CVE-2026-109618 & CVE-2026-109619: PHP2Shell Exploitation — Detection and Remediation Guide

---
title: PHP2Shell Exploitation — Suspicious PHP Process Spawning Shell
id: 550d9a23-0f72-4e3a-a8c5-1d2f3b4c5d6e
status: experimental
description: Detects PHP CGI/FPM processes spawning command shells or script interpreters, indicative of PHP2Shell exploitation.
references:
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1059.003
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
      - '\php-cgi.exe'
      - '\php.exe'
      - '\php-fpm.exe'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\sh.exe'
      - '\bash.exe'
  condition: selection
falsepositives:
  - Legitimate PHP applications that invoke system commands (rare)
level: high
---
title: PHP2Shell Exploitation — Malicious Content-Type Header
id: 7a3f1c82-9e4b-4d67-bc12-3e5a8f901234
status: experimental
description: Detects HTTP requests with malformed or suspicious Content-Type headers targeting PHP endpoints, consistent with CVE-2026-109618 exploitation.
references:
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: webserver
detection:
  selection:
    cs-method: 'POST'
    cs-uri|contains:
      - '.php'
    cs-content-type|contains:
      - 'multipart/form-data; boundary='
      - 'application/x-www-form-urlencoded'
    cs-content-type|contains:
      - '%00'
      - '%0a'
      - '%0d'
      - '../'
      - '..\\'
  condition: selection
falsepositives:
  - None expected for malformed headers with encoding or traversal sequences
level: high
---
title: PHP2Shell Exploitation — Web Shell Creation in Web Root
id: 3b8f2a91-4c5d-4e6f-8a9b-0c1d2e3f4a5b
status: experimental
description: Detects creation of PHP files in web server directories by non-web-server processes, indicative of web shell deployment following PHP2Shell exploitation.
references:
  - https://attack.mitre.org/techniques/T1505.003/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.persistence
  - attack.t1505.003
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|endswith:
      - '.php'
    TargetFilename|contains:
      - '\wwwroot\'
      - '\htdocs\'
      - '\httpdocs\'
      - '\public_html\'
      - '\var\www\'
      - '\srv\www\'
  filter:
    Image|endswith:
      - '\php-cgi.exe'
      - '\php.exe'
      - '\php-fpm.exe'
      - '\w3wp.exe'
      - '\httpd.exe'
      - '\nginx.exe'
  condition: selection and not filter
falsepositives:
  - Legitimate file uploads via web applications (tune with specific paths)
level: high

// Hunt for PHP2Shell exploitation: PHP processes spawning shells
DeviceProcessEvents
| where InitiatingProcessFileName in~ ("php-cgi.exe", "php.exe", "php-fpm", "php")
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "sh", "bash", "dash", "zsh")
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, AccountName
| order by Timestamp desc

// Hunt for suspicious HTTP requests with malformed Content-Type headers (via WAF/Proxy logs ingested into CommonSecurityLog)
CommonSecurityLog
| where RequestMethod == "POST"
| where RequestURL contains ".php"
| where RequestContext contains "multipart/form-data"
| where RequestContext contains "%00" or RequestContext contains "%0a" or RequestContext contains "%0d" or RequestContext contains "../"
| project TimeGenerated, SourceIP, RequestURL, RequestMethod, RequestContext
| order by TimeGenerated desc

// Hunt for PHP files created in web directories by non-standard processes
DeviceFileEvents
| where FileName endswith ".php"
| where FolderPath has_any ("wwwroot", "htdocs", "httpdocs", "public_html", "var/www", "srv/www")
| where InitiatingProcessFileName !in~ ("php-cgi.exe", "php.exe", "php-fpm", "w3wp.exe", "httpd", "nginx", "apache2")
| project Timestamp, DeviceName, FileName, FolderPath, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by Timestamp desc

-- Hunt for PHP processes spawning shells
SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE (Name =~ 'php' OR Exe =~ 'php')
   AND (CommandLine =~ 'cmd.exe' OR CommandLine =~ 'powershell' OR CommandLine =~ '/bin/sh' OR CommandLine =~ '/bin/bash')

-- Hunt for recently created PHP files in web directories
SELECT FullPath, Size, Mtime, Ctime
FROM glob(globs=['C:/inetpub/wwwroot/**/*.php', 'C:/xampp/htdocs/**/*.php', '/var/www/**/*.php', '/srv/www/**/*.php'])
WHERE Mtime > now() - 86400
ORDER BY Mtime DESC

-- Hunt for network connections from PHP processes
SELECT Pid, Name, RemoteAddress, RemotePort, Status
FROM netstat()
WHERE Name =~ 'php'
   AND Status == 'ESTABLISHED'
   AND RemoteAddress !~ '127.0.0.1'

#!/bin/bash
# PHP2Shell (CVE-2026-109618 / CVE-2026-109619) Remediation Script
# Run as root on Linux systems

set -e

PHP_VERSION=$(php -v | head -n 1 | cut -d ' ' -f 2 | cut -d '-' -f 1)
MAJOR=$(echo $PHP_VERSION | cut -d '.' -f 1)
MINOR=$(echo $PHP_VERSION | cut -d '.' -f 2)
PATCH=$(echo $PHP_VERSION | cut -d '.' -f 3)

VULNERABLE=0

# Check if PHP version is vulnerable
if [ "$MAJOR" -eq 8 ]; then
    if [ "$MINOR" -eq 1 ] && [ "$PATCH" -lt 35 ]; then
        VULNERABLE=1
    elif [ "$MINOR" -eq 2 ] && [ "$PATCH" -lt 25 ]; then
        VULNERABLE=1
    elif [ "$MINOR" -eq 3 ] && [ "$PATCH" -lt 15 ]; then
        VULNERABLE=1
    fi
fi

if [ $VULNERABLE -eq 1 ]; then
    echo "[!] VULNERABLE: PHP $PHP_VERSION is affected by CVE-2026-109618 and CVE-2026-109619"
    echo "[!] Updating PHP to the latest patched version..."

    # Detect package manager and update PHP
    if command -v apt-get &> /dev/null; then
        apt-get update
        apt-get install -y --only-upgrade php php-cli php-fpm php-cgi
    elif command -v yum &> /dev/null; then
        yum update -y php php-cli php-fpm php-cgi
    elif command -v dnf &> /dev/null; then
        dnf upgrade -y php php-cli php-fpm php-cgi
    elif command -v zypper &> /dev/null; then
        zypper update -y php8 php8-cli php8-fpm php8-cgi
    else
        echo "[!] Unsupported package manager. Please update PHP manually."
        exit 1
    fi

    # Restart PHP-FPM if present
    if systemctl is-active --quiet php-fpm; then
        systemctl restart php-fpm
        echo "[+] php-fpm restarted"
    fi

    # Restart web server
    if systemctl is-active --quiet apache2; then
        systemctl restart apache2
        echo "[+] Apache restarted"
    elif systemctl is-active --quiet nginx; then
        systemctl restart nginx
        echo "[+] Nginx restarted"
    fi

    # Verify patched version
    NEW_VERSION=$(php -v | head -n 1 | cut -d ' ' -f 2 | cut -d '-' -f 1)
    echo "[+] PHP updated to $NEW_VERSION"
else
    echo "[+] PHP $PHP_VERSION is not vulnerable to CVE-2026-109618 or CVE-2026-109619"
fi

# Hardening: Disable PHP CGI if not required
if [ -f /etc/php/*/cgi/php.ini ]; then
    sed -i 's/^;*cgi.force_redirect.*/cgi.force_redirect = 1/' /etc/php/*/cgi/php.ini
    sed -i 's/^;*cgi.fix_pathinfo.*/cgi.fix_pathinfo = 0/' /etc/php/*/cgi/php.ini
    echo "[+] PHP CGI hardening applied"
fi

if [ -f /etc/php/*/fpm/php.ini ]; then
    sed -i 's/^;*cgi.fix_pathinfo.*/cgi.fix_pathinfo = 0/' /etc/php/*/fpm/php.ini
    echo "[+] PHP-FPM hardening applied"
fi

echo "[+] Remediation complete. Review logs for signs of compromise."