CVE-2026-109619 — PHP Stale Internal Request-State (PHP2Shell) Exploitation

// df00tech DF00-f53b66a903 · https://df00tech.com/detections/CVE-2026-109619 · licence: https://df00tech.com/detections/licence
// CVE-2026-109619 PHP2Shell: PHP worker spawning command interpreters or crashing under request load
let phpProcs = dynamic(["php","php-fpm","php-cgi","php8","php8.1","php8.2","php8.3","httpd","apache2","nginx"]);
let shells = dynamic(["sh","bash","dash","zsh","cmd.exe","powershell.exe","pwsh.exe","python","python3","perl","wget","curl"]);
DeviceProcessEvents
| where InitiatingProcessFileName in~ (phpProcs)
| where FileName in~ (shells)
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, AccountName, ProcessId, InitiatingProcessId
| order by Timestamp desc

``` df00tech DF00-f53b66a903 · https://df00tech.com/detections/CVE-2026-109619 · licence: https://df00tech.com/detections/licence ```
index=linux (sourcetype="linux_secure" OR sourcetype="syslog" OR sourcetype="osquery:results") (process_name IN ("php","php-fpm","php-cgi") OR parent_process_name IN ("php","php-fpm","php-cgi","httpd","apache2","nginx"))
| search (child_process IN ("sh","bash","dash","curl","wget","python","python3","perl") OR _raw="*segfault*" OR _raw="*child * exited on signal 11*")
| stats count values(child_process) as child_process values(parent_process_name) as parent min(_time) as firstTime max(_time) as lastTime by host user process_name
| where count > 0
| convert ctime(firstTime) ctime(lastTime)

// df00tech DF00-f53b66a903 · https://df00tech.com/detections/CVE-2026-109619 · licence: https://df00tech.com/detections/licence
process where event.type == "start" and
  process.parent.name in ("php", "php-fpm", "php-cgi", "httpd", "apache2", "nginx") and
  process.name in ("sh", "bash", "dash", "zsh", "curl", "wget", "python", "python3", "perl", "cmd.exe", "powershell.exe")

-- df00tech DF00-f53b66a903 · https://df00tech.com/detections/CVE-2026-109619 · licence: https://df00tech.com/detections/licence
SELECT QIDNAME(qid) AS event, sourceip, destinationip, username, "Process Name" AS process, "Parent Process Name" AS parent, payload
FROM events
WHERE ("Parent Process Name" ILIKE '%php%' OR "Parent Process Name" ILIKE '%httpd%' OR "Parent Process Name" ILIKE '%apache%' OR "Parent Process Name" ILIKE '%nginx%')
  AND ("Process Name" ILIKE '%/sh' OR "Process Name" ILIKE '%/bash' OR "Process Name" ILIKE '%curl%' OR "Process Name" ILIKE '%wget%' OR "Process Name" ILIKE '%python%')
  LAST 24 HOURS

// df00tech DF00-f53b66a903 · https://df00tech.com/detections/CVE-2026-109619 · licence: https://df00tech.com/detections/licence
_sourceCategory=*linux* OR _sourceCategory=*endpoint*
| where (parent_process matches /php|php-fpm|php-cgi|httpd|apache2|nginx/)
| where (process matches /\b(sh|bash|dash|curl|wget|python|python3|perl)\b/ OR _raw matches /segfault|exited on signal 11/)
| count by _sourceHost, user, parent_process, process
| sort by _count

// df00tech DF00-f53b66a903 · https://df00tech.com/detections/CVE-2026-109619 · licence: https://df00tech.com/detections/licence
rule cve_2026_109619_php2shell {
  meta:
    author = "argus"
    description = "PHP worker spawning shell/download utility - CVE-2026-109619 PHP2Shell"
    severity = "CRITICAL"
  events:
    $e.metadata.event_type = "PROCESS_LAUNCH"
    $e.principal.process.parent_process.file.full_path = /php|php-fpm|php-cgi|httpd|apache2|nginx/ nocase
    $e.target.process.file.full_path = /\/(sh|bash|dash|curl|wget|python3?|perl)$|cmd\.exe|powershell\.exe/ nocase
  condition:
    $e
}

// df00tech DF00-f53b66a903 · https://df00tech.com/detections/CVE-2026-109619 · licence: https://df00tech.com/detections/licence
#event_simpleName=ProcessRollup2
| in(field="ParentBaseFileName", values=["php", "php-fpm", "php-cgi", "httpd", "apache2", "nginx"])
| in(field="FileName", values=["sh", "bash", "dash", "curl", "wget", "python", "python3", "perl", "cmd.exe", "powershell.exe"])
| groupBy([aid, ComputerName, ParentBaseFileName, FileName, CommandLine])