1-minute read
What a defender needs to know
Unit 42 retracted its October 23 PHP2Shell intrusion attribution. It saw a European government attack in the context of a vulnerable PHP application, but cannot confirm that either PHP2Shell CVE supplied initial access. The current report no longer uses the earlier credential timeline, NTLM relay or web-shell delimiters as PHP2Shell case evidence. Do not attribute a worker alert to either CVE without corroboration.
PHP2Shell covers two web-serving PHP code-execution flaws: CVE-2026-109618 interrupts request-memory handling after an out-of-memory error; CVE-2026-109619 lets a worker retain stale state across requests. The PHP project fixed both in 8.2.35, 8.3.36, 8.4.27 and 8.5.12; vendor-maintained packages may use backports. Unit 42 counted more than 22.6 million exposed instances potentially vulnerable in its telemetry.
Identify the PHP build actually serving requests, install the fixed build or vendor backport, and restart every worker. Preserve web, process-start and identity logs for the earlier exposure window. Hunt for unexpected shell or interpreter processes descended from apache2, httpd, php-fpm, php-cgi, lsphp or w3wp.exe, then correlate their account and time with web requests. Unit 42’s process hunt also detects other web-app compromises and can flag legitimate activity, so validate each hit. Investigate any credential access, relay activity or privileged-account changes and rotate affected secrets. Verify that the live workers are patched and that earlier worker-child activity has an explanation; review the earlier exposure window alongside the live build.