Skip to content

Security Sense

AI Threat Intelligence

  • About
  • Blog
  • Privacy Policy

CVE-2026-119977: WordPress Core RCE via TOCTOU Race Condition

Posted on November 3, 2026 by Kyle

Overview

CVE-2026-119977 is a high-severity Time-of-Check Time-of-Use (TOCTOU) race condition vulnerability affecting WordPress Core. It allows unauthenticated attackers to execute arbitrary code on the server. This threat is particularly critical as it leverages the legitimate core upgrade process, making affected WordPress installations vulnerable during their update windows.

Technical Analysis

WordPress Core versions 4.7 through 7.1.3 are vulnerable to Remote Code Execution (RCE) due to a TOCTOU race condition (CWE-367). The vulnerability arises from the use of predictable, web-accessible staging paths during full-package core upgrades. An unauthenticated attacker can exploit this window by racing the legitimate upgrade process, likely by injecting malicious code into these temporary staging paths before they are fully processed or used by the system. The CVSS 3.1 score for this vulnerability is 8.1 (High), with a vector of CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H.

  • Affected Versions: WordPress Core versions 4.7 through 7.1.3.
  • Attack Vector: Unauthenticated network access (AV:N).
  • Prerequisites: The target WordPress instance must be undergoing a full-package core upgrade.
  • Exploitation: Attackers exploit a race condition during the upgrade process, leveraging predictable, web-accessible staging paths to introduce malicious code.

Detection

Detecting exploitation of CVE-2026-119977 primarily involves monitoring for anomalous activity during or immediately after WordPress core upgrades.

  • Web Server Logs: Monitor for unusual or unexpected requests to wp-admin or temporary upgrade directories (e.g., wp-content/upgrade/) that do not align with legitimate upgrade traffic patterns.
  • Process Monitoring: Look for the web server process (e.g., httpd, nginx, php-fpm, w3wp.exe) spawning unusual child processes such as cmd.exe, powershell.exe, sh, bash, python, or perl outside of expected administrative tasks.
  • File Integrity Monitoring (FIM): Monitor for unexpected file creations or modifications in WordPress core directories (wp-admin, wp-includes, wp-content) during or immediately following an upgrade, especially for executable file types (.php, .pl, .py, .sh).
  • Network Traffic Analysis: Look for outbound connections initiated by the web server process to unusual external IP addresses or domains, which could indicate a successful webshell or backdoor.

Sigma Detection Rules

⚠️ AI-generated detection rules. These are experimental starting points. Review field names, EventIDs, and logic against your environment’s schema before deploying. Tune to reduce false positives.

Web Server Process Spawning Suspicious Child Process (Windows)

title: Web Server Process Spawning Suspicious Child Process (Windows)
id: 5f9e2d1c-8b7a-4c3e-9e7f-0d2a1b3c4e5f
status: experimental
description: Detects a web server process spawning suspicious child processes, indicative of successful RCE exploitation on Windows.
logsource:
  product: windows
  service: sysmon
detection:
  selection:
    ParentImage|endswith:
      - '\\w3wp.exe'
      - '\\httpd.exe'
      - '\\nginx.exe'
      - '\\php-cgi.exe'
    Image|endswith:
      - '\\cmd.exe'
      - '\\powershell.exe'
      - '\\pwsh.exe'
      - '\\cscript.exe'
      - '\\wscript.exe'
  condition: selection
level: high

Web Server Process Spawning Suspicious Child Process (Linux)

title: Web Server Process Spawning Suspicious Child Process (Linux)
id: 6a7b8c9d-0e1f-2a3b-4c5d-6e7f8a9b0c1d
status: experimental
description: Detects a web server process spawning suspicious child processes, indicative of successful RCE exploitation on Linux.
logsource:
  product: linux
  service: auditd
detection:
  selection:
    type: 'EXECVE'
    process.parent.name:
      - 'apache2'
      - 'httpd'
      - 'nginx'
      - 'php-fpm'
    process.name:
      - 'sh'
      - 'bash'
      - 'python'
      - 'perl'
      - 'php'
      - 'nc'
      - 'ncat'
      - 'wget'
      - 'curl'
  condition: selection
level: high

Mitigations

  1. Patch Immediately: Upgrade all WordPress installations to version 7.1.4 or later. This is the most critical mitigation.
  2. Restrict Access During Upgrades: If possible, temporarily restrict network access to the wp-admin directory or the entire WordPress site during core upgrade windows to minimize the attack surface.
  3. Implement Strong File Permissions: Ensure strict file permissions are enforced on WordPress directories, especially wp-content and wp-admin, to prevent unauthorized file writes.
  4. Deploy a Web Application Firewall (WAF): A WAF can help detect and block suspicious requests targeting WordPress upgrade paths or common webshell patterns.
  5. Regular Backups: Maintain regular, tested backups of your WordPress site and database to facilitate recovery in case of compromise.

References

  • https://nvd.nist.gov/vuln/detail/CVE-2026-119977
  • https://core.trac.wordpress.org/browser/tags/7.1.3/src/wp-admin/includes/class-core-upgrader.php#L162
  • https://core.trac.wordpress.org/browser/tags/7.1.3/src/wp-admin/includes/class-wp-upgrader.php#L378
  • https://core.trac.wordpress.org/browser/tags/7.1.3/src/wp-admin/includes/update-core.php#L1549
  • https://core.trac.wordpress.org/browser/tags/7.1.3/src/wp-admin/setup-config.php#L282
  • https://core.trac.wordpress.org/browser/tags/7.1.4/src/wp-admin/includes/class-wp-upgrader.php#L346
  • https://core.trac.wordpress.org/browser/tags/7.1.4/src/wp-admin/includes/update-core.php#L1545
  • https://wordpress.org/news/2026/10/wordpress-7-1-4/
  • https://www.wordfence.com/threat-intel/vulnerabilities/id/4b4da0cf-d9f4-47c4-a0e8-6c4dc5a6f250?source=cve
  • https://ltna.com.au/cyber

Indicators of Compromise

No public IOCs available at time of writing.

MITRE ATT&CK

  • T1190 — Exploit Public-Facing Application
  • T1059 — Command and Scripting Interpreter
🤖 AI Attribution
Generated by gemini-2.5-flash ·
2,187 input / 1,937 output tokens ·
Reviewed and approved by a human analyst before publication
Posted in vulnerabilityTagged cwe-367, high, rce, vulnerability, web, wordpressLeave a comment

CVE-2026-118527: Ivanti Connect Secure Predictable Numbers Vulnerability Leading to File Upload

Posted on November 3, 2026 by Kyle

Overview

CVE-2026-118527 affects Ivanti Connect Secure, enabling a remote authenticated attacker to upload arbitrary, attacker-controlled files to a specific location on the appliance’s disk. This vulnerability is significant as it provides a critical primitive for establishing persistence or further exploitation, often chained with other vulnerabilities like CVE-2026-104935 and CVE-2026-111357. Its inclusion in CISA’s Known Exploited Vulnerabilities Catalog indicates active exploitation.

Technical Analysis

The vulnerability in Ivanti Connect Secure is related to the generation of predictable numbers or identifiers. An authenticated attacker can leverage this predictability to bypass controls and upload files containing arbitrary content to a pre-determined location on the appliance’s filesystem. This capability can be used to drop web shells, configuration files, or other malicious payloads, paving the way for further compromise. The vulnerability requires prior authentication, meaning an attacker must first obtain valid credentials. Specific affected versions are not detailed in the provided source material.

Detection

  • Monitor Ivanti Connect Secure appliance logs for successful POST requests to unusual or unexpected paths, especially those with large body sizes indicative of file uploads.
  • Look for subsequent GET or POST requests targeting newly created or modified files in web-accessible directories (e.g., files with extensions like .jsp, .php, .sh, .pl, .py).
  • Analyze network traffic for large POST requests directed at Ivanti Connect Secure, followed by requests for unusual file types or paths that are not part of normal appliance operation.
  • If filesystem monitoring is available on the appliance, detect writes to sensitive or web-root directories by unexpected processes.

Sigma Detection Rules

⚠️ AI-generated detection rules. These are experimental starting points. Review field names, EventIDs, and logic against your environment’s schema before deploying. Tune to reduce false positives.

Ivanti Connect Secure – Suspicious File Upload Attempt

title: Ivanti Connect Secure - Suspicious File Upload Attempt
id: 9c0e4f1c-7e2a-4d3b-8c8f-1a2b3c4d5e6f
status: experimental
description: Detects suspicious file upload attempts to Ivanti Connect Secure, potentially indicating exploitation of CVE-2026-118527 or similar vulnerabilities. Looks for POST requests with common web shell extensions.
logsource:
  product: webserver
detection:
  selection:
    cs-method: 'POST'
    cs-uri-stem|endswith:
      - '.jsp'
      - '.php'
      - '.aspx'
      - '.sh'
      - '.pl'
      - '.py'
      - '.cgi'
      - '.txt' # Could be a staging file
      - '.conf' # Could be a config overwrite
    sc-status: 200
  condition: selection
level: high

Ivanti Connect Secure – Large POST Request (Potential File Upload)

title: Ivanti Connect Secure - Large POST Request (Potential File Upload)
id: 0f1e2d3c-4b5a-6c7d-8e9f-0a1b2c3d4e5f
status: experimental
description: Detects unusually large POST requests to Ivanti Connect Secure, which could indicate a file upload related to CVE-2026-118527 or other vulnerabilities. Threshold may need tuning.
logsource:
  product: webserver
detection:
  selection:
    cs-method: 'POST'
    c-bytes|gte: 102400 # Example: greater than 100KB. Adjust based on normal traffic patterns.
    sc-status: 200
  condition: selection
level: medium

Mitigations

  1. Apply vendor patches immediately once they become available. Regularly check Ivanti’s security advisories for updates.
  2. Implement and enforce strong authentication policies, including multi-factor authentication (MFA), for all Ivanti Connect Secure users and administrators to mitigate the risk of compromised credentials.
  3. Regularly review and audit Ivanti Connect Secure appliance logs for any anomalous activity, suspicious file creations, or unusual access patterns.
  4. Restrict network access to the Ivanti Connect Secure administration interface and other sensitive endpoints to only trusted IP addresses or networks.

References

  • https://nvd.nist.gov/vuln/detail/CVE-2026-118527

Indicators of Compromise

No public IOCs available at time of writing.

MITRE ATT&CK

  • T1078 — Valid Accounts
  • T1505.003 — Web Shell
  • T1105 — Ingress Tool Transfer
🤖 AI Attribution
Generated by gemini-2.5-flash ·
1,530 input / 1,269 output tokens ·
Reviewed and approved by a human analyst before publication
Posted in vulnerabilityTagged authenticated, connect secure, file upload, high, ivanti, vulnerabilityLeave a comment

CVE-2026-111357: Ivanti Connect Secure Privilege Escalation

Posted on November 3, 2026 by Kyle

Overview

CVE-2026-111357 is a high-severity privilege escalation vulnerability affecting Ivanti Connect Secure appliances, actively exploited in the wild since October 2026. This flaw allows a local authenticated attacker to escalate their privileges to root by manipulating the dsinvoked broker’s trust in DSCache configuration data. The vulnerability is particularly critical as it can be chained with other Ivanti zero-day exploits.

Technical Analysis

Ivanti Connect Secure versions 22.8 and 25.1.0.0 through 25.1.1.3 are affected by CVE-2026-111357. The vulnerability stems from the dsinvoked broker’s improper handling and trust of DSCache configuration data. A local authenticated attacker can exploit this weakness to achieve privilege escalation to root. The NVD record indicates a CVSS 3.1 score of 7.0 (High), with an attack vector of local (AV:L) and low privileges required (PR:L), but high attack complexity (AC:H). This vulnerability is categorized as CWE-829 (Improper Handling of Sensitive Information). It has been observed in the wild and can be chained with CVE-2026-104935 and CVE-2026-118527 for more impactful attacks.

Detection

Detection efforts should focus on identifying unusual activity originating from or within Ivanti Connect Secure appliances, particularly related to process execution and configuration changes.
* Monitor Ivanti Connect Secure appliance logs for unexpected process spawns, especially sh, bash, python, or other shell interpreters, initiated by the dsinvoked process or running with root privileges.
* Look for anomalous modifications to system configuration files or DSCache related data that deviate from normal administrative operations.
* Monitor for unusual authentication attempts or privilege changes on the appliance that precede suspicious process activity.

Sigma Detection Rules

⚠️ AI-generated detection rules. These are experimental starting points. Review field names, EventIDs, and logic against your environment’s schema before deploying. Tune to reduce false positives.

Ivanti Connect Secure dsinvoked Shell Spawn

title: Ivanti Connect Secure dsinvoked Shell Spawn
id: 90e8f7d6-c1b3-4a2e-8d5f-1e2a3c4b5d6e
status: experimental
description: Detects suspicious shell execution potentially indicative of CVE-2026-111357 exploitation on Ivanti Connect Secure appliances. Assumes process creation logging is available.
logsource:
  product: linux
  service: auditd
detection:
  selection:
    ParentImage|endswith: '/dsinvoked'
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/zsh'
      - '/python'
      - '/perl'
  condition: selection
level: critical

Mitigations

  1. Apply Vendor Patches: Immediately apply all available security patches from Ivanti. Refer to the official Ivanti Security Advisory for CVE-2026-104935, which may include fixes or workarounds for chained vulnerabilities.
  2. Restrict Local Access: Limit local authenticated access to Ivanti Connect Secure appliances to only essential personnel.
  3. Network Segmentation: Isolate Ivanti Connect Secure appliances on a dedicated network segment to minimize potential lateral movement post-exploitation.
  4. Regular Auditing: Conduct regular security audits of Ivanti Connect Secure configurations and logs to detect any unauthorized changes or suspicious activity.

References

  • https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935
  • https://www.volexity.com/blog/2026/10/13/a-series-of-unauthenticated-events-chained-exploitation-of-ivanti-connect-secure-zero-days/
  • https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-111357
  • https://nvd.nist.gov/vuln/detail/CVE-2026-111357

Indicators of Compromise

No public IOCs available at time of writing.

MITRE ATT&CK

  • T1068 — Exploitation for Privilege Escalation
🤖 AI Attribution
Generated by gemini-2.5-flash ·
2,041 input / 1,179 output tokens ·
Reviewed and approved by a human analyst before publication
Posted in vulnerabilityTagged cve, high, ivanti, privilege-escalation, vulnerabilityLeave a comment

CVE-2026-76418: Cisco Secure Firewall ASA/FTD Denial of Service Vulnerability

Posted on November 3, 2026 by Kyle

Overview

CVE-2026-76418 addresses a critical denial of service vulnerability in Cisco Secure Firewall ASA and FTD Software. An unauthenticated, remote attacker can trigger an unexpected device reload by sending crafted requests to the SSL remote access VPN service. This vulnerability is due to logic errors related to secondary authentication on tunnel groups and is currently listed in CISA’s Known Exploited Vulnerabilities Catalog.

Technical Analysis

A vulnerability in the Remote Access SSL VPN service of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition.

  • Vulnerability Type: Unchecked return value to NULL pointer dereference (CWE-690).
  • Affected Products: Cisco Secure Firewall Adaptive Security Appliance (ASA) Software, Cisco Secure Firewall Threat Defense (FTD) Software.
  • Attack Vector: Remote Access SSL VPN service.
  • Prerequisites: Secondary authentication must be configured on a tunnel group.
  • Exploitation: An unauthenticated, remote attacker sends a crafted request when connecting to the SSL remote access VPN.
  • Impact: A successful exploit causes the affected device to reload, resulting in a denial of service (DoS) condition.
  • CVSS 3.1 Score: 8.6 (HIGH) – CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Detection

  • Monitor Cisco ASA/FTD device logs for unexpected reloads or crashes, specifically looking for system messages indicating a reload event.
  • Look for an increased volume of failed or abnormal SSL VPN connection attempts preceding a device reload.
  • Analyze network traffic for unusual or malformed SSL VPN connection requests, particularly those targeting devices with secondary authentication configured.
  • Review device uptime and availability metrics for unexpected interruptions.

Sigma Detection Rules

⚠️ AI-generated detection rules. These are experimental starting points. Review field names, EventIDs, and logic against your environment’s schema before deploying. Tune to reduce false positives.

Cisco ASA FTD Unexpected Device Reload

title: Cisco ASA FTD Unexpected Device Reload
id: 90f7a01d-5b3e-4f1c-9e2a-7b8d6c5f4e3c
status: experimental
description: Detects unexpected device reloads in Cisco ASA/FTD logs, indicative of a denial of service condition or system instability.
logsource:
  product: cisco
  service: asa
detection:
  selection:
    message|contains:
      - 'Reloading due to'
      - 'System is restarting'
      - 'Device rebooted unexpectedly'
  condition: selection
level: high

Mitigations

  1. Apply security patches from Cisco as soon as they become available. (As of the NVD publication date, the vulnerability is undergoing analysis, and patches are anticipated).
  2. Review configurations of SSL remote access VPN tunnel groups to identify instances where secondary authentication is enabled.
  3. Implement network segmentation to restrict access to the SSL VPN service from untrusted networks where possible.
  4. Ensure robust logging and monitoring are in place for Cisco ASA/FTD devices to detect reloads or suspicious activity.

References

  • https://nvd.nist.gov/vuln/detail/CVE-2026-76418
  • https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-tunnel-dos-s6mgkb75
  • https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-76418
  • https://ltna.com.au/cyber

Indicators of Compromise

No public IOCs available at time of writing.

MITRE ATT&CK

  • T1499 — Endpoint Denial of Service
🤖 AI Attribution
Generated by gemini-2.5-flash ·
1,903 input / 1,133 output tokens ·
Reviewed and approved by a human analyst before publication
Posted in vulnerabilityTagged cisco, denial-of-service, high, network-device, vpn, vulnerabilityLeave a comment

CVE-2026-41709: Broadcom VMWare ESX Insufficient Logging Vulnerability

Posted on November 3, 2026 by Kyle

Overview

CVE-2026-41709 is an insufficient logging vulnerability affecting Broadcom VMWare ESX. This flaw permits a malicious actor with administrative access to execute certain operations without those actions being recorded in logs. While rated with a low CVSS score of 2.7, this vulnerability is significant as it could facilitate evasion of detection for post-exploitation activities by privileged attackers within virtualized environments.

Technical Analysis

  • Vulnerability ID: CVE-2026-41709
  • Affected Product: Broadcom VMWare ESX
  • Weakness Enumeration: CWE-778 (Insufficient Logging)
  • Description: The vulnerability allows a malicious administrator to perform specific operations that are not logged by the system. The exact operations that bypass logging are not detailed in public advisories at the time of writing.
  • Attack Vector: Network (AV:N)
  • Attack Complexity: Low (AC:L)
  • Prerequisites: Requires high privileges (PR:H) to exploit, meaning the attacker must already possess administrative access to the ESX host.
  • User Interaction: None (UI:N)
  • Scope: Unchanged (S:U)
  • Impact: No confidentiality impact (C:N), low integrity impact (I:L), no availability impact (A:N). The integrity impact refers to the integrity of the logs themselves, as actions are not recorded.
  • CVSS v3.1 Score: 2.7 (LOW)
  • CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
  • Affected Versions: Specific affected versions of VMWare ESX are not detailed in the provided source material.

Detection

Direct detection of the exploitation of CVE-2026-41709 is inherently challenging, as the vulnerability’s nature is the absence of logging for specific administrative actions. Therefore, detection efforts should focus on identifying anomalous administrative behavior or other indicators of compromise that might precede or follow an administrator attempting to hide their actions.

  • Anomalous Administrative Activity: Monitor for unusual or unauthorized administrative commands, configuration changes, or access patterns on ESX hosts that should be logged, even if this vulnerability might obscure some specific actions.
  • External Log Correlation: Correlate logs from other systems (e.g., vCenter Server, network devices, security tools) that interact with ESX hosts. Look for discrepancies or actions that appear to have no corresponding log entry on the ESX host itself.
  • Baseline Deviations: Establish a baseline of normal administrative activity and configuration. Alert on significant deviations, such as unexpected service restarts, VM modifications, or changes to user accounts that lack proper audit trails.
  • Host-Based Monitoring: Deploy host-based security tools that can monitor process execution, file system changes, and network connections on ESX hosts, providing an additional layer of visibility beyond native logging.

Mitigations

  1. Implement Principle of Least Privilege: Strictly enforce the principle of least privilege for all ESX administrators. Grant only the minimum necessary permissions required for their roles and revoke unnecessary access immediately.
  2. Regularly Audit Administrator Accounts: Conduct frequent audits of administrator accounts, their assigned roles, and recent activities. Look for dormant accounts, unauthorized privilege escalations, or suspicious login patterns.
  3. Enhance Logging and Monitoring: Deploy comprehensive logging and monitoring solutions that aggregate logs from multiple sources, including network devices, vCenter Server, and other security tools, to provide redundant visibility and detect activity that might bypass ESX native logging.
  4. Apply Security Patches: Ensure all VMWare ESX hosts are kept up-to-date with the latest security patches and updates from Broadcom to address this and other potential vulnerabilities. (Specific patch information for CVE-2026-41709 was not available in the provided source).

References

  • https://nvd.nist.gov/vuln/detail/CVE-2026-41709
  • https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38017
  • https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-41709

Indicators of Compromise

No public IOCs available at time of writing.

🤖 AI Attribution
Generated by gemini-2.5-flash ·
2,302 input / 1,221 output tokens ·
Reviewed and approved by a human analyst before publication
Posted in vulnerabilityTagged admin-access, esx, logging, low, low-severity, vmware, vulnerabilityLeave a comment

CVE-2026-46300: Linux Kernel Privilege Escalation via Shared Fragment Handling

Posted on November 3, 2026 by Kyle

Overview

CVE-2026-46300 is a high-severity vulnerability in the Linux kernel affecting how shared fragments are handled during socket buffer coalescing. This flaw can lead to unintended modification of page-cache-backed data, specifically allowing ESP input processing to decrypt shared fragments in place. When chained with other vulnerabilities, this can enable privilege escalation, the implantation of PHP webshells, and arbitrary command execution as root, posing a significant threat to Linux-based systems, including IoT devices.

Technical Analysis

The vulnerability stems from a missing initialization of a variable within the skb_try_coalesce() function. When skb_try_coalesce() transfers paged fragments from one socket buffer (@from) to another (@to), it fails to preserve the SKBFL_SHARED_FRAG marker if @from had it set. This breaks an invariant relied upon by later in-place writers, particularly ESP input processing. Consequently, ESP input checks skb_has_shared_frag() and, if the marker is missing, incorrectly determines that an uncloned nonlinear skb can skip skb_cow_data(), leading to in-place decryption over page-cache backed fragments.

This unintended modification of page-cache-backed data can be leveraged for privilege escalation. The NVD record explicitly states that this vulnerability can be chained with CVE-2026-109618 and CVE-2026-109619 to implant PHP webshells and execute commands as root.

  • CVSS 3.1 Score: 7.8 (High)
  • CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  • Weaknesses: CWE-787 (Out-of-bounds Write), CWE-456 (Missing Initialization of a Variable), CWE-123 (Write-what-where Condition)
  • Affected Versions:
    • Linux kernel versions >= 3.9 and <= 5.10.257
    • Linux kernel versions >= 5.11 and < 5.15.208
    • Linux kernel versions >= 5.16 and < 6.1.174
    • Linux kernel versions >= 6.2 and < 6.6.141
    • Linux kernel versions >= 6.7 and < 6.12.91
    • Linux kernel versions >= 6.13 and < 6.18.33
    • Linux kernel versions >= 6.19 and < 7.0.10
    • Linux kernel version 7.1

Detection

Direct detection of the kernel vulnerability exploitation itself can be challenging from user-space logs. However, the post-exploitation activities described (webshells, root command execution) provide clear detection opportunities.

  • Suspicious File Writes: Monitor web server directories (/var/www/, /srv/www/, /usr/share/nginx/html/, etc.) for the creation or modification of .php files by unusual processes or with suspicious content (e.g., base64 encoded strings, eval() functions). Utilize auditd logs for PATH events related to file creation/modification.
  • Privileged Process Execution: Look for sh, bash, php, python, or perl being executed with root privileges (UID 0) by unexpected parent processes or in unusual contexts. This is particularly relevant if the parent process is a network service or a process that should not typically spawn shells. Monitor auditd logs for SYSCALL events related to execve.
  • Network Activity: Monitor for unusual outbound connections from compromised systems, especially those indicative of botnet activity (e.g., DDoS attacks, C2 communications) if linked to malware families like KATARU or Mirai.

Sigma Detection Rules

⚠️ AI-generated detection rules. These are experimental starting points. Review field names, EventIDs, and logic against your environment’s schema before deploying. Tune to reduce false positives.

Linux Webshell Creation in Web Directories

title: Linux Webshell Creation in Web Directories
id: 752a1b3e-f1c3-4d0a-b8e7-2c9f0e1d4a3b
status: experimental
description: Detects the creation or modification of .php files in common web server directories, indicative of webshell deployment after exploitation.
logsource:
  product: linux
  service: auditd
detection:
  selection:
    type: 'PATH'
    name|endswith:
      - '.php'
      - '.phtml'
      - '.phar'
    # Common web server root directories
    directory|contains:
      - '/var/www/'
      - '/srv/www/'
      - '/usr/share/nginx/html/'
      - '/var/www/html/'
      - '/var/www/htdocs/'
  condition: selection
level: high

Linux Suspicious Root Command Execution

title: Linux Suspicious Root Command Execution
id: 9e0c3f1a-5b6d-4e7c-8a2b-1d0f2e3c4b5a
status: experimental
description: Detects execution of common shell or scripting interpreters with root privileges, which could indicate successful privilege escalation.
logsource:
  product: linux
  service: auditd
detection:
  selection:
    type: 'SYSCALL'
    a0|contains:
      - '/bin/sh'
      - '/bin/bash'
      - '/usr/bin/php'
      - '/usr/bin/python'
      - '/usr/bin/perl'
    uid: '0' # Root user
  condition: selection
level: high

Mitigations

  1. Apply Kernel Patches: Immediately update Linux kernel to a version that includes the fix for CVE-2026-46300. Refer to the provided kernel Git references for specific patch details.
  2. Regular System Updates: Ensure all Linux-based systems, including IoT devices, are kept up-to-date with the latest security patches from their respective distributions.
  3. Principle of Least Privilege: Restrict user and process privileges to the absolute minimum required to perform their functions.
  4. Network Segmentation: Isolate critical systems and IoT devices on separate network segments to limit lateral movement in case of compromise.
  5. Web Server Hardening: Implement strong web server security configurations, including disabling unnecessary PHP functions, restricting write access to web directories, and using Web Application Firewalls (WAFs).

References

  • https://nvd.nist.gov/vuln/detail/CVE-2026-46300
  • https://git.kernel.org/stable/c/2f2b16022a2e10ca7bccfb98db5ed2ec0f72641c
  • https://git.kernel.org/stable/c/3599e6b3cc1ada96883d496a50a210d3afbb6987
  • https://git.kernel.org/stable/c/3884358a9286b17f389a72b1426fc4547c23c111
  • https://git.kernel.org/stable/c/3bd9e113d50034db99d7ef69fd8e5242d15e414a
  • https://git.kernel.org/stable/c/760e1addc27ba1a7beb4a0a7e8b3e9ec49e7a34e
  • https://git.kernel.org/stable/c/78bf6b6bb19541d19fbda6242e7cfe2c682763c0
  • https://git.kernel.org/stable/c/9d3e5fd19fe1063bf607219e8562fbd567b8e8d5
  • https://git.kernel.org/stable/c/f84eca5817390257cef78013d0112481c503b4a3
  • https://www.nozominetworks.com/blog/kataru-iot-malware-adopts-public-lpe-exploits
  • https://ltna.com.au/cyber

Indicators of Compromise

Type Value Description
SHA256 13382c16e2401b07451577b46e634b8031ec254d98b876e59692b5fa22abc1d4 KATARU ARM32 payload hash (via https://www.nozominetworks.com/blog/kataru-iot-malware-adopts-public-lpe-exploits)
SHA256 6fbae3505ae0d638b820165c572d548ce92dda71e82dc47e8efe13f30617f35f KATARU ARM32 payload hash (via https://www.nozominetworks.com/blog/kataru-iot-malware-adopts-public-lpe-exploits)
SHA256 9d7cd4948a1fcbaeadc425752fce9a933bd6fc41eeede030dffd7b99b3bc51d5 KATARU AMD64 payload hash (via https://www.nozominetworks.com/blog/kataru-iot-malware-adopts-public-lpe-exploits)
SHA256 9d87e6615c810907443ebd5e915f3b35099c3b5c6b6c684637138a7f8ec9cebc KATARU ARM32 payload hash (via https://www.nozominetworks.com/blog/kataru-iot-malware-adopts-public-lpe-exploits)
SHA256 cc76bc218627279ecb4d0ce74ad2651e9db9e3e843e35d6569576e056e3a9218 KATARU loader hash (via https://www.nozominetworks.com/blog/kataru-iot-malware-adopts-public-lpe-exploits)
IP Address 160.191.242.92 KATARU Telnet brute force and C2 IP (via https://www.nozominetworks.com/blog/kataru-iot-malware-adopts-public-lpe-exploits)
Domain bins.sh Domain for fetching per-architecture payloads (via https://www.nozominetworks.com/blog/kataru-iot-malware-adopts-public-lpe-exploits)

MITRE ATT&CK

  • T1068 — Exploitation for Privilege Escalation
  • T1505.003 — Web Shell
  • T1059 — Command and Scripting Interpreter
  • T1110.001 — Password Guessing
  • T1498.001 — Direct Network Flood
  • T1053.003 — Cron
  • T1082 — System Information Discovery
  • T1499.002 — Service Exhaustion Flood
  • T1106 — Native API
  • T1016 — System Network Configuration Discovery
  • T1059.004 — Unix Shell
  • T1562.001 — Disable or Modify Tools
  • T1027 — Obfuscated Files or Information
  • T1573.002 — Asymmetric Cryptography
  • T1095 — Non-Application Layer Protocol
  • T1037.004 — RC Scripts
  • T1543.002 — Systemd Service
  • T1105 — Ingress Tool Transfer
🤖 AI Attribution
Generated by gemini-2.5-flash ·
2,776 input / 2,315 output tokens ·
Reviewed and approved by a human analyst before publication
Posted in vulnerabilityTagged high, iot, kataru, kernel, linux, mirai, privilege-escalation, vulnerability, webshellLeave a comment

CVE-2026-48356: Adobe Commerce Unrestricted File Upload Leading to RCE

Posted on November 3, 2026 by Kyle

Overview

CVE-2026-48356 is a critical unrestricted file upload vulnerability (CWE-434) impacting Adobe Commerce and Magento. Successful exploitation allows for arbitrary code execution in the context of the current user, potentially leading to elevated access or session control. This vulnerability is actively exploited, with observed post-exploitation activity involving CMS block loaders and malicious JavaScript injection.

Technical Analysis

  • Vulnerability: CWE-434: Unrestricted Upload of File with Dangerous Type.
  • Affected Products: The vulnerability affects multiple versions of Adobe Commerce and Adobe Commerce B2B:
    • Adobe Commerce: 2.4.4, 2.4.5, 2.4.6, 2.4.7, 2.4.8, 2.4.9
    • Adobe Commerce B2B: 1.3.3, 1.3.4, 1.4.2, 1.5.2
  • Attack Vector: Remote, network-based. Exploitation requires user interaction, where a victim must visit a maliciously crafted URL or interact with a compromised web page. This interaction facilitates the upload of a dangerous file type.
  • Impact: Arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim’s account or session. This can lead to web shell deployment, data exfiltration, and further system compromise.
  • CVSS 3.1 Score: 9.3 (CRITICAL) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N.

Detection

  • Monitor web server logs (e.g., Apache, Nginx, IIS) for HTTP POST requests to unexpected directories containing file extensions typically associated with server-side scripts (e.g., .php, .phtml, .jsp, .asp).
  • Look for web server processes (e.g., php-fpm.exe, httpd.exe, nginx.exe, w3wp.exe) spawning unusual child processes such as cmd.exe, powershell.exe, sh, bash, python.exe, or perl.exe (Sysmon Event ID 1).
  • Monitor file system events for new files with dangerous extensions (e.g., .php, .phtml) being written to web-accessible directories by the web server process, especially outside of expected upload paths (Sysmon Event ID 11).
  • Scan web server directories for known web shell signatures or suspicious file content.
  • Monitor network traffic for outbound connections initiated by the web server process to unusual external IP addresses or domains.
  • Review web access logs for requests to newly created or suspicious script files in web root directories, indicative of web shell access (e.g., GET /media/catalog/product/cache/1/image/web_shell.php?cmd=id).

Sigma Detection Rules

⚠️ AI-generated detection rules. These are experimental starting points. Review field names, EventIDs, and logic against your environment’s schema before deploying. Tune to reduce false positives.

Web Server Process Spawning Shell

title: Web Server Process Spawning Shell
id: 5a7b8c9d-e0f1-2345-6789-abcd1234ef01
status: experimental
description: Detects a web server process (e.g., PHP-FPM, Apache, Nginx) spawning a command shell, indicative of arbitrary code execution.
logsource:
  product: windows
  service: sysmon
detection:
  selection_parent:
    ParentImage|endswith:
      - '\php-fpm.exe'
      - '\httpd.exe'
      - '\nginx.exe'
      - '\w3wp.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\sh.exe'
      - '\bash.exe'
      - '\python.exe'
      - '\perl.exe'
  condition: all of selection_*
level: critical

Suspicious File Creation by Web Server Process

title: Suspicious File Creation by Web Server Process
id: 1f2e3d4c-5b6a-7890-1234-56789abcdef0
status: experimental
description: Detects a web server process creating suspicious files with dangerous extensions in web-accessible directories, potentially indicating a web shell upload.
logsource:
  product: windows
  service: sysmon
detection:
  selection_image:
    Image|endswith:
      - '\php-fpm.exe'
      - '\httpd.exe'
      - '\nginx.exe'
      - '\w3wp.exe'
  selection_filename:
    TargetFilename|endswith:
      - '.php'
      - '.phtml'
      - '.jsp'
      - '.asp'
      - '.aspx'
  selection_path:
    TargetFilename|contains:
      - '\inetpub\wwwroot\'
      - '\var\www\html\'
      - '\magento\pub\media\'
      - '\magento\var\'
      - '\upload\'
      - '\cache\'
  condition: all of selection_*
level: high

Web Access to Suspicious Script Files in Web Roots

title: Web Access to Suspicious Script Files in Web Roots
id: 9a8b7c6d-5e4f-3210-fedc-ba9876543210
status: experimental
description: Detects HTTP requests to suspicious script files in web-accessible directories, potentially indicating web shell access or post-exploitation activity.
logsource:
  category: webserver
detection:
  selection_uri:
    cs-uri-stem|contains:
      - '/shell.php'
      - '/cmd.php'
      - '/upload.php'
      - '/backdoor.php'
      - '/eval.php'
      - '/wso.php'
      - '/c99.php'
      - '/r57.php'
      - '/magento/pub/media/'
      - '/magento/var/'
  selection_method:
    cs-method: 'POST'
  condition: selection_uri or (selection_uri and selection_method)
level: high

Mitigations

  1. Patch Immediately: Apply the latest security patches from Adobe for all affected Adobe Commerce and Magento installations. Refer to the vendor advisory https://helpx.adobe.com/security/products/magento/apsb26-73.html.
  2. Restrict File Uploads: Implement strict validation and sanitization for all user-uploaded files, including type, size, and content. Restrict executable file types from being uploaded to web-accessible directories.
  3. Principle of Least Privilege: Ensure the web server process runs with the minimum necessary privileges.
  4. Web Application Firewall (WAF): Deploy and configure a WAF to detect and block suspicious file uploads and requests to known web shell patterns.
  5. File Integrity Monitoring (FIM): Implement FIM on web server directories to alert on unauthorized creation or modification of files.
  6. Regular Audits: Periodically audit web server directories for unauthorized files.

References

  • https://helpx.adobe.com/security/products/magento/apsb26-73.html
  • https://nvd.nist.gov/vuln/detail/CVE-2026-48356
  • https://sansec.io/research/magento-cms-block-loader-deepveindrilling#indicators-of-compromise
  • https://sansec.io/research/polyshell-mass-attack-wave
  • https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-48356
  • https://ltna.com.au/cyber

Indicators of Compromise

Type Value Description
Domain deepveindrilling.com Domain associated with post-exploitation CMS block loader activity.

MITRE ATT&CK

  • T1190 — Exploit Public-Facing Application
  • T1505.003 — Web Shell
  • T1059 — Command and Scripting Interpreter
  • T1059.007 — JavaScript
  • T1539 — Steal Web Session Cookie
  • T1074.001 — Local Data Staging
  • T1566.002 — Spearphishing Link
  • T1005 — Data from Local System
  • T1140 — Deobfuscate/Decode Files or Information
  • T1218 — System Binary Proxy Execution
  • T1136.001 — Local Account
  • T1056.003 — Web Portal Capture
  • T1087.004 — Cloud Account
  • T1098 — Account Manipulation
  • T1027 — Obfuscated Files or Information
  • T1573 — Encrypted Channel
  • T1567.002 — Exfiltration to Cloud Storage
  • T1070.004 — File Deletion
  • T1071.001 — Web Protocols
  • T1204.001 — Malicious Link
  • T1078.003 — Local Accounts
🤖 AI Attribution
Generated by gemini-2.5-flash ·
2,122 input / 2,212 output tokens ·
Reviewed and approved by a human analyst before publication
Posted in vulnerabilityTagged adobe commerce, critical, cwe-434, magento, rce, vulnerability, web applicationLeave a comment

CVE-2026-111497: Google Brotli Buffer Overflow Leads to Remote Code Execution

Posted on November 3, 2026 by Kyle

Overview

CVE-2026-111497 is a critical buffer overflow vulnerability in Google Brotli’s decoder, affecting versions 1.0.3 through 1.2.0. A remote, unauthenticated attacker can exploit this flaw using a specially crafted Brotli-compressed stream, leading to memory corruption, sensitive data disclosure, denial of service, or potentially arbitrary code execution. This vulnerability is actively being exploited, as indicated by CISA’s confirmation of “PHP2Shell” exploitation.

Technical Analysis

  • Vulnerability: Buffer overflow in the Brotli decoder (c/dec/decode.c). The NVD record also notes an unchecked return value (CWE-252) contributing to the issue, leading to an out-of-bounds write (CWE-787).
  • Affected Versions: Google Brotli versions 1.0.3 through 1.2.0, across all platforms.
  • Attack Vector: Remote, unauthenticated. Exploitation occurs via a crafted Brotli-compressed stream.
  • Impact: Successful exploitation can lead to:
    • Corrupt adjacent decoder state memory.
    • Disclose sensitive memory contents.
    • Cause a denial of service (DoS).
    • Potentially execute arbitrary code (RCE).
  • Exploitation: Publicly confirmed exploitation under the “PHP2Shell” moniker, indicating active abuse. Related community intelligence mentions “HTTP2Shell” and “Node2Shell” as well, suggesting broad applicability across different environments utilizing Brotli.

Detection

Detecting the initial exploitation of this library-level vulnerability can be challenging without deep packet inspection for malformed Brotli streams or specific application-level logging. However, successful exploitation leading to arbitrary code execution would likely manifest through post-exploitation activities.
* Process Creation Anomalies: Monitor for unusual child processes spawned by applications or services that utilize the Brotli library (e.g., web servers like Apache, Nginx, IIS, or applications like Node.js, PHP processes). Look for cmd.exe, powershell.exe, sh, bash, or other command interpreters executing from unexpected parent processes or with suspicious command-line arguments.
* File System Modifications: Look for new or modified files in web root directories, temporary directories, or system paths that could indicate webshells, malware drops (e.g., PolinRider), or persistence mechanisms.
* Network Connections: Monitor for outbound connections from vulnerable applications to unusual external IP addresses or domains, indicative of command-and-control (C2) communication or data exfiltration.
* Application Crashes: Monitor application logs for crashes, segmentation faults, or other memory-related errors that might indicate failed or successful exploitation attempts leading to denial of service.

Sigma Detection Rules

⚠️ AI-generated detection rules. These are experimental starting points. Review field names, EventIDs, and logic against your environment’s schema before deploying. Tune to reduce false positives.

Brotli RCE – Web Server Spawns Shell

title: Brotli RCE - Web Server Spawns Shell
id: 342f0a1d-5b7e-4c8d-9f0a-1b2c3d4e5f6a
status: experimental
description: Detects suspicious shell process creation by common web server or application processes, indicative of successful remote code execution via vulnerabilities like CVE-2026-111497.
logsource:
  product: windows
  service: sysmon
detection:
  selection_parent:
    ParentImage|endswith:
      - '\w3wp.exe'
      - '\httpd.exe'
      - '\nginx.exe'
      - '\node.exe'
      - '\php-cgi.exe'
      - '\php.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\bash.exe'
      - '\sh.exe'
  condition: all of selection_parent and all of selection_child
level: critical

Brotli RCE – Suspicious Command Line from Web Process

title: Brotli RCE - Suspicious Command Line from Web Process
id: a1b2c3d4-e5f6-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects suspicious command-line arguments executed by web server or application processes, potentially indicating successful remote code execution from vulnerabilities like CVE-2026-111497.
logsource:
  product: windows
  service: sysmon
detection:
  selection_parent:
    ParentImage|endswith:
      - '\w3wp.exe'
      - '\httpd.exe'
      - '\nginx.exe'
      - '\node.exe'
      - '\php-cgi.exe'
      - '\php.exe'
  selection_keywords:
    CommandLine|contains:
      - 'whoami'
      - 'net user'
      - 'ipconfig'
      - 'curl '
      - 'wget '
      - 'certutil '
      - 'bitsadmin '
      - 'powershell -enc '
      - 'mshta '
      - 'regsvr32 '
      - 'sc.exe create'
      - 'schtasks /create'
  condition: all of selection_parent and all of selection_keywords
level: high

Mitigations

  1. Patch Immediately: Update all instances of Google Brotli libraries or binaries to the latest available patched versions: 1.0.10, 1.1.1, or 1.2.1. Prioritize systems running versions 1.0.3 through 1.2.0.
  2. Input Validation: Implement robust input validation and sanitization for any Brotli-compressed data processed by applications, though this is a workaround and not a full fix for the underlying library vulnerability.
  3. Network Segmentation: Isolate critical applications that process untrusted Brotli-compressed data to limit potential lateral movement in case of compromise.
  4. Least Privilege: Ensure applications and services running Brotli decoders operate with the minimum necessary privileges.

References

  • https://nvd.nist.gov/vuln/detail/CVE-2026-111497
  • https://github.com/andybalholm/brotli/releases/tag/v1.2.7
  • https://nodejs.org/en/blog/vulnerability/october-2026-security-releases#nodejs-brotli-decoder-out-of-bounds-write-permits-remote-code-execution-cve-2026-111497—high
  • http://www.openwall.com/lists/oss-security/2026/10/23/25
  • http://www.openwall.com/lists/oss-security/2026/10/24/6
  • http://www.openwall.com/lists/oss-security/2026/10/26/12
  • http://www.openwall.com/lists/oss-security/2026/10/26/13
  • http://www.openwall.com/lists/oss-security/2026/10/26/16
  • https://broccoli2shell.com
  • https://www.wiz.io/blog/php2shell-exploitation-so-far
  • https://www.wiz.io/blog/gheist-attempted-scaled-abuse-of-stolen-github-tokens-stumbles
  • https://hi.sweet.security/http2shell-virtual-patching-sweet-safety-net
  • https://hackread.com/cisa-confirm-php2shell-exploit-federal-agencies-patch/
  • https://ltna.com.au/cyber

Indicators of Compromise

No public IOCs available at time of writing.

MITRE ATT&CK

  • T1190 — Exploit Public-Facing Application
  • T1059 — Command and Scripting Interpreter
  • T1499 — Endpoint Denial of Service
  • T1003 — OS Credential Dumping
  • T1537 — Transfer Data to Cloud Account
  • T1133 — External Remote Services
  • T1071 — Application Layer Protocol
  • T1560 — Archive Collected Data
  • T1595.002 — Vulnerability Scanning
  • T1595 — Active Scanning
  • T1212 — Exploitation for Credential Access
  • T1059.004 — Unix Shell
  • T1078 — Valid Accounts
  • T1068 — Exploitation for Privilege Escalation
  • T1027 — Obfuscated Files or Information
  • T1573 — Encrypted Channel
  • T1203 — Exploitation for Client Execution
  • T1071.001 — Web Protocols
  • T1074.001 — Local Data Staging
  • T1567.002 — Exfiltration to Cloud Storage
  • T1528 — Steal Application Access Token
  • T1610 — Deploy Container
  • T1213 — Data from Information Repositories
  • T1552.001 — Credentials In Files
  • T1552.007 — Container API
  • T1578.004 — Revert Cloud Instance
  • T1005 — Data from Local System
  • T1552 — Unsecured Credentials
  • T1078.004 — Cloud Accounts
  • T1070.004 — File Deletion
  • T1552.004 — Private Keys
  • T1609 — Container Administration Command
  • T1525 — Implant Internal Image
  • T1119 — Automated Collection
🤖 AI Attribution
Generated by gemini-2.5-flash ·
2,291 input / 2,181 output tokens ·
Reviewed and approved by a human analyst before publication
Posted in vulnerabilityTagged brotli, buffer overflow, critical, github tokens, http2shell, node2shell, php2shell, polinrider, remote code execution, secret exfiltration, supply chain, vulnerabilityLeave a comment

CVE-2026-109619: PHP Stale Internal Request-State RCE Vulnerability

Posted on November 3, 2026 by Kyle

Overview

CVE-2026-109619 is a high-severity vulnerability in PHP that enables unauthenticated remote code execution. The flaw stems from stale internal request-state, allowing attackers to manipulate freed memory. This vulnerability affects a wide range of PHP versions and products, including critical network devices, and is being actively exploited by threat actors, including state-sponsored groups and ransomware operators, often in conjunction with PHP2Shell exploitation.

Technical Analysis

  • Vulnerability: CVE-2026-109619 is a stale internal request-state vulnerability in PHP.
  • Mechanism: PHP contains various global state variables that temporarily point to request memory. In certain scenarios, this global state may not be correctly reset or may be repopulated after being reset, leading to it referring to freed request memory. Subsequent requests can then read or branch on this stale state before it is fully initialized.
  • Impact: Multiple strategies can trigger this condition, leading to unauthenticated remote code execution (RCE).
  • CVSS v3.1: 8.1 (HIGH) – CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H.
  • Weaknesses: CWE-416 (Use After Free), CWE-755 (Improper Handling of Exceptional Conditions), CWE-824 (Access of Uninitialized Pointer), CWE-1325 (Unchecked Return Value to NULL Pointer Dereference).
  • Affected Versions:
    • PHP php versions >= 5.4.0 < 8.2.35
    • PHP php versions >= 8.3.0 < 8.3.36
    • PHP php versions >= 8.4.0 < 8.4.27
    • PHP php versions >= 8.5.0 < 8.5.12
    • Siemens ruggedcom_ape1808_firmware
    • Palo Alto Networks pan-os versions >= 10.2.0 < 10.2.7
    • Palo Alto Networks pan-os version 10.2.7
    • Palo Alto Networks pan-os version 10.2.8
    • Palo Alto Networks pan-os version 10.2.9
    • Palo Alto Networks pan-os version 10.2.10
  • Attack Vector: Network-based (AV:N), unauthenticated (PR:N), requiring no user interaction (UI:N). The attack complexity is high (AC:H).

Detection

  • Monitor web server access logs for unusual requests to PHP files, especially those with suspicious parameters, encoded commands, or patterns indicative of PHP2Shell exploitation. Look for unexpected HTTP methods or large POST bodies to unusual endpoints.
  • Detect unexpected process spawns originating from web server processes (e.g., php-fpm.exe, httpd.exe, nginx.exe, apache2, php-fpm) or their child processes. Look for cmd.exe, powershell.exe, sh, bash, python, perl, nc, wget, curl, or other command-line utilities.
  • Monitor for the creation of suspicious files (e.g., .php, .txt, .log files containing web shell code) in web-accessible directories (/var/www/html, htdocs, wwwroot). Look for files containing common web shell keywords like eval(, system(, passthru(, shell_exec(, base64_decode(, $_GET[, $_POST[, or PHP2Shell specific strings.
  • Analyze network flow logs for outbound connections initiated by web server processes to unusual or external IP addresses/domains, indicative of C2 communication or data exfiltration.
  • Review PHP error logs for unexpected errors or warnings that might indicate exploitation attempts or memory corruption.

Sigma Detection Rules

⚠️ AI-generated detection rules. These are experimental starting points. Review field names, EventIDs, and logic against your environment’s schema before deploying. Tune to reduce false positives.

Web Server Process Spawning Suspicious Shell

title: Web Server Process Spawning Suspicious Shell
id: 90c7e2b1-d3f4-4a8e-a2c3-f0e2b1d3f4a8
status: experimental
description: Detects suspicious process creation by common web server processes, indicative of RCE exploitation of CVE-2026-109619.
logsource:
  product: windows
  service: sysmon
detection:
  selection_parent:
    ParentImage|endswith:
      - '\\httpd.exe'
      - '\\nginx.exe'
      - '\\php-fpm.exe'
  selection_child:
    Image|endswith:
      - '\\cmd.exe'
      - '\\powershell.exe'
      - '\\sh.exe'
      - '\\bash.exe'
      - '\\python.exe'
      - '\\perl.exe'
      - '\\nc.exe'
      - '\\wget.exe'
      - '\\curl.exe'
  condition: all of selection_*
level: critical

Suspicious PHP File Creation in Web Root

title: Suspicious PHP File Creation in Web Root
id: 4f1c7e2b-d3f4-4a8e-a2c3-f0e2b1d3f4a8
status: experimental
description: Detects creation of new PHP files in web-accessible directories by web server processes, potentially indicating webshell deployment (e.g., PHP2Shell) after CVE-2026-109619 exploitation.
logsource:
  product: windows
  service: sysmon
detection:
  selection:
    EventID: 11
    Image|endswith:
      - '\\httpd.exe'
      - '\\nginx.exe'
      - '\\php-fpm.exe'
    TargetFilename|endswith:
      - '.php'
      - '.phtml'
      - '.php5'
    TargetFilename|contains:
      - '\\inetpub\\wwwroot\\'
      - '\\Apache24\\htdocs\\'
      - '\\nginx\\html\\'
      - '\\www\\html\\'
  condition: selection
level: high

Web Access Log – Generic PHP RCE Attempt

title: Web Access Log - Generic PHP RCE Attempt
id: 7e2b1d3f-4a8e-a2c3-f0e2b1d3f4a8
status: experimental
description: Detects common patterns in web access logs indicative of PHP RCE attempts, potentially targeting CVE-2026-109619. This rule may produce false positives and requires tuning.
logsource:
  category: webserver
  service: apache
detection:
  selection:
    cs-uri-query|contains:
      - 'cmd='
      - 'exec='
      - 'system='
      - 'passthru='
      - 'shell_exec='
      - 'eval='
      - 'base64_decode='
      - 'id%20'
      - 'whoami%20'
      - 'cat%20/etc/passwd'
      - 'wget%20'
      - 'curl%20'
    cs-uri-stem|endswith:
      - '.php'
      - '.phtml'
      - '.php5'
  condition: selection
level: medium

Mitigations

  1. Patch PHP: Upgrade PHP installations to the latest patched versions: 8.2.35, 8.3.36, 8.4.27, 8.5.12, or newer, as soon as possible.
  2. Patch Affected Products: Apply vendor-specific patches for Siemens ruggedcom_ape1808_firmware and Palo Alto Networks pan-os to versions that address CVE-2026-109619.
  3. Implement Web Application Firewall (WAF): Deploy and configure a WAF to detect and block exploitation attempts targeting PHP vulnerabilities, including known PHP2Shell patterns and generic RCE payloads.
  4. Least Privilege: Ensure PHP processes and web servers run with the minimum necessary privileges to limit the impact of successful exploitation.
  5. Network Segmentation: Isolate web servers running PHP applications from critical internal networks to contain potential breaches.
  6. Regular Audits: Conduct regular security audits and penetration tests of PHP applications and underlying infrastructure to identify and remediate vulnerabilities.

References

  • https://nvd.nist.gov/vuln/detail/CVE-2026-109619
  • https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp
  • http://www.openwall.com/lists/oss-security/2026/10/21/16
  • https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-glocal-php-infrastructure/
  • https://hunt.io/blog/php2shell-cve-2026-109618-109619-open-directories
  • https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/
  • https://www.vulncheck.com/blog/php2shell-vulnerabilities
  • https://socradar.io/blog/inc-gentlemen-ransomware-ai-infrastructure

Indicators of Compromise

Type Value Description
SHA256 0c5486f06620e26e316f4b33f318b0d646d5e1133789331aa2fed012360d1486 PHP2Shell second-stage ELF x86-64 binary hash (via https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-glocal-php-infrastructure/)
SHA256 1485e14e0f62bc94664eec341cabd275dad7d30b1d496c40ec340c9a0d9f0ba8 Hash of follow-up POST request body (via https://www.vulncheck.com/blog/php2shell-vulnerabilities)
SHA256 150ae88f0999032e2a6113501d6082f54a3ed98d02427b21a96e773a27d7bf16 Hash of uploaded file part ‘a’ (via https://www.vulncheck.com/blog/php2shell-vulnerabilities)
SHA256 27d926a6708d6769d97d065e7a5a860ab496eab272c03d1cebc55ec71b954fa2 Hash of uploaded file part ‘b’ (via https://www.vulncheck.com/blog/php2shell-vulnerabilities)
SHA256 40caf199ca1ebe056a74427f8e9db06c66899e33ae09c0ec2769ec70bf6dd8e7 Hash of uploaded file part ‘a’ (via https://www.vulncheck.com/blog/php2shell-vulnerabilities)
SHA256 43898a0a53bbd25d31ad9f5018ed3182be98a66109b22c9cab545a9fc447992a PHP2Shell scanner/OOM-tool HTTP request body hash (via https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-glocal-php-infrastructure/)
SHA256 7bc41ed79a9ae909927a9e40701736460a8cb70fca16ce1510e58677aca764b6 PHP2Shell scanner/OOM-tool HTTP request body hash (via https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-glocal-php-infrastructure/)
IP Address 103.114.163.188 PHP2Shell-associated anonymisation network IP (via https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-glocal-php-infrastructure/)
IP Address 103.216.220.92 PHP2Shell-associated anonymisation network IP (via https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-glocal-php-infrastructure/)
IP Address 109.71.252.97 PHP2Shell scanner/exploitation IP (via https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-glocal-php-infrastructure/)
IP Address 134.209.159.64 PHP2Shell-associated anonymisation network IP (via https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-glocal-php-infrastructure/)
IP Address 221.14.159.134 Exploitation attempt IP for CVE-2026-109618 (via https://www.vulncheck.com/blog/php2shell-vulnerabilities)
IP Address 31.223.184.166 PHP2Shell-associated anonymisation network IP (via https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-glocal-php-infrastructure/)
IP Address 37.19.200.5 PHP2Shell-associated anonymisation network IP (via https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-glocal-php-infrastructure/)
IP Address 45.198.224.169 PHP2Shell scanner/exploitation IP (via https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-glocal-php-infrastructure/)
IP Address 85.11.167.243 PHP2Shell scanner/exploitation IP (via https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-glocal-php-infrastructure/)
IP Address 91.90.123.25 Verification IP for CVE-2026-109618 (via https://www.vulncheck.com/blog/php2shell-vulnerabilities)
IP Address 92.118.112.100 PHP2Shell second-stage payload staging host IP (via https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-glocal-php-infrastructure/)
IP Address 95.217.98.37 PHP2Shell-associated anonymisation network IP (via https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-glocal-php-infrastructure/)
URL https://fedi.katze.sh/@elise/117478655339557825 Fediverse post discussing a different PHP vulnerability (via http://www.openwall.com/lists/oss-security/2026/10/21/17)
URL https://fedi.katze.sh/@elise/117479383739450605 Fediverse post reporting incomplete PHP fix (via http://www.openwall.com/lists/oss-security/2026/10/21/17)

MITRE ATT&CK

  • T1190 — Exploit Public-Facing Application
  • T1059.004 — Unix Shell
  • T1059.003 — Windows Command Shell
  • T1505.003 — Web Shell
  • T1590.005 — IP Addresses
  • T1053.003 — Cron
  • T1005 — Data from Local System
  • T1608.001 — Upload Malware
  • T1595.002 — Vulnerability Scanning
  • T1583.004 — Server
  • T1098.004 — SSH Authorized Keys
  • T1552.001 — Credentials In Files
  • T1041 — Exfiltration Over C2 Channel
  • T1210 — Exploitation of Remote Services
  • T1486 — Data Encrypted for Impact
  • T1496 — Resource Hijacking
  • T1105 — Ingress Tool Transfer
  • T1588.005 — Exploits
  • T1592 — Gather Victim Host Information
  • T1133 — External Remote Services
  • T1071.004 — DNS
  • T1036.005 — Match Legitimate Resource Name or Location
  • T1499.004 — Application or System Exploitation
  • T1071 — Application Layer Protocol
  • T1036 — Masquerading
  • T1595 — Active Scanning
  • T1090.002 — External Proxy
  • T1090 — Proxy
  • T1059 — Command and Scripting Interpreter
  • T1078 — Valid Accounts
  • T1573 — Encrypted Channel
  • T1592.002 — Software
  • T1203 — Exploitation for Client Execution
  • T1499 — Endpoint Denial of Service
  • T1059.006 — Python
  • T1071.001 — Web Protocols
  • T1046 — Network Service Discovery
  • T1082 — System Information Discovery
  • T1583.003 — Virtual Private Server
  • T1102 — Web Service
  • T1562.001 — Disable or Modify Tools
  • T1070.004 — File Deletion
  • T1021 — Remote Services
  • T1083 — File and Directory Discovery
  • T1136 — Create Account
  • T1018 — Remote System Discovery
  • T1003.003 — NTDS
  • T1021.001 — Remote Desktop Protocol
  • T1567.002 — Exfiltration to Cloud Storage
  • T1587.001 — Malware
  • T1489 — Service Stop
  • T1087.002 — Domain Account
  • T1053.005 — Scheduled Task
  • T1219 — Remote Access Tools
  • T1558.003 — Kerberoasting
  • T1583.001 — Domains
  • T1135 — Network Share Discovery
  • T1059.001 — PowerShell
  • T1588.002 — Tool
  • T1490 — Inhibit System Recovery
  • T1110 — Brute Force
  • T1204.002 — Malicious File
  • T1114.001 — Local Email Collection
  • T1572 — Protocol Tunneling
  • T1021.002 — SMB/Windows Admin Shares
  • T1072 — Software Deployment Tools
  • T1566.001 — Spearphishing Attachment
  • T1070.006 — Timestomp
  • T1074.001 — Local Data Staging
  • T1555.003 — Credentials from Web Browsers
  • T1056.002 — GUI Input Capture
  • T1003.006 — DCSync
  • T1057 — Process Discovery
  • T1591 — Gather Victim Org Information
  • T1056.001 — Keylogging
  • T1555 — Credentials from Password Stores
  • T1132.001 — Standard Encoding
  • T1566.002 — Spearphishing Link
  • T1573.001 — Symmetric Cryptography
  • T1218.011 — Rundll32
  • T1497.001 — System Checks
  • T1539 — Steal Web Session Cookie
  • T1027 — Obfuscated Files or Information
  • T1102.002 — Bidirectional Communication
  • T1140 — Deobfuscate/Decode Files or Information
  • T1055.012 — Process Hollowing
  • T1110.001 — Password Guessing
  • T1087.001 — Local Account
  • T1021.004 — SSH
  • T1040 — Network Sniffing
  • T1567 — Exfiltration Over Web Service
  • T1552 — Unsecured Credentials
  • T1552.004 — Private Keys
  • T1087 — Account Discovery
  • T1087.004 — Cloud Account
🤖 AI Attribution
Generated by gemini-2.5-flash ·
2,763 input / 2,653 output tokens ·
Reviewed and approved by a human analyst before publication
Posted in vulnerabilityTagged high, php, rce, vulnerability, web, webshellLeave a comment

CVE-2026-109618: PHP Memory Corruption Leads to Unauthenticated RCE

Posted on November 3, 2026 by Kyle

Overview

This report details CVE-2026-109618, a critical memory corruption vulnerability in PHP that enables unauthenticated remote code execution. The flaw stems from improper handling of out-of-memory errors, leaving request memory in an uninitialized state. Active exploitation has been observed, with threat actors leveraging this vulnerability to deploy various malware families and establish persistence.

Technical Analysis

The vulnerability, CVE-2026-109618, is an out-of-memory (OOM) corruption flaw in PHP. It occurs because PHP uses longjmp() to exit the current context during OOM errors, but some contexts fail to properly account for this, leaving request memory uninitialized. Subsequent request cleanup procedures can then read or branch on this uninitialized memory, leading to remote code execution (RCE). The vulnerability is unauthenticated and can be triggered consistently via multiple OOM strategies.

  • CVSS 3.1 Score: 9.8 (CRITICAL) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
  • Weaknesses: CWE-416 (Use-After-Free), CWE-755 (Improper Handling of Exceptional Conditions), CWE-824 (Access of Uninitialized Pointer), CWE-1325 (Uninitialized Memory in PHP).
  • Affected PHP versions:
    • php >= 7.3.0 < 8.2.35
    • php >= 8.3.0 < 8.3.36
    • php >= 8.4.0 < 8.4.27
    • php >= 8.5.0 < 8.5.12
  • Affected products also include:
    • siemens ruggedcom_ape1808_firmware
    • paloaltonetworks pan-os >= 10.2.0 < 10.2.7
    • paloaltonetworks pan-os 10.2.7
    • paloaltonetworks pan-os 10.2.8
    • paloaltonetworks pan-os 10.2.9
    • paloaltonetworks pan-os 10.2.10

Detection

  • Monitor web server access logs for unusual request patterns, especially those that might trigger OOM conditions or attempt to execute arbitrary commands. Look for abnormally long or malformed requests.
  • Monitor for unexpected child processes spawned by web server processes (e.g., httpd.exe, nginx.exe, php-fpm.exe, php.exe). Look for cmd.exe, powershell.exe, sh, bash, python.exe, or other scripting interpreters.
  • Look for suspicious file writes in web-accessible directories, such as .php files with obfuscated content or known webshell signatures, originating from web server processes.
  • Analyze system logs for php process crashes or abnormal memory usage spikes followed by suspicious process activity.
  • Hunt for network connections initiated by the web server process to unusual external IP addresses or domains, indicative of C2 communication or data exfiltration.

Sigma Detection Rules

⚠️ AI-generated detection rules. These are experimental starting points. Review field names, EventIDs, and logic against your environment’s schema before deploying. Tune to reduce false positives.

Windows Web Server Spawning Shell

title: Windows Web Server Spawning Shell
id: 9a3e2f1a-b1c7-4d8e-a0b1-c74d8ea0b1c7
status: experimental
description: Detects suspicious shell process creation by common Windows web server processes, indicative of RCE.
logsource:
  product: windows
  service: sysmon
detection:
  selection:
    ParentImage|endswith:
      - '\inetinfo.exe'
      - '\httpd.exe'
      - '\nginx.exe'
      - '\php-cgi.exe'
      - '\php-fpm.exe'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
  condition: selection
level: high

Linux Web Server Spawning Shell

title: Linux Web Server Spawning Shell
id: 8b2d1e0a-a0b1-4c7d-8e9f-a0b1c74d8e9f
status: experimental
description: Detects suspicious shell process creation by common Linux web server processes, indicative of RCE.
logsource:
  product: linux
  service: auditd
detection:
  selection:
    ParentProcessName:
      - 'apache2'
      - 'httpd'
      - 'nginx'
      - 'php-fpm'
      - 'php-cgi'
    ProcessName:
      - 'sh'
      - 'bash'
      - 'dash'
      - 'zsh'
      - 'python'
      - 'perl'
      - 'php'
  condition: selection
level: high

PHP Process Outbound Network Connection

title: PHP Process Outbound Network Connection
id: 7c1f0d9a-9f8e-4b6c-7d5a-9f8e4b6c7d5a
status: experimental
description: Detects outbound network connections initiated by PHP processes to non-standard ports or external IPs, potentially indicating C2 or data exfiltration after RCE.
logsource:
  product: windows
  service: sysmon
detection:
  selection:
    EventID: 3
    Image|endswith:
      - '\php.exe'
      - '\php-cgi.exe'
      - '\php-fpm.exe'
    DestinationPort|!in:
      - 80
      - 443
    DestinationIp|!in:
      - '127.0.0.1'
      - '::1'
      - '10.0.0.0/8'
      - '172.16.0.0/12'
      - '192.168.0.0/16'
  condition: selection
level: medium

Mitigations

  1. Patch PHP installations immediately. Upgrade to the latest patched versions: PHP 8.2.35, PHP 8.3.36, PHP 8.4.27, PHP 8.5.12, or newer.
  2. Apply available patches for affected products such as Siemens RUGGEDCOM APE1808 firmware and Palo Alto Networks PAN-OS.
  3. Implement a Web Application Firewall (WAF) to detect and block malicious request patterns targeting PHP vulnerabilities.
  4. Restrict outbound network connectivity from web servers to only necessary services and destinations.
  5. Employ Endpoint Detection and Response (EDR) solutions to monitor for suspicious process creation and file modifications on web servers.

References

  • https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w
  • http://www.openwall.com/lists/oss-security/2026/10/21/6
  • http://www.openwall.com/lists/oss-security/2026/10/23/5
  • https://cert-portal.siemens.com/productcert/html/ssa-566512.html
  • https://www.wiz.io/blog/php2shell-php-rce
  • https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-glocal-php-infrastructure/
  • https://hunt.io/blog/php2shell-cve-2026-109618-109619-open-directories
  • https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/
  • https://www.vulncheck.com/blog/php2shell-vulnerabilities
  • https://socradar.io/blog/inc-gentlemen-ransomware-ai-infrastructure
  • https://www.huntress.com/blog/amazon-clickfix-finger
  • https://unit42.paloaltonetworks.com/ai-assisted-cybercrime-analysis/
  • https://www.security.nl/posting/959207/Amerikaanse+overheid+waarschuwt+voor+misbruik+van+PHP2Shell-lekken?channel=rss

Indicators of Compromise

Type Value Description
SHA256 0c5486f06620e26e316f4b33f318b0d646d5e1133789331aa2fed012360d1486 PHP2Shell second-stage ELF x86-64 binary hash (via https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-glocal-php-infrastructure/)
SHA256 1485e14e0f62bc94664eec341cabd275dad7d30b1d496c40ec340c9a0d9f0ba8 Hash of follow-up POST request body (via https://www.vulncheck.com/blog/php2shell-vulnerabilities)
SHA256 150ae88f0999032e2a6113501d6082f54a3ed98d02427b21a96e773a27d7bf16 Hash of uploaded file part ‘a’ (via https://www.vulncheck.com/blog/php2shell-vulnerabilities)
SHA256 27d926a6708d6769d97d065e7a5a860ab496eab272c03d1cebc55ec71b954fa2 Hash of uploaded file part ‘b’ (via https://www.vulncheck.com/blog/php2shell-vulnerabilities)
SHA256 40caf199ca1ebe056a74427f8e9db06c66899e33ae09c0ec2769ec70bf6dd8e7 Hash of uploaded file part ‘a’ (via https://www.vulncheck.com/blog/php2shell-vulnerabilities)
SHA256 43898a0a53bbd25d31ad9f5018ed3182be98a66109b22c9cab545a9fc447992a PHP2Shell scanner/OOM-tool HTTP request body hash (via https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-glocal-php-infrastructure/)
SHA256 7bc41ed79a9ae909927a9e40701736460a8cb70fca16ce1510e58677aca764b6 PHP2Shell scanner/OOM-tool HTTP request body hash (via https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-glocal-php-infrastructure/)
IP Address 103.114.163.188 PHP2Shell-associated anonymisation network IP (via https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-glocal-php-infrastructure/)
IP Address 103.216.220.92 PHP2Shell-associated anonymisation network IP (via https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-glocal-php-infrastructure/)
IP Address 109.71.252.97 PHP2Shell scanner/exploitation IP (via https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-glocal-php-infrastructure/)
IP Address 130.12.180.51 RedTail · confidence 75% · first seen 2026-10-23
IP Address 134.199.154.64 Mirai · confidence 75% · first seen 2026-10-22
IP Address 134.209.159.64 PHP2Shell-associated anonymisation network IP (via https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-glocal-php-infrastructure/)
IP Address 217.60.102.5 RedTail · confidence 100% · first seen 2026-10-23
IP Address 221.14.159.134 Exploitation attempt IP for CVE-2026-109618 (via https://www.vulncheck.com/blog/php2shell-vulnerabilities)
IP Address 31.223.184.166 PHP2Shell-associated anonymisation network IP (via https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-glocal-php-infrastructure/)
IP Address 37.19.200.5 PHP2Shell-associated anonymisation network IP (via https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-glocal-php-infrastructure/)
IP Address 45.198.224.169 PHP2Shell scanner/exploitation IP (via https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-glocal-php-infrastructure/)
IP Address 85.11.167.243 PHP2Shell scanner/exploitation IP (via https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-glocal-php-infrastructure/)
IP Address 91.90.123.25 Verification IP for CVE-2026-109618 (via https://www.vulncheck.com/blog/php2shell-vulnerabilities)
IP Address 92.118.112.100 PHP2Shell second-stage payload staging host IP (via https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-glocal-php-infrastructure/)
IP Address 95.217.98.37 PHP2Shell-associated anonymisation network IP (via https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-glocal-php-infrastructure/)
Domain p.2137gang.net RedTail · confidence 100% · first seen 2026-10-23
Domain p.2137gang.pl RedTail · confidence 100% · first seen 2026-10-23
Domain p.2137gang.shop RedTail · confidence 100% · first seen 2026-10-23
Domain p.2137gang.st RedTail · confidence 100% · first seen 2026-10-23
Domain p.2137gang.store RedTail · confidence 100% · first seen 2026-10-23
Domain proxies.identities.network RedTail · confidence 100% · first seen 2026-10-23
Domain proxy.identities.network RedTail · confidence 100% · first seen 2026-10-23
Domain proxy.insanecppdev.com RedTail · confidence 100% · first seen 2026-10-23
Domain proxy.insanitycpp.cx RedTail · confidence 100% · first seen 2026-10-23
Domain thunder.godofthunder.st Mirai · confidence 90% · first seen 2026-10-22
URL http://92.118.112.100/nfs Mirai · confidence 100% · first seen 2026-10-22
URL http://92.118.112.100/s Mirai · confidence 100% · first seen 2026-10-22
URL http://hackattackkaboom.botlesscucks.st/x86_64 Mirai · confidence 100% · first seen 2026-10-22
URL https://217.60.102.5/sh RedTail · confidence 100% · first seen 2026-10-23
URL https://217.60.103.56/sh RedTail · confidence 100% · first seen 2026-10-23

MITRE ATT&CK

  • T1190 — Exploit Public-Facing Application
  • T1059.004 — Unix Shell
  • T1059.003 — Windows Command Shell
  • T1059.006 — Python
  • T1059.001 — PowerShell
  • T1505.003 — Web Shell
  • T1590.005 — IP Addresses
  • T1053.003 — Cron
  • T1005 — Data from Local System
  • T1608.001 — Upload Malware
  • T1595.002 — Vulnerability Scanning
  • T1583.004 — Server
  • T1098.004 — SSH Authorized Keys
  • T1552.001 — Credentials In Files
  • T1041 — Exfiltration Over C2 Channel
  • T1210 — Exploitation of Remote Services
  • T1486 — Data Encrypted for Impact
  • T1496 — Resource Hijacking
  • T1105 — Ingress Tool Transfer
  • T1588.005 — Exploits
  • T1592 — Gather Victim Host Information
  • T1133 — External Remote Services
  • T1071.004 — DNS
  • T1036.005 — Match Legitimate Resource Name or Location
  • T1499.004 — Application or System Exploitation
  • T1071 — Application Layer Protocol
  • T1036 — Masquerading
  • T1595 — Active Scanning
  • T1090.002 — External Proxy
  • T1090 — Proxy
  • T1059 — Command and Scripting Interpreter
  • T1078 — Valid Accounts
  • T1573 — Encrypted Channel
  • T1592.002 — Software
  • T1203 — Exploitation for Client Execution
  • T1499 — Endpoint Denial of Service
  • T1071.001 — Web Protocols
  • T1046 — Network Service Discovery
  • T1082 — System Information Discovery
  • T1583.003 — Virtual Private Server
  • T1102 — Web Service
  • T1562.001 — Disable or Modify Tools
  • T1070.004 — File Deletion
  • T1021 — Remote Services
  • T1083 — File and Directory Discovery
  • T1136 — Create Account
  • T1018 — Remote System Discovery
  • T1003.003 — NTDS
  • T1021.001 — Remote Desktop Protocol
  • T1567.002 — Exfiltration to Cloud Storage
  • T1587.001 — Malware
  • T1489 — Service Stop
  • T1087.002 — Domain Account
  • T1053.005 — Scheduled Task
  • T1219 — Remote Access Tools
  • T1558.003 — Kerberoasting
  • T1583.001 — Domains
  • T1135 — Network Share Discovery
  • T1588.002 — Tool
  • T1490 — Inhibit System Recovery
  • T1110 — Brute Force
  • T1204.002 — Malicious File
  • T1114.001 — Local Email Collection
  • T1572 — Protocol Tunneling
  • T1021.002 — SMB/Windows Admin Shares
  • T1072 — Software Deployment Tools
  • T1566.001 — Spearphishing Attachment
  • T1070.006 — Timestomp
  • T1074.001 — Local Data Staging
  • T1555.003 — Credentials from Web Browsers
  • T1056.002 — GUI Input Capture
  • T1003.006 — DCSync
  • T1057 — Process Discovery
  • T1591 — Gather Victim Org Information
  • T1056.001 — Keylogging
  • T1555 — Credentials from Password Stores
  • T1132.001 — Standard Encoding
  • T1566.002 — Spearphishing Link
  • T1573.001 — Symmetric Cryptography
  • T1218.011 — Rundll32
  • T1497.001 — System Checks
  • T1539 — Steal Web Session Cookie
  • T1027 — Obfuscated Files or Information
  • T1102.002 — Bidirectional Communication
  • T1140 — Deobfuscate/Decode Files or Information
  • T1055.012 — Process Hollowing
  • T1110.001 — Password Guessing
  • T1087.001 — Local Account
  • T1021.004 — SSH
  • T1040 — Network Sniffing
  • T1567 — Exfiltration Over Web Service
  • T1552 — Unsecured Credentials
  • T1552.004 — Private Keys
  • T1087 — Account Discovery
  • T1087.004 — Cloud Account
🤖 AI Attribution
Generated by gemini-2.5-flash ·
2,689 input / 2,444 output tokens ·
Reviewed and approved by a human analyst before publication
Posted in vulnerabilityTagged critical, dprk, memory-corruption, php, ransomware, rce, vulnerability, web-application, webshellLeave a comment

Posts navigation

Older posts
Proudly powered by WordPress | Theme: micro, developed by DevriX.