--- title: "Threat Hunt Plan: PHP php2shell Unauthenticated Remote Code Execution — Web Server Exploitation and Post-Exploitation Hunt" description: "This hunt searches for exploitation and post-exploitation activity associated with the two critical PHP vulnerabilities disclosed on October 21, 2026, tracked as CVE-2026-109618 and CVE-2026-109619 and collectively nicknamed \"php2shell.\"" --- [Skip to content](https://1898advisories.burnsmcd.com/threat-hunt-plan-php-php2shell-unauthenticated-remote-code-execution-web-server-exploitation-and-post-exploitation-hunt#main-content) ![1898-logo-grey-R-1](https://1898advisories.burnsmcd.com/hs-fs/hubfs/1898-logo-grey-R-1.webp?width=188&height=100&name=1898-logo-grey-R-1.webp) - [Cyberthreat](https://1898advisories.burnsmcd.com/tag/cyberthreat) - [Threat Hunt](https://1898advisories.burnsmcd.com/tag/threat-hunt) - [View All](https://1898advisories.burnsmcd.com/) Open main navigation Close main navigation - [Cyberthreat](https://1898advisories.burnsmcd.com/tag/cyberthreat) - [Threat Hunt](https://1898advisories.burnsmcd.com/tag/threat-hunt) - [View All](https://1898advisories.burnsmcd.com/) - [Contact us](https://1898andco.burnsmcd.com/contact-us) [Contact us](https://1898andco.burnsmcd.com/contact-us) October 22, 2026 # Threat Hunt Plan: PHP php2shell Unauthenticated Remote Code Execution — Web Server Exploitation and Post-Exploitation Hunt ![Picture of The 1898 & Co. Team](https://1898advisories.burnsmcd.com/hs-fs/hubfs/1898%20Cyberthreat%20Advisory%20Blog%20Assets/1898-Co-Ampersand.png?width=50&name=1898-Co-Ampersand.png) [The 1898 & Co. Team](https://1898advisories.burnsmcd.com/author/1898-co-team) Date: 2026-10-21 | Revision 1.0 #### Hunt Objective and Scope This hunt searches for exploitation and post-exploitation activity associated with the two critical PHP vulnerabilities disclosed on October 21, 2026, tracked as CVE-2026-109618 and CVE-2026-109619 and collectively nicknamed "php2shell." Both are reachable without authentication by a crafted web request and yield remote code execution in the context of the PHP worker process (php-fpm, Apache mod\_php, or an IIS FastCGI php-cgi worker). The objective is to determine whether any internet-facing or internal PHP server was targeted or compromised before patches to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 were applied, and to confirm the patch and exposure state of the PHP estate. In scope: all hosts running any PHP version that serves web requests, including PHP embedded in third-party and vendor-supplied web applications, container images, and web appliances; the web, reverse-proxy, and load-balancer tier in front of them; and PHP-based engineering, HMI, and device-management web front ends that sit at the IT/OT boundary. Both Linux (the dominant PHP deployment) and Windows/IIS PHP hosts are in scope. Time window: 2026-10-07 00:00 UTC through present. Disclosure and patch release were both on 2026-10-21; the window is extended roughly two weeks earlier to catch pre-disclosure probing. No confirmed in-the-wild exploitation predating disclosure has been established, so the pre-disclosure portion is treated as a search for reconnaissance and attempt artifacts, not a claim that a campaign ran then. Data floor pre-flight (run before any event-based leg; record the oldest retained timestamp per family as a DATE, not a duration): `#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2|NetworkConnectIP4|NewScriptWritten|DnsRequest)$/ | groupBy([#event_simpleName], function=min(@timestamp, as=oldest), limit=max)`   Any portion of the window earlier than the measured data floor is Non-Conclusive for event-based clauses (process execution, outbound connection, DNS). State-based clauses — a web shell file that exists on disk now, an exposed instance observable in scan indices now, the installed PHP version now — can be re-queried as current state and are not bound by the floor. Each hypothesis below states which kind it is. #### Hypotheses and Hunt Procedures **Hypothesis 1:** An external actor can reach an internet-facing instance of PHP in the affected version range, observable as an exposed web service advertising a vulnerable PHP build in passive internet-scan indices. Execute FIRST; its output scopes the internal hypotheses. (State-based — current exposure, re-queried live.) **MITRE ATT&CK:** Reconnaissance | T1595 — Active Scanning | defender-side passive discovery of the PHP surface an actor would enumerate. Initial Access | T1133 — External Remote Services | an internet-facing PHP app is the actor's entry point. ICS | T0883 — Internet Accessible Device | a PHP engineering/HMI front end exposed to the internet. **Collection Queries** — passive external indices (STRICTLY passive; never probe target infrastructure; author unscoped first to prove the filter, then scope to owned ranges): `Shodan: http.component:"PHP"`   `"X-Powered-By: PHP/8."`   `// scope to owned space (apply after the filter is confirmed): net: org:"" asn:AS // paid tier only; otherwise triage the version banner by hand: vuln:CVE-2026-109619`   `Censys (CenQL — current host.services form; do NOT cross with the legacy services.* form, which returns zero rows with no error): host.services.software.product: "PHP"`   `host.services: (software.product: "PHP") // version triage field: host.services.software.version // scope: and (host.autonomous_system.asn = or host.ip: "")`   `Netlas (tie-breaker): http.headers.x_powered_by:PHP* // scope: AND host:`   `→ Cross-reference every exposed service and version against the CISA Known Exploited Vulnerabilities catalog (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) and this advisory's CVEs; a KEV match is a presumptive actor-associated initial-access risk. → Expected Positive shape: one or more owned, in-range public IPs returning a PHP X-Powered-By banner or a Censys software.product of PHP at a version at or below 8.5.11 / 8.4.26 / 8.3.35 / 8.2.34, corroborated in at least two engines.`   **Analysis Queries:** `- Attribute each hit with at least two independent ownership signals (PTR, ASN, certificate CN/SAN, WHOIS/RDAP, the org's own cloud inventory) before reporting; shared hosting and CDN break attribution in both directions, and an unattributable hit is Non-Conclusive, not a Negative. - Version-triage each banner against the affected range and record the index scan timestamp — a banner is stale in both directions, so an in-range banner is a prompt to verify current state and a fixed-version banner predating the window is not proof of safety. - Corroborate in at least two of Shodan / Censys / Netlas before escalating; absence from one index is evidence only that the index did not observe the host. - Historical pivot: establish whether the exposure spans the disclosure window (2026-10-21 onward); continuous exposure across it means the instance was presumptively enumerated. - Pivot every confirmed-owned in-range instance into Hypotheses 2–4 as a priority target and hunt it exhaustively; where it serves or reaches OT workloads, document the blast radius.`   **Control** — unscoped filter proof: run each engine filter with NO ownership scope first and confirm it returns the global PHP population (non-zero); only then add the net:/asn:/host.ip scope. A scoped zero is meaningful only once the unscoped filter is proven to match the product. **Verdict criteria:** Positive — at least one owned, in-range public instance at a vulnerable PHP version, corroborated in two engines and attributed by two ownership signals; Negative — no owned in-range instance after a full sweep of the complete public IP + cloud inventory AND the unscoped control non-zero; Non-Conclusive — hits unattributable, a single-engine-only result, or an incomplete public IP inventory; missing authoritative public IP/cloud asset inventory prevents determining whether an exposed instance is owned. **Hypothesis 2:** An unauthenticated attacker achieved remote code execution via php2shell, observable as a PHP worker process spawning a command shell or downloading tooling, in endpoint process telemetry. (Event-based — bounded by the data floor.) **MITRE ATT&CK:** Initial Access | T1190 — Exploit Public-Facing Application | the crafted request reaches the vulnerable PHP code path. Execution | T1059.004 — Command and Scripting Interpreter: Unix Shell (and T1059.003 Windows Command Shell on IIS) | RCE manifests as the web worker spawning an interpreter. **Collection Queries:** `CrowdStrike Falcon LogScale (CQL) — Linux web worker spawning a shell or download tool: #event_simpleName=ProcessRollup2 event_platform=Lin | ParentBaseFileName=/^(php-fpm.*|php[0-9.]*|httpd|apache2|nginx|caddy)$/i | FileName=/^(sh|bash|dash|ksh|zsh|python[0-9.]*|perl|ruby|curl|wget|nc|ncat|socat)$/i | table([aid, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine], limit=20000)`   `CrowdStrike Falcon LogScale (CQL) — Windows/IIS PHP worker spawning a shell or LOLBin: #event_simpleName=ProcessRollup2 event_platform=Win | ParentBaseFileName=/^(php-cgi\.exe|php\.exe|w3wp\.exe|httpd\.exe)$/i | FileName=/^(cmd\.exe|powershell\.exe|pwsh\.exe|wscript\.exe|cscript\.exe|certutil\.exe|bitsadmin\.exe|curl\.exe)$/i | table([aid, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine], limit=20000) → Expected Positive shape: a ProcessRollup2 row whose parent is a PHP/web worker and whose child is an interpreter or download utility, with a CommandLine carrying shell flags (sh -i, -c, IEX, -enc) or a remote URL.`   `BPF packet capture — outbound sessions from a web server (substitute 203.0.113.10 with the real web-server IP; repeat the whole primitive in each VLAN branch; pair with the unscoped control below): tcpdump -i any -n -w /captures/php_out_%Y%m%d_%H%M%S.pcap -G 3600 -C 100 '(host 203.0.113.10 and (tcp[tcpflags] & tcp-syn != 0) and not (dst net 10.0.0.0/8 or dst net 172.16.0.0/12 or dst net 192.168.0.0/16)) or (vlan and host 203.0.113.10 and (tcp[tcpflags] & tcp-syn != 0) and not (dst net 10.0.0.0/8 or dst net 172.16.0.0/12 or dst net 192.168.0.0/16))'`   `tcp​dump -i any -n -c 5000 -w /captures/control_all.pcap '(ip) or (vlan and ip)'`   `Datadog — Log Search (log-based visibility of the web worker): source:php-fpm status:error "execvp" // time range: 2026-10-07T00:00Z to current`   `source:nginx (@http.status_code:>=500 OR message:"upstream prematurely closed") // time range: 2026-10-07T00:00Z to current`   `Datadog — Live Process Monitoring (Infrastructure > Processes — NOT a log source): command:sh user:www-data`   `command:php-fpm user:www-data // Fallback where Live Process Monitoring is not enabled: source:kubernetes @kubernetes.container_name:php-fpm message:"/bin/sh" // time range: 2026-10-07T00:00Z to current`   `Windows Event IDs (IIS PHP hosts): - 4688 (A new process has been created) — Sysmon equivalent EID 1; collect where NewProcessName is a shell/LOLBin and ParentProcessName is php-cgi.exe or w3wp.exe - 4104 (PowerShell script block logging) — script content launched under the IIS worker Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4688; StartTime=(Get-Date).AddDays(-14)} | Where-Object { $_.Message -match 'php-cgi\.exe|w3wp\.exe' -and $_.Message -match 'cmd\.exe|powershell\.exe|pwsh\.exe|certutil\.exe' } | Select-Object TimeCreated, Message | Export-Csv -NoTypeInformation php_child_procs.csv`   `OT Data Collection: Armis Centrix — enumerate OT-network web servers that could host PHP engineering/HMI front ends (Armis fingerprints the HTTP service, not the PHP version; pivot the result into the EASM banner triage and the CQL legs): in:devices role:Server protocol:HTTP,HTTPS`   `OT Data Collection: Claroty CTD / Dragos / Nozomi Guardian — export the asset inventory filtered to assets exposing HTTP/HTTPS management interfaces in the engineering and HMI zones, and correlate their addresses against the CQL and capture legs above; where an interface is PHP-based, treat it as in scope for Hypotheses 2–4.`   **Analysis Queries:** `CrowdStrike Falcon LogScale (CQL) — outbound connections attributed to a PHP/web worker (reverse-join: ProcessRollup2 is primary and matched as /ProcessRollup2/ so a long-lived worker that started before the window is still attributed via SyntheticProcessRollup2; key includes aid): #event_simpleName=/ProcessRollup2/ event_platform=Lin | ImageFileName=/(php-fpm|php[0-9.]*$|httpd|apache2|nginx|caddy)/i | join({#event_simpleName=NetworkConnectIP4 | !cidr(RemoteAddressIP4, subnet=["10.0.0.0/8","172.16.0.0/12","192.168.0.0/16"])}, field=[aid, TargetProcessId], key=[aid, ContextProcessId], include=[RemoteAddressIP4, RemotePort], mode=inner) | groupBy([aid, ComputerName, ImageFileName, RemoteAddressIP4, RemotePort], function=count(as=hits), limit=max) | sort(hits, order=desc, limit=200) → Expected Positive shape: a PHP/web worker image with outbound connections to a public IP it has no business reaching (a raw-IP destination, a non-standard high port, or a known download/C2 host).`   `Datadog — Log Analytics: Table view, group by @network.client.ip; time range 2026-10-07T00:00Z to current: source:cloudtrail @evt.name:(GetObject OR PutObject) -@network.client.ip:10.* -@network.client.ip:172.16.* -@network.client.ip:192.168.*`   `Datadog — Monitor (one per hypothesis): Type: Log Alert Query: source:php-fpm "execvp" OR (source:kubernetes @kubernetes.container_name:php-fpm message:"/bin/sh") Evaluation window: last 5 minutes Alert condition: count > 0 Message: "ALERT: PHP worker spawned a shell — possible php2shell RCE, investigate immediately @soc-pagerduty" Prerequisites: php-fpm / nginx / Apache logs and (where used) kubernetes container logs forwarded to Datadog; process-exec visibility (4688/Sysmon-1 on Windows) enabled.`   `Windows Event Log — PowerShell analysis: Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-PowerShell/Operational'; Id=4104; StartTime=(Get-Date).AddDays(-14)} | Where-Object { $_.Message -match 'IEX|Invoke-Expression|DownloadString|FromBase64String|-enc' } | Select-Object TimeCreated, Message | Export-Csv -NoTypeInformation iis_php_ps_blocks.csv`   `YARA — scan live PHP worker process memory f​or reverse-shell / in-memory RCE artifacts (classic YARA 4.5; PID is the positional target, there is no -p flag; SeDebugPrivilege / root required): f​or pid in $(pgrep -f 'php-fpm|php-cgi|apache2|httpd'); d​o ya​ra /opt/hunt/rules/php2shell_mem.yar $pid >​>​ /opt/hunt/php2shell_mem_hits.txt; do​ne // CrowdStrike Falcon RTR or a Custom IOA can execute this rule on remote hosts without manual PID enumeration.`   **Control** — event-family and field presence: confirm process telemetry exists for the web hosts in-window before reading any zero. `#event_simpleName=ProcessRollup2 event_platform=Lin | ParentBaseFileName=/./ | count()`   A zero child-process result is Negative only if this control is non-zero; a zero or unrun control is Non-Conclusive. **Verdict criteria:** Positive — a PHP/web worker observed spawning an interpreter or download utility, or making an unexplained external connection, on an in-scope host; Negative — no such process or connection AND the ProcessRollup2 control non-zero across the web hosts for the in-floor window; Non-Conclusive — the control is zero/unrun, the host lacks the Falcon sensor, or the event predates the data floor; missing endpoint process telemetry on a web host prevents determining whether RCE executed there. **Hypothesis 3:** Following RCE, an attacker wrote a web shell or other malicious PHP file into a web-accessible directory, observable as a new or modified script file authored by the web-server account and as web-shell content on disk. (Collection is event-based for the write event and state-based for the file now resident on disk — both are run.) **MITRE ATT&CK:** Persistence | T1505.003 — Server Software Component: Web Shell | a planted PHP file gives durable command execution independent of the original memory-corruption trigger. **Collection Queries:** `CrowdStrike Falcon LogScale (CQL) — new script/PHP files written under web roots by a web worker (NewScriptWritten carries ContextProcessId, not ImageFileName — attribute via the reverse-join if the writer must be named): #event_simpleName=NewScriptWritten event_platform=Lin | TargetFileName=/\/(var\/www|srv\/www|usr\/share\/nginx|opt\/.*\/(web|html|public))\/.*\.(php|phtml|php[0-9]|phar|inc)$/i | table([aid, ComputerName, UserName, TargetFileName, ContextProcessId], limit=20000)`   `CrowdStrike Falcon LogScale (CQL) — Windows/IIS web-root PHP/script writes: #event_simpleName=/^(NewScriptWritten|PeFileWritten|NewExecutableWritten)$/ event_platform=Win | TargetFileName=/\\(inetpub\\wwwroot|wwwroot|htdocs)\\.*\.(php|phtml|phar|aspx|asp)$/i | table([aid, ComputerName, UserName, TargetFileName, ContextProcessId], limit=20000) → Expected Positive shape: a .php/.phtml/.phar file written under a web root by the www-data / apache / IIS worker account at a time outside any deployment or release window.`   `YARA — recursive filesystem scan of web roots f​or web-shell content (classic YARA 4.5; -r recursive): ya​ra -r /opt/hunt/rules/php2shell_disk.yar /var/www /srv/www /usr/share/nginx >​>​ /opt/hunt/php2shell_disk_hits.txt`   `ya​ra -r /opt/hunt/rules/php2shell_disk.yar "C:/inetpub/wwwroot" >​>​ C:/hunt/php2shell_disk_hits.txt`   `Datadog — Log Search (file-integrity / audit source for web-root writes): source:auditd @file.path:/var/www/* @syscall:(open OR openat OR rename) "www-data" // time range: 2026-10-07T00:00Z to current`   `Windows Event IDs: - 4663 (An attempt was made to access an object) with a SACL on the web root — captures the IIS worker writing a .php/.aspx file Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4663; StartTime=(Get-Date).AddDays(-14)} | Where-Object { $_.Message -match 'wwwroot|htdocs' -and $_.Message -match '\.php|\.phtml|\.phar|\.aspx' } | Select-Object TimeCreated, Message | Export-Csv -NoTypeInformation webroot_writes.csv`   `OT Data Collection: Dragos Platform / Nozomi Guardian — export file-transfer and HTTP-upload activity to engineering/HMI web servers in the hunt window and correlate timestamps with the web-root write events above.`   **Analysis Queries:** `CrowdStrike Falcon LogScale (CQL) — rank web-root script writers by rarity (a bulk deploy is common; a single off-hours write is the hunt target): #event_simpleName=NewScriptWritten event_platform=Lin | TargetFileName=/\.(php|phtml|phar|inc)$/i | groupBy([ComputerName, TargetFileName], function=count(as=writes), limit=max) | sort(writes, order=asc, limit=100) → Expected Positive shape: a web-accessible PHP file written once, recently, on a single host, with a short/random basename and no corresponding change ticket.`   `Datadog — Log Analytics: Top List view, group by @file.path; sort ascending (rarest first); time range 2026-10-07T00:00Z to current: source:auditd @file.path:/var/www/* @syscall:(open OR openat OR rename OR write)`   `Datadog — Monitor: Type: Log Alert Query: source:auditd @file.path:/var/www/* @syscall:(rename OR openat) "www-data" "*.php" Evaluation window: last 10 minutes Alert condition: count > 0 Message: "ALERT: web-server account wrote a PHP file under the web root — possible web shell @soc-pagerduty" Prerequisites: auditd (or a FIM agent) with a watch rule on the web-root paths forwarded to Datadog.`   `Windows Event Log — PowerShell hunting for recently created web-root scripts: Get-ChildItem -Path 'C:\inetpub\wwwroot' -Recurse -Include *.php,*.phtml,*.phar,*.aspx -ErrorAction SilentlyContinue | Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-14) } | Select-Object FullName, LastWriteTime, Length | Export-Csv -NoTypeInformation recent_webroot_scripts.csv`   `YARA — memory scan of the running worker f​or a loaded/compiled web-shell body (same rule set, process target): f​or pid in $(pgrep -f 'php-fpm|php-cgi'); d​o ya​ra /opt/hunt/rules/php2shell_disk.yar $pid >​>​ /opt/hunt/php2shell_disk_mem_hits.txt; do​ne`   **Control** — event-family presence on the web-root write family: `#event_simpleName=NewScriptWritten event_platform=Lin | TargetFileName=/./ | head(1)`   If this returns nothing, NewScriptWritten is not retained/forwarded for these hosts and a zero web-shell result is Non-Conclusive, not Negative. **Verdict criteria:** Positive — a web-accessible PHP/script file written by the web-server account outside a deployment window, or a YARA web-shell hit on disk or in memory, on an in-scope host; Negative — no such file or hit after a full scan of all web roots AND the NewScriptWritten control non-zero; Non-Conclusive — the write-event family is absent/unforwarded or the filesystem scan could not reach a host; missing file-write telemetry or scan coverage prevents determining whether a web shell was planted. **Hypothesis 4:** Exploitation attempts — successful or not — destabilized the PHP runtime, observable as repeated php-fpm / Apache / IIS worker crashes and respawns in web-server and OS logs. (Event-based — bounded by the data floor; an early, low-fidelity indicator that corroborates Hypotheses 2–3.) **MITRE ATT&CK:** Initial Access | T1190 — Exploit Public-Facing Application | memory-corruption exploitation of a public PHP endpoint commonly segfaults the worker before a reliable primitive is achieved. **Collection Queries:** `Datadog — Log Search (php-fpm worker crash / respawn): source:php-fpm ("child exited on signal" OR "child exited with code" OR "SIGSEGV" OR "has been disabled for") // time range: 2026-10-07T00:00Z to current`   `source:nginx "upstream prematurely closed connection while reading response header from upstream" // time range: 2026-10-07T00:00Z to current`   `CrowdStrike Falcon LogScale (CQL) — rapid worker process churn (short-lived php-fpm workers ending and restarting far above baseline): #event_simpleName=ProcessRollup2 event_platform=Lin | ImageFileName=/php-fpm/i | groupBy([ComputerName], function=count(as=starts), limit=max) | sort(starts, order=desc, limit=100) → Expected Positive shape: a web host whose php-fpm worker start count for the window is many multiples of its peer hosts or its own prior baseline, clustered in time with inbound requests.`   `Linux OS logs: journalctl -u php8.2-fpm --since "2026-10-07" | grep -iE "segfault|signal 11|child exited"`   `dm​esg -T | gr​ep -iE "php-fpm|php-cgi|apache2|httpd" | gr​ep -iE "segfault|general protection"`   `Windows Event IDs (IIS): - 1000 (Application Error) and 1001 (Windows Error Reporting) — php-cgi.exe or w3wp.exe faulting module Get-WinEvent -FilterHashtable @{LogName='Application'; Id=1000,1001; StartTime=(Get-Date).AddDays(-14)} | Where-Object { $_.Message -match 'php-cgi\.exe|w3wp\.exe|php8' } | Select-Object TimeCreated, Message | Export-Csv -NoTypeInformation php_app_faults.csv`   **Analysis Queries:** `Datadog — Log Analytics: Timeseries view, group by host; time range 2026-10-07T00:00Z to current — overlay worker-crash counts against inbound request volume to find crash bursts tied to specific source IPs: source:php-fpm ("child exited on signal" OR "SIGSEGV")`   `Datadog — Monitor: Type: Log Alert Query: source:php-fpm ("child exited on signal 11" OR "SIGSEGV") Evaluation window: last 15 minutes Alert condition: count > 10 Message: "ALERT: php-fpm worker crash burst — possible php2shell exploitation attempts @soc-pagerduty" Prerequisites: php-fpm error logs forwarded to Datadog; crash logging not suppressed by a low log level.`   `Windows Event Log — correlate fault bursts with IIS access logs: Get-WinEvent -FilterHashtable @{LogName='Application'; Id=1000; StartTime=(Get-Date).AddDays(-14)} | Group-Object { ($_.TimeCreated).ToString('yyyy-MM-dd HH') } | Sort-Object Count -Descending | Select-Object Name, Count | Export-Csv -NoTypeInformation php_fault_hourly.csv`   **Control** — event-family / log-source presence: `#event_simpleName=ProcessRollup2 event_platform=Lin | ImageFileName=/php-fpm/i | count()`   A zero crash/churn result is Negative only if this control (and the Datadog php-fpm source) is non-zero for the window; otherwise Non-Conclusive. **Verdict criteria:** Positive — a time-clustered burst of php-fpm/IIS worker crashes above baseline correlated with inbound requests from a common source during the window; Negative — no crash burst AND the worker-process control and php-fpm log source both non-zero; Non-Conclusive — crash logging suppressed, the php-fpm source not forwarded, or the events predate the floor; missing worker-crash telemetry prevents determining whether exploitation was attempted. A crash burst alone is an attempt indicator, not a compromise — it is corroborating, and does not by itself downgrade or upgrade the Hypothesis 2/3 verdicts. #### Threat Actor Profile Opportunistic and commodity actors are the most probable near-term threat. php2shell is an unauthenticated, network-reachable RCE in the single most widely deployed server-side web language, with proof-of-concept activity reported publicly and early exploitation attempts observed by at least one network provider around disclosure. This class of flaw is rapidly weaponized into mass-scanning and spray exploitation by botnet operators, cryptomining crews, and initial-access brokers who sell footholds onward; a planted web shell is the typical outcome, monetized through resale, cryptomining, or ransomware staging. Attribution at this stage is a vendor-cluster question at best, and no government attribution exists; claims of a specific named actor should be treated with skepticism until corroborated. A second tier is the targeted actor who uses a public PHP front end as a credential source and pivot: where a compromised PHP server authenticates into internal or OT segments, hunt authentications that originate FROM the web server's address into those segments, not only activity on the server itself. For critical-infrastructure and industrial operators, the relevant access path is a PHP-based engineering, historian, or device-management web interface reachable from the internet or from the corporate network — a foothold there can expose a route toward the operational environment, which is a finding in its own right regardless of confirmed follow-on activity. No malware family is specific to these CVEs; expect generic PHP web shells, reverse-shell one-liners, and off-the-shelf post-exploitation tooling rather than a bespoke implant. #### Data Sources Required **Endpoint:** CrowdStrike Falcon (ProcessRollup2 / SyntheticProcessRollup2, NetworkConnectIP4, NewScriptWritten and the per-file-type write families, DnsRequest) on all PHP web hosts; Windows Security 4688/4663, PowerShell 4104, and Application 1000/1001 on IIS hosts; Sysmon where deployed. Network: full-packet capture or NetFlow at the web tier, reverse-proxy and web-server access/error logs (nginx, Apache, IIS), and firewall egress logs. Host/OS: Linux auditd and journald/dmesg, php-fpm and PHP error logs, and a file-integrity watch on web-root paths. OT/ICS: Claroty CTD/xDome, Dragos, Nozomi Guardian, and Armis asset inventories and HTTP/management-interface activity for PHP front ends at the IT/OT boundary; historian and engineering-workstation web-access logs. External attack surface: the passive internet-scan indices queried read-only (Shodan, Censys, Netlas), the CISA Known Exploited Vulnerabilities catalog, and — required for attribution — the organization's authoritative public IP ranges and cloud asset inventory, without which an exposed instance cannot be confirmed as owned and the exposure determination cannot be made. #### Detection Signatures **SIGMA rule 1** (process\_creation) — PHP worker spawns a shell or download utility: `title: PHP Web Worker Spawns Shell or Download Utility (php2shell RCE) id: 7a1c4e02-9b3d-4f6a-8c21-5d0e7f2a1b44 status: experimental description: Detects a PHP/web worker process spawning a command interpreter or network download tool, consistent with php2shell (CVE-2026-109618 / CVE-2026-109619) exploitation. references: - https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching author: 1898 & Co. date: 2026-10-21 logsource: category: process_creation detection: selection_parent: ParentImage|endswith: - '/php-fpm' - '/apache2' - '/httpd' - '/nginx' - '\php-cgi.exe' - '\w3wp.exe' selection_child: Image|endswith: - '/sh' - '/bash' - '/python3' - '/perl' - '/curl' - '/wget' - '/ncat' - '\cmd.exe' - '\powershell.exe' - '\certutil.exe' condition: selection_parent and selection_child falsepositives: - Legitimate PHP applications that shell out (deployment hooks, image processing) — baseline per host level: high`   **SIGMA rule 2** (file\_event) — web shell written under a web root by the server account: `title: PHP File Written Under Web Root (possible web shell) id: c2f8b61a-3e74-4a90-9d15-6b8e0a2c7f31 status: experimental description: Detects creation of a PHP/PHAR file under a web-accessible directory, consistent with web-shell drop after php2shell RCE. references: - https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching author: 1898 & Co. date: 2026-10-21 logsource: category: file_event detection: selection: TargetFilename|contains: - '/var/www/' - '/srv/www/' - '/usr/share/nginx/' - '\inetpub\wwwroot\' - '\htdocs\' TargetFilename|endswith: - '.php' - '.phtml' - '.phar' - '.inc' condition: selection falsepositives: - Application deployments and package updates writing PHP files — suppress by known release process and account level: high`   **SIGMA rule 3** (network\_connection) — outbound connection initiated by a PHP worker: `title: Outbound Connection From PHP Web Worker to External Host id: 9e40d7b5-1a2c-4d38-b6f9-82c3e5a7014d status: experimental description: Detects a PHP/web worker initiating an outbound connection to a non-internal address, consistent with tool download or reverse shell after php2shell RCE. references: - https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching author: 1898 & Co. date: 2026-10-21 logsource: category: network_connection detection: selection: Image|endswith: - '/php-fpm' - '/apache2' - '/httpd' - '\php-cgi.exe' - '\w3wp.exe' filter_internal: DestinationIp|cidr: - '10.0.0.0/8' - '172.16.0.0/12' - '192.168.0.0/16' condition: selection and not filter_internal falsepositives: - Web apps making legitimate outbound API/webhook calls — baseline the destinations per app level: medium`   **Snort/Suricata rule 1** — web-shell command interaction over cleartext HTTP (local SID range; fires only where the sensor sees decrypted traffic — on HTTPS this requires TLS interception, inbound): `alert tcp any any -> $HTTP_SERVERS $HTTP_PORTS (msg:"PHP2SHELL possible web shell command parameter to PHP endpoint"; flow:to_server,established; http.method; content:"POST"; http.uri; content:".php"; nocase; http.request_body; content:"cmd="; nocase; classtype:web-application-attack; sid:1000001; rev:1; metadata:service http;)`   **Snort/Suricata rule 2** — reverse-shell egress from a server segment (detection\_filter rate-limits to repeated attempts; a one-shot connection may not cross the threshold): `alert tcp $HTTP_SERVERS any -> $EXTERNAL_NET any (msg:"PHP2SHELL possible reverse shell egress from web server segment"; flow:to_server,established; content:"uname -a"; fast_pattern; nocase; detection_filter:track by_src, count 1, seconds 60; classtype:trojan-activity; sid:1000002; rev:1;)`   **YARA rule 1** (disk) targets PHP source files whose body combines a command-execution sink (system, shell​\_exec, pass​thru, proc​\_open, po​pen, or eval) with request-controlled input ($\_​GET / $\_P​OST / $\_RE​QUEST / php://input). The condition requires the PHP open tag AND at least one sink AND at least one request source, so an ordinary page that merely reads $\_​GET for display, or an admin tool that shells out only on a hardcoded argument, does not satisfy all three branches — that is the false-positive mitigation. It runs over both disk (recursive web-root scan) and the compiled worker memory. `rule PHP_Webshell_Generic { meta: description = "Generic PHP web shell: command-exec sink fed by request input (php2shell post-exploitation)" author = "1898 & Co." date = "2026-10-21" reference = "CVE-2026-109618, CVE-2026-109619" strings: $php = "&" // descriptor redirection wiring shell to socket condition: 1 of ($sock*) and (1 of ($sh*) or $redir) }`   #### Indicators of Compromise **Network:** outbound connections initiated by a PHP/web worker process to external raw IP addresses, non-standard high ports, or known download/paste hosts; a burst of inbound requests to .php endpoints from a single source immediately preceding a worker crash burst or a child-process spawn. No fixed attacker IP, domain, or hash is published for these CVEs — the memory-corruption trigger has no stable network signature, so detection is behavioral. Host: a PHP/web worker (php-fpm, apache2, httpd, nginx, php-cgi.exe, w3wp.exe) as the parent of a shell, scripting interpreter, or download utility; a .php/.phtml/.phar file written under a web root by the web-server account outside a deployment window; php-fpm/IIS worker segfaults and respawns clustered in time. OT/operational: an internet- or corporate-reachable PHP-based engineering, historian, or HMI web interface at a vulnerable version; authentications originating FROM a PHP web server's address into engineering or control segments; unexpected file uploads or HTTP POST activity to an OT-zone web server during the window. External exposure: an owned public IP advertising a PHP X-Powered-By banner or Censys software.product of PHP at a version at or below 8.5.11 / 8.4.26 / 8.3.35 / 8.2.34, corroborated across two scan indices and attributed by two ownership signals, with exposure spanning the disclosure window. #### False Positive Baseline 1\. Legitimate PHP applications that shell out by design — image/PDF processing (ImageMagick, wkhtmltopdf), deployment and cron hooks, backup scripts — produce PHP-worker-to-shell lineage; baseline the expected child commands per host and suppress the known set. 2\. Application deployments, package manager updates (apt/yum/composer), and CI/CD release jobs legitimately write PHP files under web roots; suppress by the known release account, source host, and change window. 3\. Web applications that make legitimate outbound API, webhook, or payment-gateway calls from the PHP worker; baseline the expected destination hosts/ports per application before alerting on egress. 4\. php-fpm worker recycling under pm.max\_requests and normal 5xx responses under load resemble crash churn; distinguish a genuine SIGSEGV burst from ordinary recycling by signal code and correlation with a single inbound source. 5\. Security scanners and authorized vulnerability assessment tools (internal Nessus/Qualys/Burp) generate anomalous .php requests, cmd-like parameters, and malformed traffic; exclude known scanner source IPs and scan windows. 6\. EASM misattribution — a PHP banner on shared hosting, a CDN edge, or a carrier/provider ASN is not necessarily an owned asset; an unattributable hit is Non-Conclusive, never counted as an owned exposure. #### Escalation Criteria 1\. Any YARA hit on PHP\_Webshell\_Generic against a file under a web root or in a PHP worker's memory — engage IR immediately and preserve the file and process. 2\. Any YARA hit on PHP\_RCE\_ReverseShell\_Memory against a php-fpm / php-cgi / web-worker process — treat as active or attempted reverse shell; isolate the host and capture memory. 3\. A confirmed PHP/web worker spawning a shell, interpreter, or download utility (Hypothesis 2 Positive) on any in-scope host. 4\. A web-accessible PHP/script file written by the web-server account outside a deployment window (Hypothesis 3 Positive). 5\. An owned, in-range public PHP instance at a vulnerable version confirmed in two engines and attributed by two ownership signals (Hypothesis 1 Positive), especially where exposure spans the disclosure window or matches a KEV entry. 6\. Any of the above on, or reachable from, a host that authenticates into or serves an OT/engineering segment — escalate to the OT IR path and assess blast radius. 7\. Outbound connections from a PHP web worker to external infrastructure with no business justification, or authentications originating from a web server's address into internal/OT segments. #### Hunt Completion Criteria and Reporting The hunt is complete when every hypothesis has a recorded verdict derived from its Verdict criteria, each EASM hit has been attributed or marked Non-Conclusive, and every web host in scope has been covered by the endpoint and filesystem legs or explicitly recorded as uncovered. The report must give a per-hypothesis verdict; a residual finding in the low-fidelity crash leg (Hypothesis 4) does not by itself change the Hypothesis 2 or 3 verdicts. Make every absence claim from a single-predicate filter-and-count, never by reading a distribution table, and quote only queries whose LogScale status reads Done (a progressively rendered aggregate can look final while still partial — include the status bar in screenshots). Record every limitation with its direction: an IDS/IPS rule on an HTTPS service sees request URIs and bodies only where TLS is intercepted and only inbound; a host without the Falcon sensor (common on appliances and some web gateways) has no endpoint telemetry of its own; a PHP file-write family that is not forwarded yields a silent zero; EASM absence from an index means only that the index did not observe the host. Report every leg whose control was zero or not run as Non-Conclusive, naming the missing input, rather than as a clean Negative. Recommend making the external-exposure sweep a recurring control and confirming, at close, that the PHP estate is fully patched to 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 and that PHP 8.1 and earlier have been retired or isolated. #### Advisory IoC Reference | IOC Type | IOC | | --- | --- | | CVE | CVE-2026-109618 \| CVSS v4.0 9.2 \| PHP \< 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 \| Out-of-memory interruption leaves request data partially initialized, enabling unauthenticated remote code execution in the PHP worker. | | CVE | CVE-2026-109619 \| CVSS v4.0 9.2 \| PHP \< 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 \| Use-after-free of request-owned internal state enables unauthenticated remote code execution in the PHP worker. | | Threat Actor | None attributed — opportunistic/commodity mass-exploitation expected; no government attribution. Treat any named-actor claim with skepticism until corroborated. | | Malware | Generic PHP web shells, reverse-shell one-liners, and off-the-shelf post-exploitation tooling — no CVE-specific family published. | | Network IOC | None published in source material — the memory-corruption trigger has no stable network signature; monitor https://www.cisa.gov/known-exploited-vulnerabilities-catalog for KEV updates. | | File IOC | None published in source material (no fixed hashes/filenames) — hunt web-shell content behaviorally; monitor https://www.php.net/ and https://github.com/php/php-src/security/advisories for updates. | | Behavioral | PHP worker (php-fpm/apache2/httpd/nginx/php-cgi.exe/w3wp.exe) spawning sh/bash/python/perl/curl/wget/cmd.exe/powershell.exe. | | Behavioral | .php/.phtml/.phar file written under a web root by the web-server account outside a deployment window. | | Behavioral | Outbound connection initiated by a PHP web worker to an external raw IP, non-standard high port, or download/paste host. | | Behavioral | Time-clustered burst of php-fpm/IIS worker SIGSEGV crashes and respawns correlated with inbound requests from a common source. | | Behavioral | Owned public IP advertising a PHP banner/software.product at a version \<= 8.5.11 / 8.4.26 / 8.3.35 / 8.2.34, corroborated across two scan indices. | [Threat Hunt](https://1898advisories.burnsmcd.com/tag/threat-hunt) *The information in this cybersecurity advisory is provided "as is" for informational purposes only. 1898 & Co. does not provide any warranties or guarantees of any kind regarding this information. You assume all risks if you choose to rely on this information. In no event shall 1898 & Co. or its contractors or subcontractors be liable for any damages including, but not limited to, direct, indirect, special or consequential damages, arising out of, resulting from, or in any way connected with, this information, whether or not based upon warranty, contract, tort, or otherwise, whether or not arising out of negligence, and whether or not injury was sustained from, or arose out of the results of, or reliance upon the information* *1898 & Co. does not endorse any product or service, except as expressly stated otherwise. Any reference to products or processes does not constitute or imply 1898 & Co.’s endorsement or recommendation.* Subscribe ✕ Close   [Accessibility](https://1898andco.burnsmcd.com/accessibility)  |  [Privacy Statement](https://1898andco.burnsmcd.com/privacy) © 2026 1898 & Co., a part of Burns & McDonnell. All Rights Reserved. ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "The 1898 & Co. Team", "url" : "https://1898advisories.burnsmcd.com/author/1898-co-team" }, "dateModified" : "2026-10-22T14:33:37.454Z", "datePublished" : "2026-10-22T14:33:37.000Z", "headline" : "Threat Hunt Plan: PHP php2shell Unauthenticated Remote Code Execution — Web Server Exploitation and Post-Exploitation Hunt", "mainEntityOfPage" : { "@id" : "https://1898advisories.burnsmcd.com/threat-hunt-plan-php-php2shell-unauthenticated-remote-code-execution-web-server-exploitation-and-post-exploitation-hunt", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "//cdn2.hubspot.net/hub/477837/file-2585615236-jpg/Logo_1_Primary_2Color1.jpg" }, "name" : "Burns & McDonnell Engineering Co" } } ```