php2shell (CVE-2026-109618 / CVE-2026-109619): Defending Against Critical Unauthenticated PHP Remote Code Execution

The PHP security team has confirmed two critical vulnerabilities — CVE-2026-109618 and CVE-2026-109619 — both rated CVSSv4.0 9.2 and both described publicly as unauthenticated code execution flaws in PHP itself. An emergency patch release is scheduled for October 21, 2026 at 14:00 UTC, with fixed versions reported as PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. End-of-life branches — anything below PHP 8.2 — are not expected to receive fixes.

This is not a theoretical exercise. watchTowr has stated it believes it has reproduced CVE-2026-109618, and Cloudflare CTO Dane Knecht has publicly indicated that Cloudflare is already observing early attack attempts. Given PHP's footprint — powering the overwhelming majority of server-side web applications, including WordPress, Drupal, Joomla, Laravel, and countless custom stacks — the blast radius of a reliable unauthenticated RCE in the interpreter is enormous. If you operate internet-facing PHP, you should treat the window between now and the October 21 patch release as an active exposure window and act accordingly.

Technical Analysis

Affected Products and Versions

• Product: PHP interpreter (all SAPIs potentially relevant — PHP-FPM, mod_php, and PHP-CGI deployments depending on the vulnerable code path)
• Severity: CVSSv4.0 9.2 (Critical) for both CVEs, per the PHP security team
• Fixed versions (scheduled October 21, 2026, 14:00 UTC):
  • PHP 8.5.12
  • PHP 8.4.27
  • PHP 8.3.36
  • PHP 8.2.35
• Not patched: End-of-life branches (PHP 8.1 and earlier). If you are running PHP 7.x or 8.0/8.1 in production, this event is your forcing function — there will be no vendor fix.

Vulnerability Overview

Public technical detail is intentionally sparse ahead of the coordinated release — standard practice for interpreter-level RCEs. What we know with confidence:

1. Both flaws are unauthenticated. No credentials, no valid session, no application-level foothold required. An attacker who can reach the PHP handler over HTTP(S) is a potential threat actor.
2. Both yield code execution. In practical terms that means commands running in the context of the web server or PHP-FPM worker user (typically www-data, apache, or nginx) — which is more than sufficient to deploy web shells, harvest application secrets and database credentials from config files, pivot laterally, and establish persistence.
3. Exploitation is beginning. Cloudflare's early-attack telemetry, combined with watchTowr's claimed reproduction of CVE-2026-109618, means working exploit logic either already exists in the wild or will within hours of the patch diff becoming public. Patch-diffing of interpreter releases routinely yields functional exploits within 24–72 hours.

Exploitation Status

What Exploitation Looks Like on the Wire and on the Host

From a defender's perspective, successful exploitation of an interpreter-level RCE in PHP produces a consistent set of high-fidelity observables, regardless of the exact bug:

• Web server or PHP-FPM worker processes spawning shell interpreters (sh, bash, dash) or downstream tooling (curl, wget, python, perl, nc, base64).
• Outbound connections from the web tier to unfamiliar destinations — payload staging and C2.
• New or modified files in web-accessible directories (/var/www/html, upload directories, /tmp, /dev/shm) with PHP or script content — classic web shell deployment.
• Anomalous HTTP requests with abnormally long or encoded bodies/headers targeting PHP endpoints.

These are the behaviors we hunt below.

Detection & Response

The following detections assume you have endpoint process telemetry (Sysmon, AuditD, or EDR) on your web tier, plus web/WAF logs forwarded to your SIEM. If you don't, that gap is your first remediation item.

SIGMA Rules

---
title: Web Server or PHP Worker Spawning Shell - Possible php2shell Exploitation
id: 3f8a1c92-6b4d-4e7a-9c15-2d8e5f6a7b01
status: experimental
description: Detects PHP-FPM, PHP-CGI, Apache, or Nginx worker processes spawning shell interpreters, consistent with post-exploitation activity following unauthenticated PHP RCE such as CVE-2026-109618 or CVE-2026-109619.
references:
  - https://www.tenable.com/blog/php2shell-cve-2026-109618-cve-2026-109619-frequently-asked-questions-about-critical-php-remote
  - https://attack.mitre.org/techniques/T1059/004/
author: Security Arsenal
date: 2026/10/20
tags:
  - attack.execution
  - attack.t1059.004
  - attack.t1190
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/php-fpm'
      - '/php-cgi'
      - '/php'
      - '/apache2'
      - '/httpd'
      - '/nginx'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/zsh'
      - '/python'
      - '/python3'
      - '/perl'
      - '/nc'
      - '/ncat'
      - '/curl'
      - '/wget'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate application use of exec/shell_exec/system in PHP code (common in image processing, PDF generation, and backup tooling) - baseline and tune per application
level: high
---
title: Web Shell File Creation in Web-Accessible or Temp Directories
id: 9c2e7b41-1f3a-4d6e-8a52-7b4c9d1e3f05
status: experimental
description: Detects creation of PHP or script files in web root, upload, or temporary directories by web server processes - a strong indicator of web shell deployment following PHP RCE exploitation.
references:
  - https://www.tenable.com/blog/php2shell-cve-2026-109618-cve-2026-109619-frequently-asked-questions-about-critical-php-remote
  - https://attack.mitre.org/techniques/T1505/003/
author: Security Arsenal
date: 2026/10/20
tags:
  - attack.persistence
  - attack.t1505.003
logsource:
  category: file_event
  product: linux
detection:
  selection_path:
    TargetFilename|contains:
      - '/var/www/'
      - '/srv/www/'
      - '/usr/share/nginx/'
      - '/tmp/'
      - '/dev/shm/'
      - '/uploads/'
  selection_ext:
    TargetFilename|endswith:
      - '.php'
      - '.phtml'
      - '.php5'
      - '.phar'
      - '.sh'
  filter_writers:
    Image|endswith:
      - '/php-fpm'
      - '/apache2'
      - '/httpd'
      - '/nginx'
  condition: selection_path and selection_ext and not filter_writers
falsepositives:
  - Deployment pipelines writing application code - exclude CI/CD service accounts and deployment paths
level: high

KQL — Microsoft Sentinel / Defender Hunt

This query hunts for shell and tooling execution parented by web server or PHP processes, joined with outbound network activity from the same hosts. It works whether telemetry arrives via the Defender agent (Linux supported), Syslog/CEF ingestion, or the AMA connector.

// Hunt: web/PHP processes spawning shells or staging tooling (php2shell post-exploitation)
let lookback = 7d;
let WebProcs = dynamic(["php-fpm", "php-cgi", "php", "apache2", "httpd", "nginx"]);
let SuspectChildren = dynamic(["sh", "bash", "dash", "python", "python3", "perl", "nc", "ncat", "curl", "wget", "base64", "socat"]);
union withsource=tableName
    (DeviceProcessEvents
    | where TimeGenerated > ago(lookback)
    | where InitiatingProcessFileName has_any (WebProcs)
    | where FileName has_any (SuspectChildren)
    | project TimeGenerated, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, InitiatingProcessCommandLine, AccountName),
    (Syslog
    | where TimeGenerated > ago(lookback)
    | where SyslogMessage has_any (WebProcs) and SyslogMessage has_any (SuspectChildren)
    | project TimeGenerated, Computer, SyslogMessage, ProcessName),
    (SecurityEvent
    | where TimeGenerated > ago(lookback)
    | where EventID == 4688
    | where ParentProcessName has_any (WebProcs)
    | where NewProcessName has_any (SuspectChildren)
    | project TimeGenerated, Computer, ParentProcessName, NewProcessName, CommandLine)
| sort by TimeGenerated desc;

// Companion: outbound connections from web tier to rare external destinations
DeviceNetworkEvents
| where TimeGenerated > ago(lookback)
| where InitiatingProcessFileName has_any (dynamic(["php-fpm", "apache2", "httpd", "nginx", "sh", "bash"]))
| where RemoteIPType == "Public"
| summarize ConnectionCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by DeviceName, InitiatingProcessFileName, RemoteIP, RemotePort
| where ConnectionCount < 50  // surface rare/new destinations; tune threshold to your baseline
| sort by FirstSeen asc;

Velociraptor VQL — Web Tier Triage Hunt

Deploy this as a hunt across your Linux web servers to surface active shell spawns and recently dropped web-shell-style artifacts.

-- php2shell triage: shells parented by PHP/web processes and recent script artifacts in web/temp dirs
SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime,
       getppid(pid=Ppid) AS ParentChain
FROM pslist()
WHERE CommandLine =~ '(sh|bash|dash|python|perl|nc |ncat|curl|wget|base64)'
  AND (
       Name =~ '(sh|bash|dash|python|perl|nc|ncat)'
    OR Exe =~ '/(php-fpm|php-cgi|apache2|httpd|nginx)'
  )

-- Companion artifact: recently created PHP/script files in web roots and temp dirs
SELECT FullPath, Size, Mtime, Ctime, Mode
FROM glob(globs=[
  '/var/www/**/*.php',
  '/srv/www/**/*.php',
  '/tmp/*.php',
  '/tmp/*.sh',
  '/dev/shm/*',
  '/var/www/**/uploads/*.php'
])
WHERE Mtime > now() - 86400 * 7
ORDER BY Mtime DESC

Remediation & Verification Script

Run this on every Linux web/app server to inventory PHP versions, flag end-of-life branches that will receive no fix, and prepare for the October 21 emergency update.

#!/usr/bin/env bash
# php2shell (CVE-2026-109618 / CVE-2026-109619) readiness & verification script
# Run on every web/app server before and after the Oct 21, 2026 emergency release.

echo "=== PHP Version Inventory ==="
if command -v php >/dev/null 2>&1; then
  PHP_VER=$(php -r 'echo PHP_VERSION;' 2>/dev/null)
  echo "Installed PHP: ${PHP_VER}"
  MAJOR_MINOR=$(echo "${PHP_VER}" | cut -d. -f1,2)
  case "${MAJOR_MINOR}" in
    8.5|8.4|8.3|8.2) echo "[OK] Supported branch - patch expected Oct 21, 2026" ;;
    *) echo "[CRITICAL] PHP ${PHP_VER} is END-OF-LIFE - NO FIX WILL BE RELEASED. Upgrade to 8.2+ immediately." ;;
  esac
else
  echo "php CLI not found on this host"
fi

echo ""
echo "=== PHP SAPIs / Running Services ==="
ps aux | grep -E 'php-fpm|php-cgi|apache2|httpd|nginx' | grep -v grep || echo "No PHP/web services detected"

echo ""
echo "=== Post-Patch Verification Targets ==="
echo "Required minimum versions after Oct 21, 2026 14:00 UTC release:"
echo "  8.5 -> 8.5.12 | 8.4 -> 8.4.27 | 8.3 -> 8.3.36 | 8.2 -> 8.2.35"
echo ""
echo "Verify after patching with: php -v"
echo "Debian/Ubuntu: apt update && apt install --only-upgrade php*"
echo "RHEL/Rocky/Alma: dnf update php\*"
echo "Containers: rebuild images from patched base tags and redeploy - do NOT patch running containers in place"

echo ""
echo "=== Quick Exposure Check: recent shells spawned by web users ==="
journalctl _COMM=sh _COMM=bash --since "48 hours ago" 2>/dev/null | grep -E 'www-data|apache|nginx' | tail -20 || echo "journald check skipped or clean"

echo ""
echo "=== Recent files dropped in web/temp dirs (last 7 days) ==="
find /var/www /srv/www /tmp /dev/shm -type f \( -name '*.php' -o -name '*.phtml' -o -name '*.sh' \) -mtime -7 2>/dev/null | head -50

Remediation

1. Patch — October 21, 2026, 14:00 UTC

The emergency PHP release is scheduled for October 21, 2026 at 14:00 UTC. Upgrade to 8.5.12, 8.4.27, 8.3.36, or 8.2.35 as soon as packages or source builds are available. Treat this as a change-freeze exception — pre-stage your package repositories, container base images, and rollback plans now so the only remaining step on release day is deployment and smoke testing. Given confirmed early attack activity, aim to have internet-facing systems patched within 24 hours of release. Monitor the PHP security advisories page and the Tenable php2shell FAQ for final version confirmation and technical disclosure.

2. Eliminate End-of-Life PHP

Branches below 8.2 (PHP 7.x, 8.0, 8.1) will receive no fix. Any internet-facing workload on those branches will be permanently exploitable once PoCs mature. If migration is genuinely impossible before patch day, isolate those hosts: remove direct internet exposure, front them with a hardened reverse proxy/WAF, and restrict egress to an explicit allowlist. Then put the migration on a dated plan — isolation is a bridge, not a destination.

3. Compensating Controls During the Exposure Window

• WAF/virtual patching: Cloudflare and other major WAF providers are deploying managed rules based on observed attack traffic — verify your WAF is in blocking mode and that managed rulesets for PHP are current.
• Egress filtering: Deny outbound internet from web servers by default. This breaks payload staging and reverse shells even if exploitation succeeds — the single highest-value compensating control for RCE class bugs.
• Disable dangerous functions where feasible: If your application does not require them, add exec, shell_exec, system, passthru, popen, proc_open to disable_functions in php.ini. This will not stop the vulnerability itself but raises the bar for post-exploitation.
• Filesystem hardening: Mount /tmp and /dev/shm with noexec,nosuid,nodev; enforce read-only web roots outside designated upload paths; block PHP execution in upload directories via web server config.

4. Hunt Before You Patch

Early attacks are already being observed. Do not assume you are clean simply because you intend to patch quickly. Run the Sigma, KQL, and VQL content above across the last 7–14 days of telemetry. If you find web shells, suspicious child processes, or unexplained outbound connections from PHP/web processes, transition from patching to incident response: isolate the host, capture memory and disk images, and scope laterally — the www-data foothold frequently yields database credentials and internal pivot material within application config files.

5. Verify and Monitor

After patching, validate with php -v against the fixed version table, confirm application smoke tests pass, and keep the detections above active for at least 30 days. Patch-diffed exploits for this class of bug typically surge in the 72 hours after release — your highest-risk period is the gap between disclosure and your last patched host.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub