title: PHP2Shell - POST Requests Returning HTTP 500 to PHP Endpoints
id: 4f1c2a6e-6b0d-4d1e-9a51-1d6b0c9e2a01
status: experimental
description: |
  Detects POST requests to PHP endpoints that end in HTTP 500. Exploitation of CVE-2026-109618 /
  CVE-2026-109619 (GHSA-w8hw-w9fx-j79w, GHSA-6wmf-4rv5-p3rp) drives PHP into memory exhaustion or fatal
  errors via crafted (typically multipart) request bodies, commonly visible as repeated 500 responses
  from one source. Correlate by source IP and time window in your SIEM (e.g. >=5 in 10 minutes).
references:
  - https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w
  - https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp
author: Cybaverse
date: 2026-10-21
tags:
  - attack.initial-access
  - attack.t1190
  - cve.2026-109618
  - cve.2026-109619
logsource:
  category: webserver
detection:
  selection:
    cs-method: POST
    sc-status: 500
  php:
    - cs-uri-stem|endswith: '.php'
    - cs-uri-query|contains: '.php'
  condition: selection and php
falsepositives:
  - Application bugs or broken deployments returning 500
  - Legitimate large uploads or imports exceeding memory_limit
  - Authorised vulnerability scanning
level: low