🚨 PHP2Shell: Nuglaansho Amni oo Halis Gelisay Malaayiin Website — Maxaa Dhab ahaantii Dhacay?

Engineering Insights | GOLE Somali Network

Bal qiyaas inaad dhisto website leh kumannaan ama malaayiin isticmaale, database kaydiya xogta macaamiisha, iyo server maamula hawlaha muhiimka ah ee ganacsigaaga. Kadibna waxaa la ogaadaa in khalad ku jira luuqadda uu website-kaagu ku shaqaynayo uu qof weeraraya u oggolaan karo inuu amarro ka fuliyo server-kaaga isaga oo aan marka hore gelin akoonkaaga.

Taasi waa sababta nuglaanshaha amni ee dhowaan laga helay PHP uu walaac weyn u abuuray dunida tiknoolajiyadda.

PHP waxaa isticmaala ku dhowaad 70% website-yada la yaqaan luuqadda ay dhinaca server-ka ku shaqeeyaan, sida lagu sheegay xogta W3Techs. Taas macnaheedu ma aha in 70% website-yada la jabsaday, balse waxay muujinaysaa sida ay u ballaaran tahay baaxadda khatarta iman karta marka cilad halis ahi ku jirto software aad loo isticmaalo.

Aan si farsamo leh, laakiin la fahmi karo, u kala qaadno waxa dhacay iyo casharrada ay tahay in developer kasta uu ka barto.

1. Maxaa dhacay?

21-kii Oktoobar 2026, kooxda PHP waxay soo saartay cusboonaysiin amni oo lagu saxayo laba nuglaansho oo halis ah:

• CVE-2026-109618
• CVE-2026-109619

Labadan nuglaansho waxay la xiriiraan habka PHP u maareeyo xusuusta (memory management), xaaladaha xusuustu ka dhammaato iyo nadiifinta xogta gudaha ee codsi kasta.

Marka xaalado gaar ahi dhacaan, khaladaadkani waxay sababi karaan in PHP isticmaalo xog gudaha ah oo aan si sax ah loo diyaarin ama xusuusteeda hore loo sii daayay. Xaalado gaar ah, arrintani waxay u horseedi kartaa memory corruption iyo fulinta amarro aan la oggolayn oo ka dhaca server-ka.

Waxaa la ogaaday in nuglaanshayaashu ay suuragelin karaan Unauthenticated Remote Code Execution (RCE). Taas macnaheedu waa in weeraryahan, haddii shuruudaha nuglaanshuhu buuxsamaan, uu awood u yeelan karo inuu code ka fuliyo server-ka isaga oo aan marka hore xaqiijin aqoonsigiisa.

Labada cilad waxaa loo aqoonsaday inay yihiin kuwo halis aad u sarreeya leh, iyadoo qiimeyntooda CVSS ay gaartay 9.2 marka laga eego 10.

Ilaha: PHP Foundation, Google Cloud iyo ENISA.

2. Waa maxay PHP, maxaase dhibaatadani u saamayn kartaa website-yo badan?

PHP waa luuqad barnaamijyeed inta badan laga isticmaalo dhinaca server-ka. Waxay qabataa hawlo ay ka mid yihiin:

• Soo saarista bogagga website-ka.
• La xiriirka database-ka.
• Maareynta login-ka iyo sessions-ka.
• Habaynta xogta foomamka.
• Fulinta business logic-ka codsiga.
• Isku xirka adeegyada kale.

PHP kuma koobna website-yo cusub oo si toos ah PHP loogu qoray. Waxaa sidoo kale adeegsada nidaamyo badan oo diyaar ah sida WordPress, Drupal, Joomla iyo Magento.

Tusaale ahaan, ganacsi ayaa laga yaabaa inuu isticmaalo WordPress isaga oo aan waligiis si toos ah u qorin hal sadar oo PHP ah. Hase yeeshee, server-ka website-kaasi wuxuu weli ku shaqayn karaa PHP.

Sidaas darteed, qofka maamula website-ku waa inuu ogaadaa software-ka dhab ahaan ka shaqaynaya server-kiisa, halkii uu ku ekaan lahaa magaca framework-ga ama CMS-ka uu isticmaalo.

Casharka muhiimka ah: Isticmaalka software caan ah kama dhigna in nidaamkaagu si toos ah ammaan u yahay. Amniga waxaa saameeya nooca software-ka, habka loo habeeyey, cusboonaysiintiisa iyo sida server-ka loo ilaaliyo.

3. Sidee bay cilad ku jirta memory management u noqon kartaa weerar server?

Si loo fahmo arrintan, aan eegno sida server-ku codsiyada u maareeyo.

Marka browser-ku codsi u diro server, PHP wuxuu qaabilaa xogta codsiga, wuxuuna qabtaa hawlaha loo baahan yahay si jawaab loo soo celiyo. Inta hawshaasi socoto, runtime-ku wuxuu isticmaalaa xusuusta kombiyuutarka si uu u kaydiyo xogta ku meelgaarka ah.

Xusuustaas waa in si taxaddar leh loo maareeyaa.

Tusaale ahaan, haddii qayb ka mid ah barnaamijku sii dayso xusuus uu isticmaali jiray, qayb kale waa inaysan mar dambe u qaadan in xogtii hore weli sax tahay.

Haddii runtime-ku si khaldan u maareeyo xaaladdan, waxaa dhici karta in barnaamijku isticmaalo xog aan sax ahayn ama xusuus aan loo isticmaalin sidii loogu talagalay.

Labada nuglaansho ee hadda laga hadlayo waxay taabanayaan hababkaas gudaha ee PHP.

Si fudud:

1. Codsi ayaa sababa xaalad khaldan oo gudaha PHP ah.
2. PHP wuxuu galaa xaalad aan si sax ah loo maareyn.
3. Xaaladaha qaarkood, khaladkaasi wuxuu dhaawici karaa xusuusta ama habka loo maareeyo xogta codsiga.
4. Haddii weeraryahanku si guul leh uga faa’iidaysto xaaladdaas, wuxuu heli karaa awood ka baxsan tii loogu talagalay inuu yeesho.

Tani waa sharaxaad fikradeed, mana aha tilmaamo lagu fulinayo weerar. Habka saxda ah ee looga faa’iidaysan karo nuglaanshuhu wuxuu ku xiran yahay nooca software-ka iyo xaaladaha uu ku shaqaynayo.

Waxa muhiimka ahi waa in cilad ka muuqata gudaha runtime-ka ay mararka qaarkood ka khatar badnaan karto bug ku jira hal bog oo website-ka ah, sababtoo ah waxay taaban kartaa aasaaska ay codsiyo badan ku shaqeeyaan.

4. Maxaa ka dhigaya Remote Code Execution mid khatar ah?

Remote Code Execution, ama RCE, waa xaalad weeraryahan u saamaxaysa inuu code ka fuliyo kombiyuutar ama server meel fog jooga.

Khatartu kuma koobna in website-ku shaqada joojiyo.

Haddii weeraryahanku helo awood fulineed oo ku filan, waxaa suuragal noqon kara inuu:

• Akhriyo xogta uu account-ka server-ku heli karo.
• Xado xogta macaamiisha ama xog kale oo xasaasi ah.
• Beddelo faylasha ama nuxurka website-ka.
• Ku rakibo malware ama backdoor.
• Carqaladeeyo adeegga ama gebi ahaanba joojiyo website-ka.
• Isku dayo inuu gaaro nidaamyo kale oo isla deegaanka server-ka ku jira.

Laakiin waa muhiim in la kala saaro laba arrimood: nuglaansho jirta iyo server si dhab ah loo jabsaday isku mid ma aha.

Sidoo kale, heerka waxyeelladu wuxuu ku xiran yahay rukhsadaha uu PHP process-ku haysto, habaynta server-ka, xannibaadaha jira iyo in weeraryahanku si dhab ah uga faa’iidaysto ciladda.

Server PHP ah oo leh rukhsado xaddidan, secrets si fiican loo ilaaliyo iyo nidaamyo kala soocid wanaagsan leh wuxuu yareyn karaa waxyeellada suurtagalka ah, inkasta oo tallaabooyinkaas aysan beddelayn baahida loo qabo in nuglaanshaha la saxo.

5. Ma PHP oo keliya ayaa khatartu saamaysay?

Mowduucan waxaa muhiim ah in aan si sax ah u kala saarno PHP iyo Node.js.

PHP ayaa ah luuqadda ay si toos ah u khuseeyaan labada CVE ee kor ku xusan. Ma hayo caddayn ku filan oo muujinaysa in isla labada nuglaansho ay si toos ah u saameeyeen Node.js.

Node.js waa JavaScript runtime kale oo dhinaca server-ka laga isticmaalo. Isaguna wuxuu yeelan karaa nuglaanshayaal amni oo u gaar ah, laakiin taasi macnaheedu ma aha in bug kasta oo PHP ku jira uu isaga sidoo kale saameeyo.

Haddii aad isticmaasho Node.js, Express, Next.js ama React, ha u qaadan in codsigaagu si toos ah u nugul yahay sababta oo ah wararka PHP.

Taas beddelkeeda, waa inaad hubisaa noocyada software-ka aad isticmaasho, talooyinka amni ee rasmiga ah iyo dependencies-ka mashruucaaga.

React oo browser-ka ka shaqaynaya iyo Node.js oo server-ka ka shaqaynaya sidoo kale ma aha wax isku mid ah. Mid walba wuxuu leeyahay meelihiisa amni ee u gaarka ah.

Casharku ma aha in PHP laga fogaado oo Node.js loo cararo. Casharku waa in software kasta oo aad isticmaasho la cusboonaysiiyo, la kormeero, si ammaan ahna loo habeeyo.

6. Doorka AI: sidee loo ogaaday nuglaansho noocan ah?

Arrin kale oo dhacdadan ka dhigaysa mid muhiim ah waa doorka AI ee cilmi-baarista amniga.

Warbixinnada Google Cloud waxay sheegayaan in cilmi-baarayaasha Wiz ay adeegsadeen habab AI ku dhisan si ay u caawiyaan ogaanshaha iyo baaritaanka nuglaanshayaashan. Tani waxay muujinaysaa sida AI loogu adeegsan karo falanqaynta code-ka, aqoonsiga khaladaadka adag iyo xaqiijinta xalalka.

Laakiin waa inaanan ku degdegin sheegashada ah in AI keligeed wax walba samaysay. Helitaanka nuglaansho, fahamka sababta ay u dhacday, xaqiijinta saameynteeda iyo diyaarinta patch ammaan ah waa hawlo kala duwan oo u baahan cilmi-baaris iyo hubin farsamo.

AI waxay dedejin kartaa hawlo ay dadka khibradda leh ku qaadan lahayd waqti badan. Isla awooddaas ayaa sidoo kale ka caawin karta weeraryahannada inay falanqeeyaan code-ka oo ay raadiyaan khaladaad.

Taasi waxay kordhinaysaa muhiimadda ay leedahay in shirkaduhu si dhakhso leh u ogaadaan, u tijaabiyaan, uguna rakibaan patches-ka amniga.

Waxa kale oo ay xoojinaysaa fikradda ah in AI aysan beddelayn injineernimada amniga; waxay beddelaysaa xawaaraha iyo baaxadda shaqada la qaban karo.

7. Maxay tahay in developer-ku hadda sameeyo?

Haddii aad maamusho website ama backend, tallaabooyinkan ayaa muhiim ah.

A. Ogaaw waxa server-kaagu dhab ahaan isticmaalayo

Hubi nooca PHP ee ku rakiban server-ka, hosting-kaaga, containers-kaaga iyo adeegyada aad isticmaasho.

Haddii aad leedahay WordPress ama CMS kale, xusuusnow in cusboonaysiinta CMS-ka oo keliya aysan khasab ahaan cusboonaysiin PHP runtime-ka server-ka.

B. Ku rakib nooca PHP ee la saxay

PHP waxay soo saartay noocyo amni oo la saxay:

• PHP 8.5.12
• PHP 8.4.27
• PHP 8.3.36
• PHP 8.2.35

Noocyadan ayaa lagu sheegay inay saxayaan labada nuglaansho. PHP 8.1 iyo noocyadii ka horreeyay waxay ka baxeen muddadii taageerada amniga ee rasmiga ahayd, sidaas darteed waa in la qorsheeyo u guurid nooc weli la taageero.

Ka hubi PHP advisory-ga rasmiga ah si aad u xaqiijiso nooca ku habboon nidaamkaaga, ka dibna patch-ka ku tijaabi deegaanka staging ka hor inta aan production-ka loo gudbin, haddii xaaladdu kuu saamaxayso.

Haddii server-kaagu yahay mid internet-ka si toos ah ugu xiran oo aan la ilaalin, ha dib u dhigin tallaabooyinka yareynta khatarta.

C. Haddii aadan isla markiiba patch samayn karin

La xiriir hosting provider-kaaga ama kooxda maamusha server-ka. Raac talooyinka amniga ee rasmiga ah. Haddii aadan awoodin inaad si degdeg ah u xannibto nuglaanshaha, waxaa laga yaabaa in go’doominta adeegga internet-ka laga saaro ay noqoto tallaabo ku meel gaar ah oo loo baahan yahay.

Ha samayn go’aan degdeg ah oo website-ka muhiimka ah lagu daminayo adigoon qiimeyn saameynta ganacsiga iyo qorshaha beddelka, balse sidoo kale ha u oggolaan adeeg halis ah inuu sii furnaado sabab keliya oo ah inaad ka baqayso downtime.

D. Hubi in server-ku hore uusan u dhaawacmin

Haddii nidaamkaagu ahaa mid nugul intii ay suurtagal ahayd in weerarro dhacaan, patch-ku keligiis ma caddaynayo in wax walba hagaageen.

Kooxaha amniga waa inay eegaan logs-ka, dhaqdhaqaaqyada aan caadiga ahayn, faylasha la beddelay, accounts cusub iyo tilmaamaha kale ee muujin kara in server-ka la galay.

Haddii aad ka shakido in server-ku jabsaday, la xiriir khabiir incident response ah. Waxaa laga yaabaa in loo baahdo in la xaddido gelitaanka, la baaro nidaamka, la beddelo secrets-ka khatartu saamaysay, lana soo celiyo adeegga iyadoo laga duulayo xaalad la hubo.

E. Adkee difaaca guud ee server-ka

Patch-ku waa tallaabada ugu muhiimsan ee nuglaanshahan gaarka ah, laakiin amniga guud wuxuu u baahan yahay wax ka badan hal update:

• Adeegso principle of least privilege.
• Ha ku kaydin secrets-ka repository-ga GitHub.
• Xaddid gelitaanka database-ka iyo adeegyada maamulka.
• Ilaali backups-ka oo tijaabi in dib loo soo celin karo.
• La soco logs-ka iyo digniinaha amniga.
• Adeegso WAF marka ay ku habboon tahay, adigoo u arka difaac dheeraad ah ee aan beddelka patch-ka.
• Samee nidaam joogto ah oo lagu cusboonaysiiyo dependencies-ka iyo server-ka.

8. Maxay tahay in mulkiilayaasha website-yadu fahmaan?

Mulkiilaha website-ka mararka qaarkood ma yaqaan luuqadda uu server-ku ku shaqeeyo. Wuxuu kaliya og yahay in website-ku shaqaynayo.

Taasi waa sababta maamulayaasha ganacsiyada, hay’adaha iyo ururradu ay ugu baahan yihiin inay ogaadaan cidda ka mas’uulka ah cusboonaysiinta server-ka.

Haddii aad isticmaasho shared hosting, weydii shirkadda hosting-ka nooca PHP ee la isticmaalayo iyo in patch-ka amniga lagu rakibay.

Haddii aad isticmaasho cloud server ama VPS, mas’uuliyadda cusboonaysiinta runtime-ka badanaa waxay saaran tahay adiga ama kooxdaada.

Haddii aad isticmaasho adeeg managed ah, hubi in vendor-ku maareeyo runtime-ka iyo in kale. Mas’uuliyadaha amniga mar walba si isku mid ah looma qaybsado.

Website-ku inuu furmayo ma aha caddayn ku filan oo muujinaysa inuu ammaan yahay.

9. Casharka ay tahay inay developers-ka Soomaaliyeed ka bartaan

Bulshadeenna waxaa ku sii badanaya developers dhisaya e-commerce, booking platforms, systems-ka shirkadaha, adeegyada lacag-bixinta iyo nidaamyada xogta dadka kaydiya.

Marka la dhisayo nidaam noocaas ah, waxaa fudud in xoogga la saaro UI/UX, features-ka, database-ka iyo in mashruuca la launch-gareeyo. Laakiin software-ka la sii daayo waa in sidoo kale la ilaaliyo inta uu nool yahay.

Developer wanaagsan ma aha oo keliya qof qori kara code shaqaynaya. Waa qof fahmaya khataraha code-ka, la socda updates-ka amniga, yareeya rukhsadaha aan loo baahnayn, isla markaana diyaariya hab lagu ogaado loogana jawaabo dhibaatooyinka.

Haddii aad dhisayso mashruuc yar, amniga ha u arkin hawl la qabanayo marka shirkaddu weynaato. Go’aannada aad maanta ka qaadato secrets-ka, authentication-ka, database permissions-ka, logging-ka iyo updates-ku waxay saameyn ku yeelanayaan sida mashruucaagu u adkeysan karo mustaqbalka.

10. Gunaanad: dhibaatadu ma aha PHP, ee waa sida aan u maamulno software-ka

PHP waxay dhistay qayb aad u weyn oo ka mid ah webka, waxaana jira kumannaan developer oo maalin kasta ku shaqeeya. Nuglaanshahan ma caddaynayo in PHP ay tahay luuqad aan ammaan ahayn, mana caddaynayo in Node.js uu si dabiici ah uga ammaan badan yahay.

Waxa uu ina tusayaa in software kasta, xitaa mid muddo dheer la isticmaalayey, uu yeelan karo khaladaad aan hore loo aqoonsan.

Marka khalad noocaas ahi soo baxo, farqiga ugu weyn waxaa sameeya sida ugu dhakhsaha badan ee loo ogaado, loo fahmo, loo saxo, loona hubiyo in nidaamku ammaan yahay.

Internet-ku kuma dhisna luuqad keliya. Wuxuu ku dhisan yahay lakabyo badan oo software ah oo isku xiran. Taasi waxay ka dhigaysaa amniga mas’uuliyad joogto ah oo ay wadaagaan developers-ka, shirkadaha software-ka, hosting providers-ka iyo hay’adaha maamula adeegyada.

Su’aasha doodda GOLE: Haddii PHP ay maamusho qayb aad u weyn oo webka ka mid ah, maxay tahay tallaabada ugu muhiimsan ee developer-ku qaadi karo si uu u yareeyo khatarta noocan ah — cusboonaysiinta joogtada ah, naqshad ammaan ah, mise kormeer joogto ah? Sidee ayay saddexdani isugu xiran yihiin?

⸻

Tixraacyo iyo akhris dheeraad ah

📚 Tixraacyada maqaalka: PHP2Shell

Maqaalkan waxaa lagu diyaariyey xog iyo talooyin laga soo xigtay ilo rasmi ah iyo hay’ado amniga internet-ka ka shaqeeya.

🔗 PHP Security Advisory: https://www.php.net/archive/2026.php

🔗 Google Cloud Research: https://cloud.google.com/blog/products/identity-security/responding-to-core-php-vulnerabilities-cve-2026-109618-cve-2026-109619

🔗 ENISA Security Alert: https://www.enisa.europa.eu/news/joint-statement-on-critical-php-vulnerabilities

🔗 CERT-EU Technical Advisory: https://cert.europa.eu/publications/security-advisories/2026-018/

Aqoon la hubiyey, faham qoto dheer, iyo amni wanaagsan.

GOLE Somali Network