FBI warns of critical PHP Core RCE flaws
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
FBI IC3 urges immediate patching of two PHP core vulnerabilities enabling remote code execution against web applications.
The FBI's Internet Crime Complaint Center issued a public service announcement warning of two critical vulnerabilities in PHP core, a programming language widely used to power websites and web applications. Tracked as CVE-2026-109618 and CVE-2026-109619, the flaws could allow malicious cyber actors to remotely execute code, potentially compromising sensitive data and network operations. This PSA follows an initial FBI social media alert on October 21st and reiterates the urgency of remediation.
The advisory does not provide technical details on the vulnerabilities, affected PHP versions, or confirmation of in-the-wild exploitation, but frames the issue as critical and urges immediate action. Business owners and website operators are directed to check whether their systems run affected PHP versions and apply available security updates without delay. Given PHP's broad use across web infrastructure, unpatched systems represent a significant and widespread attack surface for remote code execution attacks.
Mentioned in this report
Detection guidance
PHP or Web Server Process Spawning Recon or Download Tools on Windows
php-cgi/php/httpd/nginx spawning PowerShell, whoami, certutil, bitsadmin or net commands, typical post-exploitation after PHP RCE. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: PHP or Web Server Process Spawning Recon or Download Tools on Windows
description: Detects PHP or web server worker processes spawning PowerShell, whoami,
certutil, bitsadmin, net or similar tools. This is a common post-exploitation pattern
after remote code execution in PHP applications (for example the PHP core RCE flaws
in the FBI PSA). Generalises on the parent/child relation, not on any specific CVE
payload.
tags:
- attack.initial-access
- attack.t1190
- attack.execution
- attack.t1059
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|endswith:
- \php-cgi.exe
- \php.exe
- \php-win.exe
- \httpd.exe
- \nginx.exe
selection_child:
Image|endswith:
- \powershell.exe
- \pwsh.exe
- \whoami.exe
- \certutil.exe
- \bitsadmin.exe
- \net.exe
- \net1.exe
- \nltest.exe
- \systeminfo.exe
- \mshta.exe
- \rundll32.exe
- \regsvr32.exe
condition: selection_parent and selection_child
falsepositives:
- Web applications such as admin panels that deliberately call systeminfo or net from
PHP
- Local development stacks (XAMPP/WAMP) running PHP scripts that invoke PowerShell
level: high
id: 2d6ba850-6a93-5e1f-8dba-c5c1fc7ee7f0
status: experimental
author: Vorant
references:
- https://www.ic3.gov/PSA/2026/PSA261023
PHP or Web Server Process Spawning Shell with Reverse Shell or Download Pattern on Linux
php-fpm/php-cgi/apache/nginx spawning a shell or tool with reverse shell, download-and-execute, or recon patterns, indicating web RCE. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: PHP or Web Server Process Spawning Shell with Reverse Shell or Download Pattern
on Linux
description: Detects PHP-FPM, PHP-CGI, Apache or nginx worker processes launching
a shell or network tool with reverse-shell, download-and-execute or recon command-line
patterns, consistent with exploitation of a PHP remote code execution flaw.
tags:
- attack.initial-access
- attack.t1190
- attack.execution
- attack.t1059.004
logsource:
category: process_creation
product: linux
detection:
selection_parent:
ParentImage|endswith:
- /php-fpm
- /php-cgi
- /apache2
- /httpd
- /nginx
selection_shell:
Image|endswith:
- /sh
- /bash
- /dash
selection_cmd:
CommandLine|contains:
- /dev/tcp/
- bash -i
- nc -e
- ncat -e
- curl http
- wget http
- base64 -d
- chmod +x
selection_tools:
Image|endswith:
- /whoami
- /nc
- /ncat
- /socat
condition: selection_parent and ((selection_shell and selection_cmd) or selection_tools)
falsepositives:
- Web applications that shell out to curl or wget for legitimate update or webhook
functionality
- Admin scripts triggered through a web control panel
level: high
id: 28a4d126-663c-5410-85e2-b9b74da837d2
status: experimental
author: Vorant
references:
- https://www.ic3.gov/PSA/2026/PSA261023
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.ic3.gov/PSA/2026/PSA261023
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 14,087 reports from 142 sources, 545 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs