PHP2Shell CVE-2026-109619 worker spawning shell after PHP fatal memory error
Detects when a PHP or web server worker process (such as php-fpm, apache2, httpd) spawns a shell or script interpreter (such as sh, bash, python, cmd.exe), which may indicate a web shell execution, post-exploitation activity, or a successful cross-request use-after-free leading to command execution.
Microsoft Sentinel (KQL)
