PHP2Shell in short

PHP2Shell is a public exploit chain for two critical PHP flaws, CVE-2026–109618 and CVE-2026–109619, both rated CVSS v4.0 9.2. It gives an unauthenticated attacker remote code execution on any server that processes web requests with PHP, including products that bundle PHP, such as CMSs, control panels, and appliances. Sansec reports that attacks began on October 21, hours before the fixed versions were released. The flaws run before your application code, so logins and app-level protections do not stop them.
 

Do you use GREYCORTEX Mendel?
We prepared a PHP2Shell threat hunting playbook with seven IDS rules and step-by-step filters for your network.

Download the playbook

 

What to do today

  • Find your PHP. List every server and every product that bundles PHP. Start with what is reachable from the internet.
  • Patch. The fixed versions are 8.5.12, 8.4.27, 8.3.36, and 8.2.35, or your vendor’s patched package. PHP 8.1 and older get no official release, so check your distribution or LTS vendor (PHP advisory).
  • If you cannot patch yet, reduce the risk. Set session.upload_progress.enabled=0 in php.ini or the pool configuration and restart all workers. On PHP 8.5 also set fatal_error_backtraces=0. Limit request size at the web server or proxy, and block multipart/form-data where the application needs no uploads.

What to look for if you do not use Mendel

There are no signatures that stay reliable for long, so hunt for behavior:

  • Multipart POST requests that carry the PHP_SESSION_UPLOAD_PROGRESS field.
  • Bursts of 5xx errors (often 502 or 503) after multipart POSTs from one client, and Allowed memory size … exhausted in PHP logs.
  • A malformed or oversized PHPSESSID in a Set-Cookie response, which can indicate leaked memory.
  • A web server that starts shells, curl, or wget, connects to destinations it never used before, or probes internal hosts (Huntress).

If you confirm a compromise, isolate the server, keep the logs and packet captures, patch, and rotate every secret the PHP workers could have held in memory: passwords, API keys, session secrets, and TLS private keys. A memory leak leaves no trace, so rotation is the only safe answer.

Encrypted traffic hides the request content from network sensors. Where you cannot decrypt it, rely on the behavioral signs above.

Sources
Category
IT/OT Security

Categories