The 'PHP2Shell' Crisis That Shook the Foundation of the Internet: How Does HPE Networking SRX Block It?

A massive issue has broken out that has kept the global security industry and IT infrastructure operators awake at night. It is... ‘'PHP2Shell(CVE-2026-109618, CVE-2026-109619)'’ It is a situation.
As the name suggests—reminiscent of 'Log4Shell,' which once terrified the world—this vulnerability is also being evaluated as unprecedented in terms of its impact and level of threat.

How the recent PHP crisis unfolded and why it is so fatal, and HPE Networking SRX FirewallWe will summarize how you can immediately defend against this threat at the network level through this.

1. The 'PHP2Shell' Incident: How on Earth Did It Happen and Why Is There Such an Uproar?

사건의 발단은 지난 10월 21일이었습니다.

PHP 개발팀이 두 건의 치명적인 원격 코드 실행(RCE) 취약점(CVE-2026-109618, CVE-2026-109619)을 해결하기 위해 긴급 보안 패치를 배포했는데, 문제는 Related information was leaked in advance the day before (October 20), even before the official patch was released.The point is that it became.

As a result, within just a few hours of the patch's release, active exploits and proof-of-concept (PoC) code flooded the world indiscriminately.
There are three main reasons why the security industry has called this incident 'PHP2Shell' and issued the highest level of alert.

• Flaws in the 'PHP engine itself' supporting the 75% of the web ecosystem: It is not merely a matter of a single website or plugin being poorly made. It involves WordPress, Drupal, Laravel, and others that power the majority of the global web. Memory handling defects in the PHP core engine (Runtime) itselfNot only externally exposed websites, but also PHP embedded in internal corporate management consoles and third-party solutions are all within the attack range.
• A single request that doesn't even require a login (Unauthenticated RCE): The risk score reaches 9.8 (Critical) on the CVSS scale. Hackers do not need separate login privileges or complex bypass processes. By simply sending cleverly manipulated data on a standard HTTP request that the server processes by default, a 'Web Shell' that seizes control of the server is immediately executed as the PHP engine's memory areas (such as Out-of-Bounds) become corrupted.
• Neutralization of Application Security: What is even more critical is the timing of the attack. The vulnerability strikes at the lowest level, the PHP engine, before the web application's business logic or security plugins can even finish executing. In other words, the server can be breached before any defense code embedded within the application has a chance to react.

2. HPE Threat Labs' Immediate Response: Urgent Deployment of SRX Firewall IDP Signatures

As such, indiscriminate scanning and attacks began immediately after the patch was released, but for companies, it is practically impossible to update the PHP versions of all their numerous web servers and legacy systems overnight. To put out the immediate fire without service interruption or compatibility testing, Cutting off malicious traffic at the network perimeter before it reaches the web serverThis is the only answer.

In response to this, HPE Threat Labsimmediately after the incident occurred October 22, 2026, Updated to detect exploit attempts matching known PHP2Shell attack patterns and immediately block corresponding traffic in inline enforcement environments. IDP (Intrusion Detection and Prevention) Signatures for SRX FirewallWe have urgently released it.

Latest IDP Signature (HTTP:PHP:PHP2SHELL-OOB)가 적용된 SRX 방화벽은 트래픽 경로(Traffic path) 상에서 백엔드의 PHP 애플리케이션으로 향하는 모든 트래픽을 실시간으로 정밀 검사하며, PHP2Shell 익스플로잇 활동과 일치하는 비정상적인 패턴이 감지되는 즉시 정책에 따라 공격 패킷을 네트워크 단에서 원천 차단합니다.

IDP protection in firewalls buys time until patches are applied and is a key means of implementing Defense-in-Depth, but It does not completely replace the fundamental software patch..
You must resolve the immediate crisis using IDP signatures and proceed with PHP runtime updates sequentially. (※ Be sure to check whether SSL Inspection is configured to prevent attacks via encrypted HTTPS traffic.)

3. SRX 방화벽 적용 및 대응 가이드 (실무 체크리스트)

실무에서 해당 장비를 운영 중인 보안 및 네트워크 담당자라면 즉시 아래 조치를 수행하여 안전한 방어선을 구축해야 합니다.

① IDP 시그니처 업데이트 및 확인

SRX 장비에서 최신 IDP 시그니처 패키지를 신속히 다운로드하여 적용합니다. 장비 CLI에서 아래 명령어를 사용해 패키지 버전과 업데이트 진행 상태를 실시간으로 모니터링할 수 있습니다.

# IDP 시그니처 패키지 버전 확인
show security idp security-package-version

# IDP 시그니처 다운로드 진행 상황 및 상태 확인
request security idp security-package download status

# IDP 시그니처 패키지 버전 확인
show security idp security-package-version

# IDP 시그니처 다운로드 진행 상황 및 상태 확인
request security idp security-package download status

해당 명령어를 실행해 2026년 10월 22일자 이후 최신 패키지가 정상 적용되었는지 반드시 점검하시기 바랍니다.

② 인라인 차단(Inline Enforcement) 정책 활성화

식별된 HTTP:PHP:PHP2SHELL-OOB 시그니처가 단순 탐지 및 로깅(Alert/Ignore) 상태로 남아있지 않은지 반드시 점검하고, 실제 악성 패킷을 끊어낼 수 있도록 차단(Drop/Block) 정책으로 인라인 적용되어 있는지 확인해야 합니다.

4. 근본적인 해결을 위한 패치 및 인프라 업그레이드 권장

방화벽의 IDP/IPS를 통한 선제 방어는 외부 공격으로부터 내부 자산을 보호하고 패치 시간을 벌어주는 강력한 가상 패치(Virtual Patching)이자 다계층 방어(Layered Defense) 역할을 수행하지만, 소프트웨어 자체의 취약점을 해결하는 근본적인 해결책을 대체할 수는 없습니다.

반드시 임시 방어선을 가동한 상태에서 아래의 근본적인 Remediation 작업을 병행해야 합니다.

• 백엔드 PHP 업그레이드: 사내에서 가동 중인 PHP 기반 애플리케이션의 런타임 버전을 즉시 파악하고, 아래의 보안 취약점 해결 패치가 포함된 최신 버전 이상으로 업데이트를 마쳐야 합니다.
  👉 권장 PHP 패치 버전: 8.5.12, 8.4.27, 8.3.36, 8.2.35 이상
• SRX 방화벽 자체의 안전성 확보: 많은 네트워크 및 보안 장비들이 내장 웹 서버에 PHP를 사용하여 취약점 위협을 받곤 합니다.
  그러나 HPE SRX 시리즈의 경우, Junos OS 25.2 릴리스부터는 아키텍처 상 아예 PHP를 사용하지 않으므로(Does not use PHP) 해당 이슈로부터 완벽히 안전합니다.
  만약 25.2 미만의 구형 릴리스 버전을 사용 중이시라면, 방화벽 자체의 잠재적 리스크 제거를 위해서도 최신 25.2 이상 버전으로 업그레이드할 것을 적극 권장합니다.

지금 바로 확인해야 할 체크리스트

The PHP2Shell incident, in which the attack began before the patch with a time difference of just one day, involved the rapid reflection of threat intelligence at the network level and Security internalizationIt reminded me once again how important it is.
If you are currently operating an HPE Networking SRX firewall, please check the following three things right now.

1. IDP Signature DB Update: Whether the latest IDP security package distributed since October 22 has been downloaded, and HTTP:PHP:PHP2SHELL-OOB Please check if the signature is included correctly.
2. Inline Enforcement Settings Check: Check the policy to ensure that the signature is configured with an inline blocking action to cut off actual malicious traffic, rather than stopping at simple detection and logging (Alert).
3. Maintain continuous signature automatic updates: As HPE Threat Labs continues to update signatures based on additional data, please keep update cycles short and strengthen monitoring for the time being.
4. PHP 버전 업그레이드: IDP 기능만 맹신하지 말고, 실제 백엔드의 PHP 서버 패치를 통해 안전한 버전으로 업데이트하세요.