[VL] - PHP2Shell: List Devices affected (PHP + Version + InternetFacing) by Critical PHP Vulnerabilities (CVE-2026-109618 and CVE-2026-109619)

Sergio Albea@Sergio_Albea

•updated today•110•4•170

With a reported CVSS score of 9.2 and security updates scheduled for today, October 21, these vulnerabilities deserve attention, especially if you're still running legacy PHP versions. 𝗪𝗵𝗶𝗹𝗲 𝘄𝗮𝗶𝘁𝗶𝗻𝗴 𝗳𝗼𝗿 𝘁𝗵𝗲 𝗼𝗳𝗳𝗶𝗰𝗶𝗮𝗹 𝗽𝗮𝘁𝗰𝗵𝗲𝘀 𝗮𝗻𝗱 𝘁𝗲𝗰𝗵𝗻𝗶𝗰𝗮𝗹 𝗱𝗲𝘁𝗮𝗶𝗹𝘀, 𝘂𝗽𝗱𝗮𝘁𝗲 𝗮𝗹𝗹 𝗣𝗛𝗣 𝗩𝗲𝗿𝘀𝗶𝗼𝗻𝘀 𝘁𝗼 𝗮𝘁 𝗹𝗲𝗮𝘀𝘁 𝟴.𝟮 𝘁𝗼 𝗯𝗲 𝗮𝗯𝗹𝗲 𝘁𝗼 𝗵𝗮𝘃𝗲 𝘁𝗵𝗲 𝘀𝗲𝗰𝘂𝗿𝗶𝘁𝘆 𝘂𝗽𝗱𝗮𝘁𝗲𝘀. I decided to spend some time exploring what we can already hunt for using Microsoft Defender XDR and KQL. I've put together a short technical article covering six hunting scenarios: - PHP installations and outdated versions - Suspicious child processes and command execution - Reconnaissance activity - Unexpected PHP file creation - Unusual outbound network connections - New process relationships compared to historical activity These are not PHP2Shell-specific detections, but they can help identify suspicious activity on PHP servers without relying on published IoCs. Sharing the queries in case they're useful for your own investigations.