PHP2Shell (CVE-2026-109618, CVE-2026-109619): Detecting and Remediating Critical Unauthenticated PHP Remote Code Execution

---
title: PHP Process Spawning Command Interpreter
title_alt: PHP2Shell Post-Exploitation
tid: 3f9c1a72-8b4d-4e6a-9c2f-7d1e5a8b3c4d
status: experimental
description: Detects PHP CGI/FPM/CLI processes spawning command shells or scripting interpreters, a hallmark of runtime-level PHP RCE exploitation such as PHP2Shell (CVE-2026-109618, CVE-2026-109619).
references:
  - https://www.bleepingcomputer.com/news/security/php-ships-emergency-patches-for-critical-php2shell-flaws/
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/04/09
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\php-cgi.exe'
      - '\php.exe'
      - '\php-fpm.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Rare legitimate installer or maintenance scripts executed under PHP CLI
  - Some CMS admin functions invoking system commands (e.g., image processing) — tune per application baseline
level: high
---
title: Linux Web Server Worker Spawning Shell
id: 8e2b4d61-5c7f-4a39-b1e8-2d6f9a4c7e5b
status: experimental
description: Detects Apache, Nginx, PHP-FPM, or other web server worker processes spawning interactive shells on Linux, consistent with exploitation of PHP runtime RCE flaws like PHP2Shell.
references:
  - https://www.bleepingcomputer.com/news/security/php-ships-emergency-patches-for-critical-php2shell-flaws/
  - https://attack.mitre.org/techniques/T1059/004/
author: Security Arsenal
date: 2026/04/09
tags:
  - attack.execution
  - attack.t1059.004
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/php-fpm'
      - '/php'
      - '/httpd'
      - '/apache2'
      - '/nginx'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/zsh'
      - '/python'
      - '/python3'
      - '/perl'
      - '/nc'
      - '/ncat'
      - '/socat'
      - '/wget'
      - '/curl'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate admin tooling invoked by web management panels (cPanel, Plesk) — scope exclusions to known management paths
  - Health-check scripts in some container images
level: high
---
title: Webshell Dropped in Web-Accessible Directory
id: 5a1d8f3e-2b6c-4d97-a4f1-9e3c7b2d8a6f
status: experimental
description: Detects creation of PHP script files in web root directories by web server or PHP processes, consistent with webshell staging following PHP2Shell exploitation.
references:
  - https://www.bleepingcomputer.com/news/security/php-ships-emergency-patches-for-critical-php2shell-flaws/
  - https://attack.mitre.org/techniques/T1505/003/
author: Security Arsenal
date: 2026/04/09
tags:
  - attack.persistence
  - attack.t1505.003
logsource:
  category: file_event
  product: linux
detection:
  selection_path:
    TargetFilename|contains:
      - '/var/www/'
      - '/srv/www/'
      - '/usr/share/nginx/'
      - '/htdocs/'
      - '/public_html/'
  selection_ext:
    TargetFilename|endswith:
      - '.php'
      - '.phtml'
      - '.phar'
  filter_deploy:
    Image|endswith:
      - '/composer'
      - '/git'
      - '/rsync'
      - '/scp'
      - '/sftp-server'
  condition: selection_path and selection_ext and not filter_deploy
falsepositives:
  - CI/CD deployments and CMS plugin updates — filter on the deploying process rather than the file path
  - Developer activity via deployment tooling
level: medium

// PHP2Shell post-exploitation hunt: web/PHP processes spawning shells or egress tools
let lookback = 14d;
let web_parents = dynamic(["php-cgi.exe", "php.exe", "php-fpm", "php", "httpd", "apache2", "nginx", "w3wp.exe"]);
let suspicious_children = dynamic(["cmd.exe", "powershell.exe", "pwsh.exe", "sh", "bash", "dash", "python", "python3", "perl", "nc", "ncat", "socat", "wget", "curl", "certutil.exe", "mshta.exe"]);
union isfuzzy=true
(DeviceProcessEvents
| where TimeGenerated > ago(lookback)
| where InitiatingProcessFileName in~ (web_parents)
| where FileName in~ (suspicious_children)
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, AccountName, InitiatingProcessRemoteIp = RemoteIP
),
(Syslog
| where TimeGenerated > ago(lookback)
| where Facility == "auth" or SyslogMessage has_any ("php-fpm", "apache", "nginx")
| where SyslogMessage has_any ("/bin/sh", "/bin/bash", "wget ", "curl ", "nc -", "python -c")
| project TimeGenerated, Computer, ProcessName, SyslogMessage
)
| order by TimeGenerated desc

// Webshell staging: .php files written to web roots by non-deployment processes
let lookback = 14d;
DeviceFileEvents
| where TimeGenerated > ago(lookback)
| where FolderPath has_any ("/var/www/", "/srv/www/", "/htdocs/", "/public_html/", "\\inetpub\\wwwroot\\")
| where FileName endswith ".php" or FileName endswith ".phtml"
| where InitiatingProcessFileName !in~ ("git", "rsync", "composer", "scp", "sftp-server", "sshd")
| project TimeGenerated, DeviceName, FolderPath, FileName, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256
| order by TimeGenerated desc

-- PHP2Shell triage: suspicious web-process children and recent webshell artifacts
LET proc_hunt = SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Name =~ '(?i)php|httpd|apache2|nginx|w3wp'

LET shell_children = SELECT Pid, Ppid, Name, CommandLine, Username, CreateTime
FROM pslist()
WHERE Ppid IN (SELECT Pid FROM proc_hunt)
  AND Name =~ '(?i)cmd|powershell|pwsh|sh$|bash|dash|python|perl|nc|ncat|wget|curl'

LET webshell_candidates = SELECT FullPath, Mtime, Size
FROM glob(globs=['/var/www/**/*.php', '/srv/www/**/*.php', 'C:\\inetpub\\wwwroot\\**\\*.php'])
WHERE Mtime > now() - 1209600
ORDER BY Mtime DESC

SELECT * FROM shell_children
UNION ALL
SELECT NULL AS Pid, NULL AS Ppid, 'WEBSHELL_FILE' AS Name, FullPath AS CommandLine, NULL AS Username, Mtime AS CreateTime FROM webshell_candidates

#!/usr/bin/env bash
# PHP2Shell (CVE-2026-109618 / CVE-2026-109619) triage and verification script
# Run as root. Review PHP official advisories for fixed version numbers and pin EXPECTED_MIN accordingly.
set -u

echo "=== [1] Installed PHP versions ==="
for bin in php php8 php8.1 php8.2 php8.3 php8.4; do
  if command -v "$bin" >/dev/null 2>&1; then
    printf "%s -> " "$bin"; "$bin" -r 'echo PHP_VERSION, "\n";' 2>/dev/null
  fi
done
dpkg -l 2>/dev/null | grep -E '^ii\s+php' | awk '{print $2, $3}'
rpm -qa 2>/dev/null | grep -i '^php'

echo "=== [2] PHP-FPM / SAPI processes running ==="
ps -eo pid,user,comm,args | grep -E 'php-fpm|php-cgi|php ' | grep -v grep

echo "=== [3] Recently modified PHP files in web roots (last 7 days) ==="
for root in /var/www /srv/www /usr/share/nginx /home/*/public_html; do
  [ -d "$root" ] && find "$root" -name '*.php' -o -name '*.phtml' | \
    xargs -r find 2>/dev/null -mtime -7 -printf '%T@ %TY-%Tm-%Td %TH:%TM %p\n' | sort -rn | head -50
done

echo "=== [4] Web server child processes spawning shells RIGHT NOW ==="
for wp in $(pgrep -f 'php-fpm|httpd|apache2|nginx'); do
  children=$(pgrep -P "$wp" -a 2>/dev/null | grep -E '/bin/(sh|bash|dash)|python|nc |ncat|socat' || true)
  [ -n "$children" ] && echo "ALERT: web pid $wp spawned: $children"
done

echo "=== [5] Outbound connections from web/PHP processes (possible reverse shells) ==="
ss -tunp 2>/dev/null | grep -E 'php|httpd|apache2|nginx' | grep -v ':80\|:443\|:9000'

echo ""
echo "NEXT STEPS:"
echo " 1. Compare installed versions against the PHP security advisory fixed releases."
echo " 2. Patch via your package manager or rebuild from source, then restart php-fpm/apache."
echo " 3. Investigate any ALERT lines and recent web-root PHP files as potential compromise."

# PHP2Shell triage for Windows/IIS hosts running PHP via FastCGI
# 1) Enumerate PHP installations and versions
Get-ChildItem -Path 'C:\php','C:\Program Files\PHP','C:\Program Files (x86)\PHP' -Recurse -Filter 'php-cgi.exe' -ErrorAction SilentlyContinue |
    ForEach-Object { "$($_.FullName) -> $((Get-Item $_.FullName).VersionInfo.ProductVersion)" }

# 2) Detect web server worker processes spawning command interpreters (live triage)
$webPids = (Get-Process w3wp,php-cgi,php -ErrorAction SilentlyContinue).Id
Get-CimInstance Win32_Process |
    Where-Object { $webPids -contains $_.ParentProcessId -and
                   $_.Name -match 'cmd.exe|powershell.exe|pwsh.exe|mshta.exe|certutil.exe' } |
    Select-Object ProcessId, ParentProcessId, Name, CommandLine, CreationDate

# 3) Webshell staging: .php files written to wwwroot in the last 7 days
Get-ChildItem 'C:\inetpub\wwwroot' -Recurse -Include *.php,*.phtml -ErrorAction SilentlyContinue |
    Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-7) } |
    Sort-Object LastWriteTime -Descending |
    Select-Object LastWriteTime, FullName, Length