{"id":18705,"date":"2026-10-28T03:41:12","date_gmt":"2026-10-28T03:41:12","guid":{"rendered":"https:\/\/luvina.net\/vi\/?p=18705"},"modified":"2026-10-28T03:41:14","modified_gmt":"2026-10-28T03:41:14","slug":"php2shell","status":"publish","type":"post","link":"https:\/\/luvina.net\/vi\/php2shell\/","title":{"rendered":"PHP2Shell: Website s\u1eed d\u1ee5ng PHP 7.4, 8.0 v\u00e0 8.1 c\u1ea7n l\u00e0m g\u00ec ngay?\u00a0"},"content":{"rendered":"\n<p>PHP2Shell l\u00e0 t\u00ean g\u1ecdi chung c\u1ee7a hai l\u1ed7 h\u1ed5ng nghi\u00eam tr\u1ecdng trong b\u1ed9 m\u00e1y PHP: CVE-2026-109618 v\u00e0 CVE-2026-109619. C\u1ea3 hai \u0111\u1ec1u c\u00f3 th\u1ec3 cho ph\u00e9p k\u1ebb t\u1ea5n c\u00f4ng th\u1ef1c thi m\u00e3 t\u1eeb xa tr\u00ean m\u00e1y ch\u1ee7 b\u1ecb \u1ea3nh h\u01b0\u1edfng m\u00e0 kh\u00f4ng c\u1ea7n \u0111\u0103ng nh\u1eadp. C\u00e1c l\u1ed7 h\u1ed5ng \u0111\u01b0\u1ee3c x\u1ebfp h\u1ea1ng Critical, v\u1edbi \u0111i\u1ec3m CVSS v4.0 l\u00e0 9.2.&nbsp;<\/p>\n\n\n\n<p>V\u00ec l\u1ed7i n\u1eb1m \u1edf m\u00f4i tr\u01b0\u1eddng ch\u1ea1y website, vi\u1ec7c ch\u1ec9 c\u1eadp nh\u1eadt CMS (nh\u01b0 WordPress, Drupal), \u0111\u1ed5i giao di\u1ec7n hay update plugin l\u00e0 kh\u00f4ng \u0111\u1ee7 \u0111\u1ec3 ng\u0103n ch\u1eb7n. B\u00e0i vi\u1ebft d\u01b0\u1edbi \u0111\u00e2y s\u1ebd gi\u00fap c\u00e1c nh\u00e0 qu\u1ea3n tr\u1ecb website, \u0111\u1eb7c bi\u1ec7t bi\u1ec7t l\u00e0 nh\u1eefng h\u1ec7 th\u1ed1ng v\u1eabn \u0111ang ch\u1ea1y PHP 7.4, 8.0 ho\u1eb7c 8.1, hi\u1ec3u r\u00f5 ph\u1ea1m vi \u1ea3nh h\u01b0\u1edfng v\u00e0 c\u00e1ch ph\u1ed1i h\u1ee3p v\u1edbi \u0111\u01a1n v\u1ecb hosting \u0111\u1ec3 b\u1ea3o v\u1ec7 d\u1eef li\u1ec7u doanh nghi\u1ec7p.&nbsp;<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">PHP2Shell l\u00e0 g\u00ec? M\u1ee9c \u0111\u1ed9 nguy hi\u1ec3m ra sao?&nbsp;<\/h2>\n\n\n\n<p>PHP2Shell bao g\u1ed3m hai m\u00e3 \u0111\u1ecbnh danh <strong>CVE-2026-109618<\/strong> v\u00e0 <strong>CVE-2026-109619<\/strong>, c\u1ea3 hai \u0111\u1ec1u \u0111\u01b0\u1ee3c x\u1ebfp h\u1ea1ng c\u1ef1c k\u1ef3 nghi\u00eam tr\u1ecdng v\u1edbi \u0111i\u1ec3m <strong>CVSS v4.0 \u0111\u1ea1t 9.2\/10<\/strong>.&nbsp;<\/p>\n\n\n\n<p>Khi ng\u01b0\u1eddi d\u00f9ng truy c\u1eadp website, b\u1ed9 m\u00e1y PHP s\u1ebd x\u1eed l\u00fd m\u00e3 \u1ee9ng d\u1ee5ng \u0111\u1ec3 t\u1ea1o n\u1ed9i dung tr\u1ea3 v\u1ec1 tr\u00ecnh duy\u1ec7t. Do l\u1ed7i n\u1eb1m ngay trong kh\u00e2u x\u1eed l\u00fd n\u00e0y, m\u1ed9t website d\u00f9 c\u00f3 b\u1ed9 code \u1ee9ng d\u1ee5ng s\u1ea1ch v\u1eabn c\u00f3 th\u1ec3 b\u1ecb t\u1ea5n c\u00f4ng. C\u1ee5 th\u1ec3:&nbsp;<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>CVE-2026-109618 (RCE qua l\u1ed7i c\u1ea1n ki\u1ec7t b\u1ed9 nh\u1edb):<\/strong> Li\u00ean quan \u0111\u1ebfn c\u00e1ch PHP x\u1eed l\u00fd t\u00ecnh hu\u1ed1ng h\u1ebft b\u1ed9 nh\u1edb. Khi ti\u1ebfn tr\u00ecnh b\u1ecb d\u1eebng \u0111\u1ed9t ng\u1ed9t, b\u01b0\u1edbc d\u1ecdn d\u1eb9p d\u1eef li\u1ec7u c\u1ee7a PHP s\u1eed d\u1ee5ng sai c\u00e1c v\u00f9ng nh\u1edb kh\u00f4ng h\u1ee3p l\u1ec7, d\u1eabn \u0111\u1ebfn h\u1ecfng b\u1ed9 nh\u1edb.\u00a0<\/li>\n<\/ul>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>CVE-2026-109619 (RCE qua tr\u1ea1ng th\u00e1i l\u01b0u \u0111\u1ecdng):<\/strong> Khi v\u00f9ng nh\u1edb b\u1ecb gi\u1ea3i ph\u00f3ng, c\u00e1c tr\u1ea1ng th\u00e1i l\u1ed7i kh\u00f4ng b\u1ecb x\u00f3a \u0111i. C\u00e1c y\u00eau c\u1ea7u ti\u1ebfp theo g\u1eedi \u0111\u1ebfn c\u00f9ng m\u1ed9t ti\u1ebfn tr\u00ecnh PHP c\u00f3 th\u1ec3 s\u1eed d\u1ee5ng l\u1ea1i tr\u1ea1ng th\u00e1i \u0111\u1ed9c h\u1ea1i n\u00e0y, t\u1ea1o \u0111i\u1ec1u ki\u1ec7n cho hacker chi\u1ebfm quy\u1ec1n th\u1ef1c thi l\u1ec7nh (RCE).\u00a0<\/li>\n<\/ul>\n\n\n\n<figure class=\"wp-block-image size-large\"><img fetchpriority=\"high\" decoding=\"async\" width=\"1024\" height=\"576\" src=\"https:\/\/luvina.net\/vi\/wp-content\/uploads\/2026\/10\/PHP2Shell-1-1024x576.webp\" alt=\"S\u01a1 \u0111\u1ed3 k\u1ef9 thu\u1eadt m\u00f4 t\u1ea3 c\u01a1 ch\u1ebf khai th\u00e1c th\u1ef1c thi m\u00e3 t\u1eeb xa c\u1ee7a hai l\u1ed7 h\u1ed5ng PHP2Shell.\" class=\"wp-image-18707\" title=\"\" srcset=\"https:\/\/luvina.net\/vi\/wp-content\/uploads\/2026\/10\/PHP2Shell-1-1024x576.webp 1024w, https:\/\/luvina.net\/vi\/wp-content\/uploads\/2026\/10\/PHP2Shell-1-300x169.webp 300w, https:\/\/luvina.net\/vi\/wp-content\/uploads\/2026\/10\/PHP2Shell-1-768x432.webp 768w, https:\/\/luvina.net\/vi\/wp-content\/uploads\/2026\/10\/PHP2Shell-1.webp 1200w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><figcaption class=\"wp-element-caption\">S\u01a1 \u0111\u1ed3 c\u01a1 ch\u1ebf hai l\u1ed7 h\u1ed5ng PHP2Shell<\/figcaption><\/figure>\n\n\n\n<p><strong>S\u1ef1 can thi\u1ec7p c\u1ee7a AI trong vi\u1ec7c ph\u00e1t hi\u1ec7n l\u1ed7i:<\/strong> Theo Wiz, PHP t\u1eeb 5.4 tr\u1edf l\u00ean \u0111\u00e3 t\u1ed3n t\u1ea1i ti\u1ec1m \u1ea9n \u00edt nh\u1ea5t m\u1ed9t \u0111i\u1ec3m y\u1ebfu trong nh\u00f3m n\u00e0y, nh\u01b0ng \u0111\u1ebfn th\u00e1ng 8\/2026, nh\u00f3m nghi\u00ean c\u1ee9u t\u1ea1i Calif ph\u1ed1i h\u1ee3p c\u00f9ng OpenAI v\u00e0 Wiz, m\u1edbi s\u1eed d\u1ee5ng AI \u0111\u1ec3 ph\u00e2n t\u00edch m\u00e3 v\u00e0 t\u1ea1o ra c\u00e1c k\u1ecbch b\u1ea3n khai th\u00e1c th\u00e0nh c\u00f4ng.&nbsp;<\/p>\n\n\n\n<p>Ng\u00e0y 21\/10\/2026, PHP ph\u00e1t h\u00e0nh c\u00e1c b\u1ea3n c\u1eadp nh\u1eadt b\u1ea3o m\u1eadt cho PHP 8.2, 8.3, 8.4 v\u00e0 8.5. PHP 7.4, 8.0 v\u00e0 8.1 \u0111\u00e3 h\u1ebft v\u00f2ng \u0111\u1eddi h\u1ed7 tr\u1ee3 (End-of-Life \u2013 EOL) v\u00e0 kh\u00f4ng c\u00f3 b\u1ea3n s\u1eeda ch\u00ednh th\u1ee9c t\u1eeb d\u1ef1 \u00e1n PHP. Doanh nghi\u1ec7p \u0111ang s\u1eed d\u1ee5ng c\u00e1c phi\u00ean b\u1ea3n n\u00e0y c\u1ea7n ki\u1ec3m tra v\u1edbi nh\u00e0 cung c\u1ea5p hosting ho\u1eb7c ph\u1ea7n m\u1ec1m \u0111\u1ec3 x\u00e1c nh\u1eadn c\u00f3 g\u00f3i \u0111\u00e3 v\u00e1 ho\u1eb7c b\u1ea3n backport hay kh\u00f4ng, \u0111\u1ed3ng th\u1eddi l\u00ean k\u1ebf ho\u1ea1ch n\u00e2ng c\u1ea5p l\u00ean phi\u00ean b\u1ea3n PHP c\u00f2n \u0111\u01b0\u1ee3c h\u1ed7 tr\u1ee3.&nbsp;<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Nh\u1eefng website n\u00e0o c\u00f3 th\u1ec3 b\u1ecb \u1ea3nh h\u01b0\u1edfng&nbsp;<\/h2>\n\n\n\n<p>B\u1ea5t k\u1ef3 h\u1ec7 th\u1ed1ng n\u00e0o d\u00f9ng PHP ch\u01b0a \u0111\u01b0\u1ee3c v\u00e1 \u0111\u1ec3 x\u1eed l\u00fd web request \u0111\u1ec1u c\u00f3 nguy c\u01a1, bao g\u1ed3m:&nbsp;<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>C\u00e1c n\u1ec1n t\u1ea3ng ph\u1ed5 bi\u1ebfn:<\/strong> WordPress, Drupal, Joomla, MediaWiki ho\u1eb7c c\u00e1c web app t\u1ef1 ph\u00e1t tri\u1ec3n.\u00a0<\/li>\n<\/ul>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>M\u00f4i tr\u01b0\u1eddng m\u00e1y ch\u1ee7:<\/strong> PHP-FPM, php-cgi, FrankenPHP, LiteSpeed v\u00e0 \u0111\u1eb7c bi\u1ec7t l\u00e0 <strong>Apache (mod_php)<\/strong> \u2013 c\u1ea5u h\u00ecnh \u0111\u01b0\u1ee3c PHP c\u1ea3nh b\u00e1o c\u00f3 r\u1ee7i ro cao nh\u1ea5t.\u00a0<\/li>\n<\/ul>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong><em>L\u01b0u \u00fd:<\/em><\/strong><strong> <\/strong>Ngay c\u1ea3 khi website c\u1ee7a b\u1ea1n kh\u00f4ng c\u00f3 form upload file v\u1eabn c\u1ea7n \u0111\u01b0\u1ee3c ki\u1ec3m tra. V\u1edbi Apache mod_php, CVE-2026-109618 c\u00f3 th\u1ec3 b\u1ecb k\u00edch ho\u1ea1t b\u1edfi m\u1ed9t y\u00eau c\u1ea7u ch\u01b0a x\u00e1c th\u1ef1c, ngay tr\u01b0\u1edbc khi m\u00e3 \u1ee9ng d\u1ee5ng k\u1ecbp ch\u1ea1y. PHP-FPM, php-cgi, FrankenPHP v\u00e0 LiteSpeed c\u0169ng n\u1eb1m trong di\u1ec7n b\u1ecb \u1ea3nh h\u01b0\u1edfng, n\u00ean c\u00e1c c\u1ea5u h\u00ecnh n\u00e0y v\u1eabn c\u1ea7n \u0111\u01b0\u1ee3c v\u00e1.\u00a0<\/li>\n<\/ul>\n\n\n\n<p><strong>H\u1eadu qu\u1ea3 n\u1ebfu b\u1ecb khai th\u00e1c:<\/strong> K\u1ebb t\u1ea5n c\u00f4ng c\u00f3 th\u1ec3 ch\u1ea1y m\u00e3 \u0111\u1ed9c v\u1edbi quy\u1ec1n c\u1ee7a ti\u1ebfn tr\u00ecnh PHP, cho ph\u00e9p ch\u00fang:&nbsp;<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>\u0110\u00e1nh c\u1eafp d\u1eef li\u1ec7u nh\u1ea1y c\u1ea3m (m\u1eadt kh\u1ea9u, token, kh\u00f3a API) t\u1eeb b\u1ed9 nh\u1edb ti\u1ebfn tr\u00ecnh.\u00a0<\/li>\n<\/ul>\n\n\n\n<ul class=\"wp-block-list\">\n<li>S\u1eeda \u0111\u1ed5i n\u1ed9i dung website ho\u1eb7c c\u1ea5y m\u00e3 \u0111\u1ed9c (backdoor).\u00a0<\/li>\n<\/ul>\n\n\n\n<ul class=\"wp-block-list\">\n<li>G\u00e2y gi\u00e1n \u0111o\u1ea1n giao d\u1ecbch, \u1ea3nh h\u01b0\u1edfng n\u1eb7ng n\u1ec1 \u0111\u1ebfn uy t\u00edn v\u00e0 t\u00e0i ch\u00ednh c\u1ee7a doanh nghi\u1ec7p.\u00a0<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Ba b\u01b0\u1edbc ki\u1ec3m tra xem website c\u00f3 b\u1ecb \u1ea3nh h\u01b0\u1edfng kh\u00f4ng&nbsp;<\/h2>\n\n\n\n<p>Giao di\u1ec7n website ho\u1ea1t \u0111\u1ed9ng b\u00ecnh th\u01b0\u1eddng kh\u00f4ng \u0111\u1ed3ng ngh\u0129a v\u1edbi vi\u1ec7c h\u1ec7 th\u1ed1ng c\u1ee7a b\u1ea1n an to\u00e0n. H\u00e3y ph\u1ed1i h\u1ee3p v\u1edbi \u0111\u1ed9i ng\u0169 IT ho\u1eb7c nh\u00e0 cung c\u1ea5p hosting th\u1ef1c hi\u1ec7n ngay 3 b\u01b0\u1edbc sau:&nbsp;<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>B\u01b0\u1edbc 1: X\u00e1c \u0111\u1ecbnh ch\u00ednh x\u00e1c phi\u00ean b\u1ea3n PHP \u0111ang s\u1eed d\u1ee5ng<\/strong>&nbsp;<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>V\u1edbi WordPress:<\/strong> V\u00e0o <em>C\u00f4ng c\u1ee5 \u2192 S\u1ee9c kh\u1ecfe website \u2192 Th\u00f4ng tin \u2192 M\u00e1y ch\u1ee7<\/em> \u0111\u1ec3 xem nhanh phi\u00ean b\u1ea3n PHP.\u00a0<\/li>\n<\/ul>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>V\u1edbi Hosting\/VPS:<\/strong> Ki\u1ec3m tra qua b\u1ea3ng \u0111i\u1ec1u khi\u1ec3n (cPanel, DirectAdmin) ho\u1eb7c d\u00f9ng l\u1ec7nh php -v (l\u01b0u \u00fd l\u1ec7nh n\u00e0y ch\u1ec9 hi\u1ec3n th\u1ecb b\u1ea3n CLI, c\u1ea7n \u0111\u1ed1i chi\u1ebfu th\u00eam v\u1edbi d\u1ecbch v\u1ee5 web nh\u01b0 PHP-FPM \u0111ang ch\u1ea1y). \u0110\u1eebng qu\u00ean ki\u1ec3m tra c\u00e1c subdomain ho\u1eb7c m\u00f4i tr\u01b0\u1eddng test.\u00a0<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>B\u01b0\u1edbc 2: \u0110\u1ed1i chi\u1ebfu b\u1ea3n v\u00e1 (Patch &amp; Backport)<\/strong>&nbsp;<\/h3>\n\n\n\n<p>Ch\u1ec9 nh\u00ecn v\u00e0o s\u1ed1 phi\u00ean b\u1ea3n (v\u00ed d\u1ee5 PHP 8.3) l\u00e0 ch\u01b0a \u0111\u1ee7. B\u1ea1n c\u1ea7n ch\u1eafc ch\u1eafn h\u1ec7 th\u1ed1ng \u0111ang ch\u1ea1y b\u1ea3n \u0111\u00e3 fix l\u1ed7i:&nbsp;<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>PHP 8.5:<\/strong> C\u1eadp nh\u1eadt l\u00ean 8.5.12\u00a0<\/li>\n<\/ul>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>PHP 8.4:<\/strong> C\u1eadp nh\u1eadt l\u00ean 8.4.27\u00a0<\/li>\n<\/ul>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>PHP 8.3:<\/strong> C\u1eadp nh\u1eadt l\u00ean 8.3.36\u00a0<\/li>\n<\/ul>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>PHP 8.2:<\/strong> C\u1eadp nh\u1eadt l\u00ean 8.2.35 (S\u1eafp h\u1ebft h\u1ed7 tr\u1ee3 v\u00e0o 31\/12\/2026).\u00a0<\/li>\n<\/ul>\n\n\n\n<p>N\u1ebfu d\u00f9ng c\u00e1c g\u00f3i PHP do h\u1ec7 \u0111i\u1ec1u h\u00e0nh ph\u00e2n ph\u1ed1i (nh\u01b0 Ubuntu, Debian, RHEL, AlmaLinux), h\u00e3y y\u00eau c\u1ea7u hosting x\u00e1c nh\u1eadn m\u00e3 g\u00f3i (package version) \u0111\u00e3 bao g\u1ed3m b\u1ea3n v\u00e1 ng\u01b0\u1ee3c (backport) cho CVE-2026-109618 v\u00e0 CVE-2026-109619 ch\u01b0a, \u0111\u1ed3ng th\u1eddi \u0111\u1ea3m b\u1ea3o c\u00e1c d\u1ecbch v\u1ee5 \u0111\u00e3 \u0111\u01b0\u1ee3c <em>restart<\/em> sau khi c\u1eadp nh\u1eadt.&nbsp;<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>B\u01b0\u1edbc 3: R\u00e0 so\u00e1t d\u1ea5u hi\u1ec7u b\u1ecb x\u00e2m nh\u1eadp<\/strong>&nbsp;<\/h3>\n\n\n\n<p>N\u1ebfu website t\u1eebng ch\u1ea1y b\u1ea3n PHP d\u00ednh l\u1ed7i, h\u00e3y r\u00e0 so\u00e1t log m\u00e1y ch\u1ee7 (access log, error log), ki\u1ec3m tra c\u00e1c file b\u1ecb thay \u0111\u1ed5i b\u1ea5t th\u01b0\u1eddng v\u00e0 r\u00e0 so\u00e1t t\u00e0i kho\u1ea3n qu\u1ea3n tr\u1ecb m\u1edbi. Vi\u1ec7c v\u00e1 l\u1ed7i ch\u1ec9 gi\u00fap ch\u1eb7n l\u1ed7 h\u1ed5ng, ch\u1ee9 kh\u00f4ng t\u1ef1 \u0111\u1ed9ng x\u00f3a m\u00e3 \u0111\u1ed9c n\u1ebfu server \u0111\u00e3 b\u1ecb hacker &#8220;gh\u00e9 th\u0103m&#8221; tr\u01b0\u1edbc \u0111\u00f3.&nbsp;<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">C\u00e1c website s\u1eed d\u1ee5ng phi\u00ean b\u1ea3n PHP (7.4, 8.0, 8.1) c\u1ea7n l\u00e0m g\u00ec ngay l\u00fac n\u00e0y?&nbsp;<\/h2>\n\n\n\n<p>C\u00e1c nh\u00e1nh PHP 7.4, 8.0 v\u00e0 8.1 <strong>\u0111\u00e3 ch\u00ednh th\u1ee9c b\u1ecb khai t\u1eed (End-of-Life)<\/strong> v\u00e0 kh\u00f4ng c\u00f2n th\u01b0\u1eddng xuy\u00ean nh\u1eadn \u0111\u01b0\u1ee3c c\u00e1c b\u1ea3n v\u00e1 b\u1ea3o m\u1eadt ch\u00ednh th\u1ee9c t\u1eeb d\u1ef1 \u00e1n PHP. N\u1ebfu h\u1ec7 th\u1ed1ng c\u1ee7a b\u1ea1n \u0111ang k\u1eb9t \u1edf c\u00e1c phi\u00ean b\u1ea3n n\u00e0y, r\u1ee7i ro l\u00e0 r\u1ea5t l\u1edbn.&nbsp;<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img decoding=\"async\" width=\"1024\" height=\"576\" src=\"https:\/\/luvina.net\/vi\/wp-content\/uploads\/2026\/10\/PHP2Shell-2-1024x576.webp\" alt=\"S\u01a1 \u0111\u1ed3 quy tr\u00ecnh l\u1ef1a ch\u1ecdn ph\u01b0\u01a1ng \u00e1n kh\u1eafc ph\u1ee5c l\u1ed7 h\u1ed5ng PHP2Shell cho c\u00e1c n\u1ec1n t\u1ea3ng PHP phi\u00ean b\u1ea3n c\u0169.\" class=\"wp-image-18708\" title=\"\" srcset=\"https:\/\/luvina.net\/vi\/wp-content\/uploads\/2026\/10\/PHP2Shell-2-1024x576.webp 1024w, https:\/\/luvina.net\/vi\/wp-content\/uploads\/2026\/10\/PHP2Shell-2-300x169.webp 300w, https:\/\/luvina.net\/vi\/wp-content\/uploads\/2026\/10\/PHP2Shell-2-768x432.webp 768w, https:\/\/luvina.net\/vi\/wp-content\/uploads\/2026\/10\/PHP2Shell-2.webp 1200w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><figcaption class=\"wp-element-caption\">S\u01a1 \u0111\u1ed3 ch\u1ecdn h\u01b0\u1edbng x\u1eed l\u00fd PHP2Shell cho website d\u00f9ng PHP 7.4, 8.0, 8.1<\/figcaption><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\">X\u1eed l\u00fd r\u1ee7i ro tr\u01b0\u1edbc m\u1eaft&nbsp;<\/h3>\n\n\n\n<ol start=\"1\" class=\"wp-block-list\">\n<li><strong>H\u1ecfi nh\u00e0 cung c\u1ea5p OS\/Hosting v\u1ec1 Backport:<\/strong> M\u1ed9t s\u1ed1 nh\u00e0 ph\u00e2n ph\u1ed1i Linux (nh\u01b0 Ubuntu, Debian) c\u00f3 th\u1ec3 cung c\u1ea5p c\u00e1c g\u00f3i v\u00e1 ng\u01b0\u1ee3c t\u1ef1 bi\u00ean d\u1ecbch cho PHP c\u0169. H\u00e3y y\u00eau c\u1ea7u h\u1ecd x\u00e1c nh\u1eadn.\u00a0<\/li>\n<\/ol>\n\n\n\n<ol start=\"2\" class=\"wp-block-list\">\n<li><strong>Gi\u1ea3m b\u1ec1 m\u1eb7t t\u1ea5n c\u00f4ng:<\/strong> C\u1ea5u h\u00ecnh l\u1ea1i t\u01b0\u1eddng l\u1eeda \u1ee9ng d\u1ee5ng (WAF), ch\u1eb7n c\u00e1c request b\u1ea5t th\u01b0\u1eddng, gi\u1edbi h\u1ea1n IP truy c\u1eadp v\u00e0o trang qu\u1ea3n tr\u1ecb, ho\u1eb7c s\u1eed d\u1ee5ng VPN n\u1ebfu \u0111\u00f3 l\u00e0 h\u1ec7 th\u1ed1ng n\u1ed9i b\u1ed9.\u00a0<\/li>\n<\/ol>\n\n\n\n<ol start=\"3\" class=\"wp-block-list\">\n<li><strong>T\u00f9y ch\u1ec9nh th\u00f4ng s\u1ed1:<\/strong> T\u1ea1m th\u1eddi tinh ch\u1ec9nh gi\u1edbi h\u1ea1n b\u1ed9 nh\u1edb v\u00e0 v\u00f4 hi\u1ec7u h\u00f3a c\u00e1c t\u00ednh n\u0103ng kh\u00f4ng c\u1ea7n thi\u1ebft theo khuy\u1ebfn c\u00e1o kh\u1ea9n c\u1ea5p c\u1ee7a c\u1ed9ng \u0111\u1ed3ng (Tuy\u1ec7t \u0111\u1ed1i kh\u00f4ng t\u1ef1 s\u1eeda th\u00f4ng s\u1ed1 n\u1ebfu kh\u00f4ng hi\u1ec3u r\u00f5 ki\u1ebfn tr\u00fac server).\u00a0<\/li>\n<\/ol>\n\n\n\n<h3 class=\"wp-block-heading\">L\u1eadp l\u1ed9 tr\u00ecnh n\u00e2ng c\u1ea5p to\u00e0n di\u1ec7n (Gi\u1ea3i ph\u00e1p d\u00e0i h\u1ea1n)&nbsp;<\/h3>\n\n\n\n<p>\u0110\u1ec3 \u0111\u1ea3m b\u1ea3o an to\u00e0n v\u00e0 hi\u1ec7u su\u1ea5t, doanh nghi\u1ec7p n\u00ean l\u1eadp k\u1ebf ho\u1ea1ch &#8220;chuy\u1ec3n nh\u00e0&#8221; sang PHP 8.3, 8.4 ho\u1eb7c 8.5. Qu\u00e1 tr\u00ecnh n\u00e0y c\u1ea7n s\u1ef1 c\u1ea9n tr\u1ecdng \u0111\u1ec3 kh\u00f4ng l\u00e0m s\u1eadp h\u1ec7 th\u1ed1ng:&nbsp;<\/p>\n\n\n\n<ol start=\"1\" class=\"wp-block-list\">\n<li><strong>Ki\u1ec3m k\u00ea &amp; Sao l\u01b0u:<\/strong> \u0110\u00e1nh gi\u00e1 to\u00e0n b\u1ed9 m\u00e3 ngu\u1ed3n, plugin, th\u01b0 vi\u1ec7n b\u00ean th\u1ee9 3 (nh\u01b0 c\u1ed5ng thanh to\u00e1n, CRM). Backup to\u00e0n b\u1ed9 database v\u00e0 source code.\u00a0<\/li>\n<\/ol>\n\n\n\n<ol start=\"2\" class=\"wp-block-list\">\n<li><strong>T\u1ea1o m\u00f4i tr\u01b0\u1eddng Staging:<\/strong> D\u1ef1ng m\u1ed9t m\u00f4i tr\u01b0\u1eddng th\u1eed nghi\u1ec7m \u0111\u1ed9c l\u1eadp. N\u00e2ng c\u1ea5p PHP l\u00ean b\u1ea3n \u0111\u00edch v\u00e0 s\u1eeda c\u00e1c \u0111o\u1ea1n code kh\u00f4ng t\u01b0\u01a1ng th\u00edch (Deprecations\/Fatal Errors).\u00a0<\/li>\n<\/ol>\n\n\n\n<ol start=\"3\" class=\"wp-block-list\">\n<li><strong>Ki\u1ec3m th\u1eed to\u00e0n di\u1ec7n (Testing):<\/strong> Test k\u1ef9 c\u00e1c lu\u1ed3ng sinh doanh thu (\u0111\u1eb7t h\u00e0ng, thanh to\u00e1n, g\u1eedi email, \u0111\u0103ng nh\u1eadp) \u0111\u1ec3 \u0111\u1ea3m b\u1ea3o kh\u00f4ng c\u00f3 gi\u00e1n \u0111o\u1ea1n.\u00a0<\/li>\n<\/ol>\n\n\n\n<ol start=\"4\" class=\"wp-block-list\">\n<li><strong>Deploy th\u1ef1c t\u1ebf:<\/strong> Tri\u1ec3n khai b\u1ea3n \u0111\u00e3 s\u1eeda l\u00ean m\u00f4i tr\u01b0\u1eddng th\u1eadt trong khung gi\u1edd th\u1ea5p \u0111i\u1ec3m, kh\u1edfi \u0111\u1ed9ng l\u1ea1i d\u1ecbch v\u1ee5 v\u00e0 gi\u00e1m s\u00e1t ch\u1eb7t ch\u1ebd.\u00a0<\/li>\n<\/ol>\n\n\n\n<p>Tr\u01b0\u1eddng h\u1ee3p h\u1ec7 th\u1ed1ng d\u00f9ng m\u1ed9t CMS qu\u00e1 c\u0169, c\u00e1c plugin \u0111\u00e3 b\u1ecb b\u1ecf r\u01a1i kh\u00f4ng t\u01b0\u01a1ng th\u00edch v\u1edbi PHP 8.x, doanh nghi\u1ec7p n\u00ean c\u00e2n nh\u1eafc chuy\u1ec3n sang c\u00e1c c\u00f4ng ngh\u1ec7 m\u1edbi h\u01a1n.&nbsp;<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">\u0110\u1ed3ng h\u00e0nh c\u00f9ng Luvina Software \u2013 Chuy\u1ec3n \u0111\u1ed5i v\u00e0 n\u00e2ng c\u1ea5p h\u1ec7 th\u1ed1ng an to\u00e0n&nbsp;<\/h2>\n\n\n\n<p>B\u1ea1n \u0111ang lo l\u1eafng v\u00ec h\u1ec7 th\u1ed1ng c\u1ee7a doanh nghi\u1ec7p v\u1eabn k\u1eb9t l\u1ea1i \u1edf PHP 7.4, hay kh\u00f4ng ch\u1eafc ch\u1eafn server c\u1ee7a m\u00ecnh \u0111\u00e3 \u0111\u01b0\u1ee3c v\u00e1 l\u1ed7i PHP2Shell ch\u01b0a? Vi\u1ec7c t\u1ef1 tay can thi\u1ec7p v\u00e0o m\u00e1y ch\u1ee7 ho\u1eb7c n\u00e2ng c\u1ea5p PHP m\u00f9 qu\u00e1ng c\u00f3 th\u1ec3 l\u00e0m h\u1ecfng to\u00e0n b\u1ed9 t\u00ednh n\u0103ng website.&nbsp;<\/p>\n\n\n\n<p>\u0110\u1eebng \u0111\u1ec3 h\u1ec7 th\u1ed1ng tr\u1edf th\u00e0nh con m\u1ed3i c\u1ee7a t\u1ed9i ph\u1ea1m m\u1ea1ng. H\u00e3y li\u00ean h\u1ec7 v\u1edbi \u0111\u1ed9i ng\u0169 k\u1ef9 s\u01b0 gi\u00e0u kinh nghi\u1ec7m t\u1ea1i <strong>Luvina Software<\/strong>. Ch\u00fang t\u00f4i cung c\u1ea5p d\u1ecbch v\u1ee5 \u0111\u00e1nh gi\u00e1 b\u1ea3o m\u1eadt t\u1ed5ng th\u1ec3, r\u00e0 so\u00e1t l\u1ed7 h\u1ed5ng, v\u00e0 thi\u1ebft k\u1ebf l\u1ed9 tr\u00ecnh n\u00e2ng c\u1ea5p (migration) ho\u1eb7c chuy\u1ec3n \u0111\u1ed5i ki\u1ebfn tr\u00fac h\u1ec7 th\u1ed1ng m\u1ed9t c\u00e1ch tr\u01a1n tru, kh\u00f4ng g\u00e2y gi\u00e1n \u0111o\u1ea1n ho\u1ea1t \u0111\u1ed9ng kinh doanh c\u1ee7a b\u1ea1n.&nbsp;<\/p>\n\n\n\n<p>\ud83d\udc49 <a href=\"https:\/\/luvina.net\/vi\/contact-us\/\" target=\"_blank\" rel=\"noreferrer noopener\"><strong>[Li\u00ean h\u1ec7 Luvina Software ngay h\u00f4m nay \u0111\u1ec3 \u0111\u01b0\u1ee3c t\u01b0 v\u1ea5n n\u00e2ng c\u1ea5p website an to\u00e0n!]<\/strong><\/a>&nbsp;<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>Ngu\u1ed3n tham kh\u1ea3o<\/strong>&nbsp;<\/h2>\n\n\n\n<p>C\u00e1c s\u1ed1 trong b\u00e0i t\u01b0\u01a1ng \u1ee9ng v\u1edbi ngu\u1ed3n d\u01b0\u1edbi \u0111\u00e2y. Th\u00f4ng tin \u0111\u01b0\u1ee3c \u0111\u1ed1i chi\u1ebfu \u0111\u1ebfn ng\u00e0y 27\/10\/2026; c\u1ea7n ki\u1ec3m tra l\u1ea1i c\u00e1c b\u1ea3n ph\u00e1t h\u00e0nh v\u00e0 khuy\u1ebfn c\u00e1o m\u1edbi tr\u01b0\u1edbc khi xu\u1ea5t b\u1ea3n ho\u1eb7c tri\u1ec3n khai.&nbsp;<\/p>\n\n\n\n<p><strong>[1] PHP. <\/strong><a href=\"https:\/\/www.php.net\/archive\/2026.php\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">Th\u00f4ng b\u00e1o b\u1ea3o m\u1eadt v\u00e0 c\u1eadp nh\u1eadt ng\u00e0y 21, 23 v\u00e0 26\/10\/2026<\/a>&nbsp;<\/p>\n\n\n\n<p><strong>[2] Wiz Research. <\/strong><a href=\"https:\/\/www.wiz.io\/blog\/php2shell-php-rce\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">PHP2Shell v\u00e0 k\u1ebft qu\u1ea3 th\u1eed nghi\u1ec7m tr\u00ean \u1ee9ng d\u1ee5ng PHP<\/a>&nbsp;<\/p>\n\n\n\n<p><strong>[3] PHP Security Advisory. <\/strong><a href=\"https:\/\/github.com\/php\/php-src\/security\/advisories\/GHSA-w8hw-w9fx-j79w\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">CVE-2026-109618 \u2014 RCE via OOM corruption<\/a>&nbsp;<\/p>\n\n\n\n<p><strong>[4] PHP Security Advisory. <\/strong><a href=\"https:\/\/github.com\/php\/php-src\/security\/advisories\/GHSA-6wmf-4rv5-p3rp\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">CVE-2026-109619 \u2014 RCE via stale global state<\/a>&nbsp;<\/p>\n\n\n\n<p><strong>[5] Calif Research. <\/strong><a href=\"https:\/\/calif.io\/php2shell\/\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">PHP2Shell v\u00e0 d\u00f2ng th\u1eddi gian ph\u00e1t hi\u1ec7n<\/a>&nbsp;<\/p>\n\n\n\n<p><strong>[6] CERT-EU. <\/strong><a href=\"https:\/\/cert.europa.eu\/publications\/security-advisories\/2026-018\/\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">Security Advisory 2026-018 \u2014 Critical Vulnerabilities in PHP<\/a>&nbsp;<\/p>\n\n\n\n<p><strong>[7] Canonical Ubuntu. <\/strong><a href=\"https:\/\/ubuntu.com\/blog\/php2shell-vulnerability-fixes-available\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">G\u00f3i PHP \u0111\u00e3 v\u00e1 v\u00e0 h\u01b0\u1edbng d\u1eabn x\u00e1c minh b\u1ea3n ph\u00e2n ph\u1ed1i<\/a>&nbsp;<\/p>\n\n\n\n<p><strong>[8] PHP. <\/strong><a href=\"https:\/\/www.php.net\/supported-versions.php\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">V\u00f2ng \u0111\u1eddi c\u00e1c phi\u00ean b\u1ea3n \u0111\u01b0\u1ee3c h\u1ed7 tr\u1ee3<\/a>&nbsp;<\/p>\n\n\n\n<p><strong>[9] WordPress Documentation. <\/strong><a href=\"https:\/\/wordpress.org\/documentation\/article\/site-health-screen\/\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">Site Health screen<\/a>&nbsp;<\/p>\n\n\n\n<p><strong>[10] PHP Manual. <\/strong><a href=\"https:\/\/www.php.net\/manual\/en\/features.commandline.options.php\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">T\u00f9y ch\u1ecdn d\u00f2ng l\u1ec7nh PHP<\/a>&nbsp;<\/p>\n\n\n\n<p><strong>[11] PHP Manual. <\/strong><a href=\"https:\/\/www.php.net\/manual\/en\/migration80.incompatible.php\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">C\u00e1c thay \u0111\u1ed5i kh\u00f4ng t\u01b0\u01a1ng th\u00edch khi chuy\u1ec3n t\u1eeb PHP 7.4 l\u00ean PHP 8.0<\/a>&nbsp;<\/p>\n\n\n\n<p><strong>[12] The PHP Foundation. <\/strong><a href=\"https:\/\/thephp.foundation\/blog\/2026\/10\/21\/todays-php-security-release-and-how-were-strengthening-php-security\/\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">Qu\u00e1 tr\u00ecnh ph\u00e1t hi\u1ec7n v\u00e0 x\u1eed l\u00fd hai l\u1ed7 h\u1ed5ng PHP<\/a>&nbsp;<\/p>\n\n\n\n<p><strong>[13] PHP2Shell Research. <\/strong><a href=\"https:\/\/www.php2shell.com\/\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">Ph\u1ea1m vi \u1ea3nh h\u01b0\u1edfng v\u00e0 h\u01b0\u1edbng d\u1eabn c\u1eadp nh\u1eadt<\/a>&nbsp;<\/p>\n","protected":false},"excerpt":{"rendered":"<p>PHP2Shell l\u00e0 t\u00ean g\u1ecdi chung c\u1ee7a hai l\u1ed7 h\u1ed5ng nghi\u00eam tr\u1ecdng trong b\u1ed9 m\u00e1y PHP: CVE-2026-109618 v\u00e0 CVE-2026-109619. C\u1ea3 hai&#8230;<\/p>\n","protected":false},"author":15,"featured_media":18709,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1093,551],"tags":[],"class_list":["post-18705","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-phat-trien-web","category-technology-and-industry"],"acf":[],"lang":"vi","translations":{"vi":18705},"pll_sync_post":[],"_links":{"self":[{"href":"https:\/\/luvina.net\/vi\/wp-json\/wp\/v2\/posts\/18705","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/luvina.net\/vi\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/luvina.net\/vi\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/luvina.net\/vi\/wp-json\/wp\/v2\/users\/15"}],"replies":[{"embeddable":true,"href":"https:\/\/luvina.net\/vi\/wp-json\/wp\/v2\/comments?post=18705"}],"version-history":[{"count":2,"href":"https:\/\/luvina.net\/vi\/wp-json\/wp\/v2\/posts\/18705\/revisions"}],"predecessor-version":[{"id":18710,"href":"https:\/\/luvina.net\/vi\/wp-json\/wp\/v2\/posts\/18705\/revisions\/18710"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/luvina.net\/vi\/wp-json\/wp\/v2\/media\/18709"}],"wp:attachment":[{"href":"https:\/\/luvina.net\/vi\/wp-json\/wp\/v2\/media?parent=18705"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/luvina.net\/vi\/wp-json\/wp\/v2\/categories?post=18705"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/luvina.net\/vi\/wp-json\/wp\/v2\/tags?post=18705"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}