PHP2Shell - Web Worker Spawning cmd or PowerShell
Detects Windows web/PHP worker processes (php.exe, php-cgi.exe, apache.exe, httpd.exe, lsphp.exe, nginx.exe) spawning unexpected command shells or download utilities. Exploitation of CVE-2026-109618 / CVE-2026-109619 in core PHP grants unauthenticated RCE; the child process is the observable artifact since the memory corruption leaves no trace in the PHP logs. mod_php deployments are the highest-risk configuration.
YARA-L
