« First Occurrence of a PHP Fatal Error on a Web Server AWS Bedrock AgentCore with Public Network Browser or Code Interpreter Sandbox »
Elastic Docs ›Elastic Security [8.19] ›Downloadable rule update v8.19.36

Potential PHP2Shell Exploitation Attempt

edit
IMPORTANT: This documentation is no longer updated. Refer to Elastic's version policy and the latest documentation.

Potential PHP2Shell Exploitation Attempt

edit

This rule detects a distinctive PHP out-of-memory fatal error associated with PHP2Shell exploitation attempts. The combination of an allowed-memory-size exhaustion and the location "Unknown on line 0" is produced before normal application execution and is an indicator of attempts to exploit PHP memory-safety vulnerabilities, including CVE-2026-109618 and CVE-2026-109619. The rule can detect unsuccessful as well as successful attempts and does not, by itself, confirm remote code execution.

Rule type: query

Rule indices:

  • logs-apache.error-*
  • logs-apache_tomcat.*
  • logs-nginx.error-*

Severity: medium

Risk score: 47

Runs every: 5m

Searches indices from: now-9m (Date Math format, see also Additional look-back time)

Maximum alerts per execution: 100

References:

Tags:

  • Domain: Web
  • Use Case: Threat Detection
  • Use Case: Vulnerability
  • Tactic: Initial Access
  • Data Source: Nginx
  • Data Source: Apache
  • Data Source: Apache Tomcat
  • Resources: Investigation Guide
  • Threat: Vulnerability Exploit
  • Rule Type: Query
  • Service: Nginx
  • Service: Apache Tomcat
  • Service: Apache HTTP Server
  • Vuln: CVE-2026-109618
  • Vuln: CVE-2026-109619

Version: 1

Rule authors:

  • Elastic

Rule license: Elastic License v2

Investigation guide

edit

Triage and analysis

Investigating Potential PHP2Shell Exploitation Attempt

PHP2Shell chains PHP memory-safety flaws that are triggered while PHP processes fatal out-of-memory conditions. The combination of PHP Fatal error, Allowed memory size, bytes exhausted, and Unknown on line 0 is substantially more specific than a generic PHP fatal error. The alert represents an exploitation attempt; use corroborating web and endpoint telemetry to determine whether code execution or process-memory disclosure succeeded.

Possible investigation steps

  • Identify host.id, host.name, event.dataset, log.file.path, and the complete message or event.original value.
  • Treat source.ip as the immediate client observed by the web server. If a proxy, CDN, load balancer, or container bridge is present, recover the original client from trusted proxy or edge logs rather than assuming source.ip is the attacker.
  • Review web access and error events around the alert for multipart requests, upload-progress session fields, repeated HTTP 500 responses, unusual or malformed PHPSESSID cookies, worker churn, and repeated memory-limit errors.
  • Correlate the alert with process telemetry for shells, interpreters, downloaders, or other unusual children of Apache, Nginx, IIS, PHP-CGI, or PHP-FPM workers. Review outbound network connections and recent file modifications on the host.
  • Establish the installed PHP version and determine whether it includes the PHP security updates published on October 21,2026. PHP2Shell affects PHP itself and does not require a vulnerability in the hosted application.

False positive analysis

  • A genuine application memory leak or deliberately constrained memory_limit can cause memory exhaustion, but the complete Unknown on line 0 signature is unusual. Compare the event with historical fatal errors on the same host.
  • Confirm whether an approved security assessment was active and whether its source and timing match the alert.

Response and remediation

  • If the server runs an affected PHP release, remove it from public traffic or isolate it until PHP is updated.
  • Preserve web, PHP, process, network, and file telemetry before restarting workers or rebuilding the host.
  • If follow-on execution or memory disclosure is suspected, rotate credentials and secrets accessible to the PHP worker, rebuild from a trusted image, and hunt for the same activity across other PHP servers.

Rule query

edit
event.dataset:("apache.error" or "nginx.error" or "apache_tomcat.catalina" or "apache_tomcat.localhost") and
message:("PHP Fatal error" and "Allowed memory size" and "bytes exhausted" and "Unknown on line 0")

Framework: MITRE ATT&CKTM

« First Occurrence of a PHP Fatal Error on a Web Server AWS Bedrock AgentCore with Public Network Browser or Code Interpreter Sandbox »