Nangabe ubuyekete iwebhusayithi yenkampani yakho yaya ku-PHP 8.5.12, 8.4.27, 8.3.36 nobe 8.2.35 ngemuva kwesikhala i-PHP2Shell, wente lokulungile, kodvwa loko akukumboti konkhe. Mhla ti-23 Imphala 2026, iphrojekthi ye-PHP yashicilela secwayiso lesisha mayelana nesikhala sesitsatfu, i-CVE-2026-115560, lesingalungiswa kubuyeketa kwati-21 Imphala. Sidzinga imisetho lengakavami futsi i-PHP isibona njengendlela yekuhlasela lengatenteki kakhulu, kodvwa likhambi lesikhashana lilula: namuhla cela licembu lakho nobe umhlinzeki wakho we-hosting kutsi abeke session.upload_progress.enabled ku-0 bese aphindze acalise i-PHP, bese akucinisekisela ngekubhala kutsi kubuyeketa kwati-21 Imphala kufakiwe ngempela.

Yini i-PHP leyayimemetela mhla ti-23 Imphala?

Emalangeni lamabili ngemuva kwekukhishwa kwesimo lesiphutfumako, iphrojekthi yashicilela secwayiso lesifisha sekwatisa mayelana nekulandzelela «inchubekela-phambili yekulayisha» kuma-session, lesici lesikhombisa umsebentisi kutsi ifayela lelikhulu selilayishwe kangakanani. Lesecwayiso sitsi lesici singavula indlela yekusebentisa ikhodi kusuka khashane esimeni lesitsite, nekutsi kulungiswa kutawuta nekukhishwa lokulandzelako lokujwayelekile, hhayi njengekubuyeketa kwesimo lesiphutfumako, kanye nesecwayiso lesiphelele ngalesikhala.

Kumnikati webhizinisi tintfo letimbili tibalulekile. Kwekucala, lesi sikhala lesehlukile, ngako-ke kusebentisa yinye yetinguculo letine letingenhla akwaneli kuphela. Kwesibili, lesinyatselo sesikhashana lesifanako besesibhaliwe esecwayisweni se-CVE-2026-109619 mhla ti-21 Imphala. Nangabe licembu lakho lasenta ngaleso sikhatsi, akudzingeki lokusha: kushiye kunjalo.

Iwebhusayithi yakho isengotini yini?

Ngekusho kwesecwayiso se-PHP, inkinga ivela kuphela nangabe timo letintsatfu tihlangana:

  • Imisetho ye-PHP ibeka session.serialize_handler ku-php_binary nobe php_serialize.
  • Ikhodi yesicelo iyigucula ibe ngu-php ngesikhatsi isebenta nge-ini_set() ngaphambi kwekucala kwe-session.
  • Kulandzelela inchubekela-phambili yekulayisha ku-session kusavuliwe, njengobe kunjalo ngekwejwayelekile.

Emawebhusayithi lamanyenti akakwenti loku. Inkinga kutsi umnikati akavamisi kwati kutsi umugca ngamunye wenta ini eluhlelweni lolwakhiwa eminyakeni leyendlulile nobe ku-plugin lendzala. Ngako-ke kukhetsa lokuphephe kakhulu nguloku: nangabe iwebhusayithi yakho ingakhombisi umugca wenchubekela-phambili nawulayisha emafayela, kucisha lesici akuphuli lutfo futsi kuvala umnyango. Nangabe incike kuso, buta tinjiniyela takho kutsi ikhodi iyayigucula yini lemisetho ngesikhatsi isebenta.

Emalangeni lamatsatfu ngemuva: hlola kutsi kubuyeketa kwati-21 Imphala kufakiwe ngempela

Tikhala tekucala, i-CVE-2026-109618 ne-CVE-2026-109619, tisengulengoti lenkhulu. Siphatsimandla Savelonkhe Sekuphepha kwe-Inthanethi saseSaudi Arabia (NCA) sakhipha secwayiso lesinombolo 2026-7949 ngato, futsi i-ejensi yaseMelika CISA yeluleka kutsi kubhalwe luhlu lwato tonkhe tinhlelo te-PHP, kucalwe ngekuvala letivulekele i-inthanethi, nekutsi luhlelo lolungeke luvalwe masinyane lucinywe. I-CISA yatsi beyingakaboni kuhlasela lokuphumelelako ngesikhatsi kushicilelwa, kodvwa loko akusho kutsi sikhatsi singasekunene kwakho.

Emaphuzu lamatsatfu labantfu labanyenti labeteka:

  • Phindze ucalise, ungagcini ngekulayisha kabusha. Incwadzi yetindzaba ye-Red Hat itsi kugucula imisetho kudzinga kutsi tinchubo te-PHP tiphindze ticaliswe, nekutsi kulayisha kabusha kuphela akwaneli.
  • Inombolo yenguculo ingehluka kuma-seva e-Linux. Simemetelo se-PHP sitsi tinhlobo te-Linux tatfola kulungiswa kusenesikhatsi, ngako-ke ungabona inombolo lehlukile ku-8.5.12, ngekwesibonelo, nanobe kulungiswa sekufakiwe. Cela umhlinzeki wakho we-hosting kucinisekisa ngekubhala, hhayi nje inombolo. I-Red Hat iphawula kutsi i-RHEL 8, 9 na-10 tonkhe titsintsekile.
  • Indlela i-PHP lesebenta ngayo iyayigucula ingoti. Iphrojekthi ye-PHP ibona ingoti iphakeme kakhulu nge-mod_php ku-Apache, kantsi i-Red Hat itsi kuhlasela kumatima kakhulu ngalokusebentako nge-PHP-FPM lejwayelekile. Lokumatima akusho kutsi akwenteki, ngako-ke kubuyeketa kuyadzingeka kuto tombili timo.

Imibuto lemi-5 lokufanele uyitfumele namuhla kumhlinzeki wakho we-hosting nobe kulicembu lakho

  1. Nguyiphi inguculo ye-PHP lesebenta kuwebhusayithi nakuluhlelo ngalunye lwetfu, futsi iyakufaka yini kulungiswa kwati-21 Imphala 2026?
  2. Tinchubo te-PHP taphindze tacaliswa yini ngemuva kwekubuyeketa, hhayi nje kulayishwa kabusha?
  3. Sesiyibekile yini session.upload_progress.enabled ku-0? Nangabe kungenjalo, siyasidzinga ngempela yini lesici?
  4. Ikhodi yewebhusayithi yetfu iyayigucula yini session.serialize_handler ngesikhatsi isebenta?
  5. Sinayo yini iwebhusayithi lesebenta nge-8.1 nobe lendzala kunaleyo? Leto tinguculo atisasekelwa, futsi litafula letinguculo letisekelwako likhombisa kutsi kusekelwa kwekuphepha kwe-8.2 kuphela mhla ti-31 Ingongoni 2026.

Umbono we-Origami

Tecwayiso letintsatfu emalangeni lamatsatfu kuyintfo lejwayelekile ngemuva kwesikhala lesikhulu: nangabe bacwaningi bagubha incenye yinye yelulwimi, batfola nalokuseceleni kwayo. Kodvwa loku kusho lokutsite nangetinkampani. Loyo lowavala mhla ti-21 wabese uyavala indzaba utawuphutsa secwayiso sati-23. Lapha kuphepha kukulandzelela lokuchubekako, hhayi umsebenti lowentiwa kanye kuphela.

Loko lesikubona etinkampanini taseSaudi kutsi umbuto lomatima akusiwo «yini lesikhala?», kodvwa «ngubani kitsi lofundza secwayiso se-PHP ngeLesihlanu ekuseni futsi lowati kutsi nguyiphi iseva yetfu?». Ku-Origami sakha emawebhusayithi netinhlelo futsi silandzelela kubuyeketwa kwato kusukela ngelilanga lekucala. Nangabe ufuna iwebhusayithi yakho ihlolwe, nobe lemisetho ifakwe ngaphandle kwekumisa lusito, sitsintse.

Sigcino

Kubuyeketa kwati-21 Imphala kubalulekile futsi kusese ngulokubaluleke kakhulu; secwayiso lesisha asikugucuci loko. Namuhla engeta sinyatselo sinye lesishibhile: cisha kulandzelela inchubekela-phambili yekulayisha nangabe ungakudzingi, phindze ucalise i-PHP, bese utfola kucinisekisa ngekubhala kumhlinzeki wakho we-hosting. Bese ulindza kukhishwa lokulandzelako lokujwayelekile kwe-PHP, lokutawuletsa kulungiswa kwekugcina kwe-CVE-2026-115560.

Imitfombo