# CERT-FR warns of PHP RCE exploitation attempts

Published: 2026-10-21 · Severity: severe · Sectors: Technology
Canonical: https://vorant.io/reports/7cba8aba-d89a-523e-92cb-1b407c3c722d/cert-fr-warns-of-php-rce-exploitation-attempts

> CERT-FR reports active exploitation attempts against two critical PHP RCE vulnerabilities, with patches released and a third flaw still unpatched.

CERT-FR issued an alert on multiple critical PHP vulnerabilities affecting all PHP versions including unsupported 5.x, 7.x, 8.0.x and 8.1.x branches, as well as supported 8.2.x (before 8.2.35), 8.3.x (before 8.3.36), 8.4.x (before 8.4.27) and 8.5.x (before 8.5.12). CVE-2026-109618 and CVE-2026-109619 allow remote arbitrary code execution; patches were released by PHP on 21 October 2026. CERT-FR has since confirmed in-the-wild exploitation attempts against specific PHP deployments targeting these two CVEs, and proof-of-concept code is publicly known (referenced via NCSC-NL's php2shell GitHub repository). A third vulnerability, CVE-2026-115560, disclosed 23 October 2026, also permits remote code execution but the vendor assesses exploitation requires an unlikely combination of configuration and application code; a fix is deferred to the next regular PHP release cycle.

Defenders running unsupported PHP versions (5.x/7.x/8.0.x/8.1.x) have no patch available and should isolate affected systems and migrate to maintained, patched versions. For CVE-2026-109619, CERT-FR notes an unqualified temporary mitigation: disabling session.upload_progress in php.ini (and php_admin_flag for PHP-FPM), plus WAF-level blocking or monitoring of HTTP requests with Content-Type: multipart headers. CERT-EU has also issued a related advisory, and CERT-FR references its network edge equipment compromise containment playbook, suggesting these PHP services may be exposed on network perimeters.

Given the combination of public PoC availability, confirmed in-the-wild exploitation attempts, and the widespread use of PHP across web applications and embedded products, this represents a significant and urgent patching priority for any organization running affected PHP deployments.

## Mentioned in this report

- Vulnerabilities: CVE-2026-109618 (templated), CVE-2026-109619, CVE-2026-115560

## Detection guidance (public sample)

### Linux Web or PHP Process Spawning Shell With Download or Reverse-Shell Arguments

ATT&CK: T1190

PHP-FPM, PHP-CGI, Apache, httpd or nginx spawning a shell whose command line downloads a payload or opens a reverse shell, as seen after PHP RCE exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Linux Web or PHP Process Spawning Shell With Download or Reverse-Shell Arguments
description: Detects PHP and web server worker processes spawning a shell with payload-download,
  decode or reverse-shell arguments. This is typical post-exploitation behaviour after
  remote code execution in a public-facing PHP application, such as the PHP RCE CVEs
  described by CERT-FR.
tags:
- attack.initial-access
- attack.t1190
- attack.execution
- attack.t1059.004
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|contains:
    - /php-fpm
    - /php-cgi
    - /apache2
    - /httpd
    - /nginx
  selection_parent_php:
    ParentImage|endswith: /php
  selection_child:
    Image|endswith:
    - /sh
    - /bash
    - /dash
  selection_cmd:
    CommandLine|contains:
    - 'curl '
    - 'wget '
    - /dev/tcp/
    - base64 -d
    - chmod +x
    - mkfifo
    - nc -e
    - bash -i
  condition: 1 of selection_parent* and selection_child and selection_cmd
falsepositives:
- PHP applications that legitimately shell out to curl or wget for updates or backups
- Web-based admin panels that run maintenance scripts through the shell
level: medium
id: 2177b089-4d18-5fe7-a321-6c966571e2ba
status: experimental
author: Vorant
references:
- https://www.cert.cyber.gouv.fr/alerte/CERTFR-2026-ALE-014
```

### Windows Web Server or PHP Process Spawning Shell With Recon or Download Commands

ATT&CK: T1190

php-cgi, php, httpd, nginx or w3wp spawning cmd or PowerShell with reconnaissance, download or encoded-command arguments, indicating web-shell or RCE exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Windows Web Server or PHP Process Spawning Shell With Recon or Download Commands
description: Detects PHP and web server processes on Windows spawning cmd.exe or PowerShell
  with reconnaissance, download or encoded-command arguments. This is consistent with
  successful exploitation of a public-facing PHP application via RCE.
tags:
- attack.initial-access
- attack.t1190
- attack.execution
- attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
    - \php-cgi.exe
    - \php.exe
    - \httpd.exe
    - \nginx.exe
    - \w3wp.exe
  selection_child:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
  selection_cmd:
    CommandLine|contains:
    - whoami
    - net user
    - net localgroup
    - certutil
    - bitsadmin
    - Invoke-WebRequest
    - DownloadString
    - ' -enc'
    - FromBase64String
    - ipconfig /all
    - systeminfo
  condition: selection_parent and selection_child and selection_cmd
falsepositives:
- Administrators running diagnostic commands through a PHP-based admin or hosting
  control panel
- Legacy PHP applications that shell out to systeminfo or ipconfig for inventory
level: high
id: 686971c6-77e8-514e-94e6-a38022e03025
status: experimental
author: Vorant
references:
- https://www.cert.cyber.gouv.fr/alerte/CERTFR-2026-ALE-014
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cert.cyber.gouv.fr/alerte/CERTFR-2026-ALE-014

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/7cba8aba-d89a-523e-92cb-1b407c3c722d/cert-fr-warns-of-php-rce-exploitation-attempts.
In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out. Slack alerts on the vendors, sectors and countries a reader follows come with the paid plans too. A new account starts with a three-day trial, no card: https://vorant.io/signup