CVE-2026-109618 & CVE-2026-109619: PHP2Shell Exploitation Hits Government — Detection and Remediation Guide

---
title: Web Server Process Spawning Suspicious Shell
description: Detects PHP web server processes (Apache, Nginx, IIS) spawning command shells or scripting interpreters, indicative of PHP2Shell RCE exploitation.
references:
  - https://attack.mitre.org/techniques/T1059/
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/10/18
status: experimental
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/apache2'
      - '/nginx'
      - '/php-fpm'
  selection_child:
    Image|endswith:
      - '/bash'
      - '/sh'
      - '/dash'
      - '/zsh'
      - '/python'
      - '/python3'
      - '/perl'
      - '/nc'
      - '/netcat'
      - '/wget'
      - '/curl'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate administrative scripts executed via cron or systemd
  - PHP applications that legitimately invoke system commands (rare in production)
level: high
---
title: Webshell File Creation in Web Root
description: Detects creation of PHP files in web-accessible directories by non-standard processes, consistent with webshell deployment after exploitation.
references:
  - https://attack.mitre.org/techniques/T1505.003/
author: Security Arsenal
date: 2026/10/18
status: experimental
logsource:
  category: file_event
  product: linux
detection:
  selection_path:
    TargetFilename|startswith:
      - '/var/www/'
      - '/usr/share/nginx/'
      - '/opt/lampp/htdocs/'
      - '/home/*/public_html/'
  selection_extension:
    TargetFilename|endswith:
      - '.php'
      - '.phtml'
      - '.php3'
      - '.php4'
      - '.php5'
      - '.php7'
      - '.phar'
  filter_legitimate:
    Image|endswith:
      - '/composer'
      - '/git'
      - '/rsync'
  condition: selection_path and selection_extension and not filter_legitimate
falsepositives:
  - Legitimate deployments via CI/CD pipelines (tune to your deployment tools)
  - Content management system updates (WordPress, Drupal core updates)
level: high
---
title: Rapid Credential Access After Web Server Compromise
description: Detects access to sensitive credential files (/etc/shadow, application config files) by web server processes, indicative of post-exploitation credential harvesting.
references:
  - https://attack.mitre.org/techniques/T1003/
  - https://attack.mitre.org/techniques/T1552/
author: Security Arsenal
date: 2026/10/18
status: experimental
logsource:
  category: file_event
  product: linux
detection:
  selection_process:
    Image|endswith:
      - '/apache2'
      - '/nginx'
      - '/php-fpm'
      - '/php'
  selection_target:
    TargetFilename|contains:
      - '/etc/shadow'
      - '/etc/passwd'
      - '/.env'
      - '/config.php'
      - '/wp-config.php'
      - '/settings.php'
      - '/database.php'
      - '/.aws/credentials'
      - '/.ssh/'
  condition: selection_process and selection_target
falsepositives:
  - Legitimate PHP applications reading their own config files (baseline and whitelist known application paths)
  - Backup scripts running under web server context (rare, should use dedicated service account)
level: critical

// Hunt for web server processes spawning suspicious child processes (Linux)
// Requires Sysmon for Linux or AuditD forwarded to Sentinel
let suspiciousParents = dynamic(["apache2", "nginx", "php-fpm", "httpd"]);
let suspiciousChildren = dynamic(["bash", "sh", "python", "python3", "perl", "nc", "wget", "curl", "netcat"]);
Syslog
| where TimeGenerated > ago(7d)
| where Facility == "user" or Facility == "daemon"
| where SyslogMessage has_any (suspiciousParents) and SyslogMessage has_any (suspiciousChildren)
| extend ParentProcess = extract(@"(\w+)\[\d+\]", 1, SyslogMessage)
| extend ChildCommand = extract(@"execve\(\"/([\w/]+)\"", 1, SyslogMessage)
| where ParentProcess in~ (suspiciousParents) and ChildCommand in~ (suspiciousChildren)
| project TimeGenerated, Computer, ParentProcess, ChildCommand, SyslogMessage
| order by TimeGenerated desc;

// Hunt for PHP file writes to web root directories (Linux via Sysmon FileCreate)
Syslog
| where TimeGenerated > ago(7d)
| where SyslogMessage contains "FileCreate" or SyslogMessage contains "open"
| where SyslogMessage has_any ("/var/www/", "/usr/share/nginx/", "/opt/lampp/htdocs/")
| where SyslogMessage has_any (".php", ".phtml", ".phar")
| where SyslogMessage !has_any ("composer", "git", "rsync", "scp")
| extend FilePath = extract(@"(/[\w/\.]+\.php[htmalr37]*)", 1, SyslogMessage)
| extend ProcessName = extract(@"(\w+)\[\d+\]", 1, SyslogMessage)
| project TimeGenerated, Computer, ProcessName, FilePath, SyslogMessage
| order by TimeGenerated desc;

// Hunt for suspicious network connections from web server processes (potential C2)
// Requires Sysmon NetworkConnect or firewall logs
CommonSecurityLog
| where TimeGenerated > ago(7d)
| where DeviceProduct =~ "Sysmon" or DeviceProduct =~ "AuditD"
| where SourceProcessName in~ ("apache2", "nginx", "php-fpm", "php")
| where DestinationIP !startswith "10." and DestinationIP !startswith "172.16." and DestinationIP !startswith "192.168."
| where DestinationPort in (80, 443, 8080, 4444, 5555, 6666, 7777)
| summarize ConnectionCount = count() by SourceIP, SourceProcessName, DestinationIP, DestinationPort, Computer
| where ConnectionCount > 5
| order by ConnectionCount desc;

// Hunt for IIS worker process spawning command shells (Windows PHP via FastCGI)
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName =~ "w3wp.exe"
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, AccountName
| order by TimeGenerated desc;

// Hunt for credential file access by web server processes (Linux)
Syslog
| where TimeGenerated > ago(7d)
| where SyslogMessage has_any ("/etc/shadow", "/etc/passwd", "/.env", "wp-config.php", "/.aws/credentials")
| where SyslogMessage has_any ("apache2", "nginx", "php-fpm", "php")
| where SyslogMessage has_any ("open", "read", "access")
| extend AccessedFile = extract(@"(/[\w/\.\-]+)", 1, SyslogMessage)
| extend AccessingProcess = extract(@"(\w+)\[\d+\]", 1, SyslogMessage)
| project TimeGenerated, Computer, AccessingProcess, AccessedFile, SyslogMessage
| order by TimeGenerated desc;

-- Hunt for suspicious PHP files in web directories modified in the last 7 days
SELECT 
    FullPath,
    Size,
    Mtime,
    Ctime,
    Mode,
    hash(path=FullPath) AS FileHash
FROM glob(globs=['/var/www/**/*.php', '/usr/share/nginx/**/*.php', '/opt/lampp/htdocs/**/*.php'])
WHERE Mtime > (now() - 604800)
ORDER BY Mtime DESC

-- Hunt for web server processes with suspicious network connections (Linux)
SELECT 
    Pid,
    Name,
    CommandLine,
    Exe,
    Username,
    CreateTime,
    netstat().RemoteIP,
    netstat().RemotePort,
    netstat().State
FROM pslist()
WHERE Name =~ 'apache2|nginx|php-fpm|php'
  AND netstat().RemoteIP !~ '^(10\.|172\.16\.|192\.168\.|127\.)'
  AND netstat().RemotePort IN (80, 443, 8080, 4444, 5555)
ORDER BY CreateTime DESC

-- Hunt for cron jobs or systemd timers created by web server user (persistence)
SELECT 
    FullPath,
    Mtime,
    read_file(filename=FullPath) AS Content
FROM glob(globs=['/etc/cron.d/*', '/var/spool/cron/crontabs/www-data', '/etc/systemd/system/*.service', '/etc/systemd/system/*.timer'])
WHERE Mtime > (now() - 604800)
  AND Content =~ 'www-data|apache|nginx'
ORDER BY Mtime DESC

-- Hunt for recently modified files in /tmp or /dev/shm (common webshell staging areas)
SELECT 
    FullPath,
    Size,
    Mtime,
    Ctime,
    Mode
FROM glob(globs=['/tmp/*.php', '/dev/shm/*.php', '/var/tmp/*.php'])
WHERE Mtime > (now() - 86400)
ORDER BY Mtime DESC

#!/bin/bash
# PHP2Shell Emergency Response Script - Linux
# Detects webshells, checks for compromise indicators, and applies hardening

set -euo pipefail

LOG_FILE="/var/log/php2shell_response_$(date +%Y%m%d_%H%M%S).log"
ALERT_FILE="/tmp/php2shell_alerts.txt"

echo "=== PHP2Shell Emergency Response Script ===" | tee -a "$LOG_FILE"
echo "Started: $(date)" | tee -a "$LOG_FILE"

# Function to log alerts
log_alert() {
    echo "[ALERT] $1" | tee -a "$LOG_FILE" "$ALERT_FILE"
}

# 1. Check for recently modified PHP files in web directories
echo "\n[1] Checking for recently modified PHP files..." | tee -a "$LOG_FILE"
find /var/www /usr/share/nginx /opt/lampp/htdocs -name "*.php" -mtime -7 -type f 2>/dev/null | while read -r file; do
    log_alert "Recently modified PHP file: $file"
    # Check for common webshell signatures
    if grep -qE "(eval\(|assert\(|base64_decode\(|gzinflate\(|str_rot13\(|system\(|exec\(|shell_exec\(|passthru\(|popen\(|proc_open\()" "$file"; then
        log_alert "SUSPICIOUS CONTENT in $file - possible webshell"
    fi
done

# 2. Check for PHP files in /tmp and /dev/shm
echo "\n[2] Checking for PHP files in temporary directories..." | tee -a "$LOG_FILE"
for dir in /tmp /dev/shm /var/tmp; do
    if [ -d "$dir" ]; then
        find "$dir" -name "*.php" -type f 2>/dev/null | while read -r file; do
            log_alert "PHP file in temp directory: $file"
        done
    fi
done

# 3. Check for web server processes with outbound connections
echo "\n[3] Checking for web server processes with suspicious network connections..." | tee -a "$LOG_FILE"
for pid in $(pgrep -f "apache2|nginx|php-fpm"); do
    if [ -d "/proc/$pid" ]; then
        connections=$(ss -tnp 2>/dev/null | grep "pid=$pid" | grep -vE "127\.0\.0\.1|::1" || true)
        if [ -n "$connections" ]; then
            log_alert "Web server PID $pid has outbound connections: $connections"
        fi
    fi
done

# 4. Check for unauthorized cron jobs
echo "\n[4] Checking for unauthorized cron jobs..." | tee -a "$LOG_FILE"
if [ -f "/var/spool/cron/crontabs/www-data" ]; then
    log_alert "Cron job exists for www-data user"
    cat /var/spool/cron/crontabs/www-data | tee -a "$LOG_FILE"
fi
find /etc/cron.d -type f -mtime -7 2>/dev/null | while read -r file; do
    log_alert "Recently modified cron file: $file"
done

# 5. Check for unauthorized SSH keys
echo "\n[5] Checking for unauthorized SSH keys..." | tee -a "$LOG_FILE"
for user_home in /home/* /root; do
    if [ -f "$user_home/.ssh/authorized_keys" ]; then
        recent_keys=$(find "$user_home/.ssh/authorized_keys" -mtime -7 2>/dev/null || true)
        if [ -n "$recent_keys" ]; then
            log_alert "Recently modified SSH authorized_keys: $user_home/.ssh/authorized_keys"
        fi
    fi
done

# 6. Check PHP version and recommend update
echo "\n[6] Checking PHP version..." | tee -a "$LOG_FILE"
if command -v php &> /dev/null; then
    php_version=$(php -v | head -n1)
    echo "Current PHP version: $php_version" | tee -a "$LOG_FILE"
    echo "ACTION REQUIRED: Check for vendor security updates for CVE-2026-109618 and CVE-2026-109619" | tee -a "$LOG_FILE"
    echo "  - Debian/Ubuntu: sudo apt update && sudo apt upgrade php*" | tee -a "$LOG_FILE"
    echo "  - RHEL/CentOS: sudo yum update php*" | tee -a "$LOG_FILE"
else
    echo "PHP not found on this system" | tee -a "$LOG_FILE"
fi

# 7. Hardening recommendations
echo "\n[7] Hardening Recommendations:" | tee -a "$LOG_FILE"
echo "  - Disable dangerous PHP functions in php.ini: disable_functions = exec,passthru,shell_exec,system,proc_open,popen,curl_exec,curl_multi_exec,parse_ini_file,show_source" | tee -a "$LOG_FILE"
echo "  - Enable PHP open_basedir restriction to web root only" | tee -a "$LOG_FILE"
echo "  - Implement Web Application Firewall (WAF) rules to block PHP2Shell exploitation attempts" | tee -a "$LOG_FILE"
echo "  - Enable detailed PHP error logging and monitor for exploitation attempts" | tee -a "$LOG_FILE"
echo "  - Segment web servers from internal networks and credential stores" | tee -a "$LOG_FILE"

# 8. Summary
echo "\n=== Response Summary ===" | tee -a "$LOG_FILE"
if [ -f "$ALERT_FILE" ]; then
    alert_count=$(wc -l < "$ALERT_FILE")
    echo "Total alerts generated: $alert_count" | tee -a "$LOG_FILE"
    echo "Review alerts in: $ALERT_FILE" | tee -a "$LOG_FILE"
else
    echo "No alerts generated. System appears clean based on current checks." | tee -a "$LOG_FILE"
fi

echo "\nCompleted: $(date)" | tee -a "$LOG_FILE"
echo "Full log: $LOG_FILE"

if [ -f "$ALERT_FILE" ]; then
    echo "\n*** ALERTS DETECTED - IMMEDIATE INVESTIGATION REQUIRED ***"
    exit 1
else
    exit 0
fi

   - Enable `open_basedir` to restrict PHP to only the web root directory.
   - Disable remote file inclusion: `allow_url_include = Off`
   - Set `expose_php = Off` to reduce information disclosure.

7. **Web Application Firewall (WAF)**
   - Deploy or update WAF rules to detect PHP2Shell exploitation patterns:
     - Block requests with suspicious PHP code in parameters (e.g., `<?php`, `eval(`, `base64_decode(`)
     - Rate-limit requests to PHP endpoints
     - Implement virtual patching rules for CVE-2026-109618 and CVE-2026-109619 (check with your WAF vendor: Cloudflare, AWS WAF, ModSecurity, etc.)

8. **Network Segmentation**
   - Ensure web servers cannot directly access:
     - Internal Active Directory or LDAP servers
     - Databases containing credentials or MFA secrets (use jump hosts or API gateways)
     - Backup systems
     - Other web servers (prevent lateral movement)
   - Implement egress filtering: web servers should only be allowed to make outbound connections on ports 80/443 to approved destinations.

9. **Monitoring and Alerting**
   - Enable Sysmon for Linux or AuditD on all web servers and forward logs to your SIEM.
   - Create high-priority alerts for:
     - Web server processes spawning shells or scripting interpreters
     - PHP file writes to web directories outside of deployment windows
     - Web server processes accessing `/etc/shadow`, config files, or credential stores
     - Outbound network connections from web servers to non-standard ports or geographies

10. **Incident Response Readiness**
    - Update IR playbooks to account for **AI-accelerated post-exploitation**. Traditional 24-48 hour response timelines are obsolete.
    - Implement automated response actions:
      - Auto-isolate hosts when webshells are detected
      - Auto-block IPs attempting PHP2Shell exploitation
      - Auto-rotate credentials when compromise is suspected
    - Conduct tabletop exercises simulating a two-hour compromise scenario.

### Long-Term Strategic Actions (Next 30 Days)

11. **Application Security Review**
    - Conduct a security review of all PHP applications, focusing on:
      - Input validation and sanitization
      - Use of prepared statements for database queries
      - Secure session management
      - Proper error handling (avoid exposing stack traces or sensitive data)
    - Consider migrating legacy PHP applications to modern frameworks with built-in security controls (Laravel, Symfony) or alternative languages.

12. **Zero Trust Architecture**
    - Implement zero-trust principles: assume your web servers are compromised and design controls accordingly.
    - Use short-lived, dynamically generated credentials instead of static passwords or API keys.
    - Implement mutual TLS (mTLS) for service-to-service communication.
    - Deploy Privileged Access Management (PAM) solutions to control and monitor access to sensitive systems.

13. **Threat Intelligence Integration**
    - Subscribe to threat intelligence feeds that track PHP2Shell exploitation indicators (IPs, domains, file hashes).
    - Integrate indicators into your firewall, WAF, and EDR platforms for automated blocking.
    - Monitor CISA KEV for the addition of CVE-2026-109618 and CVE-2026-109619: [https://www.cisa.gov/known-exploited-vulnerabilities-catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)

14. **AI-Assisted Defense**
    - The attackers are using agentic AI for offense. You must use AI for defense.
    - Deploy AI-powered SIEM correlation to detect multi-stage attacks faster.
    - Use AI-driven anomaly detection to identify unusual process behavior, network traffic, and file access patterns.
    - Implement automated threat hunting workflows that continuously search for PHP2Shell indicators without manual analyst intervention.

### Vendor Resources and References

- **PHP Group Security**: [https://www.php.net/security](https://www.php.net/security)
- **The Hacker News Original Article**: [https://thehackernews.com/2026/10/php2shell-exploitation-hits-government.html](https://thehackernews.com/2026/10/php2shell-exploitation-hits-government.html)
- **CISA Known Exploited Vulnerabilities**: [https://www.cisa.gov/known-exploited-vulnerabilities-catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
- **MITRE ATT&CK - Exploit Public-Facing Application (T1190)**: [https://attack.mitre.org/techniques/T1190/](https://attack.mitre.org/techniques/T1190/)
- **MITRE ATT&CK - Web Shell (T1505.003)**: [https://attack.mitre.org/techniques/T1505/003/](https://attack.mitre.org/techniques/T1505/003/)

### CISA Deadlines

At the time of writing, CVE-2026-109618 and CVE-2026-109619 have not yet been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. However, given confirmed active exploitation and targeting of government entities, inclusion is expected imminently. When added, federal civilian executive branch (FCEB) agencies will be required to remediate within the timeline specified in the KEV entry (typically 2-3 weeks for critical vulnerabilities under active exploitation).

**Do not wait for KEV inclusion to act.** Patch now.

---

## Conclusion

The PHP2Shell campaign represents a paradigm shift in attacker speed and efficiency. The use of **agentic AI platforms** to automate post-exploitation tasks means that the window between initial compromise and full credential theft has collapsed from days or weeks to **hours**. Defenders must respond with equal urgency and automation.

If you operate PHP-based web applications, assume you are being scanned right now. Patch immediately, deploy the detection rules provided above, and hunt aggressively for signs of compromise. The European government entity that was breached had only two hours to respond. You may have even less time.

Stay vigilant, patch aggressively, and automate everything you can. The attackers already have.

## Related Resources

[Security Arsenal Healthcare Cybersecurity](https://securityarsenal.com/industries/healthcare)
[AlertMonitor Platform](https://securityarsenal.com/products/alertmonitor)
[Book a SOC Assessment](https://securityarsenal.com/contact)
[healthcare Intel Hub](https://securityarsenal.com/intel/healthcare-security)