How to detect PHP RCE exploitation (PHP2Shell) with Greycortex Mendel

A public exploit chain targets two critical PHP flaws rated CVSS 9.2, giving unauthenticated attackers remote code execution before application-level defenses can react.

PHP2Shell is a public exploit chain for CVE-2026-109618 and CVE-2026-109619, both rated CVSS v4.0 9.2. The flaws run before application code, so logins and app-level protections do not stop them. Sansec reports attacks began on October 21, hours before the fixed versions were released. Softprom is the official distributor of Greycortex.

What was announced

Greycortex published a PHP2Shell threat hunting playbook for GREYCORTEX Mendel. The playbook contains seven IDS rules and step-by-step network filters that help SOC teams identify exploitation attempts in real time, even when attackers rotate payloads.

Fixed PHP versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older receive no official release, so organizations must rely on their distribution or LTS vendor.

Why this matters

PHP powers a vast share of public-facing web infrastructure, including CMS platforms, control panels and appliances that bundle PHP internally. An unauthenticated RCE in the runtime bypasses WAF signatures that focus on application payloads, forcing CISOs to shift from signature-based blocking to behavioral detection on the network layer.

Attacks started before the patch shipped, so defenders need network-level visibility, not only endpoint telemetry

Technical details

• Vulnerabilities: CVE-2026-109618 and CVE-2026-109619, CVSS v4.0 9.2, pre-auth RCE in PHP.
• Fixed versions: PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35.
• Mitigations: set session.upload_progress.enabled=0 in php.ini; on PHP 8.5 also set fatal_error_backtraces=0; restart workers; limit request size; block multipart/form-data where not needed.
• Behavioral indicators: multipart POSTs carrying PHP_SESSION_UPLOAD_PROGRESS, bursts of 502 or 503 after multipart POSTs, Allowed memory size exhausted in PHP logs, malformed or oversized PHPSESSID in Set-Cookie.
• Post-exploit signs: web server spawning shells, curl or wget, connecting to unknown destinations or probing internal hosts.
• Response: isolate host, preserve logs and PCAP, patch, rotate passwords, API keys, session secrets and TLS private keys.

FAQ

What is PHP2Shell?

PHP2Shell is a public exploit chain for two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, enabling unauthenticated remote code execution on any server processing PHP web requests.

Which PHP versions fix the vulnerabilities?

Patched versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older receive no official release, so administrators must apply distribution or LTS vendor patches.

How does Greycortex Mendel help detect exploitation?

Mendel ships a PHP2Shell playbook with seven IDS rules and behavioral filters that flag suspicious multipart POSTs, memory exhaustion patterns and anomalous outbound connections from web servers, enabling detection even when payloads change.

Softprom and Greycortex

Softprom is the official distributor of Greycortex. The Greycortex Mendel NDR platform helps SOC teams gain network visibility, hunt advanced threats and respond to zero-day exploitation such as PHP2Shell.

Prepared by the Softprom editorial team based on vendor materials (Softprom DistriFlow). Source: original article.