PHP2Shell: detections available now
Written by Tim Peck · Director of Threat Research
The vulnerability
PHP2Shell is two critical bugs in the PHP runtime, both CVSS v4.0 9.2. Wiz Research reported them to PHP on 24 August with Calif and OpenAI. Details leaked on 20 October and PHP released fixes on 21 October at 14:00 UTC: 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Every release back to PHP 5.4 carries at least one bug, and 8.1 and older get no official fix. All web SAPIs are affected (PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, LiteSpeed). The bugs sit below the application, so a WordPress or Drupal site with clean code is still exposed. Restart PHP workers after updating.
Exploit chain
When PHP runs out of memory it aborts the request with a longjmp "bailout". If that happens after PHP has stored a pointer and before cleanup, the pointer outlives its memory, and the next request on the same worker can reach it.
- A request sized to exceed memory_limit during start-up, usually a multipart/form-data body using session upload progress (on by default). Datadog also shows a form-urlencoded variant with a 3.5 MB field name.
- The bailout leaves stale state: an unserializer pointer and the session id PS(id) (CVE-2026-109618), or a fatal-error backtrace and OPcache slot (CVE-2026-109619).
- A second request copies the reused heap into the PHPSESSID response cookie. Sansec notes this leaks passwords, tokens and keys from other requests, and it defeats ASLR.
- The attacker grooms the heap so cleanup calls a forged destructor pointing to system(), running commands as the web worker user.
Wiz showed unauthenticated RCE on stock WordPress, Drupal and Joomla images. Sansec found the public exploits mostly need a local file inclusion bug as well. Datadog's refined exploit returned HTTP 200 without crashing the worker. Cloudflare saw attacks at 07:43 UTC on 21 October, before the patch (reported by Sansec), and Datadog cites AWS seeing attempts from 17 October.
Detections you can use
Seven public rules cover exposure, the trigger, the crash or leak, and post-exploitation. Log in and search php2shell on detections.ai, or open the PHP2Shell Threat Report.
PHP Versions Below the Fixes for CVE-2026-109618 and CVE-2026-109619 (PHP2Shell)
KQL · Exposure
Defender vulnerability inventory below each branch's fixed release, plus end-of-life branches, with internet-facing status.
Tuning: Distro packages that backport the fix keep the old version number, so check the changelog before closing a finding.
https://detections.ai/detections/01a15f30-a794-7672-93d1-11651d1600be
Inventory PHP Version Detection (CVE-2026-109618 / CVE-2026-109619)
CQL · Exposure
Falcon process events for PHP binaries, including lsphp and frankenphp, labelled EOL, needs fix or unknown branch.
https://detections.ai/detections/01a15ef9-eff1-7375-8912-5f42f09073b3
PHP CVE-2026-109618/9 multipart PHP_SESSION_UPLOAD_PROGRESS upload attempt
Suricata · Trigger
Three or more multipart POSTs carrying PHP_SESSION_UPLOAD_PROGRESS from one source within 120 seconds.
Tuning: Needs decrypted traffic and full body inspection. It does not cover the form-urlencoded variant.
https://detections.ai/detections/01a15fb6-6a59-711f-9f51-5a526775df75
PHP CVE-2026-109618/109619 arm - pre-RINIT OOM bailout
Sigma · Trigger
The PHP fatal error Allowed memory size … exhausted … in Unknown on line 0, meaning memory ran out before request start-up finished. Datadog lists the same line as its log indicator.
Tuning: Large legitimate uploads also match, so correlate by source IP. Map the PHP error log with a processing pipeline.
https://detections.ai/detections/01a15fb5-e43d-7565-920a-e57bb7eacbcb
PHP CVE-2026-109618 malformed PHPSESSID Set-Cookie memory disclosure
Suricata · Leak
Outbound Set-Cookie: PHPSESSID= values that are not 32 hex characters, which is how leaked heap bytes leave the server.
Tuning: The php.ini-production template uses 26-character session ids. Adjust the pattern to your configuration before enabling it.
https://detections.ai/detections/01a15fb6-8e1a-76f9-a237-39bfb60bbcac
PHP-FPM worker SIGSEGV after arm-shaped request
Sigma · Crash
The FPM master logging exited on signal 11 (SIGSEGV) after a failed address guess.
Tuning: A successful exploit may not crash anything. Use it to catch attempts, not as proof of compromise.
https://detections.ai/detections/01a15fb6-39eb-7769-8abc-ecf5312aa36b
Potential PHP2Shell Exploitation via Suspicious Web Server Child Processes
KQL · Post-exploitation
PHP, FastCGI, Apache and IIS workers starting shells, download tools or recon commands, with flags for reverse-shell and encoded command lines. Includes references and false-positive notes.
https://detections.ai/detections/01a15f13-f7a8-7265-ab55-a7912922b09e
No public rule exists yet in SPL, YARA-L, S1QL or XQL. Translate any rule into those languages from its detection page.
If the indicators change
Payload sizes and field names will change. Keep watching for out-of-memory fatal errors during request start-up on internet-facing routes (PHP or FPM error log, with log_errors on), and for response session cookies that don't match your id format. The most durable signal is a web worker starting a shell: Datadog's lab tree was apache2 (www-data) → sh -c → bash with an outbound connection, and EDR sees it whether or not anything crashed. KQL rules listed below also cover web workers writing .php files to the web root and querying the cloud metadata service. Make sure your WAF inspects large bodies, since a truncated body can't match the trigger.
From leak to rules
- 20 Oct: details leak two days before the planned disclosure.
- 21 Oct, 07:43 UTC: Cloudflare sees early attacks.
- 21 Oct, 08:03 UTC: first public rule on detections.ai, a KQL exposure hunt.
- 21 Oct, 13:30 UTC: first public Threat Report on detections.ai.
- 21 Oct, 14:00 UTC: PHP releases fixes.
- 21 Oct, 18:26 UTC: 11 rules in four languages.
- 22 Oct, 09:37 UTC: 20 rules, the last nine covering post-exploitation.
The most-used spelling was php2shell (50 people on 21 October), then cve-2026-109618 (36). Since 21 October, 1,147 people viewed, 931 copied and 72 translated at least one of the 20 rules. PHP2Shell has its own new CVE ids, and rules for older PHP flaws such as CVE-2024-4577 do not detect it.
More public rules
The other 13 public rules, from exposure checks to post-exploitation hunts. Most are KQL for Microsoft Defender XDR and Sentinel.
Threat Hunting KQL – PHP RCE (CVE-2026-109618 & CVE-2026-109619)
KQL · Exposure
Lists internet-facing devices where a process signed by The PHP Group ran in the last 30 days. A quick exposure inventory for Defender for Endpoint.
https://detections.ai/detections/01a15d7c-9406-76fd-8e1d-00494e3f435f
PHP Code Execution and Post-Exploitation on Internet-Facing Hosts (php2shell)
KQL · Post-exploitation
A broad Defender hunt for PHP and mod_php workers on internet-facing hosts that start shells, interpreters or download tools, compared against a 30-day baseline. Maps to T1190, T1059, T1505.003 and T1105.
https://detections.ai/detections/01a15e0a-59df-72d6-bc79-c9d9734e203b
PHP2Shell CVE-2026-109618/109619 PHP installed and active exposure
KQL · Exposure
Joins installed PHP packages from Defender and Azure inventory with PHP processes that actually ran in the last 14 days. It separates hosts that have PHP installed from hosts serving requests with it.
https://detections.ai/detections/01a15ed7-25d1-7218-bcb7-e7eb8bf379b2
PHP CVE-2026-109618/109619 session decode failure after arm
Sigma · Trigger
Matches the PHP error Failed to decode session object, which can follow the out-of-memory request in the exploit chain. Correlate with multipart POSTs to rule out ordinary session storage corruption.
https://detections.ai/detections/01a15fb6-0e0a-7468-854f-cf7e7b8620d8
High-Fidelity php2shell KQL Detection
KQL · Post-exploitation
Alerts when a PHP, Apache, nginx or IIS process starts a shell on an internet-facing host that Defender lists as vulnerable to either CVE. Limiting it to vulnerable, exposed hosts keeps the alert volume low.
https://detections.ai/detections/01a1625e-4b01-73b4-ad3e-78b6a1e1bdbf
PHP2Shell multipart upload-progress exploitation via CommonSecurityLog
KQL · Trigger
Searches WAF and proxy logs in Sentinel's CommonSecurityLog for multipart POSTs that reference session upload progress, then scores any crash or memory-exhaustion messages that follow. A 5xx response on its own never alerts.
https://detections.ai/detections/01a162d2-0bcb-7462-b0fd-c5eaa3d3108e
Recon Commands Spawned Directly by PHP or Web Server Worker (php2shell)
KQL · Post-exploitation
Flags whoami, id, uname -a and ipconfig run by a PHP or web server worker, directly or through a shell. These are usually the first commands an attacker runs after gaining execution.
https://detections.ai/detections/01a162f7-5838-72a4-9ab2-8b1cc6db46db
Vulnerable PHP Versions Exposed to PHP2Shell (CVE-2026-109618/109619)
KQL · Exposure
Lists Defender inventory entries on end-of-life branches (5.x to 8.1) or below the fixed release on 8.2 to 8.5. Inventory can't show whether session upload progress is enabled, so confirm that on flagged hosts.
https://detections.ai/detections/01a162f7-85c5-76b0-8745-e81b384eca78
PHP/web server worker spawning shell or interpreter child (php2shell post-exploitation)
KQL · Post-exploitation
Flags PHP and web server workers starting shells, interpreters, transfer tools or recon commands, and marks reverse-shell strings such as /dev/tcp, fsockopen and mkfifo.
https://detections.ai/detections/01a162f7-b4e7-7761-9883-01330e3bb4ae
PHP/web server worker persistence: webshell drop, cron, scheduled task or new account
KQL · Persistence
Looks for a PHP or web server worker writing script files into web root folders, or running crontab, schtasks, useradd or net user. These are the usual ways an attacker keeps access after exploitation.
https://detections.ai/detections/01a162f8-758f-70ef-9890-623949857049
Reverse shell command lines spawned by PHP or web server worker process
KQL · Post-exploitation
Matches reverse-shell constructs (/dev/tcp, fsockopen, mkfifo, or netcat with -e or -c) in commands whose parent or grandparent is a PHP or web server worker.
https://detections.ai/detections/01a162f8-a66c-730c-8a69-7770bbbfd363
Web server process accessing cloud instance metadata credentials
KQL · Credential access
Flags a web worker starting a shell or tool that contacts the cloud instance metadata service (169.254.169.254) or reads stored cloud credentials. This is how code execution on a cloud host becomes access to the cloud account.
https://detections.ai/detections/01a162f8-d59f-70ac-9acd-aa833f313117
PHP/web server worker spawning shell, interpreter or download tool (php2shell)
KQL · Post-exploitation
A short Defender query for shells, interpreters, curl, wget, netcat or certutil started by a PHP or web server worker in the last day. A simple starting point if the longer post-exploitation rules are too broad.
https://detections.ai/detections/01a162f9-2f34-7598-896a-df88dbbf9264
Sources and method
Rules: published rules in detections.ai community groups that name PHP2Shell or either CVE id, or link the Threat Report. Demand and copies: distinct people in product analytics from 21 October, staff excluded.
