Overview
This report details CVE-2026-109618, a critical memory corruption vulnerability in PHP that enables unauthenticated remote code execution. The flaw stems from improper handling of out-of-memory errors, leaving request memory in an uninitialized state. Active exploitation has been observed, with threat actors leveraging this vulnerability to deploy various malware families and establish persistence.
Technical Analysis
The vulnerability, CVE-2026-109618, is an out-of-memory (OOM) corruption flaw in PHP. It occurs because PHP uses longjmp() to exit the current context during OOM errors, but some contexts fail to properly account for this, leaving request memory uninitialized. Subsequent request cleanup procedures can then read or branch on this uninitialized memory, leading to remote code execution (RCE). The vulnerability is unauthenticated and can be triggered consistently via multiple OOM strategies.
- CVSS 3.1 Score: 9.8 (CRITICAL) with vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. - Weaknesses:
CWE-416(Use-After-Free),CWE-755(Improper Handling of Exceptional Conditions),CWE-824(Access of Uninitialized Pointer),CWE-1325(Uninitialized Memory in PHP). - Affected PHP versions:
php >= 7.3.0 < 8.2.35php >= 8.3.0 < 8.3.36php >= 8.4.0 < 8.4.27php >= 8.5.0 < 8.5.12
- Affected products also include:
siemens ruggedcom_ape1808_firmwarepaloaltonetworks pan-os >= 10.2.0 < 10.2.7paloaltonetworks pan-os 10.2.7paloaltonetworks pan-os 10.2.8paloaltonetworks pan-os 10.2.9paloaltonetworks pan-os 10.2.10
Detection
- Monitor web server access logs for unusual request patterns, especially those that might trigger OOM conditions or attempt to execute arbitrary commands. Look for abnormally long or malformed requests.
- Monitor for unexpected child processes spawned by web server processes (e.g.,
httpd.exe,nginx.exe,php-fpm.exe,php.exe). Look forcmd.exe,powershell.exe,sh,bash,python.exe, or other scripting interpreters. - Look for suspicious file writes in web-accessible directories, such as
.phpfiles with obfuscated content or known webshell signatures, originating from web server processes. - Analyze system logs for
phpprocess crashes or abnormal memory usage spikes followed by suspicious process activity. - Hunt for network connections initiated by the web server process to unusual external IP addresses or domains, indicative of C2 communication or data exfiltration.
Sigma Detection Rules
⚠️ AI-generated detection rules. These are experimental starting points. Review field names, EventIDs, and logic against your environment’s schema before deploying. Tune to reduce false positives.
Windows Web Server Spawning Shell
title: Windows Web Server Spawning Shell
id: 9a3e2f1a-b1c7-4d8e-a0b1-c74d8ea0b1c7
status: experimental
description: Detects suspicious shell process creation by common Windows web server processes, indicative of RCE.
logsource:
product: windows
service: sysmon
detection:
selection:
ParentImage|endswith:
- '\inetinfo.exe'
- '\httpd.exe'
- '\nginx.exe'
- '\php-cgi.exe'
- '\php-fpm.exe'
Image|endswith:
- '\cmd.exe'
- '\powershell.exe'
- '\pwsh.exe'
condition: selection
level: high
Linux Web Server Spawning Shell
title: Linux Web Server Spawning Shell
id: 8b2d1e0a-a0b1-4c7d-8e9f-a0b1c74d8e9f
status: experimental
description: Detects suspicious shell process creation by common Linux web server processes, indicative of RCE.
logsource:
product: linux
service: auditd
detection:
selection:
ParentProcessName:
- 'apache2'
- 'httpd'
- 'nginx'
- 'php-fpm'
- 'php-cgi'
ProcessName:
- 'sh'
- 'bash'
- 'dash'
- 'zsh'
- 'python'
- 'perl'
- 'php'
condition: selection
level: high
PHP Process Outbound Network Connection
title: PHP Process Outbound Network Connection
id: 7c1f0d9a-9f8e-4b6c-7d5a-9f8e4b6c7d5a
status: experimental
description: Detects outbound network connections initiated by PHP processes to non-standard ports or external IPs, potentially indicating C2 or data exfiltration after RCE.
logsource:
product: windows
service: sysmon
detection:
selection:
EventID: 3
Image|endswith:
- '\php.exe'
- '\php-cgi.exe'
- '\php-fpm.exe'
DestinationPort|!in:
- 80
- 443
DestinationIp|!in:
- '127.0.0.1'
- '::1'
- '10.0.0.0/8'
- '172.16.0.0/12'
- '192.168.0.0/16'
condition: selection
level: medium
Mitigations
- Patch PHP installations immediately. Upgrade to the latest patched versions:
PHP 8.2.35,PHP 8.3.36,PHP 8.4.27,PHP 8.5.12, or newer. - Apply available patches for affected products such as Siemens RUGGEDCOM APE1808 firmware and Palo Alto Networks PAN-OS.
- Implement a Web Application Firewall (WAF) to detect and block malicious request patterns targeting PHP vulnerabilities.
- Restrict outbound network connectivity from web servers to only necessary services and destinations.
- Employ Endpoint Detection and Response (EDR) solutions to monitor for suspicious process creation and file modifications on web servers.
References
- https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w
- http://www.openwall.com/lists/oss-security/2026/10/21/6
- http://www.openwall.com/lists/oss-security/2026/10/23/5
- https://cert-portal.siemens.com/productcert/html/ssa-566512.html
- https://www.wiz.io/blog/php2shell-php-rce
- https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-glocal-php-infrastructure/
- https://hunt.io/blog/php2shell-cve-2026-109618-109619-open-directories
- https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/
- https://www.vulncheck.com/blog/php2shell-vulnerabilities
- https://socradar.io/blog/inc-gentlemen-ransomware-ai-infrastructure
- https://www.huntress.com/blog/amazon-clickfix-finger
- https://unit42.paloaltonetworks.com/ai-assisted-cybercrime-analysis/
- https://www.security.nl/posting/959207/Amerikaanse+overheid+waarschuwt+voor+misbruik+van+PHP2Shell-lekken?channel=rss
Indicators of Compromise
| Type | Value | Description |
|---|---|---|
| SHA256 | 0c5486f06620e26e316f4b33f318b0d646d5e1133789331aa2fed012360d1486 |
PHP2Shell second-stage ELF x86-64 binary hash (via https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-glocal-php-infrastructure/) |
| SHA256 | 1485e14e0f62bc94664eec341cabd275dad7d30b1d496c40ec340c9a0d9f0ba8 |
Hash of follow-up POST request body (via https://www.vulncheck.com/blog/php2shell-vulnerabilities) |
| SHA256 | 150ae88f0999032e2a6113501d6082f54a3ed98d02427b21a96e773a27d7bf16 |
Hash of uploaded file part ‘a’ (via https://www.vulncheck.com/blog/php2shell-vulnerabilities) |
| SHA256 | 27d926a6708d6769d97d065e7a5a860ab496eab272c03d1cebc55ec71b954fa2 |
Hash of uploaded file part ‘b’ (via https://www.vulncheck.com/blog/php2shell-vulnerabilities) |
| SHA256 | 40caf199ca1ebe056a74427f8e9db06c66899e33ae09c0ec2769ec70bf6dd8e7 |
Hash of uploaded file part ‘a’ (via https://www.vulncheck.com/blog/php2shell-vulnerabilities) |
| SHA256 | 43898a0a53bbd25d31ad9f5018ed3182be98a66109b22c9cab545a9fc447992a |
PHP2Shell scanner/OOM-tool HTTP request body hash (via https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-glocal-php-infrastructure/) |
| SHA256 | 7bc41ed79a9ae909927a9e40701736460a8cb70fca16ce1510e58677aca764b6 |
PHP2Shell scanner/OOM-tool HTTP request body hash (via https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-glocal-php-infrastructure/) |
| IP Address | 103.114.163.188 |
PHP2Shell-associated anonymisation network IP (via https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-glocal-php-infrastructure/) |
| IP Address | 103.216.220.92 |
PHP2Shell-associated anonymisation network IP (via https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-glocal-php-infrastructure/) |
| IP Address | 109.71.252.97 |
PHP2Shell scanner/exploitation IP (via https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-glocal-php-infrastructure/) |
| IP Address | 130.12.180.51 |
RedTail · confidence 75% · first seen 2026-10-23 |
| IP Address | 134.199.154.64 |
Mirai · confidence 75% · first seen 2026-10-22 |
| IP Address | 134.209.159.64 |
PHP2Shell-associated anonymisation network IP (via https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-glocal-php-infrastructure/) |
| IP Address | 217.60.102.5 |
RedTail · confidence 100% · first seen 2026-10-23 |
| IP Address | 221.14.159.134 |
Exploitation attempt IP for CVE-2026-109618 (via https://www.vulncheck.com/blog/php2shell-vulnerabilities) |
| IP Address | 31.223.184.166 |
PHP2Shell-associated anonymisation network IP (via https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-glocal-php-infrastructure/) |
| IP Address | 37.19.200.5 |
PHP2Shell-associated anonymisation network IP (via https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-glocal-php-infrastructure/) |
| IP Address | 45.198.224.169 |
PHP2Shell scanner/exploitation IP (via https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-glocal-php-infrastructure/) |
| IP Address | 85.11.167.243 |
PHP2Shell scanner/exploitation IP (via https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-glocal-php-infrastructure/) |
| IP Address | 91.90.123.25 |
Verification IP for CVE-2026-109618 (via https://www.vulncheck.com/blog/php2shell-vulnerabilities) |
| IP Address | 92.118.112.100 |
PHP2Shell second-stage payload staging host IP (via https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-glocal-php-infrastructure/) |
| IP Address | 95.217.98.37 |
PHP2Shell-associated anonymisation network IP (via https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-glocal-php-infrastructure/) |
| Domain | p.2137gang.net |
RedTail · confidence 100% · first seen 2026-10-23 |
| Domain | p.2137gang.pl |
RedTail · confidence 100% · first seen 2026-10-23 |
| Domain | p.2137gang.shop |
RedTail · confidence 100% · first seen 2026-10-23 |
| Domain | p.2137gang.st |
RedTail · confidence 100% · first seen 2026-10-23 |
| Domain | p.2137gang.store |
RedTail · confidence 100% · first seen 2026-10-23 |
| Domain | proxies.identities.network |
RedTail · confidence 100% · first seen 2026-10-23 |
| Domain | proxy.identities.network |
RedTail · confidence 100% · first seen 2026-10-23 |
| Domain | proxy.insanecppdev.com |
RedTail · confidence 100% · first seen 2026-10-23 |
| Domain | proxy.insanitycpp.cx |
RedTail · confidence 100% · first seen 2026-10-23 |
| Domain | thunder.godofthunder.st |
Mirai · confidence 90% · first seen 2026-10-22 |
| URL | http://92.118.112.100/nfs |
Mirai · confidence 100% · first seen 2026-10-22 |
| URL | http://92.118.112.100/s |
Mirai · confidence 100% · first seen 2026-10-22 |
| URL | http://hackattackkaboom.botlesscucks.st/x86_64 |
Mirai · confidence 100% · first seen 2026-10-22 |
| URL | https://217.60.102.5/sh |
RedTail · confidence 100% · first seen 2026-10-23 |
| URL | https://217.60.103.56/sh |
RedTail · confidence 100% · first seen 2026-10-23 |
MITRE ATT&CK
T1190— Exploit Public-Facing ApplicationT1059.004— Unix ShellT1059.003— Windows Command ShellT1059.006— PythonT1059.001— PowerShellT1505.003— Web ShellT1590.005— IP AddressesT1053.003— CronT1005— Data from Local SystemT1608.001— Upload MalwareT1595.002— Vulnerability ScanningT1583.004— ServerT1098.004— SSH Authorized KeysT1552.001— Credentials In FilesT1041— Exfiltration Over C2 ChannelT1210— Exploitation of Remote ServicesT1486— Data Encrypted for ImpactT1496— Resource HijackingT1105— Ingress Tool TransferT1588.005— ExploitsT1592— Gather Victim Host InformationT1133— External Remote ServicesT1071.004— DNST1036.005— Match Legitimate Resource Name or LocationT1499.004— Application or System ExploitationT1071— Application Layer ProtocolT1036— MasqueradingT1595— Active ScanningT1090.002— External ProxyT1090— ProxyT1059— Command and Scripting InterpreterT1078— Valid AccountsT1573— Encrypted ChannelT1592.002— SoftwareT1203— Exploitation for Client ExecutionT1499— Endpoint Denial of ServiceT1071.001— Web ProtocolsT1046— Network Service DiscoveryT1082— System Information DiscoveryT1583.003— Virtual Private ServerT1102— Web ServiceT1562.001— Disable or Modify ToolsT1070.004— File DeletionT1021— Remote ServicesT1083— File and Directory DiscoveryT1136— Create AccountT1018— Remote System DiscoveryT1003.003— NTDST1021.001— Remote Desktop ProtocolT1567.002— Exfiltration to Cloud StorageT1587.001— MalwareT1489— Service StopT1087.002— Domain AccountT1053.005— Scheduled TaskT1219— Remote Access ToolsT1558.003— KerberoastingT1583.001— DomainsT1135— Network Share DiscoveryT1588.002— ToolT1490— Inhibit System RecoveryT1110— Brute ForceT1204.002— Malicious FileT1114.001— Local Email CollectionT1572— Protocol TunnelingT1021.002— SMB/Windows Admin SharesT1072— Software Deployment ToolsT1566.001— Spearphishing AttachmentT1070.006— TimestompT1074.001— Local Data StagingT1555.003— Credentials from Web BrowsersT1056.002— GUI Input CaptureT1003.006— DCSyncT1057— Process DiscoveryT1591— Gather Victim Org InformationT1056.001— KeyloggingT1555— Credentials from Password StoresT1132.001— Standard EncodingT1566.002— Spearphishing LinkT1573.001— Symmetric CryptographyT1218.011— Rundll32T1497.001— System ChecksT1539— Steal Web Session CookieT1027— Obfuscated Files or InformationT1102.002— Bidirectional CommunicationT1140— Deobfuscate/Decode Files or InformationT1055.012— Process HollowingT1110.001— Password GuessingT1087.001— Local AccountT1021.004— SSHT1040— Network SniffingT1567— Exfiltration Over Web ServiceT1552— Unsecured CredentialsT1552.004— Private KeysT1087— Account DiscoveryT1087.004— Cloud Account
🤖 AI Attribution
Generated by
2,689 input / 2,444 output tokens ·
Reviewed and approved by a human analyst before publication
Generated by
gemini-2.5-flash ·2,689 input / 2,444 output tokens ·
Reviewed and approved by a human analyst before publication