Analytics Story: PHP2Shell

Created: 2026-10-22 Last Updated: 2026-10-22 ID: 9cb29d42-7c34-4db8-86b4-b385848d2b3c Author: Nasreddine Bencherchali, Raven Tait, Onur Mustafa Erdogan, Splunk Product: Splunk Enterprise Security

Description

This analytic story covers exploitation attempts and post-exploitation activity associated with PHP2Shell (CVE-2026-109618 and CVE-2026-109619). Its detections identify suspicious multipart upload and PHP session upload-progress patterns, large POST requests that receive HTTP 500 responses, PHP memory exhaustion correlated with web requests, and endpoint process activity that may follow successful exploitation.

Why it matters

PHP2Shell is associated with remote code execution vulnerabilities in PHP session upload-progress and multipart request handling. The web detections in this story look for related request patterns: a PHP_SESSION_UPLOAD_PROGRESS field accompanied by a serialized PHP structure in an upload filename, a PHPSESSID field accompanied by a PHP opening tag in an upload filename, and large POST request bodies that receive HTTP 500 responses. Another detection correlates multipart access events with PHP memory exhaustion errors in Apache or Nginx logs.

These web indicators identify suspicious activity for investigation; any one result alone does not confirm successful exploitation. Review the full request headers, filenames, source and destination addresses, URI, response status, and PHP error details. Correlate access and error records by host, client, and PID, and consider request identifiers where the logs provide them.

Endpoint detections add post-exploitation coverage by identifying inline PHP interpreter execution, web or application servers spawning shells, and suspicious child processes spawned from Windows web servers. Review process ancestry, command lines, users, network activity, and timing alongside the web events. Validate the affected PHP version and configuration, including upload-progress and session handling settings, and tune for approved large uploads or development activity.

Detections

Name ▲▼	Technique ▲▼	Type ▲▼
PHP Session Upload Progress with PHP Code in Upload Filename	Exploit Public-Facing Application	Anomaly
Web or Application Server Spawning a Shell	External Remote Services, Exploit Public-Facing Application	TTP
Large HTTP POST Request Resulting in Server Error	Exploit Public-Facing Application	Anomaly
Inline PHP Code Execution	Command and Scripting Interpreter	Anomaly
PHP Session Upload Progress Serialized Payload in Upload Filename	Exploit Public-Facing Application	Anomaly
Windows Suspicious Child Process Spawned From WebServer	Web Shell	Anomaly
PHP Memory Exhaustion Exploitation Attempt via Multipart Request	Exploit Public-Facing Application	Anomaly

Data Sources

Name ▲▼	Platform ▲▼	Sourcetype ▲▼	Source ▲▼
Zeek HTTP	Web	`zeek:http`	`http.log`
Sysmon for Linux EventID 1	Linux	`sysmon:linux`	`Syslog:Linux-Sysmon/Operational`
Sysmon EventID 1	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
CrowdStrike ProcessRollup2	Other	`crowdstrike:events:sensor`	`crowdstrike`
Windows Event Log Security 4688	Windows	`XmlWinEventLog`	`XmlWinEventLog:Security`
Nginx Error Log	Web	`nginx:plus:error`	`/var/log/nginx/error.log`
Nginx Access	Web	`nginx:plus:kv`	`/var/log/nginx/access.log`

References

Source: GitHub | Version: 2