title: PHP2Shell - Shell or Recon Tool Spawned by PHP Worker
id: 8b3e7d21-2c4a-4f6e-8e0a-5a7c9d1f3b02
status: experimental
description: |
  Successful exploitation of CVE-2026-109618 / CVE-2026-109619 yields code execution as the web worker.
  Detects php-fpm, php-cgi, lsphp or Apache (mod_php) spawning a shell or common recon/download tool.
references:
  - https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w
  - https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp
author: Cybaverse
date: 2026-10-21
tags:
  - attack.execution
  - attack.t1059.004
  - attack.persistence
  - attack.t1505.003
  - cve.2026-109618
  - cve.2026-109619
logsource:
  product: linux
  category: process_creation
detection:
  parent:
    ParentImage|contains:
      - '/php-fpm'
      - '/php-cgi'
      - '/lsphp'
      - '/httpd'
      - '/apache2'
  child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/curl'
      - '/wget'
      - '/nc'
      - '/ncat'
      - '/python3'
      - '/perl'
      - '/base64'
      - '/id'
      - '/whoami'
      - '/uname'
  condition: parent and child
falsepositives:
  - Applications that legitimately exec helpers (ImageMagick wrappers, git, wp-cli, mail via sendmail wrapper scripts)
  - Apache piped loggers or CGI scripts
level: medium