PHP2Shell: what is confirmed, and what to look for in your logs

PHP2Shell comprises two critical PHP core vulnerabilities, CVE-2026-109618 and CVE-2026-109619, each rated CVSS v4.0 9.2. They can allow unauthenticated attackers to execute code with the PHP worker’s privileges or disclose sensitive process memory.

If you operate PHP-based services, prioritise patching, worker restarts and investigation of prior exposure before continuing with the technical analysis.

Actions to take

Patch and restart

Inventory PHP across web servers, containers and third-party products. Use NCSC-NL’s software inventory to help identify bundled runtimes and follow vendor guidance. Install PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, a newer release in the corresponding branch, or a vendor-confirmed patched package. Updating application code alone does not fix PHP.

Restart affected Apache, PHP-FPM and other persistent PHP processes; rebuild affected container images and replace running containers. Verify the runtime serving web requests and its complete package revision, since vendors may backport fixes without changing the upstream version. For unsupported branches, confirm vendor coverage or upgrade. Isolate exposed services that cannot be patched promptly.

Apply temporary controls

PHP’s configuration mitigations address specific attack paths and do not replace patching:

• Set session.upload_progress.enabled=0 administratively, in php.ini or with php_admin_flag in the Apache or PHP-FPM pool configuration, so that it applies before PHP parses the request. Confirm that no .htaccess file (mod_php) or .user.ini file (PHP-FPM) re-enables it. On unpatched PHP 8.5, also set fatal_error_backtraces=0. Restart every worker.
• Enforce conservative limits on decoded request size, input fields, multipart parts, headers and nesting, including requests without a usable Content-Length. Block multipart requests where unnecessary.
• Consider enforcing memory_limit=-1 administratively, ensuring no pool, directory or application restores a finite limit. Pair it with request limits and container or cgroup containment. This removes PHP’s per-request memory safeguard, increasing availability risk, while underlying allocation failures remain possible. Do not use RLIMIT_AS or RLIMIT_DATA as replacement memory limits.
• Address attacker-reachable fatal errors, execution timeouts and settings that generate startup or shutdown diagnostics. Suppressing error messages alone does not prevent exploitation.

Test changes for functionality and availability, then verify effective settings for each serving pool and virtual host. WAF rules, worker recycling and least-privilege controls provide additional protection, not complete remediation.

Patch status

As of 28 October 2026, we found no publicly confirmed bypass of the 21 October fixes for CVE-2026-109618 or CVE-2026-109619 in the sources reviewed. The separate, configuration-dependent CVE-2026-115560 is not addressed by those releases. PHP recommends keeping session.upload_progress.enabled=0 pending its fix.

Investigate prior exposure

Review retained telemetry from at least 17 October, the date of Amazon’s earliest reported exploitation attempt. Look for web workers launching shells or download tools, execution from temporary directories and unexplained web-root changes.

Wiz also highlights unusual multipart requests followed by memory errors or repeated HTTP 500 responses, abnormal PHPSESSID response cookies and unexpected worker restarts.

Correlate these investigation leads across web, proxy, PHP and endpoint logs. An absence of child processes or logged errors does not rule out exploitation or memory disclosure. Where secret exposure is suspected, contain the system and revoke or rotate affected credentials, tokens and keys.

CVEs

PHP2Shell refers to two flaws in the PHP engine. Both can be triggered while PHP handles web requests, but they affect different parts of the request lifecycle.

• CVE-2026-109618, “RCE via out-of-memory corruption”: PHP’s out-of-memory handling can interrupt a request before internal structures are fully initialised. Shutdown routines then treat that incomplete state as valid, causing memory corruption. PHP confirms RCE over HTTP against Apache mod_php with default input and memory limits.
• CVE-2026-109619, “RCE via stale global state”: PHP can retain references to freed request memory that a later request on the same worker accesses. This use-after-free can enable memory disclosure or code execution. The PHP advisory confirms session-related exploitation against mod_php and PHP-FPM, although the FPM path requires a suitable application operation.

Why it matters

PHP2Shell affects the PHP engine beneath applications such as WordPress and Drupal, so application updates alone do not fix it. PHP identifies all installations serving web requests as at risk, although exploitability depends on the version, configuration and deployment.

On 21–22 October, government, school and hospital websites across Asia, Europe and North America went offline or restricted services while patches were applied. Reported closures included Japan, Canada and several European countries, alongside school websites in Japan’s Gifu Prefecture. These were precautionary measures, not evidence of compromise.

What attackers can do with it

Successful exploitation may disclose sensitive process memory or enable code execution with the PHP worker’s privileges. Any further access depends on the worker’s permissions and the target environment.

The following describes potential consequences of exploitation, rather than a list of confirmed attacker actions.

• Persistence: Drop a web shell in the webroot, add a backdoored PHP file, or modify an existing one so access survives the patch. Persistence outside the webroot is also possible, such as cron jobs, SSH keys, or a rogue CMS admin account.
• Secret theft: Read wp-config.php, .env files, framework configs, API keys, SMTP credentials and database passwords, plus anything in the worker’s environment variables.
• Data theft: Use the stolen database credentials to dump customer records, orders and user tables.
• Memory disclosure: An unauthenticated attacker may read sensitive data from a PHP worker’s memory, including passwords, session tokens and API keys, without achieving code execution. The use-after-free in CVE-2026-109619 can enable both memory disclosure and remote code execution.
• Lateral movement: Pivot from the web server into internal networks, reach cloud metadata services for credentials, and attack neighbouring hosts or containers.
• Privilege escalation: Chain a local privilege escalation bug to move from the web user to root.
• Hitting many sites at once: On shared hosting, one vulnerable PHP install can expose many tenants. The advisories also name other runtimes beyond classic mod_php and FPM: FrankenPHP is likely susceptible, and LSAPI models FPM.

Exploitation status

Status as of 28 October 2026.

CISA added CVE-2026-109618 and CVE-2026-109619 to its Known Exploited Vulnerabilities catalog on 26 October, listing both as exploited in the wild.

Earlier, Amazon recorded an exploitation attempt on 17 October, four days before public disclosure. Subsequent evidence now goes beyond scanning and failed attempts.

Adel Karimi’s investigation documents 35 shell executions across three honeypots on 24 October. Packet and process telemetry linked multipart requests, memory disclosure through oversized PHPSESSID response cookies and Apache-launched shells. The activity was consistent with CVE-2026-109618, without establishing a separate CVE-2026-109619 path.

The honeypots ran PHP 8.4.26 under single-worker Apache mod_php, deliberately favouring exploitation. These results do not establish reliability across other deployments or the extent of production compromise. No downloaded second-stage file was observed.

Separately, Swiss public broadcaster SRF reported on 26 October that Touring Club Switzerland (TCS) confirmed customer and booking data theft involving Camping.Care, linked in reporting to the PHP vulnerabilities. Stolen reservation details were used in fraudulent WhatsApp messages, but attribution to either PHP2Shell CVE remains unverified.

Trail of Bits demonstrated shells on MediaWiki, Symfony, Laravel and phpBB, reporting working exploits against pre-patch PHP 8.2–8.5.

VulnCheck found few legitimate exploits among hundreds of public repositories, but identified a public exploit bypassing Address Space Layout Randomisation (ASLR) by 22 October, limited to a specific PHP 8.4.26 configuration. ASLR randomises memory locations to hinder exploitation. Its 26 October update expanded its own exploit coverage to selected PHP 8.2–8.5 releases under mod_php.

Reliability remains configuration-dependent: a failed public proof of concept does not establish that a deployment is safe.

ATT&CK mapping

The honeypot activity maps to two MITRE ATT&CK techniques. We did not map the potential consequences listed earlier, because none is a confirmed observation.

Detection with Guardsix SIEM

This section contains hunting queries to identify potential post-exploitation activity on PHP-serving hosts. Unusual multipart requests, HTTP 500 responses and memory errors can help identify suspicious activity, but they also occur during normal operation and may not appear in every logging configuration.

For stronger evidence of command execution, correlate web requests with PHP or web-server workers unexpectedly launching shells, downloaders or interpreters. Review the command line and process tree to distinguish suspicious execution from legitimate application behaviour. Such commands may run without writing a payload file to disk.

These hunts require process telemetry. Where web servers or containers lack EDR coverage, collect it through host or container auditing. The queries do not replace patching or establish PHP2Shell as the entry point, and an absence of matches does not rule out exploitation or memory disclosure.

Log sources required

• Linux
  • Process Creation with process and parent-process executable paths and command lines.
• Windows
  • Process Creation with Command Line Auditing.
• Windows Sysmon
  • Use our Sysmon baseline configuration.
  • Collect Process Creation (Event ID 1), including parent-process details.
• For correlation
  • Web/proxy access logs, PHP errors and available file-change and outbound-connection telemetry.

Hunting queries

Before hunting, verify the serving PHP runtime and complete package revision against the PHP security advisory or your vendor’s notice. The following command checks the command-line installation, which may differ from the web-server runtime:

php -v

Update affected installations and restart their workers. If patching is delayed, apply the temporary controls under “Actions to take” above.

Legitimate application processing, maintenance and monitoring can launch external commands. Tune matches using the complete command line and host role, and exclude activity only after verifying its purpose. The queries also match only direct children of the listed processes. Follow-on commands may run through intermediate shells, so investigate the full process tree.

Investigate PHP workers or PHP-enabled Apache launching shells, discovery commands, interpreters or download utilities. This query adapts Linux Webshell Indicators for PHP-serving hosts.

parent_process IN ["*/php-fpm*", "*/php-cgi*", "*/php", "*/lsphp*", "*/frankenphp", "*/sw-engine-fpm", "*/httpd", "*/apache2"]
"process" IN ["*/sh", "*/bash", "*/dash", "*/id", "*/whoami", "*/uname", "*/hostname", "*/python*", "*/perl", "*/curl", "*/wget"]
| chart count() by host, user, parent_process, "process", command

The Windows equivalent covers PHP and PHP-enabled Apache processes launching shells, scripting engines, discovery commands or download tools. It adapts Suspicious Process by Web Server Process, restricting it to PHP-relevant parents. Review unexpected activity under web-service accounts.

label="Process" label=Create
parent_process IN ["*\php-cgi.exe", "*\php.exe", "*\httpd.exe"]
"process" IN ["*\cmd.exe", "*\powershell.exe", "*\pwsh.exe", "*\cscript.exe", "*\wscript.exe", "*\whoami.exe", "*\hostname.exe", "*\systeminfo.exe", "*\ipconfig.exe", "*\net.exe", "*\net1.exe", "*\curl.exe", "*\wget.exe", "*\certutil.exe", "*\bitsadmin.exe"]
| chart count() by host, user, parent_process, "process", command

The next query looks for PHP-serving processes executing commands associated with credential access, account changes, registry exports or payload retrieval. Adapted from Webshell Hacking Activity Patterns, it provides investigation leads that require command-line and process-tree review.

label="Process" label=Create 
parent_process IN ["*\php-cgi.exe", "*\php.exe", "*\httpd.exe"] 
((command="*rundll32*" command="*comsvcs*") 
OR (command="* -hp*" command="* a *" command="* -m*") 
OR (command="*net*" command="* user *" command="* /add*") 
OR (command="*net*" command="* localgroup *" command="* administrators *" command="*/add*") 
OR "process" IN ["*\ntdsutil.exe", "*\ldifde.exe", "*\adfind.exe", "*\procdump.exe", "*\Nanodump.exe", "*\vssadmin.exe", "*\fsutil.exe"] 
OR command IN ["* -decode *", "* -NoP *", "* -W Hidden *", "* /decode *", "* /ticket:*", "* sekurlsa*", "*.dmp full*", "*.downloadfile(*", "*.downloadstring(*", "*FromBase64String*", "*process call create*", "*reg save *", "*whoami /priv*"]) 
| chart count() by host, user, parent_process, "process", command 

A fourth query covers discovery commands, remote-system queries and encoded or hidden PowerShell. It adapts Webshell Detection with Command Line Keywords and complements Guardsix’s broader Potential Webshell Activity Detected alert rule. It focuses on php-cgi.exe, php.exe and PHP-enabled Apache httpd.exe on Windows. Prioritise matches followed by downloads, persistence or remote access.

label="Process" label=Create
parent_process IN ["*\php-cgi.exe", "*\php.exe", "*\httpd.exe"]
(("process" IN ["*\net.exe", "*\net1.exe"] command IN ["* user *", "* use *", "* group *"])
OR ("process"="*\ping.exe" command="* -n *")
OR command IN ["*&cd&echo*", "*cd /d *"]
OR ("process"="*\wmic.exe" command="* /node:*")
OR ("process" IN ["*\cmd.exe", "*\powershell.exe", "*\pwsh.exe"] command IN ["* -enc *", "* -EncodedCommand *", "* -w hidden *", "* -windowstyle hidden*", "*.WebClient).Download*"])
OR "process" IN ["*\dsquery.exe", "*\find.exe", "*\findstr.exe", "*\ipconfig.exe", "*\netstat.exe", "*\nslookup.exe", "*\pathping.exe", "*\quser.exe", "*\schtasks.exe", "*\systeminfo.exe", "*\tasklist.exe", "*\tracert.exe", "*\vssadmin.exe", "*\wevtutil.exe", "*\whoami.exe"]
OR command IN ["* Test-NetConnection *", "*dir \*"])
| chart count() by host, user, parent_process, "process", command

Checks for Perl, Python or Wget availability may indicate preparation for payload execution or transfer. Adapted from Webshell Tool Reconnaissance Activity, this query should be reviewed against legitimate application diagnostics.

label="Process" label=Create
parent_process IN ["*\php-cgi.exe", "*\php.exe", "*\httpd.exe"]
command IN ["*perl --help*", "*perl -h*", "*python --help*", "*python -h*", "*python3 --help*", "*python3 -h*", "*wget --help*"]
| chart count() by host, user, parent_process, "process", command

Run these hunts on confirmed PHP-serving hosts. For matches, inspect the full process tree, including intermediate shells, and correlate web requests, PHP errors, file changes and outbound connections. Multiple hunts may match the same execution chain.

Conclusion

PHP2Shell requires both remediation and investigation. Patch every affected PHP runtime, restart its workers and review previously exposed systems for suspicious activity. Temporary controls reduce specific attack paths but do not replace the fixes.

Use the Guardsix hunting queries to investigate potential post-exploitation activity alongside web, PHP and endpoint telemetry. A clean process search does not rule out memory disclosure; where secret exposure is suspected, revoke or rotate affected credentials. Setup guidance for the log sources above is in the Guardsix documentation.