PHP2Shell: Wiz Uncovers Critical Unauthenticated RCE and Memory Disclosure in Core PHP Engine — Emergency Patching and Detection Guide

Wiz researchers have disclosed a set of critical vulnerabilities in the core PHP engine — dubbed PHP2Shell — that enable unauthenticated remote code execution (RCE) and a Heartbleed-style memory disclosure across vulnerable PHP installations. Because PHP powers the server side of an enormous share of the web — content management systems, e-commerce platforms, APIs, and legacy applications alike — the blast radius here is measured in tens of millions of internet-facing assets.

If you operate any internet-facing PHP application, treat this as a drop-everything event. This post covers what the vulnerabilities are, how they work from a defender's perspective, how to hunt for exploitation in your environment, and exactly how to remediate.

What Happened

Wiz's research team identified flaws in the core PHP engine itself — not in a framework, plugin, or CMS, but in the language runtime that underpins the entire PHP ecosystem. The disclosed issues fall into two categories:

1. Unauthenticated remote code execution: A flaw in PHP's request-handling path that allows an attacker to execute arbitrary code on the server without any credentials or prior access, simply by sending crafted requests to an exposed PHP endpoint.
2. Heartbleed-style memory disclosure: A separate flaw that leaks the contents of server memory to a remote attacker — analogous to OpenSSL Heartbleed in impact — potentially exposing session tokens, credentials, cryptographic keys, environment variables, and other secrets held in PHP process memory.

The combination is devastating. The memory disclosure can be used to extract secrets that make exploitation of the RCE trivially reliable, or to harvest credentials for follow-on attacks. The RCE alone grants full code execution in the context of the PHP process — typically the web server user, but from there, privilege escalation paths are well-worn.

Wiz's framing that these flaws affect a substantial majority of the internet reflects the dominance of PHP across the web stack: WordPress, Drupal, Joomla, Magento, and countless custom applications all ride on the PHP engine. Even if your applications are patched, the runtime underneath them is the vulnerability here.

Source: Wiz Research — PHP2Shell

Technical Analysis

Affected Components

• Product: PHP language interpreter / core engine (mod_php, PHP-FPM, CGI, and CLI SAPIs)
• Platforms: Linux, Windows, and any OS running vulnerable PHP builds — including container images built on vulnerable base images
• Exposure requirement: The vulnerable code path is reachable over the network, meaning any internet-facing PHP application is potentially in scope. Internal PHP services are also at risk from lateral movement.

Refer to the Wiz advisory and PHP.net security releases for the definitive list of affected version branches. Do not assume your version is safe because it is recent — core engine flaws of this class frequently span many release branches, including actively supported ones. Validate against the fixed versions listed in the official PHP security advisories.

How the Attack Works (Defender's View)

From the defender's perspective, the attack chain looks like this:

1. Reconnaissance: The attacker scans for internet-facing PHP endpoints (any .php handler, PHP-FPM upstream, or framework entry point like /index.php).
2. Memory disclosure (optional but likely): Crafted requests trigger the memory read primitive, leaking heap contents from the PHP worker process — environment variables, database credentials, session cookies, API keys.
3. RCE trigger: A crafted request to a PHP handler triggers the engine flaw and executes attacker-controlled code in the PHP process context (e.g., www-data, apache, nginx, IIS AppPool).
4. Post-exploitation: Web shell deployment, credential theft, lateral movement, persistence via cron/systemd/scheduled tasks, and data exfiltration.

Observable artifacts to anchor your detections on:

• The web server or PHP worker process (php-fpm, php-cgi, httpd, nginx, w3wp.exe with PHP handler) spawning child processes — especially shells (sh, bash, cmd.exe, powershell.exe) or download/recon tools (curl, wget, whoami, id, uname).
• Outbound connections from web server processes to unusual destinations (C2, exfiltration).
• New or modified files in web root directories (web shells like *.php dropped in uploads/, /tmp, or theme/plugin directories).
• Anomalous request patterns in web logs: abnormally long or encoded query strings/bodies, repeated requests of similar size and timing consistent with memory leak probing (Heartbleed-style extraction is characteristically iterative).

Exploitation Status

• Research was published by Wiz with technical detail sufficient for defenders to understand exposure; assume public PoC and in-the-wild exploitation follow quickly for a flaw of this severity and reach. PHP engine RCEs historically move from disclosure to mass scanning within hours to days.
• Check the CISA Known Exploited Vulnerabilities catalog for additions related to these PHP flaws, and monitor the Wiz blog and PHP.net for updated exploitation intelligence.

Detection & Response

Sigma Rules

The highest-fidelity detection for this class of vulnerability is web server / PHP worker process spawning shells or system tools — legitimate PHP deployments almost never do this. The second rule targets iterative memory-disclosure probing visible in web request logs. Both are tuned to minimize noise.

---
title: PHP Worker or Web Server Process Spawning Shell - Potential PHP2Shell RCE Exploitation
id: 3f8b2c41-7a6e-4d9f-b1c2-5e8a4f7d9031
status: experimental
description: Detects PHP-FPM, PHP-CGI, or web server processes spawning shells or system utilities, a strong indicator of successful remote code execution via a PHP engine vulnerability such as those disclosed in PHP2Shell research.
references:
  - https://www.wiz.io/blog/php2shell-php-rce
  - https://attack.mitre.org/techniques/T1059/
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/02/14
tags:
  - attack.initial_access
  - attack.execution
  - attack.t1190
  - attack.t1059.004
logsource:
  category: process_creation
  product: linux
detection:
  selection_parents:
    ParentImage|endswith:
      - '/php-fpm'
      - '/php-fpm8.1'
      - '/php-fpm8.2'
      - '/php-fpm8.3'
      - '/php-fpm8.4'
      - '/php-cgi'
      - '/httpd'
      - '/nginx'
      - '/apache2'
  selection_children:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/zsh'
      - '/curl'
      - '/wget'
      - '/id'
      - '/whoami'
      - '/uname'
      - '/nc'
      - '/ncat'
      - '/python'
      - '/python3'
      - '/perl'
      - '/base64'
  condition: selection_parents and selection_children
falsepositives:
  - Rare legitimate PHP applications invoking system utilities (e.g., image processing, backup scripts) - baseline per application and tune ParentImage accordingly
level: critical
---
title: Windows IIS PHP Handler Spawning Command Shell - Potential PHP2Shell Exploitation
id: 9c1d4e72-2b8f-4a5d-93e6-1f7b3c8a2054
status: experimental
description: Detects the IIS worker process or PHP-CGI on Windows spawning cmd.exe or powershell.exe, indicating successful remote code execution through a PHP engine vulnerability.
references:
  - https://www.wiz.io/blog/php2shell-php-rce
  - https://attack.mitre.org/techniques/T1059/
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/02/14
tags:
  - attack.initial_access
  - attack.execution
  - attack.t1190
  - attack.t1059.001
  - attack.t1059.003
logsource:
  category: process_creation
  product: windows
detection:
  selection_parents:
    ParentImage|endswith:
      - '\w3wp.exe'
      - '\php-cgi.exe'
      - '\httpd.exe'
  selection_children:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
      - '\curl.exe'
      - '\whoami.exe'
  condition: selection_parents and selection_children
falsepositives:
  - Legitimate PHP applications invoking shell commands for administration tasks - tune per application baseline
level: critical
---
title: Potential PHP Memory Disclosure Probing via Repetitive Uniform Web Requests
id: 6e2a7d93-4c1b-4f8e-a2d5-8b9c1e6f3047
status: experimental
description: Detects high volumes of similarly-sized requests to PHP endpoints from a single source within a short window, consistent with Heartbleed-style iterative memory extraction against the PHP memory disclosure flaw described in PHP2Shell research. Tune thresholds to environment baseline.
references:
  - https://www.wiz.io/blog/php2shell-php-rce
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/02/14
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: webserver
detection:
  selection:
    cs-uri-stem|endswith:
      - '.php'
  condition: selection | count() by c-ip > 500
falsepositives:
  - High-traffic legitimate API clients and AJAX-heavy frontends - whitelist known good source IPs and adjust count threshold per application
level: medium

KQL — Microsoft Sentinel / Defender

This hunt query surfaces web server and PHP worker processes spawning shells or tooling, using Defender process telemetry on Windows endpoints and Syslog ingested into Sentinel for Linux web servers.

// Hunt 1: PHP/web server processes spawning shells (Defender for Endpoint - Windows)
DeviceProcessEvents
| where TimeGenerated > ago(24h)
| where InitiatingProcessFileName in~ ("w3wp.exe", "php-cgi.exe", "httpd.exe")
   or InitiatingProcessCommandLine has_any ("php-cgi", "php-fpm")
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "certutil.exe", "bitsadmin.exe", "curl.exe", "whoami.exe")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, AccountName, RemoteIP
| order by TimeGenerated desc;

// Hunt 2: PHP-FPM / web server spawning shells on Linux via Syslog ingestion
Syslog
| where TimeGenerated > ago(24h)
| where SyslogMessage has_any ("php-fpm", "apache", "httpd", "nginx")
| where SyslogMessage has_any ("/bin/sh", "/bin/bash", "cmdline", "execve")
| where SyslogMessage has_any ("whoami", "curl ", "wget ", "nc -", "bash -i", "sh -i")
| project TimeGenerated, Computer, ProcessName, SyslogMessage
| order by TimeGenerated desc;

// Hunt 3: Volumetric anomaly - potential memory disclosure probing against PHP endpoints (proxy/WAF logs via CEF)
CommonSecurityLog
| where TimeGenerated > ago(6h)
| where RequestURL endswith ".php"
| summarize RequestCount = count(), DistinctURIs = dcount(RequestURL) by SourceIP, bin(TimeGenerated, 10m)
| where RequestCount > 500
| order by RequestCount desc;

Velociraptor VQL

This artifact hunts Linux web servers for PHP workers that have spawned suspicious child processes, and separately inventories recently created PHP files in web roots (web shell triage).

-- PHP2Shell post-exploitation hunt: PHP/web worker child processes and dropped PHP files
-- Part 1: Process execution chain
SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Ppid IN (
   SELECT Pid FROM pslist()
   WHERE Name =~ '(?i)php-fpm|php-cgi|apache|httpd|nginx'
)
AND Name =~ '(?i)sh|bash|dash|curl|wget|nc|ncat|whoami|python|perl'

-- Part 2: Recently created or modified PHP files in common web roots (web shell triage)
SELECT FullPath, Size, Mtime, Ctime
FROM glob(globs=[
   '/var/www/**/*.php',
   '/srv/www/**/*.php',
   '/home/*/public_html/**/*.php'
])
WHERE Mtime > now() - 86400
ORDER BY Mtime DESC

Remediation Script

Use this Bash script to inventory PHP versions across your estate, flag vulnerable installations, and verify post-patch state. Run via your configuration management or MDM tooling at scale.

#!/bin/bash
# PHP2Shell exposure assessment - Security Arsenal
# Run as root on each web server. Reports PHP version, active SAPIs, and exposure.

set -euo pipefail

REPORT="php2shell_assessment_$(hostname)_$(date +%Y%m%d).txt"

echo "=== PHP2Shell Exposure Assessment - $(hostname) - $(date) ===" | tee "$REPORT"

echo -e "\n[1] Installed PHP version(s):" | tee -a "$REPORT"
if command -v php >/dev/null 2>&1; then
    php -v | tee -a "$REPORT"
else
    echo "php CLI not found in PATH" | tee -a "$REPORT"
fi
dpkg -l 2>/dev/null | grep -E '^ii\s+php' | tee -a "$REPORT" || true
rpm -qa 2>/dev/null | grep -i '^php' | tee -a "$REPORT" || true

echo -e "\n[2] Active PHP SAPIs / handlers:" | tee -a "$REPORT"
ps aux | grep -E 'php-fpm|php-cgi|httpd|apache2|nginx' | grep -v grep | tee -a "$REPORT" || echo "No PHP/web processes running" | tee -a "$REPORT"

echo -e "\n[3] Listening web ports (internet exposure check):" | tee -a "$REPORT"
ss -tlnp 2>/dev/null | grep -E ':80|:443|:8080|:8443|:9000' | tee -a "$REPORT" || true

echo -e "\n[4] ACTION REQUIRED: Compare versions above against the fixed versions in:"
echo "    - https://www.php.net/security/ (official PHP security advisories)"
echo "    - https://www.wiz.io/blog/php2shell-php-rce (Wiz research)" | tee -a "$REPORT"

echo -e "\n[5] Patch now (Debian/Ubuntu example - adjust repo pinning per advisory):"
echo "    apt update && apt install --only-upgrade php-cli php-fpm php-common php-cgi"
echo "    For RHEL-family: dnf update php\*"
echo "    Then restart handlers: systemctl restart php*-fpm apache2 nginx"
echo "    Containers: rebuild from updated base images - 'docker pull' alone is insufficient"

echo -e "\n[6] Post-patch verification: re-run this script and confirm version strings match the fixed builds listed in the PHP advisories."

echo -e "\nReport saved to $REPORT"

Remediation

1. Patch immediately. Upgrade all PHP installations — CLI, FPM, CGI, and mod_php — to the fixed versions specified in the official advisories at php.net/security and the Wiz PHP2Shell writeup. This includes PHP runtimes embedded in containers, appliances, and vendor software bundles, which are frequently forgotten and ship their own vulnerable interpreter.
2. Inventory first, patch everything. Enumerate every PHP runtime in your estate: web servers, app servers, cron hosts, CI runners, and container images. Scan container registries for images containing vulnerable PHP builds — a patched host with a vulnerable container is still compromised territory.
3. Restart all PHP handlers after patching. A patched binary with a still-running old FPM pool leaves the vulnerable code resident in memory. Restart php-fpm, httpd/apache2, and nginx (where mod_php or proxying is in play) after every upgrade.
4. Hunt before and after patching. Patching closes the hole; it does not evict an attacker who got in before you patched. Run the Sigma/KQL/VQL hunts above across a retrospective window of at least 30 days. Look for web shells in upload directories, unexpected PHP files, and web-server-spawned child processes.
5. Rotate secrets if exploitation is suspected. Because the memory disclosure flaw can leak credentials, session tokens, and keys from PHP process memory, any confirmed or suspected exploitation requires rotation of database credentials, API keys, application secrets, and invalidation of active sessions.
6. Reduce exposure while patching. As a temporary mitigation, restrict network access to PHP endpoints where possible (WAF rules, IP allowlisting for admin panels), and ensure your WAF is receiving virtual patches from your vendor. Note: WAF rules for engine-level flaws are a speed bump, not a fix — do not treat them as a substitute for patching.
7. Monitor CISA KEV. Watch the CISA Known Exploited Vulnerabilities catalog for additions tied to these PHP flaws; KEV listing carries binding remediation deadlines for federal agencies and is a reliable prioritization signal for everyone else.
8. Longer term: Establish PHP version management as a first-class item in your vulnerability management program. Core language runtimes patch infrequently enough that they fall off the radar — until a PHP2Shell-grade event puts them back on it.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub