PHP2Shell Log Analysis Traces Unauthenticated Exploitation to a Reverse Shell
Summary
A six-event PHP2Shell sample links PHP memory-exhaustion errors and a worker crash to shell spawning and a reverse shell. The article uses LogTotal to show detection and recommends patching, removing persistence, and hunting PHP logs.
Key points
- The article describes CVE-2026-109618 and CVE-2026-109619 as unauthenticated PHP core remote code execution flaws, each rated CVSS v4.0 9.2.
- It lists releases before PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 as affected, along with older branches; it recommends using vendor backports or upgrading where no official release is available.
- In a six-event sample from web-prod-01, LogTotal linked PHP memory exhaustion and a PHP-FPM worker crash to later shell activity within three seconds; its verdict was suspicious and required investigation.
- The sample’s sequence includes php-fpm spawning a shell as www-data, followed by a reverse-shell command connecting to 198.51.100.23:4444.
- The article identifies possible persistence evidence in uploads/.cache.php, .user.ini with auto_prepend_file, and /dev/shm/.s, and advises preserving evidence before cleanup.
- Recommended response includes patching PHP and restarting workers, restricting egress, rotating secrets readable by the web user, and monitoring PHP/PHP-FPM logs alongside EDR events.
Article Details
- Defense Focus
- Detect PHP2Shell exploitation by correlating PHP worker crashes with shell spawning, reverse-shell activity, and persistence artifacts; remediate by patching PHP and removing persistence.
- Detection Methods
- Correlate PHP “Allowed memory size … exhausted” errors with PHP-FPM child crashes, including SIGSEGV.
- Alert when php-fpm, php-cgi, apache2, or httpd spawns sh or bash; review the process user and command line.
- Inspect file events for .user.ini files containing auto_prepend_file, hidden PHP files in upload folders, and the staged /dev/shm/.s file.
- Correlate shell activity with outbound connections to the reverse-shell destination.
- Combine runtime and PHP-FPM errors with EDR process and file events to reconstruct the event sequence.
- Data Sources
- PHP runtime and PHP-FPM error logs
- EDR process and file events
- Web, system, and network logs
- Platforms
- SIEM
- EDR
- Defensive Actions
- Isolate the affected server and preserve web, system, and network logs.
- Verify PHP versions and update installations to the fixed release for their branch; restart every PHP worker.
- Restrict internet access to PHP systems that cannot be updated immediately.
- Block egress to the observed reverse-shell destination.
- Preserve evidence before cleanup, including uploads/.cache.php, .user.ini, and /dev/shm/.s.
- Remove persistence by deleting the auto_prepend_file directive; rebuild the host on a fixed PHP release where appropriate.
- Rotate secrets readable by the web server user, including database credentials and application API keys.
- Hunt across the web fleet for suspicious .user.ini files, hidden PHP files in upload folders, and shells spawned by web server processes.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 198[.]51[.]100[.]23 | Destination of the reverse shell observed in the sample; the article recommends blocking egress to it. |
MITRE ATT&CK
T1059.004 · Unix ShellThe php-fpm worker spawned sh, which ran bash commands, including an interactive reverse shell.T1095 · Non-Application Layer ProtocolThe observed Bash reverse shell connected directly to the destination using /dev/tcp/198.51.100.23/4444.T1505.003 · Web ShellThe article reports a hidden PHP webshell at uploads/.cache.php and persistence through .user.ini loading it with auto_prepend_file.
CVE
CVE-2026-109618Vendor / Product unavailablePHP2Shell is the name for two unauthenticated remote code execution flaws in PHP core, CVE-2026-109618 and CVE-2026-109619, both rated CVSS v4.0 9.2.CVE-2026-109619Vendor / Product unavailablePHP2Shell is the name for two unauthenticated remote code execution flaws in PHP core, CVE-2026-109618 and CVE-2026-109619, both rated CVSS v4.0 9.2.CVE-2026-115560Vendor / Product unavailableCommunity trackers also report CVE-2026-115560, a separate, configuration-dependent session upload-progress vector covered by a PHP informational advisory on 23 October 2026.
Products
PHPPHP2Shell is the name for two unauthenticated remote code execution flaws in PHP core, CVE-2026-109618 and CVE-2026-109619, both rated CVSS v4.0 9.2.PHP-FPMEvery PHP installation that serves web requests is in scope, whether it runs under PHP-FPM, Apache mod_php, php-cgi, LiteSpeed, or FrankenPHP.