VORANT. Threat Intelligence Research Create a free account

PHP2Shell flaws enable PHP remote code execution

high threat Technology

Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.

Two chained PHP vulnerabilities, dubbed PHP2Shell, allow remote code execution and affect PHP versions as old as 5.4 through 8.5.

IPA (Japan's Information-technology Promotion Agency) issued an advisory on two PHP vulnerabilities, CVE-2026-109618 (related to out-of-memory error handling) and CVE-2026-109619 (related to request processing), which when combined are referred to as 'PHP2Shell'. Exploitation of these flaws could allow a remote attacker to execute arbitrary code on affected systems. The PHP Group has released patched versions: 8.2.35, 8.3.36, 8.4.27, and 8.5.12, which fix the issues for supported branches.

According to Wiz, who participated in the vulnerability research, PHP versions as far back as 5.4 are affected by at least one of the two flaws, significantly broadening the exposure given PHP's ubiquity across web applications and products built on it. Organizations running PHP are urged to check with vendors of their specific products for applicability and patch guidance.

IPA recommends immediate patching to the fixed versions. For organizations unable to patch promptly, IPA advises checking whether their PHP version is still supported (noting PHP 8.1 and earlier are already end-of-life and will not receive fixes), applying interim mitigations or access restrictions, and considering network isolation or service suspension if adequate mitigations cannot be implemented. The advisory also recommends broader organizational review of migration feasibility, staffing, and budget constraints for legacy systems that have not been updated, and encourages decommissioning or migrating unsupported systems when long-term maintenance cannot be assured.

Mentioned in this report

Vulnerabilities CVE-2026-109618templatedCVE-2026-109619
Campaigns PHP2Shell

Related reporting

Detection guidance

PHP or Web Server Process Spawning Shell With Recon or Download Commands (Linux)

ATT&CK T1190

PHP-FPM/CGI or web server worker spawning a shell that runs recon, download or reverse-shell commands, a typical post-exploitation sign after PHP remote code execution such as PHP2Shell. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: PHP or Web Server Process Spawning Shell With Recon or Download Commands (Linux)
description: Detects PHP-FPM, php-cgi or web server processes spawning a shell whose
  command line contains recon, download or reverse-shell tooling. This is a post-exploitation
  pattern after PHP remote code execution (for example PHP2Shell CVE-2026-109618/109619).
  Written as a behavioural consequence detection, since the advisory gives no exploit-specific
  artefacts.
tags:
- attack.initial-access
- attack.t1190
- attack.execution
- attack.t1059.004
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
    - /php-fpm
    - /php-cgi
    - /apache2
    - /httpd
    - /nginx
  selection_child:
    Image|endswith:
    - /sh
    - /bash
    - /dash
  selection_cmd:
    CommandLine|contains:
    - whoami
    - uname -a
    - 'curl '
    - 'wget '
    - /dev/tcp/
    - base64 -d
    - nc -e
    - /etc/passwd
  condition: selection_parent and selection_child and selection_cmd
falsepositives:
- Web applications that legitimately shell out to curl or wget for fetching resources
  or health checks
- Administrative web panels that run system information commands
level: high
id: 2ace9b4d-d1bd-5788-924f-f7300a674b74
status: experimental
author: Vorant
references:
- https://www.ipa.go.jp/security/security-alert/2026/alert20261022.html

PHP or Web Server Process Spawning Shell With Recon Commands (Windows)

ATT&CK T1190

php-cgi.exe, Apache or nginx spawning cmd/PowerShell with recon or download commands, indicating possible PHP remote code execution. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: PHP or Web Server Process Spawning Shell With Recon Commands (Windows)
description: Detects php-cgi.exe, Apache httpd.exe or nginx.exe spawning cmd.exe or
  PowerShell with reconnaissance, user-creation or download-cradle commands. Indicates
  possible post-exploitation after PHP remote code execution (for example PHP2Shell).
tags:
- attack.initial-access
- attack.t1190
- attack.execution
- attack.t1059.003
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
    - \php-cgi.exe
    - \httpd.exe
    - \nginx.exe
  selection_child:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
  selection_cmd:
    CommandLine|contains:
    - whoami
    - net user
    - net localgroup
    - certutil
    - bitsadmin
    - Invoke-WebRequest
    - DownloadString
    - '-enc '
    - systeminfo
  condition: selection_parent and selection_child and selection_cmd
falsepositives:
- Web-based server administration panels running systeminfo or net commands
- Deployment scripts triggered via a PHP application on the same host
level: high
id: 3089b804-906c-5d13-8a0c-51efd5cf0d02
status: experimental
author: Vorant
references:
- https://www.ipa.go.jp/security/security-alert/2026/alert20261022.html

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.ipa.go.jp/security/security-alert/2026/alert20261022.html

What this brief leaves out

This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs and campaigns it names. The paid plans add the security research and news reporting the free tier leaves out.

It sits in a corpus of 13,874 reports from 143 sources, 506 of them written in the last seven days, and it grows through the day.

A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.

Create a free account   What it costs