CVE-2026-109618: PHP2Shell Unauthenticated RCE Actively Exploited — Detection, Hunting, and Remediation Guide

---
title: PHP Worker Process Spawning Shell or Script Interpreter
description: Detects php-fpm, php-cgi, or php processes spawning shells or script interpreters, consistent with exploitation of PHP2Shell unauthenticated RCE flaws (CVE-2026-109618) enabling code execution under the web server context.
references:
  - https://thehackernews.com/2026/10/cisa-confirms-active-exploitation-of.html
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
status: experimental
date: 2026/10/20
tags:
  - attack.execution
  - attack.t1059
  - attack.t1190
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/php-fpm'
      - '/php-fpm7.4'
      - '/php-fpm8.0'
      - '/php-fpm8.1'
      - '/php-fpm8.2'
      - '/php-fpm8.3'
      - '/php-fpm8.4'
      - '/php'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/zsh'
      - '/python'
      - '/python3'
      - '/perl'
      - '/curl'
      - '/wget'
      - '/nc'
      - '/ncat'
      - '/base64'
  condition: selection_parent and selection_child
falsepositives:
  - Rare legitimate PHP applications that shell out for media processing or system tasks; baseline per application before deployment
level: critical
---
title: PHP CGI or PHP Executable Spawning Windows Command Shell
description: Detects php.exe or php-cgi.exe spawning cmd.exe, powershell.exe, or other Windows script hosts, consistent with post-exploitation activity following PHP2Shell RCE exploitation on Windows-hosted PHP deployments.
references:
  - https://thehackernews.com/2026/10/cisa-confirms-active-exploitation-of.html
  - https://attack.mitre.org/techniques/T1059.001/
author: Security Arsenal
status: experimental
date: 2026/10/20
tags:
  - attack.execution
  - attack.t1059.001
  - attack.t1190
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\php.exe'
      - '\php-cgi.exe'
      - '\php-win.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\rundll32.exe'
      - '\certutil.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Custom PHP applications invoking system commands for administration; investigate parent-child lineage before whitelisting
level: critical
---
title: Webshell File Dropped in Webroot by Web Server Process
description: Detects creation of PHP script files in webroot directories by web server or PHP worker processes, a common persistence step following unauthenticated RCE exploitation such as the PHP2Shell flaws.
references:
  - https://thehackernews.com/2026/10/cisa-confirms-active-exploitation-of.html
  - https://attack.mitre.org/techniques/T1505.003/
author: Security Arsenal
status: experimental
date: 2026/10/20
tags:
  - attack.persistence
  - attack.t1505.003
logsource:
  category: file_event
  product: linux
detection:
  selection_path:
    TargetFilename|contains:
      - '/var/www/'
      - '/srv/www/'
      - '/usr/share/nginx/'
      - '/home/*/public_html/'
  selection_ext:
    TargetFilename|endswith:
      - '.php'
      - '.phtml'
      - '.phar'
      - '.php5'
      - '.php7'
  selection_actor:
    Image|endswith:
      - '/php-fpm'
      - '/php'
      - '/nginx'
      - '/apache2'
      - '/httpd'
  condition: selection_path and selection_ext and selection_actor
falsepositives:
  - Deployment pipelines writing application code via the web server context; suppress known CI/CD service accounts and paths
level: high

// Hunt: PHP runtime spawning shells or script interpreters (PHP2Shell post-exploitation)
let phpParents = dynamic(["php-fpm", "php", "php-cgi", "php-cgi.exe", "php.exe", "php-win.exe"]);
let suspiciousChildren = dynamic(["sh", "bash", "dash", "zsh", "python", "python3", "perl", "curl", "wget", "nc", "ncat", "base64", "cmd.exe", "powershell.exe", "pwsh.exe", "certutil.exe", "rundll32.exe"]);
union isfuzzy=true
(DeviceProcessEvents
 | where InitiatingProcessFileName has_any (phpParents)
 | where FileName has_any (suspiciousChildren)
 | project TimeGenerated, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, RemoteIP="n/a", Source="MDE"),
(Syslog
 | where Facility =~ "auth" or SyslogMessage has "php-fpm" or SyslogMessage has "php-cgi"
 | where SyslogMessage has_any (suspiciousChildren)
 | project TimeGenerated, DeviceName=Computer, AccountName="n/a", InitiatingProcessFileName="php", InitiatingProcessCommandLine=SyslogMessage, FileName=ProcessName, ProcessCommandLine=SyslogMessage, RemoteIP=HostIP, Source="Syslog"),
(CommonSecurityLog
 | where DeviceProcessName has_any (phpParents)
 | where AdditionalExtensions has_any (suspiciousChildren) or Message has_any (suspiciousChildren)
 | project TimeGenerated, DeviceName=DeviceName, AccountName=SourceUserName, InitiatingProcessFileName=DeviceProcessName, InitiatingProcessCommandLine=Message, FileName="n/a", ProcessCommandLine=Message, RemoteIP=SourceIP, Source="CEF"))
| sort by TimeGenerated desc

-- Hunt: PHP worker processes spawning shells or interpreters (PHP2Shell RCE indicator)
SELECT Pid,
       Ppid,
       Name AS ProcessName,
       Exe AS ProcessPath,
       CommandLine,
       Username,
       CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)(php-fpm|php-cgi|php\.exe)'
   OR Exe =~ '(?i)(/php-fpm|/php$|php-cgi|php\.exe$)'

-- Follow-up: enumerate child processes of any PHP worker and flag shell children
LET php_workers <= SELECT Pid, Name, Exe
FROM pslist()
WHERE Name =~ '(?i)php'

SELECT child.Pid AS ChildPid,
       child.Name AS ChildName,
       child.Exe AS ChildPath,
       child.CommandLine AS ChildCmdline,
       child.Username AS ChildUser,
       parent.Pid AS ParentPid,
       parent.Name AS ParentName
FROM pslist() AS child
JOIN php_workers AS parent ON child.Ppid = parent.Pid
WHERE child.Name =~ '(?i)(sh|bash|dash|zsh|python|perl|curl|wget|nc|ncat|cmd|powershell|certutil)'

#!/bin/bash
# PHP2Shell (CVE-2026-109618) exposure verification and hardening script
# Run as root on each PHP-enabled server

echo "=== [1] Installed PHP version(s) ==="
php -v 2>/dev/null || echo "php CLI not found"
php-fpm -v 2>/dev/null || php-fpm8.3 -v 2>/dev/null || echo "php-fpm binary not directly invocable"

echo ""
echo "=== [2] Running PHP services ==="
systemctl list-units --type=service --state=running 2>/dev/null | grep -iE 'php|fpm' || echo "No running PHP-FPM services detected"

echo ""
echo "=== [3] Pending security updates (Debian/Ubuntu) ==="
if command -v apt-get >/dev/null 2>&1; then
    apt-get update -qq 2>/dev/null
    apt-get -s upgrade 2>/dev/null | grep -iE 'php' | head -20
    echo ""
    echo "To apply PHP security updates: apt-get install --only-upgrade 'php*' -y && systemctl restart php*-fpm"
fi

echo ""
echo "=== [3b] Pending security updates (RHEL/Rocky/Alma) ==="
if command -v dnf >/dev/null 2>&1; then
    dnf check-update --security 2>/dev/null | grep -iE 'php' | head -20
    echo ""
    echo "To apply PHP security updates: dnf update --security 'php*' -y && systemctl restart php-fpm"
fi

echo ""
echo "=== [4] Recently created/modified PHP files in webroots (last 7 days) - possible webshells ==="
for webroot in /var/www /srv/www /usr/share/nginx/html /home/*/public_html; do
    if [ -d "$webroot" ]; then
        find "$webroot" -type f \( -name '*.php' -o -name '*.phtml' -o -name '*.phar' \) -mtime -7 -printf '%T@ %Tc %p\n' 2>/dev/null | sort -rn | head -25
    fi
done

echo ""
echo "=== [5] PHP-FPM workers with shell children (live compromise check) ==="
for pid in $(pgrep -f 'php-fpm' 2>/dev/null); do
    children=$(ps --ppid "$pid" -o pid=,comm= 2>/dev/null | grep -E '\b(sh|bash|dash|zsh|python|perl|curl|wget|nc|ncat)\b')
    if [ -n "$children" ]; then
        echo "ALERT: php-fpm PID $pid has shell children:"
        echo "$children"
    fi
done

echo ""
echo "=== [6] Outbound connections from web server users ==="
ss -tupn 2>/dev/null | grep -iE 'php|www-data|apache|nginx' | grep -v ':80\|:443' | head -20

echo ""
echo "=== Remediation checklist ==="
echo "1. Apply vendor PHP security updates immediately (see section 3 output)."
echo "2. Restart php-fpm / Apache after patching - in-memory processes keep the vulnerable code until restart."
echo "3. Review any files flagged in section 4 before deleting; preserve for forensics."
echo "4. Investigate any alerts from sections 5 and 6 as active compromise - isolate the host."