描述均为“小型维护工具包：保持选项存储整洁”。请更改管理员密码，如果发现任何异常，请从 10 月 17 日之前的备份中恢复。账户持有人还应更改其 teamupdraft.com 的密码。

Over the long term, treat any remote management key that can install plugins as an administrator credential. Remove connections you no longer use, and require two factor authentication on administrator logins. The backdoor account can sign in through the normal login form unless 2FA is enabled.

从长远来看，应将任何能够安装插件的远程管理密钥视为管理员凭据。删除不再使用的连接，并要求管理员登录时进行双重身份验证（2FA）。除非启用了 2FA，否则后门账户可以通过常规登录表单进行登录。

How Raxis Can Help. Raxis sent an overview of both issues to our newsletter subscribers today. Customers of our Penetration Testing as a Service (PTaaS) offering were notified directly as part of that service, and we contacted those we believe may be affected. An external network penetration test shows which internet-facing servers still run vulnerable or unsupported PHP versions. A web application penetration test looks at your WordPress sites the way an attacker would, including unexpected accounts and management connections that grant more access than they should.

Raxis 如何提供帮助。Raxis 今天向我们的时事通讯订阅者发送了这两个问题的概述。我们“渗透测试即服务”（PTaaS）的客户已作为该服务的一部分直接收到通知，我们也联系了我们认为可能受到影响的用户。外部网络渗透测试可以显示哪些面向互联网的服务器仍在运行易受攻击或不受支持的 PHP 版本。Web 应用程序渗透测试会以攻击者的视角审视您的 WordPress 网站，包括检查是否存在异常账户和权限过大的管理连接。

To get alerts like for critical issues like that this as the news breaks, sign up for the Raxis newsletter. As always, the Raxis team is available if we can help in any way, so contact us with any questions.

如需在新闻发布时获得此类关键问题的警报，请订阅 Raxis 时事通讯。一如既往，如果我们需要提供任何帮助，Raxis 团队随时待命，如有任何问题，请联系我们。