VORANT. Threat Intelligence Research Create a free account

CERT-FR warns of PHP RCE exploitation attempts

severe vulnerability Technology

Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.

CERT-FR reports active exploitation attempts against two critical PHP RCE vulnerabilities, with patches released and a third flaw still unpatched.

CERT-FR issued an alert on multiple critical PHP vulnerabilities affecting all PHP versions including unsupported 5.x, 7.x, 8.0.x and 8.1.x branches, as well as supported 8.2.x (before 8.2.35), 8.3.x (before 8.3.36), 8.4.x (before 8.4.27) and 8.5.x (before 8.5.12). CVE-2026-109618 and CVE-2026-109619 allow remote arbitrary code execution; patches were released by PHP on 21 October 2026. CERT-FR has since confirmed in-the-wild exploitation attempts against specific PHP deployments targeting these two CVEs, and proof-of-concept code is publicly known (referenced via NCSC-NL's php2shell GitHub repository). A third vulnerability, CVE-2026-115560, disclosed 23 October 2026, also permits remote code execution but the vendor assesses exploitation requires an unlikely combination of configuration and application code; a fix is deferred to the next regular PHP release cycle.

Defenders running unsupported PHP versions (5.x/7.x/8.0.x/8.1.x) have no patch available and should isolate affected systems and migrate to maintained, patched versions. For CVE-2026-109619, CERT-FR notes an unqualified temporary mitigation: disabling session.upload_progress in php.ini (and php_admin_flag for PHP-FPM), plus WAF-level blocking or monitoring of HTTP requests with Content-Type: multipart headers. CERT-EU has also issued a related advisory, and CERT-FR references its network edge equipment compromise containment playbook, suggesting these PHP services may be exposed on network perimeters.

Given the combination of public PoC availability, confirmed in-the-wild exploitation attempts, and the widespread use of PHP across web applications and embedded products, this represents a significant and urgent patching priority for any organization running affected PHP deployments.

Mentioned in this report

Vulnerabilities CVE-2026-109618templatedCVE-2026-109619CVE-2026-115560

Related reporting

Detection guidance

Linux Web or PHP Process Spawning Shell With Download or Reverse-Shell Arguments

ATT&CK T1190

PHP-FPM, PHP-CGI, Apache, httpd or nginx spawning a shell whose command line downloads a payload or opens a reverse shell, as seen after PHP RCE exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Linux Web or PHP Process Spawning Shell With Download or Reverse-Shell Arguments
description: Detects PHP and web server worker processes spawning a shell with payload-download,
  decode or reverse-shell arguments. This is typical post-exploitation behaviour after
  remote code execution in a public-facing PHP application, such as the PHP RCE CVEs
  described by CERT-FR.
tags:
- attack.initial-access
- attack.t1190
- attack.execution
- attack.t1059.004
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|contains:
    - /php-fpm
    - /php-cgi
    - /apache2
    - /httpd
    - /nginx
  selection_parent_php:
    ParentImage|endswith: /php
  selection_child:
    Image|endswith:
    - /sh
    - /bash
    - /dash
  selection_cmd:
    CommandLine|contains:
    - 'curl '
    - 'wget '
    - /dev/tcp/
    - base64 -d
    - chmod +x
    - mkfifo
    - nc -e
    - bash -i
  condition: 1 of selection_parent* and selection_child and selection_cmd
falsepositives:
- PHP applications that legitimately shell out to curl or wget for updates or backups
- Web-based admin panels that run maintenance scripts through the shell
level: medium
id: 2177b089-4d18-5fe7-a321-6c966571e2ba
status: experimental
author: Vorant
references:
- https://www.cert.cyber.gouv.fr/alerte/CERTFR-2026-ALE-014

Windows Web Server or PHP Process Spawning Shell With Recon or Download Commands

ATT&CK T1190

php-cgi, php, httpd, nginx or w3wp spawning cmd or PowerShell with reconnaissance, download or encoded-command arguments, indicating web-shell or RCE exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Windows Web Server or PHP Process Spawning Shell With Recon or Download Commands
description: Detects PHP and web server processes on Windows spawning cmd.exe or PowerShell
  with reconnaissance, download or encoded-command arguments. This is consistent with
  successful exploitation of a public-facing PHP application via RCE.
tags:
- attack.initial-access
- attack.t1190
- attack.execution
- attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
    - \php-cgi.exe
    - \php.exe
    - \httpd.exe
    - \nginx.exe
    - \w3wp.exe
  selection_child:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
  selection_cmd:
    CommandLine|contains:
    - whoami
    - net user
    - net localgroup
    - certutil
    - bitsadmin
    - Invoke-WebRequest
    - DownloadString
    - ' -enc'
    - FromBase64String
    - ipconfig /all
    - systeminfo
  condition: selection_parent and selection_child and selection_cmd
falsepositives:
- Administrators running diagnostic commands through a PHP-based admin or hosting
  control panel
- Legacy PHP applications that shell out to systeminfo or ipconfig for inventory
level: high
id: 686971c6-77e8-514e-94e6-a38022e03025
status: experimental
author: Vorant
references:
- https://www.cert.cyber.gouv.fr/alerte/CERTFR-2026-ALE-014

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cert.cyber.gouv.fr/alerte/CERTFR-2026-ALE-014

What this brief leaves out

This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.

It sits in a corpus of 14,237 reports from 143 sources, 591 of them written in the last seven days, and it grows through the day.

A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.

Create a free account   What it costs