PHP2Shell: From Log Indicators to Evidence-Based Investigation
Understand the PHP2Shell risk and investigate suspicious PHP activity by correlating BehaviorLens findings with web logs and endpoint telemetry.
PHP2Shell refers to two critical vulnerabilities in the way PHP handles web requests and error conditions. An attacker can use specially crafted HTTP requests to execute code on the server without a username or password. Successful exploitation puts application files, configuration and data accessible to the PHP service account at risk.
CVE-2026-109618 · CVE-2026-109619 · CVSS v4.0: 9.2 / Critical · Unauthenticated RCE risk
How can the two vulnerabilities be exploited?
| Vulnerability | How exploitation can occur |
|---|---|
| CVE-2026-109618 — OOM corruption | A specially crafted multipart/form-data request can exhaust PHP’s memory limit, for example through large numbers of form fields or headers. A flaw in request shutdown after the resulting out-of-memory (OOM) error can lead to remote code execution under suitable conditions. A path that triggers before application code runs has been confirmed in mod_php. |
| CVE-2026-109619 — Stale global state | A fatal error during one request may prevent session or error state from being reset correctly. An attacker may exploit this stale state when the same PHP worker handles a later request. Session upload progress is one path that can consume it. RCE has been confirmed in mod_php and, with suitable application behavior, PHP-FPM. |
Apache mod_php deployments are the priority: exploitation before application code runs has been confirmed. PHP-FPM, php-cgi, FrankenPHP and LiteSpeed also require assessment and patching; exploitation conditions vary by deployment model.
First patched versions and priority actions
| PHP branch | First patched version |
|---|---|
| PHP 8.5 | 8.5.12 |
| PHP 8.4 | 8.4.27 |
| PHP 8.3 | 8.3.36 |
| PHP 8.2 | 8.2.35 |
- Identify internet-facing PHP services and the PHP runtime that actually handles web requests.
- Install a package that fixes both CVEs and restart PHP processes.
- Review pre-update logs for suspicious commands and newly created files.
Vendor backports must be verified against the package revision. PHP 8.1 and earlier are no longer supported by the PHP project. Patching is the permanent fix.
Read the PHP security announcement.
Defensium BehaviorLens: detecting PHP2Shell indicators
Defensium BehaviorLens detects log indicators associated with PHP2Shell. Web access, PHP Fatal error and PHP-FPM worker crash records can be reviewed in one view with their source files and detection rules. The scan output below shows three log files and four rule matches.
The displayed rule names include a LAB prefix; this is an example scan, not evidence of a confirmed production compromise.
Defensium BehaviorLens scan results.
Which indicators did BehaviorLens detect?
| Log file | Detected indicator | Investigation focus |
|---|---|---|
| nginx-access.log | multipart/form-data / upload progress request and server-error match | Review the HTTP request, response status and upload traffic |
| apache-error.log | PHP Fatal error: Allowed memory size … exhausted (OOM) | Review the fatal error timestamp, request and PHP memory_limit context |
| php-fpm-error.log | Worker crash / unexpected child exit; two rule matches | Review the worker PID, requests preceding the crash and EDR/XDR telemetry |
BehaviorLens brings PHP2Shell indicators into view. It scans log files, identifies relevant patterns and presents each matching record with its detection rule. Security teams can see which file triggered an alert and which indicator was detected.
These matches identify records requiring review. They do not, by themselves, establish successful exploitation.
What should EDR/XDR teams look for?
Unexpected commands launched by a PHP or web server process warrant investigation. The process trees below illustrate the parent-child relationships to examine in EDR telemetry.
PHP-FPM → shell → system discovery
systemd
└─ php-fpm: master process
└─ php-fpm: pool www
└─ /bin/sh
├─ id [user discovery]
└─ uname [system discovery]
Apache mod_php → download and execution
systemd
└─ apache2 / httpd
└─ /bin/sh
├─ curl / wget [download from a remote host]
└─ sh / python3 [follow-on execution]
Windows PHP-CGI → command interpreter
services.exe
└─ web server
└─ php-cgi.exe
└─ cmd.exe / powershell.exe
└─ whoami.exe
Findings that increase alert priority
| Related observations | Analyst assessment |
|---|---|
| Shell + unexpected outbound connection | Review the command line, destination IP or domain, and execution account together. |
| Download utility + new file + execution | Verify the downloaded file’s source, hash and subsequent process tree. |
| PHP error + HTTP 5xx + process termination | Correlate timestamps and request IDs on the same host. |
Process trees illustrate investigation scenarios. Legitimate PDF or media processing may launch similar commands. The absence of a child process does not rule out compromise: PHP can perform file or network operations directly.
Example SIEM detection query
The following Splunk SPL search lists shells, interpreters and download utilities launched directly by PHP or an Apache process running PHP. EDR/XDR telemetry must be mapped to the CIM Endpoint.Processes data model.
| tstats count min(_time) as first_seen max(_time) as last_seen
from datamodel=Endpoint.Processes
where Processes.parent_process_name IN
("php-fpm*", "php-cgi", "php-cgi.exe", "php.exe", "lsphp*",
"frankenphp", "apache2", "httpd", "httpd.exe")
AND Processes.process_name IN
("sh", "bash", "dash", "zsh", "python", "python3", "perl",
"curl", "wget", "nc", "ncat", "socat", "cmd.exe",
"powershell.exe", "pwsh.exe", "certutil.exe", "bitsadmin.exe")
by Processes.dest Processes.user Processes.parent_process_name
Processes.process_name Processes.process
| rename Processes.dest as host Processes.user as user
Processes.parent_process_name as parent_process
Processes.process_name as child_process
Processes.process as command_line
| sort - last_seen
This search covers direct child processes. Apache results require confirmation that the server runs PHP. Field mappings and normal application behavior should be tested before the query is used in production.
Investigation steps after a match
- Process: validate the parent process, full command line, execution account and timestamp.
- Web request: compare access logs and PHP errors within the same time window.
- Follow-on activity: investigate outbound connections, new files and subsequent commands.
- Response: preserve evidence and initiate incident response when malicious activity is confirmed.
Correlate records using a process GUID and request ID where available. A PID alone may link unrelated events because operating systems reuse process IDs.
About Defensium
Defensium is a cybersecurity platform that brings threat hunting, detection, digital forensics and incident response together within an organization’s own environment. BehaviorLens analyzes behavioral indicators, while Atlantis supports the collection and examination of digital evidence.