· 5 min read · LNX Inc.

MSP Threat Briefing: October 26, 2026

PHP2Shell now has confirmed successful exploitation, and CISA lists an exploited flaw in Nextcloud's built-in Collabora CODE server.

A security analyst seen from behind, reviewing three monitors of status tiles and a world map in a dark office before dawn

A quiet weekend with two items that need action today. PHP2Shell has moved from attempts to confirmed shells on unpatched servers. A Nextcloud add-on that many small offices run has been exploited since September, and it is now on CISA's exploited list.

  1. Patch every PHP server that is still unpatched today, starting with Apache mod_php. Then hunt for shells spawned by the web server since October 17.
  2. Upgrade the Nextcloud "Built-in CODE Server" app to 26.4.303 or remove it. Disabling it is not enough. Then look for shx*.php files in its folder.

1. Update: PHP2Shell exploitation now confirmed successful

This is a follow-up to item 2 in the October 25 briefing. Until this weekend, every report described scanning and failed attempts. That changed on October 24.

Adel Karimi published honeypot evidence of working remote code execution against PHP 8.4.26 on Apache mod_php. Two source addresses got shells on three honeypots that day, 35 in total. The chain is consistent with CVE-2026-109618; his records do not show CVE-2026-109619 in use. Expel's Marcus Hutchins independently confirmed the findings, as reported by BleepingComputer on October 26.

After getting in, the attackers ran id, tried to write files to web roots, and called home with curl, wget or PHP itself. No second-stage download was seen. The shells ran as the web server user, with Apache as the parent process.

Weaponized tooling is spreading. SecurityWeek reported on October 23 that a Mirai-style botnet has added the flaws to its spreading methods. It also reported that VulnCheck built an exploit that works against default production settings. Neither CVE was in the CISA catalog when we checked on October 26. Do not wait for it.

Who is exposed. The same as last week: any client PHP site, hosting panel, intranet app or appliance on a build older than the October 21 releases. The confirmed shells were on mod_php, the configuration PHP's advisory already called the riskiest.

What to do.

  • Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (php.net advisory). PHP says updating is the only complete fix; the mitigations only reduce exposure.
  • Restart every PHP worker and Apache after updating, then confirm the running version.
  • Hunt for /bin/sh started by apache2, httpd or php-fpm, running as the web server user. That process is the reliable success signal. An HTTP 200 on the earlier stages is not.
  • Search PHP and web server logs for the strings below, and for very large multipart POSTs to / or /index.php.
  • Check egress logs for the addresses below. Treat any match on an unpatched server as an incident.
  • Keep session.upload_progress.enabled=0 in place. It is also the interim fix for CVE-2026-115560, which still has no patch (PHP informational advisory).
IndicatorValue
Source IPs with confirmed shells15.204.59[.]70, 162.35.99[.]94
Source IPs, attempts only104.28.208[.]84, 144.48.4[.]242
Callback ports8081, 8080, 80
Request shapeMultipart POST to / or /index.php, no User-Agent, about 900 to 1,000 parts, PHP_SESSION_UPLOAD_PROGRESS field
PHP logAllowed memory size of 134217728 bytes exhausted ... in Unknown on line 0
PHP logPHP Request Startup: Session ID is too long or contains illegal characters
Apache logSegmentation fault (11) shortly after a shell starts
ResponsePHPSESSID cookie of about 819,200 bytes

The memory figure is the honeypots' 128 MiB limit. Yours may differ.

2. Nextcloud's built-in Collabora CODE server is exploited and on the CISA list

CISA added CVE-2026-110447 to its Known Exploited Vulnerabilities catalog on October 23 (CISA alert). The flaw is an unauthenticated OS command injection in proxy.php of richdocumentscode, the Nextcloud app listed as the Built-in CODE Server. Collabora's advisory, published October 14, rates it CVSS 4.0 9.2.

The attack works only while the built-in CODE server is not running, for example after a restart, upgrade or crash. The advisory says disabling the app does not prevent it. Standalone Collabora Online servers are not affected.

Exploitation started weeks before the advisory. In the project's issue tracker, one administrator logged the first malicious request on September 10. Attackers wrote PHP webshells into the app folder. On one server they searched for password vaults and cryptocurrency wallet files. The fixed version, 26.4.303, shipped on September 11, but its release notes did not mention a security fix.

Who is exposed. Small offices, schools and nonprofits that run Nextcloud with the one-click office suite instead of a separate Collabora server. Anything the web server account can read on that host is at risk, including synced files and config secrets.

What to do.

  • In each Nextcloud instance's Apps page, check whether the Built-in CODE Server app (richdocumentscode) is installed, and its version. Upgrade to 26.4.303 or later, or remove the app.
  • 26.4.303 needs Nextcloud 30 or later. On older Nextcloud, upgrade Nextcloud or remove the app.
  • Patching does not remove a webshell. Look for shx*.php files under apps/richdocumentscode/ and run Nextcloud's code integrity check.
  • Search web logs back to September 10 for requests to /apps/richdocumentscode/proxy.php containing %2e%2e.
  • If you find a webshell, rebuild the host and rotate the Nextcloud database, admin and storage credentials.
Indicator (from administrator reports)Value
Request path/apps/richdocumentscode/proxy.php?status with %2e%2e traversal
Payload markers${IFS}, base64${IFS}-d, $(, %24%28
Webshell file namesshxa35d0.php, shx5cf91.php, shxd33ce.php, shxf4645.php, shx13a86.php, shx56367.php, shrf4645.php
Webshell SHA-2564b9fbd0663fbfd6028fc216ed18e0d6ef3ae498a7fdc97083e4b0ce3cec40562
Attacker IPs139.28.18[.]122, 89.38.98[.]50
Callback servicewebhook.site

Quick hits

ConnectWise Cloud Backup. No new indicators since October 18. The October 25 advisory update still targets phased partner onboarding for October 26, with backup restore access first. Keep the affected apps disabled until ConnectWise sends instructions for your service.

Sources

threat-briefingmanaged-it

More from LNX

All posts →
A security analyst seen from behind, reviewing three monitors of status tiles and a world map in a dark office before dawn MSP Threat Briefing: October 29, 2026 CISA lists Fragnesia, a Linux kernel flaw chained with PHP2Shell to get root on firewalls. Federal deadline is October 31. ConnectWise starts restores. Read the post → A security analyst seen from behind, reviewing three monitors of status tiles and a world map in a dark office before dawn MSP Threat Briefing: October 28, 2026 CISA lists the Brotli decoder flaw and Adobe Commerce PolyShell as exploited. Both carry a November 10 federal deadline. Read the post → A security analyst seen from behind, reviewing three monitors of status tiles and a world map in a dark office before dawn MSP Threat Briefing: October 27, 2026 CISA adds PHP2Shell to its exploited list, and the Brotli decoder flaw now has .NET and PHP for Windows fixes plus reported exploit traffic. Read the post →

Tell us what's in front of you.

A drawing set, a failing switch, an audit deadline, or a hunch that IT costs too much. We'll tell you who picks it up and what it takes.

Request a quote Book an assessment (833) 569-5690 · Mon–Fri 8–4