{"id":13770,"date":"2026-10-23T01:22:05","date_gmt":"2026-10-22T17:22:05","guid":{"rendered":"https:\/\/infernews.com\/blog\/php2shell-20261022-infernews\/"},"modified":"2026-10-23T01:30:31","modified_gmt":"2026-10-22T17:30:31","slug":"php2shell-20261022-infernews","status":"publish","type":"post","link":"https:\/\/infernews.com\/blog\/php2shell-20261022-infernews\/","title":{"rendered":"\u4e09\u5206\u9418\u652a\u6382 PHP2Shell \u6f0f\u6d1e\uff1a\u91dd\u5c0d\u6240\u6709 Ubuntu PHP \u7248\u672c"},"content":{"rendered":"\n<figure class=\"wp-block-image size-large\"><img decoding=\"async\" src=\"https:\/\/infernews.com\/blog\/wp-content\/uploads\/2026\/10\/PHP2Shell-Ubuntu-PHP.jpg\" alt=\"Og image\"\/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">\u63a1\u7528 Ubuntu\u3001Apache \u8207 mod_php \u7684\u7db2\u7ad9\uff0c\u53ef\u80fd\u56e0 PHP2Shell \u9762\u81e8\u672a\u7d93\u8eab\u5206\u9a57\u8b49\u7684\u9060\u7aef\u7a0b\u5f0f\u78bc\u57f7\u884c\u98a8\u96aa\u3002\u9019\u9805\u554f\u984c\u6d89\u53ca CVE-2026-109618 \u53ca CVE-2026-109619\uff0cCVSS v4.0 \u8a55\u5206\u70ba 9.2\uff0c\u5c6c\u56b4\u91cd\u7d1a\u5225\u3002PHP 8.1 \u53ca\u66f4\u820a\u7248\u672c\u5df2\u505c\u6b62\u652f\u63f4\uff0c\u7e7c\u7e8c\u904b\u884c\u4e0d\u80fd\u8996\u70ba\u5b89\u5168\u7684\u904e\u6e21\u65b9\u6848\u3002<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u6f0f\u6d1e\u6e90\u81ea PHP \u6838\u5fc3\u8a18\u61b6\u9ad4\u7ba1\u7406\uff0c\u653b\u64ca\u8005\u53ef\u900f\u904e\u7279\u5b9a\u60e1\u610f\u8acb\u6c42\u89f8\u767c Use-After-Free\uff0c\u4e26\u5229\u7528\u8a18\u61b6\u9ad4\u8017\u76e1\u7b49\u60c5\u6cc1\u53d6\u5f97\u7a0b\u5f0f\u57f7\u884c\u80fd\u529b\u3002\u7576 Apache \u900f\u904e mod_php \u8207 PHP \u5171\u7528\u884c\u7a0b\u53ca\u8a18\u61b6\u9ad4\u6642\uff0c\u5f71\u97ff\u7bc4\u570d\u53ef\u64f4\u81f3\u6574\u500b\u7db2\u9801\u4f3a\u670d\u5668\uff0c\u9060\u7aef\u7a0b\u5f0f\u78bc\u57f7\u884c\uff08Remote Code Execution\uff0cRCE\uff09\u98a8\u96aa\u5c24\u5176\u76f4\u63a5\u3002<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u5b89\u5168\u8655\u7406\u65b9\u5f0f\u4e0d\u662f\u53ea\u66f4\u65b0\u4e00\u500b\u5957\u4ef6\uff0c\u800c\u662f\u628a\u57f7\u884c\u74b0\u5883\u5207\u63db\u81f3\u5df2\u4fee\u88dc\u7248\u672c\u3002\u6587\u7ae0\u4ee5 Ubuntu 22.04 \u70ba\u4f8b\uff0c\u52a0\u5165 Ond\u0159ej Sur\u00fd PPA\u3001\u5b89\u88dd PHP 8.3 \u53ca\u6240\u9700\u64f4\u5145\u5957\u4ef6\uff0c\u518d\u505c\u7528 php8.1\u3001\u555f\u7528 php8.3\uff0c\u4e26\u91cd\u65b0\u555f\u52d5 Apache\uff1b\u5be6\u969b\u74b0\u5883\u4ea6\u8981\u6309\u539f\u6709\u7248\u672c\u53ca\u7db2\u7ad9\u5957\u4ef6\u8abf\u6574\u3002<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>\u53d7\u5f71\u97ff\u7de8\u865f\uff1aCVE-2026-109618\u3001CVE-2026-109619<\/li>\n\n\n\n<li>\u5efa\u8b70\u7248\u672c\uff1a\u81f3\u5c11 PHP 8.2.35\u3001<mark>8.3.36<\/mark> \u6216 8.4.27<\/li>\n\n\n\n<li>\u9ad8\u98a8\u96aa\u7d44\u5408\uff1aApache mod_php \u52a0\u672a\u4fee\u88dc PHP<\/li>\n\n\n\n<li>\u95dc\u9375\u52d5\u4f5c\uff1a\u505c\u7528\u820a\u6a21\u7d44\u3001\u6aa2\u67e5\u7248\u672c\u3001\u91cd\u555f\u670d\u52d9<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">\u9a57\u8b49\u4e0d\u80fd\u53ea\u770b CLI \u8f38\u51fa\uff0c\u4e5f\u8981\u78ba\u8a8d Apache \u5be6\u969b\u8f09\u5165\u7684\u65b0\u6a21\u7d44\u53ca\u7db2\u7ad9\u4f9d\u8cf4\u7684\u64f4\u5145\u5957\u4ef6\u3002\u6d89\u53ca PHP 8.1 \u7684\u74b0\u5883\u61c9\u5148\u5b89\u6392\u76f8\u5bb9\u6027\u6e2c\u8a66\uff1b\u5b89\u5168\u7248\u672c\u8981\u6c42\u8207\u9801\u9762\u6240\u793a PHP 8.3 \u7bc4\u4f8b\u4ea6\u61c9\u5206\u958b\u6838\u5c0d\u3002<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/infernews.com\/blog\/php2shell-patch\/\" rel=\"noopener noreferrer\"><strong>\u9805\u76ee\u4e3b\u9801<\/strong><\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>PHP2Shell \u53ef\u8b93\u672a\u9a57\u8b49\u653b\u64ca\u8005\u63a5\u7ba1\u4f3a\u670d\u5668\u3002Ubuntu \u7ba1\u7406\u54e1\u61c9\u505c\u7528\u820a\u7248 mod_php\uff0c\u4e26\u5c07 PHP \u5347\u81f3\u5df2\u4fee\u88dc\u7248\u672c\u3002<\/p>\n","protected":false},"author":8,"featured_media":13769,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"wpai_generated_summary":"","wpai_meta_description":"","footnotes":""},"categories":[116,151,24,38,168,150,170],"tags":[],"class_list":["post-13770","post","type-post","status-publish","format-standard","hentry","category-agentic","category-mcp","category-aisoftware","category-38","category-linux","category-150","category-170"],"_links":{"self":[{"href":"https:\/\/infernews.com\/blog\/wp-json\/wp\/v2\/posts\/13770","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/infernews.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/infernews.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/infernews.com\/blog\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/infernews.com\/blog\/wp-json\/wp\/v2\/comments?post=13770"}],"version-history":[{"count":2,"href":"https:\/\/infernews.com\/blog\/wp-json\/wp\/v2\/posts\/13770\/revisions"}],"predecessor-version":[{"id":13773,"href":"https:\/\/infernews.com\/blog\/wp-json\/wp\/v2\/posts\/13770\/revisions\/13773"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/infernews.com\/blog\/wp-json\/wp\/v2\/media\/13769"}],"wp:attachment":[{"href":"https:\/\/infernews.com\/blog\/wp-json\/wp\/v2\/media?parent=13770"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/infernews.com\/blog\/wp-json\/wp\/v2\/categories?post=13770"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/infernews.com\/blog\/wp-json\/wp\/v2\/tags?post=13770"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}