What happened
PHP2Shell is the name given to two critical flaws in PHP itself, each rated 9.2 (CVSS v4.0). A single crafted web request can let an unauthenticated attacker run code on the server, in some setups, such as Apache mod_php, before the website’s own code even runs. The exploit hides inside PHP’s memory handling. Because the flaw is in PHP rather than in any one application, almost every PHP site is in scope, including Apache mod_php, PHP-FPM, php-cgi, FrankenPHP and LiteSpeed.
Attacks started before the fix. Amazon saw an exploitation attempt on 17 October 2026, four days before PHP released patches, and CISA added both flaws to its Known Exploited Vulnerabilities catalog on 26 October.
How Securonix catches it
Once attackers use PHP2Shell to take over a server, they make the web server run system commands: checking which account they are running as, downloading a payload with curl, or opening a reverse shell.
Securonix detects that moment on both Linux and Windows servers. For every new program the server starts, the detections ask three questions: was it started by a web or PHP worker, is it a shell or download tool, and does the command look like an attacker’s?
Examples of what it flags
- A web or PHP worker starting a shell with an attacker command: for example sh -c id, whoami, or reading /etc/passwd.
- A download from the web server: curl or wget pulling a file, often into /tmp.
- A reverse shell: bash, netcat or socat connecting back to the attacker.
- Encoded or staged payloads: base64 commands, or a downloaded file run from a temporary folder.
- On Windows servers: IIS or PHP starting cmd or PowerShell, or downloading with certutil or bitsadmin.
Securonix detections for PHP2Shell
Six detections cover PHP2Shell across Linux and Windows. Turn on the ones that match the logs you send to SNYPR.
Functionality - Endpoint Management Systems
- EDR-UNX-1467-RU – Sysmon for Linux
- EDR-ALL-1469-RU – Crowdstrike Falcon (Linux)
- EDR-UNX-1496-RU – Sysmon for Linux
- EDR-ALL-1500-RU – Microsoft Defender for Endpoint (Linux)
- EDR-ALL-1499-RU - Sysmon
Functionality - Microsoft Windows
- WEL-ALL-1463-RU – Windows Security Logs
What to do now
- Check if you are exposed: run php -v on each web server. Any version older than the patched releases below is exposed.
- Patch PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 or later, then restart every PHP worker. Updated packages do not fix workers that are already running. This applies to Windows servers running PHP under IIS too.
- Turn on the detections that match the logs you send to SNYPR (see the table above). For EDR-ALL-1500-RU, make sure Microsoft Defender is sending process events to SNYPR.
- If an alert fires, isolate the host and check for new files in the web root, new cron jobs and outbound connections from PHP.
Sources
- PHP security advisory: Critical remote code execution vulnerabilities
- CISA Known Exploited Vulnerabilities catalog