title: PHP2Shell - PHP Memory Exhaustion or FPM Worker Killed by Signal
id: c2d9a4f0-7e1b-4a3c-b6d5-0f8e2a9c4b03
status: experimental
description: |
  Matches PHP 'Allowed memory size ... exhausted' / 'Out of memory' errors and PHP-FPM children exiting on a
  signal. Per GHSA-w8hw-w9fx-j79w, exploitation relies on controllable OOM; FPM exits the child when request
  startup fails. Bursts of these messages on internet-facing hosts warrant investigation. Note the advisory
  warns a failure may occur before PHP writes any message.
references:
  - https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w
  - https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp
author: Cybaverse
date: 2026-10-21
tags:
  - attack.initial-access
  - attack.t1190
  - cve.2026-109618
  - cve.2026-109619
logsource:
  product: linux
  service: syslog
detection:
  keywords:
    - 'Allowed memory size of'
    - 'PHP Fatal error:  Out of memory'
    - 'exited on signal'
  condition: keywords
falsepositives:
  - Memory-hungry legitimate scripts and leaky plugins
  - Deliberate restarts / kills of PHP-FPM children
level: low