Critical PHP flaw hits all versions, exploited
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
A critical PHP core vulnerability (CVSS 9.4) affects all PHP versions and is already being exploited, with a patch for PHP 8 pending.
SANS ISC raised its InfoCon to YELLOW after PHP.net announced an imminent critical security release addressing two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, rated CVSS 9.4. The flaw resides in PHP core and affects all PHP installations starting from PHP 5 through current releases by default configuration. Only PHP 8 is expected to receive an official patch since older branches are end-of-life and unsupported, leaving a large population of legacy PHP deployments permanently exposed.
At the time of writing, Cloudflare and independent researcher jackalsyn had already published proof-of-concept details and reported exploitation attempts in the wild, ahead of the vendor patch (expected 14:00 UTC, October 21). Full technical details of the vulnerability were still emerging, but SANS noted that default PHP configurations are vulnerable with no special extension or configuration required to trigger exploitation.
As an interim mitigation, early guidance recommends setting session.upload_progress.enabled = Off, since this setting is On by default and appears to provide partial protection against exploitation. Some CDN/WAF providers, including Cloudflare, have already deployed detection/blocking rules, and other vendors are expected to follow. Given the ubiquity of PHP across web applications, defenders should prioritize monitoring PHP.net advisories, apply the patch as soon as it is released, and apply the configuration mitigation immediately while awaiting the fix.
Mentioned in this report
Detection guidance
PHP or Web Server Process Spawning Shell With Recon or Download Commands (Linux)
A PHP handler or web server (php-fpm, php-cgi, apache, httpd) spawns a shell that runs recon, download-and-execute or reverse-shell commands. This is typical post-exploitation after a PHP RCE such as the unpatched PHP core flaw. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: PHP or Web Server Process Spawning Shell With Recon or Download Commands (Linux)
description: Detects PHP handlers or web server processes (php-fpm, php-cgi, apache2,
httpd) spawning a shell that runs recon, payload download or reverse-shell commands.
Generalises post-exploitation of a PHP remote code execution flaw, not a specific
payload.
tags:
- attack.initial-access
- attack.t1190
logsource:
category: process_creation
product: linux
detection:
selection_parent:
ParentImage|contains:
- /php-fpm
- /php-cgi
- /apache2
- /httpd
selection_shell:
Image|endswith:
- /sh
- /bash
- /dash
selection_cmd:
CommandLine|contains:
- whoami
- 'curl '
- 'wget '
- /dev/tcp/
- nc -e
- base64 -d
- chmod +x
- /etc/passwd
- python -c
- perl -e
condition: selection_parent and selection_shell and selection_cmd
falsepositives:
- Web applications that intentionally shell out to curl or wget from PHP for updates
or health checks
- Administrative web panels that run system commands
level: high
id: 99690fd4-78b8-5ff6-86d2-1dbed7fcc044
status: experimental
author: Vorant
references:
- https://isc.sans.edu/diary/rss/33440
PHP CGI or Web Server Process Spawning Command Interpreter With Suspicious Arguments (Windows)
php-cgi.exe, httpd.exe or w3wp.exe spawning cmd, PowerShell or a LOLBin with recon or download arguments, indicating web shell or RCE exploitation of a PHP application. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: PHP CGI or Web Server Process Spawning Command Interpreter With Suspicious
Arguments (Windows)
description: Detects PHP CGI or web server worker processes spawning cmd, PowerShell
or download LOLBins with recon or download arguments. Indicates post-exploitation
of a public-facing PHP application.
tags:
- attack.initial-access
- attack.t1190
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|endswith:
- \php-cgi.exe
- \httpd.exe
- \w3wp.exe
selection_child:
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \certutil.exe
- \bitsadmin.exe
selection_cmd:
CommandLine|contains:
- whoami
- net user
- net localgroup
- urlcache
- -enc
- downloadstring
- Invoke-WebRequest
- ipconfig /all
- systeminfo
condition: selection_parent and selection_child and selection_cmd
falsepositives:
- Web-based admin tools that legitimately run systeminfo or ipconfig from PHP
- Vulnerability scanners run with authenticated command execution against the server
level: high
id: 3c0b6903-ba8b-5586-b53a-e2f250d75cdd
status: experimental
author: Vorant
references:
- https://isc.sans.edu/diary/rss/33440
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://isc.sans.edu/diary/rss/33440
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 13,820 reports from 143 sources, 505 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs