PHP2Shell - Web Server Process Spawning System Shell

Georg Lauenstein@gsec

•updated yesterday•16•0•40

Detects exploitation of the PHP2Shell RCE vulnerabilities in core PHP (CVE-2026-109618 out-of-memory corruption and CVE-2026-109619 stale global state), which allow unauthenticated remote code execution delivered through malicious multipart uploads. Successful exploitation causes the PHP-FPM/Apache/httpd/lsphp worker, typically running as www-data, to spawn a system shell (sh, bash, cmd, powershell) or a download utility (curl, wget) to retrieve a second-stage payload. A web server process spawning an interactive shell is a high-fidelity indicator of web application compromise and should be investigated immediately.