11 Detections for Catching PHP2Shell
PHP2Shell gives an unauthenticated attacker code execution inside the PHP engine, before any application code runs. We mapped it to 11 procedures you can detect, and the 59 existing detections that cover them.
PHP2Shell is a pair of vulnerabilities in the PHP engine itself, disclosed in October 2026. CVE-2026-109618 is an out-of-memory corruption bug and CVE-2026-109619 is stale global state, reachable through PHP's upload-progress handling and, on 8.5, fatal-error backtraces. Together they give an unauthenticated attacker remote code execution before any application code runs, so it doesn't matter how carefully your app is written. PHP's own advisories rate both critical, at 9.2 out of 10 on the CVSS v4 severity scale.
Wiz and CrowdStrike have demonstrated RCE in the lab, and Cloudflare, watchTowr and Kaspersky have reported exploitation attempts. As of disclosure day, though, no source has confirmed a successful compromise: CISA had not observed exploitation, and neither CVE was in the KEV catalog. The fix is in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35: patch, then restart every worker, because a worker that was running before the upgrade is still running the vulnerable build.
How we built this
When a threat like PHP2Shell surfaces, Spectrum's Autonomous Threat Research sends a swarm of research agents across the public record: the PHP advisories, vendor write-ups, researcher blogs, and public rule repositories like SigmaHQ, Elastic's detection rules and Corelight's php2shell-detect. Rather than collecting indicators, they break the threat into procedures, the specific behaviors a defender can observe. For PHP2Shell there are 11, running from the exploit request at the edge, through what the web worker does next on the host, to the control check of whether you're still running a vulnerable build.
For each procedure, the agents work out the detection logic, which logs it needs and which fields matter, and whether those logs ship on by default or need setting up. Then they inventory every detection that already exists for it and grade each one: repo-verified if we read the rule in a public repository, vendor-stated if we're taking the vendor's word for it. Every rule also notes what it misses, and every claim links to its source, so you can check the research rather than take it on faith. This map was built from public research on disclosure day, and nothing in it was lab-tested.
That's the general version. For a customer, Spectrum matches each procedure against the technologies in your environment, shows your actual coverage across your SIEMs and EDR in the Threat Graph, and builds the detections you're missing.
The 11 procedures and the 59 detections behind them
At the edge
01Multipart POSTs followed by worker crashesExploit attempt: multipart POST to a PHP URI, then an abnormal worker exit or memory fatal99 detections
Detection logic
Per client: multipart POSTs to PHP URIs, each followed within seconds by an abnormal worker exit (signal or crash) or memory fatal; routine recycling after pm.max_requests doesn’t count. Behind a proxy a failed attempt returns 5xx (commonly 502); mod_php without a proxy often drops the connection; a 200 on the same pattern is the success case. Patched runtimes can also end a worker at the hard memory limit, so check the version before escalating.
Delta Tradecraft · DT-P2S-APP-007 ↗ (opens in a new tab)Logs it needs
- Web, proxy or CDN access logon by defaultclient and forwarded client IP, method, URI, status; Content-Type and request length need a log-format change (the default bytes field counts the response, not the upload)
- Web server and PHP-FPM error logon by defaultthe startup out-of-memory line Allowed memory size … in Unknown on line 0 reaches the web server or FPM error log only when PHP error logging is routed there; FPM child exited on signal; Apache AH00052 segfault
- Container or service restart eventson by defaultout-of-memory kill, crash loop
Shipped detections · 9
- PHP2SHELL::PHP_Crash_Sequence (suspicious transaction then same-session follow-up within a minute)
Misses: Network-only producer; needs cleartext HTTP and Zeek 7.0+ (HEAD 4d5131c). TLS limits visibility; version cutoffs in the version notice are provisional.
- Apache Segmentation Fault (Sigma 1da8ce0b)
Misses: Generic 2021 rule; segfault line only, Apache only, no per-client join. Per host; crashes also happen for benign reasons, so baseline first.
- Web - PHP Fatal Error from Unknown Script (Potential PHP2Shell Exploitation)
Misses: Absent where the log is not forwarded or memory_limit=-1 was applied as a mitigation.
- Web - Burst of Oversized POST Requests from Single Source
Misses: Web-log source not stated. No body, no Set-Cookie, no request headers beyond the format.
- Generic - Web - PHP Memory Exhaustion During Request Startup (CVE-2026-109618 & CVE-2026-109619)
Misses: One signal only, no multipart/crash/5xx join; query text not shown. Absent where the log is not forwarded or memory_limit=-1 was applied as a mitigation.
- POST Requests Returning HTTP 500 to PHP Endpoints (Sigma)
Misses: Counts 500 only (misses 502/503/504, 499), groups by host not client, no multipart-then-crash join. No body, no Set-Cookie, no request headers beyond the format.
- PHP Memory Exhaustion or FPM Worker Killed by Signal (Sigma)
Misses: Per pool; benign segfaults exist.
- Customer-written rule, not a Google-shipped detection: Rule so no uninspected or unnecessarily large content reaches backends (out-of-memory payloads)
Misses: Decisions appear in the application load balancer logs in Cloud Logging only after load-balancer request logging is enabled per backend service. Google says to deploy in preview mode first.
- Exploitation detection via Wiz Defend and Sensor
Misses: Detection logic not published. Wiz hunting guidance: multipart requests followed by memory-limit errors or repeated 500s; unexplained worker churn.
No shipped rule found for Apache AH00052 crash clusters per client. Build it.
02Request-body anomaly toward a PHP endpointMultipart body to a PHP URI carries the upload-progress field1111 detections
Detection logic
A multipart body to a PHP URI carries the upload-progress field. Alone that is feature use; it is an attempt only with a never-issued session id, an exploit-rule block, a paired worker fault, or one client across several URIs. PHP writes upload progress to the session before any script runs; don’t treat a request without a session cookie as benign. The field name is configurable (session.upload_progress.name, default PHP_SESSION_UPLOAD_PROGRESS), and PHP’s lenient multipart parsing can evade single-line field matching. Without bodies: one client sends multipart POSTs to many PHP URIs with 5xx or dropped responses.
Delta Tradecraft · DT-P2S-APP-008 ↗ (opens in a new tab)Logs it needs
- WAF, CDN or proxy body inspectionneeds setupbody-field match, rule action, client, URI
- Zeek or Suricata HTTP bodyneeds setupdecrypted traffic only
- Origin or proxy access logon by defaultmethod, URI, Content-Type, status (fallback only)
Shipped detections · 11
- PHP2SHELL:: notices for multipart header flood, large form key, serialized-data anomalies (body-sample field)
Misses: Zeek 7.0+; needs cleartext HTTP. TLS limits visibility; version cutoffs in the version notice are provisional.
- SID 3000650 (upload-progress field in the request)
Misses: TLS blinds the sensor unless it sits after termination.
- ModSecurity rule set 3201001-3201004 and 3101004-3101009
Misses: Rule text is published inline; Abstract says it verified the rules against PoC request shapes (not tested by us); 3201004 logs and correlates only.
- Suricata rule set 1001201-1001204 and 1001103-1001107
Misses: Rule text published inline; Abstract says it verified the rules against PoC request shapes (not tested by us). 1001204 logs and correlates only.
- PHP Remote Code Execution Attack Detected (CVE-2026-109618, CVE-2026-109619), rule 3000991 v1
Misses: No body.
- Talos lists Snort SIDs 67359, 67360 and 67375 for subscribers; 67359 and 67360 are also in the free Community Ruleset.
Misses: Covered for subscribers, with free rules in the Community Ruleset; what they match is not stated. TLS blinds the sensor unless it sits after termination.
- Generic Rules - Anomalous Execution - 1 to 7 (Free and Managed rulesets)
Misses: Live 03:02 UTC 21 Oct; what each rule matches is not stated; Cloudflare reports attackers mutating payloads to evade the rules.
- CVE-specific templated rule (virtual patch)
Misses: Opt-in; no id; matching not stated. Signal only; no rule body published.
- Cloud Armor managed rules, at minimum the File Upload and RFI categories (protection automatic for customers with active managed rules)
Misses: Decisions appear in the application load balancer logs in Cloud Logging only after load-balancer request logging is enabled per backend service. Google says to deploy in preview mode first.
- Inspection of anomalous multipart payloads, upload-progress activity and repeated session fields
Misses: No rule id. Rule ids not published for this CVE pair.
- Named as detecting attempts
Misses: Rule names not given. Encrypted traffic limits.
On the host
04PHP worker spawns an unusual child processphp-fpm / lsphp / php-cgi / mod_php starts a shell, interpreter, downloader or recon tool1818 detections
Detection logic
A PHP-hosting parent (php-fpm, lsphp, php-cgi or a mod_php web server) starts a shell, interpreter, downloader or recon tool that is not in that host’s baseline. A shell is never baselined alone, since PHP string commands start one; compare its command and children. Code execution as the worker is shown end to end on Apache mod_php.
Delta Tradecraft · DT-P2S-APP-001 ↗ (opens in a new tab)Logs it needs
- EDR process creationneeds setupparent and child image, command line, user, host
- auditd execveneeds setupsyscall=execve, euid / auid, ppid, exe
- Container runtime process eventsneeds setupcontainer and pod identity
Shipped detections · 18
- Web Server Exploitation Detected via Defend for Containers
Misses: Containers only; generic pre-existing rule.
- Unusual Child Execution via Web Server
Misses: Generic pre-existing rule read in the repo. Parents include php-fpm*, lsphp*, php-cgi; new_terms needs a baseline.
- Suspicious Child Execution via Web Server
Misses: Generic pre-existing rule read in the repo. Misses code that runs inside PHP without starting a process.
- Suspicious Command Execution via Web Server
Misses: Generic pre-existing rule read in the repo. Misses code that runs inside PHP without starting a process.
- Unusual Command Execution via Web Server
Misses: Generic pre-existing rule read in the repo. Misses code that runs inside PHP without starting a process.
- Run shell untrusted (Web Server Spawned Shell lineage)
Misses: Stable rule read: ancestors are nginx, httpd, httpd-foregroun, lighttpd, apache and apache2; no php-fpm, php-cgi or lsphp. Generic, not PHP2Shell-specific.
- Web Server Spawned Shell (sandbox maturity; not loaded by default; parents include php-fpm, php, php-cgi, php7, php8)
Misses: Sandbox rules are not loaded by default.
- Webshell Remote Command Execution (Sigma c0d3734d)
Misses: Generic pre-existing rule: needs -F euid=33 audit rule and keys on uid 33 only; not tied to a PHP worker. Not PHP2Shell coverage.
- Linux Webshell Indicators (Sigma 818f7b24)
Misses: Generic: parents httpd, lighttpd, nginx, apache2, node, caddy; no php-fpm; recon children only. Not PHP2Shell coverage. Coverage varies by distro.
- Webshell Detection With Command Line Keywords (Sigma bed2a484)
Misses: Windows-only; php-cgi.exe among parents. Generic, not PHP2Shell coverage. Needs deployment and tuning.
- Web or Application Server Spawning a Shell
Misses: Generic; Linux parent list omits php-fpm, php-cgi and lsphp; Windows list includes php-cgi.exe. Misses code that runs inside PHP without starting a process.
- Linux - Web Server Spawning Suspicious Shell
Misses: Generic content; source telemetry not stated. Misses code that runs inside PHP without starting a process.
- Existing IOAs: suspicious child processes of PHP/web server processes (unnamed)
Misses: Generic shipped IOAs, not credited as PHP2Shell-specific; rule bodies unseen. Misses code that runs inside PHP without starting a process.
- Shell or Recon Tool Spawned by PHP Worker (Sigma)
Misses: Parent list lacks FrankenPHP and Windows parents.
- potential_web_shell_v2 / potential_web_shell_parent_v2
Misses: Article claims out-of-the-box coverage; rule definitions unread; php-fpm parent not established.
- Container / Cloud Run threat detection named for affected workloadsGoogle Cloud Security Command Center threat detectionGenericvendor-statedSource ↗ (opens in a new tab)
Misses: Detections not described.
- Named as detecting exploitation attempts
Misses: Rule names not given. Misses code that runs inside PHP without starting a process.
- Suspicious shell command execution; hunting queries Web Server Spawning Shell, Unexpected Shell from Backend Workers
Misses: From an April 2026 cookie-controlled PHP webshell post, not PHP2Shell. Misses code that runs inside PHP without starting a process.
05Web user writes a script into the web rootWeb account drops an executable script into a served path, then it receives POSTs77 detections
Detection logic
The web account writes an executable script into a served path outside deploy windows; raise when a POST to the new path follows soon after. Webshells and new web-root files are on the list of things to check.
Delta Tradecraft · DT-P2S-HOST-002 ↗ (opens in a new tab)Logs it needs
- EDR file create and renameneeds setuppath, extension, writing process and account
- auditd file watches or FIM on served pathsneeds setuppath, auid, exe, hash
- Access logon by defaultfirst-seen URI that starts receiving successful POSTs
Shipped detections · 7
- Unusual File Creation via Web Server
Misses: Generic pre-existing rule. Misses code that runs inside PHP without starting a process.
- Potential Polyglot Bypass File Created by Web Server
Misses: Generic pre-existing rule. Misses code that runs inside PHP without starting a process.
- File with Suspicious Double Extension Created by Web Server
Misses: Generic pre-existing rule. Double-extension only. Misses code that runs inside PHP without starting a process.
- File with High Entropy Created by Web Server
Misses: Generic pre-existing rule. Process/extension fields read; entropy logic not read. Misses code that runs inside PHP without starting a process.
- PHP File Creation in WordPress Plugin Directory
Misses: Generic pre-existing rule. Path logic not read in full. Misses code that runs inside PHP without starting a process.
- Existing IOAs: web shell deployment (unnamed)
Misses: Generic shipped; rule bodies unseen. Misses code that runs inside PHP without starting a process.
- Possible Web Server compromise activity; hunting queries Base64 Decode Writing PHP File, tee Writing PHP Files
Misses: From an April 2026 post, not PHP2Shell. Misses code that runs inside PHP without starting a process.
06Web user writes a PHP settings overrideWeb account creates or edits .user.ini / .htaccess outside deploy windowsNo rule · build itNo rule · build it
Detection logic
The web account creates or edits a per-directory PHP override (.user.ini, .htaccess) outside deploy windows; raise when an engine directive is added. Application-file changes are on the post-compromise review list.
Delta Tradecraft · DT-P2S-HOST-003 ↗ (opens in a new tab)Logs it needs
- EDR or auditd file eventsneeds setuppath, writing process, effective user
- FIM with prior-content storageneeds setupdiff of the override file
Shipped detections · 0
No shipped rule found. Build it.
07PHP worker connects out to a new destinationPHP worker or its child reaches a destination absent from the 30-day baselineNo rule · build itNo rule · build it
Detection logic
A PHP worker or its child connects to a destination absent from the host group’s 30-day baseline; raise when the initiator is a shell or downloader child. Unusual outbound connections are on the review list.
Delta Tradecraft · DT-P2S-APP-004 ↗ (opens in a new tab)Logs it needs
- EDR network connect eventsneeds setupinitiating process and parents, remote IP, port
- DNS resolver logsneeds setuphost and name, no process
- Flow and egress proxy logsneeds setupdestination, port, bytes, allow or deny
Shipped detections · 1
- Deprecated - Uncommon Destination Port Connection by Web Server
Misses: Deprecated 2026-07-02; name and deprecation date only; not a current rule. Misses code that runs inside PHP without starting a process.
No current shipped rule found; the one generic rule is deprecated. Build it.
08Web user adds a scheduled jobcrontab / at / systemd-run under the web account or a PHP worker11 detection
Detection logic
A scheduler tool runs as the web account or under a PHP worker with arguments that create or change a job (read-only calls are discovery), or a cron spool or unit file is written with the web account’s real user id or PHP lineage (setuid crontab writes as root). Cron jobs are on the check list. Condition: on shared or panel hosting the worker can run as the site owner’s login account, which edits its own crontab, so separate by process lineage.
Delta Tradecraft · DT-P2S-HOST-005 ↗ (opens in a new tab)Logs it needs
- EDR process creationneeds setupcrontab, at, systemd-run with acting user
- auditd or EDR file events on scheduler storesneeds setuppath, real and effective user, operation
Shipped detections · 1
- Suspicious cron job
Misses: Covers a cron job created by a hosting control panel process (vendor-stated); no web-account linkage. Generic, not PHP2Shell-specific.
09Web user adds an account, group member or SSH keyAccount, group, sudoers or authorized_keys change with PHP lineageNo rule · build itNo rule · build it
Detection logic
An account or key tool runs with PHP lineage and arguments that make a change (status or list calls are discovery), or one of those files is written with the web account’s real user id or PHP lineage (identity files are root-owned). New accounts are on the check list. Condition: on shared hosting the site owner’s account may edit its own keys, so separate by lineage.
Delta Tradecraft · DT-P2S-HOST-006 ↗ (opens in a new tab)Logs it needs
- Host auth and account logon by defaultaccount and group changes
- auditd or EDR file eventsneeds setuppasswd, shadow, group, sudoers, every authorized_keys sshd reads
Shipped detections · 0
No shipped rule found. Build it.
10PHP host secrets used from somewhere elseA PHP host's cloud key, DB account or session is used from an unknown sourceNo rule · build itNo rule · build it
Detection logic
A PHP host’s cloud key, database account or session is used from a source outside its baseline. Only a successful sign-in shows the credential was used; a failed one is an attempt. Unauthenticated disclosure of worker memory is demonstrated, and credential exposure is on the review list.
Delta Tradecraft · DT-P2S-APP-010 ↗ (opens in a new tab)Logs it needs
- IdP sign-in logson by defaultinclude non-interactive sign-ins; service-principal sign-ins are a separate log you must enable
- Cloud audit logson by defaultmanagement events; data events need enabling
- Database connection logsneeds setupaccount, client IP, result
Shipped detections · 0
No shipped rule found. Build it.
Exposure
11Unpatched PHP, or patched but workers not restartedControl check: any worker started before the fixed package was installed1212 detections
Detection logic
Mark exposed any worker started before the fixed package was installed. An older master is unknown until the running build is checked: workers fork from it, and an FPM graceful reload keeps its start time. php -v may report a different installation from the one serving web requests.
Delta Tradecraft · DT-P2S-ESTATE-011 ↗ (opens in a new tab)Logs it needs
- Package and image inventoryon by defaultPHP build and install time
- Process start timeson by defaultevery PHP worker and master
- Version scans and bannersyou build itinternet-facing hosts
Shipped detections · 12
- PHP2SHELL::Potentially_Affected_PHP_Version
Misses: Inventory only; cutoffs provisional; backports keep old strings.
- SIDs 3000651 and 3000652 (PHP version in response header or phpinfo)
Misses: Inventory only, not attack detection. Cutoffs provisional.
- Banner-based and sensor-based assessment of vulnerable PHP versions
Misses: Version-based; backports can false-positive.
- Finding query for both CVEs
Misses: Version-based; backports can false-positive.
- Vulnerability scanning for the CVEsGoogle Cloud Artifact Analysis / On-Demand ScanningPHP2Shellvendor-statedSource ↗ (opens in a new tab)
Misses: Version-based; backports can false-positive.
- SCA coverage for both CVEs (no ids)
Misses: Version-based; backports can false-positive.
- QIDs 389102, 39033, 5019895 and 5019896 (QID 45110 is discovery only)
Misses: Version-based; backports can false-positive.
- Remote unauthenticated vulnerability checks (no ids)Rapid7 Exposure Command / Vulnerability ManagementPHP2Shellvendor-statedSource ↗ (opens in a new tab)
Misses: Version-based; backports can false-positive.
- Generic.Applications.PHPInventory
Misses: Inventory. Backports keep old version strings.
- Plugins for PHP 8.5.x < 8.5.12, 8.4.x < 8.4.27, 8.3.x < 8.3.36, 8.2.x < 8.2.35
Misses: Version-based; backports can false-positive.
- PHP detection plugins (inventory, not CVE checks)
- Built-in coverage for agentless and runtime vulnerability detection
Misses: Advisory not read. Version-based; backports can false-positive.
All 31 detections written specifically for PHP2Shell either watch the exploit attempt at the edge or check your PHP version. Not one watches what happens on the host after an exploit succeeds. That side is covered only by generic web-shell and child-process rules that predate PHP2Shell, and five of the 11 procedures (the leaked session cookie, a PHP settings override, outbound connections from the worker, new accounts or SSH keys, and stolen secrets used elsewhere) have no current shipped rule at all.
The full research behind this map is open source as the PHP2Shell Delta Tradecraft pack: one object per procedure, 24 detection strategies in all, each covering how the behavior shows up in logs, the conditions it depends on, and how to detect it. Each procedure in the map above links to its object. Delta Tradecraft is our format for detection knowledge that travels between tools, so you can build the missing detections on whatever stack you run.
Want to know which of these 11 you'd catch today? Connect Spectrum and see your own coverage.