Skip to content

Security Sense

AI Threat Intelligence

  • About
  • Blog
  • Privacy Policy

Tag: php

CVE-2026-109619: PHP Stale Internal Request-State RCE Vulnerability

Posted on November 3, 2026 by Kyle

Overview

CVE-2026-109619 is a high-severity vulnerability in PHP that enables unauthenticated remote code execution. The flaw stems from stale internal request-state, allowing attackers to manipulate freed memory. This vulnerability affects a wide range of PHP versions and products, including critical network devices, and is being actively exploited by threat actors, including state-sponsored groups and ransomware operators, often in conjunction with PHP2Shell exploitation.

Technical Analysis

  • Vulnerability: CVE-2026-109619 is a stale internal request-state vulnerability in PHP.
  • Mechanism: PHP contains various global state variables that temporarily point to request memory. In certain scenarios, this global state may not be correctly reset or may be repopulated after being reset, leading to it referring to freed request memory. Subsequent requests can then read or branch on this stale state before it is fully initialized.
  • Impact: Multiple strategies can trigger this condition, leading to unauthenticated remote code execution (RCE).
  • CVSS v3.1: 8.1 (HIGH) – CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H.
  • Weaknesses: CWE-416 (Use After Free), CWE-755 (Improper Handling of Exceptional Conditions), CWE-824 (Access of Uninitialized Pointer), CWE-1325 (Unchecked Return Value to NULL Pointer Dereference).
  • Affected Versions:
    • PHP php versions >= 5.4.0 < 8.2.35
    • PHP php versions >= 8.3.0 < 8.3.36
    • PHP php versions >= 8.4.0 < 8.4.27
    • PHP php versions >= 8.5.0 < 8.5.12
    • Siemens ruggedcom_ape1808_firmware
    • Palo Alto Networks pan-os versions >= 10.2.0 < 10.2.7
    • Palo Alto Networks pan-os version 10.2.7
    • Palo Alto Networks pan-os version 10.2.8
    • Palo Alto Networks pan-os version 10.2.9
    • Palo Alto Networks pan-os version 10.2.10
  • Attack Vector: Network-based (AV:N), unauthenticated (PR:N), requiring no user interaction (UI:N). The attack complexity is high (AC:H).

Detection

  • Monitor web server access logs for unusual requests to PHP files, especially those with suspicious parameters, encoded commands, or patterns indicative of PHP2Shell exploitation. Look for unexpected HTTP methods or large POST bodies to unusual endpoints.
  • Detect unexpected process spawns originating from web server processes (e.g., php-fpm.exe, httpd.exe, nginx.exe, apache2, php-fpm) or their child processes. Look for cmd.exe, powershell.exe, sh, bash, python, perl, nc, wget, curl, or other command-line utilities.
  • Monitor for the creation of suspicious files (e.g., .php, .txt, .log files containing web shell code) in web-accessible directories (/var/www/html, htdocs, wwwroot). Look for files containing common web shell keywords like eval(, system(, passthru(, shell_exec(, base64_decode(, $_GET[, $_POST[, or PHP2Shell specific strings.
  • Analyze network flow logs for outbound connections initiated by web server processes to unusual or external IP addresses/domains, indicative of C2 communication or data exfiltration.
  • Review PHP error logs for unexpected errors or warnings that might indicate exploitation attempts or memory corruption.

Sigma Detection Rules

⚠️ AI-generated detection rules. These are experimental starting points. Review field names, EventIDs, and logic against your environment’s schema before deploying. Tune to reduce false positives.

Web Server Process Spawning Suspicious Shell

title: Web Server Process Spawning Suspicious Shell
id: 90c7e2b1-d3f4-4a8e-a2c3-f0e2b1d3f4a8
status: experimental
description: Detects suspicious process creation by common web server processes, indicative of RCE exploitation of CVE-2026-109619.
logsource:
  product: windows
  service: sysmon
detection:
  selection_parent:
    ParentImage|endswith:
      - '\\httpd.exe'
      - '\\nginx.exe'
      - '\\php-fpm.exe'
  selection_child:
    Image|endswith:
      - '\\cmd.exe'
      - '\\powershell.exe'
      - '\\sh.exe'
      - '\\bash.exe'
      - '\\python.exe'
      - '\\perl.exe'
      - '\\nc.exe'
      - '\\wget.exe'
      - '\\curl.exe'
  condition: all of selection_*
level: critical

Suspicious PHP File Creation in Web Root

title: Suspicious PHP File Creation in Web Root
id: 4f1c7e2b-d3f4-4a8e-a2c3-f0e2b1d3f4a8
status: experimental
description: Detects creation of new PHP files in web-accessible directories by web server processes, potentially indicating webshell deployment (e.g., PHP2Shell) after CVE-2026-109619 exploitation.
logsource:
  product: windows
  service: sysmon
detection:
  selection:
    EventID: 11
    Image|endswith:
      - '\\httpd.exe'
      - '\\nginx.exe'
      - '\\php-fpm.exe'
    TargetFilename|endswith:
      - '.php'
      - '.phtml'
      - '.php5'
    TargetFilename|contains:
      - '\\inetpub\\wwwroot\\'
      - '\\Apache24\\htdocs\\'
      - '\\nginx\\html\\'
      - '\\www\\html\\'
  condition: selection
level: high

Web Access Log – Generic PHP RCE Attempt

title: Web Access Log - Generic PHP RCE Attempt
id: 7e2b1d3f-4a8e-a2c3-f0e2b1d3f4a8
status: experimental
description: Detects common patterns in web access logs indicative of PHP RCE attempts, potentially targeting CVE-2026-109619. This rule may produce false positives and requires tuning.
logsource:
  category: webserver
  service: apache
detection:
  selection:
    cs-uri-query|contains:
      - 'cmd='
      - 'exec='
      - 'system='
      - 'passthru='
      - 'shell_exec='
      - 'eval='
      - 'base64_decode='
      - 'id%20'
      - 'whoami%20'
      - 'cat%20/etc/passwd'
      - 'wget%20'
      - 'curl%20'
    cs-uri-stem|endswith:
      - '.php'
      - '.phtml'
      - '.php5'
  condition: selection
level: medium

Mitigations

  1. Patch PHP: Upgrade PHP installations to the latest patched versions: 8.2.35, 8.3.36, 8.4.27, 8.5.12, or newer, as soon as possible.
  2. Patch Affected Products: Apply vendor-specific patches for Siemens ruggedcom_ape1808_firmware and Palo Alto Networks pan-os to versions that address CVE-2026-109619.
  3. Implement Web Application Firewall (WAF): Deploy and configure a WAF to detect and block exploitation attempts targeting PHP vulnerabilities, including known PHP2Shell patterns and generic RCE payloads.
  4. Least Privilege: Ensure PHP processes and web servers run with the minimum necessary privileges to limit the impact of successful exploitation.
  5. Network Segmentation: Isolate web servers running PHP applications from critical internal networks to contain potential breaches.
  6. Regular Audits: Conduct regular security audits and penetration tests of PHP applications and underlying infrastructure to identify and remediate vulnerabilities.

References

  • https://nvd.nist.gov/vuln/detail/CVE-2026-109619
  • https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp
  • http://www.openwall.com/lists/oss-security/2026/10/21/16
  • https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-glocal-php-infrastructure/
  • https://hunt.io/blog/php2shell-cve-2026-109618-109619-open-directories
  • https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/
  • https://www.vulncheck.com/blog/php2shell-vulnerabilities
  • https://socradar.io/blog/inc-gentlemen-ransomware-ai-infrastructure

Indicators of Compromise

Type Value Description
SHA256 0c5486f06620e26e316f4b33f318b0d646d5e1133789331aa2fed012360d1486 PHP2Shell second-stage ELF x86-64 binary hash (via https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-glocal-php-infrastructure/)
SHA256 1485e14e0f62bc94664eec341cabd275dad7d30b1d496c40ec340c9a0d9f0ba8 Hash of follow-up POST request body (via https://www.vulncheck.com/blog/php2shell-vulnerabilities)
SHA256 150ae88f0999032e2a6113501d6082f54a3ed98d02427b21a96e773a27d7bf16 Hash of uploaded file part ‘a’ (via https://www.vulncheck.com/blog/php2shell-vulnerabilities)
SHA256 27d926a6708d6769d97d065e7a5a860ab496eab272c03d1cebc55ec71b954fa2 Hash of uploaded file part ‘b’ (via https://www.vulncheck.com/blog/php2shell-vulnerabilities)
SHA256 40caf199ca1ebe056a74427f8e9db06c66899e33ae09c0ec2769ec70bf6dd8e7 Hash of uploaded file part ‘a’ (via https://www.vulncheck.com/blog/php2shell-vulnerabilities)
SHA256 43898a0a53bbd25d31ad9f5018ed3182be98a66109b22c9cab545a9fc447992a PHP2Shell scanner/OOM-tool HTTP request body hash (via https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-glocal-php-infrastructure/)
SHA256 7bc41ed79a9ae909927a9e40701736460a8cb70fca16ce1510e58677aca764b6 PHP2Shell scanner/OOM-tool HTTP request body hash (via https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-glocal-php-infrastructure/)
IP Address 103.114.163.188 PHP2Shell-associated anonymisation network IP (via https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-glocal-php-infrastructure/)
IP Address 103.216.220.92 PHP2Shell-associated anonymisation network IP (via https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-glocal-php-infrastructure/)
IP Address 109.71.252.97 PHP2Shell scanner/exploitation IP (via https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-glocal-php-infrastructure/)
IP Address 134.209.159.64 PHP2Shell-associated anonymisation network IP (via https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-glocal-php-infrastructure/)
IP Address 221.14.159.134 Exploitation attempt IP for CVE-2026-109618 (via https://www.vulncheck.com/blog/php2shell-vulnerabilities)
IP Address 31.223.184.166 PHP2Shell-associated anonymisation network IP (via https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-glocal-php-infrastructure/)
IP Address 37.19.200.5 PHP2Shell-associated anonymisation network IP (via https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-glocal-php-infrastructure/)
IP Address 45.198.224.169 PHP2Shell scanner/exploitation IP (via https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-glocal-php-infrastructure/)
IP Address 85.11.167.243 PHP2Shell scanner/exploitation IP (via https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-glocal-php-infrastructure/)
IP Address 91.90.123.25 Verification IP for CVE-2026-109618 (via https://www.vulncheck.com/blog/php2shell-vulnerabilities)
IP Address 92.118.112.100 PHP2Shell second-stage payload staging host IP (via https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-glocal-php-infrastructure/)
IP Address 95.217.98.37 PHP2Shell-associated anonymisation network IP (via https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-glocal-php-infrastructure/)
URL https://fedi.katze.sh/@elise/117478655339557825 Fediverse post discussing a different PHP vulnerability (via http://www.openwall.com/lists/oss-security/2026/10/21/17)
URL https://fedi.katze.sh/@elise/117479383739450605 Fediverse post reporting incomplete PHP fix (via http://www.openwall.com/lists/oss-security/2026/10/21/17)

MITRE ATT&CK

  • T1190 — Exploit Public-Facing Application
  • T1059.004 — Unix Shell
  • T1059.003 — Windows Command Shell
  • T1505.003 — Web Shell
  • T1590.005 — IP Addresses
  • T1053.003 — Cron
  • T1005 — Data from Local System
  • T1608.001 — Upload Malware
  • T1595.002 — Vulnerability Scanning
  • T1583.004 — Server
  • T1098.004 — SSH Authorized Keys
  • T1552.001 — Credentials In Files
  • T1041 — Exfiltration Over C2 Channel
  • T1210 — Exploitation of Remote Services
  • T1486 — Data Encrypted for Impact
  • T1496 — Resource Hijacking
  • T1105 — Ingress Tool Transfer
  • T1588.005 — Exploits
  • T1592 — Gather Victim Host Information
  • T1133 — External Remote Services
  • T1071.004 — DNS
  • T1036.005 — Match Legitimate Resource Name or Location
  • T1499.004 — Application or System Exploitation
  • T1071 — Application Layer Protocol
  • T1036 — Masquerading
  • T1595 — Active Scanning
  • T1090.002 — External Proxy
  • T1090 — Proxy
  • T1059 — Command and Scripting Interpreter
  • T1078 — Valid Accounts
  • T1573 — Encrypted Channel
  • T1592.002 — Software
  • T1203 — Exploitation for Client Execution
  • T1499 — Endpoint Denial of Service
  • T1059.006 — Python
  • T1071.001 — Web Protocols
  • T1046 — Network Service Discovery
  • T1082 — System Information Discovery
  • T1583.003 — Virtual Private Server
  • T1102 — Web Service
  • T1562.001 — Disable or Modify Tools
  • T1070.004 — File Deletion
  • T1021 — Remote Services
  • T1083 — File and Directory Discovery
  • T1136 — Create Account
  • T1018 — Remote System Discovery
  • T1003.003 — NTDS
  • T1021.001 — Remote Desktop Protocol
  • T1567.002 — Exfiltration to Cloud Storage
  • T1587.001 — Malware
  • T1489 — Service Stop
  • T1087.002 — Domain Account
  • T1053.005 — Scheduled Task
  • T1219 — Remote Access Tools
  • T1558.003 — Kerberoasting
  • T1583.001 — Domains
  • T1135 — Network Share Discovery
  • T1059.001 — PowerShell
  • T1588.002 — Tool
  • T1490 — Inhibit System Recovery
  • T1110 — Brute Force
  • T1204.002 — Malicious File
  • T1114.001 — Local Email Collection
  • T1572 — Protocol Tunneling
  • T1021.002 — SMB/Windows Admin Shares
  • T1072 — Software Deployment Tools
  • T1566.001 — Spearphishing Attachment
  • T1070.006 — Timestomp
  • T1074.001 — Local Data Staging
  • T1555.003 — Credentials from Web Browsers
  • T1056.002 — GUI Input Capture
  • T1003.006 — DCSync
  • T1057 — Process Discovery
  • T1591 — Gather Victim Org Information
  • T1056.001 — Keylogging
  • T1555 — Credentials from Password Stores
  • T1132.001 — Standard Encoding
  • T1566.002 — Spearphishing Link
  • T1573.001 — Symmetric Cryptography
  • T1218.011 — Rundll32
  • T1497.001 — System Checks
  • T1539 — Steal Web Session Cookie
  • T1027 — Obfuscated Files or Information
  • T1102.002 — Bidirectional Communication
  • T1140 — Deobfuscate/Decode Files or Information
  • T1055.012 — Process Hollowing
  • T1110.001 — Password Guessing
  • T1087.001 — Local Account
  • T1021.004 — SSH
  • T1040 — Network Sniffing
  • T1567 — Exfiltration Over Web Service
  • T1552 — Unsecured Credentials
  • T1552.004 — Private Keys
  • T1087 — Account Discovery
  • T1087.004 — Cloud Account
🤖 AI Attribution
Generated by gemini-2.5-flash ·
2,763 input / 2,653 output tokens ·
Reviewed and approved by a human analyst before publication
Posted in vulnerabilityTagged high, php, rce, vulnerability, web, webshellLeave a comment

CVE-2026-109618: PHP Memory Corruption Leads to Unauthenticated RCE

Posted on November 3, 2026 by Kyle

Overview

This report details CVE-2026-109618, a critical memory corruption vulnerability in PHP that enables unauthenticated remote code execution. The flaw stems from improper handling of out-of-memory errors, leaving request memory in an uninitialized state. Active exploitation has been observed, with threat actors leveraging this vulnerability to deploy various malware families and establish persistence.

Technical Analysis

The vulnerability, CVE-2026-109618, is an out-of-memory (OOM) corruption flaw in PHP. It occurs because PHP uses longjmp() to exit the current context during OOM errors, but some contexts fail to properly account for this, leaving request memory uninitialized. Subsequent request cleanup procedures can then read or branch on this uninitialized memory, leading to remote code execution (RCE). The vulnerability is unauthenticated and can be triggered consistently via multiple OOM strategies.

  • CVSS 3.1 Score: 9.8 (CRITICAL) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
  • Weaknesses: CWE-416 (Use-After-Free), CWE-755 (Improper Handling of Exceptional Conditions), CWE-824 (Access of Uninitialized Pointer), CWE-1325 (Uninitialized Memory in PHP).
  • Affected PHP versions:
    • php >= 7.3.0 < 8.2.35
    • php >= 8.3.0 < 8.3.36
    • php >= 8.4.0 < 8.4.27
    • php >= 8.5.0 < 8.5.12
  • Affected products also include:
    • siemens ruggedcom_ape1808_firmware
    • paloaltonetworks pan-os >= 10.2.0 < 10.2.7
    • paloaltonetworks pan-os 10.2.7
    • paloaltonetworks pan-os 10.2.8
    • paloaltonetworks pan-os 10.2.9
    • paloaltonetworks pan-os 10.2.10

Detection

  • Monitor web server access logs for unusual request patterns, especially those that might trigger OOM conditions or attempt to execute arbitrary commands. Look for abnormally long or malformed requests.
  • Monitor for unexpected child processes spawned by web server processes (e.g., httpd.exe, nginx.exe, php-fpm.exe, php.exe). Look for cmd.exe, powershell.exe, sh, bash, python.exe, or other scripting interpreters.
  • Look for suspicious file writes in web-accessible directories, such as .php files with obfuscated content or known webshell signatures, originating from web server processes.
  • Analyze system logs for php process crashes or abnormal memory usage spikes followed by suspicious process activity.
  • Hunt for network connections initiated by the web server process to unusual external IP addresses or domains, indicative of C2 communication or data exfiltration.

Sigma Detection Rules

⚠️ AI-generated detection rules. These are experimental starting points. Review field names, EventIDs, and logic against your environment’s schema before deploying. Tune to reduce false positives.

Windows Web Server Spawning Shell

title: Windows Web Server Spawning Shell
id: 9a3e2f1a-b1c7-4d8e-a0b1-c74d8ea0b1c7
status: experimental
description: Detects suspicious shell process creation by common Windows web server processes, indicative of RCE.
logsource:
  product: windows
  service: sysmon
detection:
  selection:
    ParentImage|endswith:
      - '\inetinfo.exe'
      - '\httpd.exe'
      - '\nginx.exe'
      - '\php-cgi.exe'
      - '\php-fpm.exe'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
  condition: selection
level: high

Linux Web Server Spawning Shell

title: Linux Web Server Spawning Shell
id: 8b2d1e0a-a0b1-4c7d-8e9f-a0b1c74d8e9f
status: experimental
description: Detects suspicious shell process creation by common Linux web server processes, indicative of RCE.
logsource:
  product: linux
  service: auditd
detection:
  selection:
    ParentProcessName:
      - 'apache2'
      - 'httpd'
      - 'nginx'
      - 'php-fpm'
      - 'php-cgi'
    ProcessName:
      - 'sh'
      - 'bash'
      - 'dash'
      - 'zsh'
      - 'python'
      - 'perl'
      - 'php'
  condition: selection
level: high

PHP Process Outbound Network Connection

title: PHP Process Outbound Network Connection
id: 7c1f0d9a-9f8e-4b6c-7d5a-9f8e4b6c7d5a
status: experimental
description: Detects outbound network connections initiated by PHP processes to non-standard ports or external IPs, potentially indicating C2 or data exfiltration after RCE.
logsource:
  product: windows
  service: sysmon
detection:
  selection:
    EventID: 3
    Image|endswith:
      - '\php.exe'
      - '\php-cgi.exe'
      - '\php-fpm.exe'
    DestinationPort|!in:
      - 80
      - 443
    DestinationIp|!in:
      - '127.0.0.1'
      - '::1'
      - '10.0.0.0/8'
      - '172.16.0.0/12'
      - '192.168.0.0/16'
  condition: selection
level: medium

Mitigations

  1. Patch PHP installations immediately. Upgrade to the latest patched versions: PHP 8.2.35, PHP 8.3.36, PHP 8.4.27, PHP 8.5.12, or newer.
  2. Apply available patches for affected products such as Siemens RUGGEDCOM APE1808 firmware and Palo Alto Networks PAN-OS.
  3. Implement a Web Application Firewall (WAF) to detect and block malicious request patterns targeting PHP vulnerabilities.
  4. Restrict outbound network connectivity from web servers to only necessary services and destinations.
  5. Employ Endpoint Detection and Response (EDR) solutions to monitor for suspicious process creation and file modifications on web servers.

References

  • https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w
  • http://www.openwall.com/lists/oss-security/2026/10/21/6
  • http://www.openwall.com/lists/oss-security/2026/10/23/5
  • https://cert-portal.siemens.com/productcert/html/ssa-566512.html
  • https://www.wiz.io/blog/php2shell-php-rce
  • https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-glocal-php-infrastructure/
  • https://hunt.io/blog/php2shell-cve-2026-109618-109619-open-directories
  • https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/
  • https://www.vulncheck.com/blog/php2shell-vulnerabilities
  • https://socradar.io/blog/inc-gentlemen-ransomware-ai-infrastructure
  • https://www.huntress.com/blog/amazon-clickfix-finger
  • https://unit42.paloaltonetworks.com/ai-assisted-cybercrime-analysis/
  • https://www.security.nl/posting/959207/Amerikaanse+overheid+waarschuwt+voor+misbruik+van+PHP2Shell-lekken?channel=rss

Indicators of Compromise

Type Value Description
SHA256 0c5486f06620e26e316f4b33f318b0d646d5e1133789331aa2fed012360d1486 PHP2Shell second-stage ELF x86-64 binary hash (via https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-glocal-php-infrastructure/)
SHA256 1485e14e0f62bc94664eec341cabd275dad7d30b1d496c40ec340c9a0d9f0ba8 Hash of follow-up POST request body (via https://www.vulncheck.com/blog/php2shell-vulnerabilities)
SHA256 150ae88f0999032e2a6113501d6082f54a3ed98d02427b21a96e773a27d7bf16 Hash of uploaded file part ‘a’ (via https://www.vulncheck.com/blog/php2shell-vulnerabilities)
SHA256 27d926a6708d6769d97d065e7a5a860ab496eab272c03d1cebc55ec71b954fa2 Hash of uploaded file part ‘b’ (via https://www.vulncheck.com/blog/php2shell-vulnerabilities)
SHA256 40caf199ca1ebe056a74427f8e9db06c66899e33ae09c0ec2769ec70bf6dd8e7 Hash of uploaded file part ‘a’ (via https://www.vulncheck.com/blog/php2shell-vulnerabilities)
SHA256 43898a0a53bbd25d31ad9f5018ed3182be98a66109b22c9cab545a9fc447992a PHP2Shell scanner/OOM-tool HTTP request body hash (via https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-glocal-php-infrastructure/)
SHA256 7bc41ed79a9ae909927a9e40701736460a8cb70fca16ce1510e58677aca764b6 PHP2Shell scanner/OOM-tool HTTP request body hash (via https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-glocal-php-infrastructure/)
IP Address 103.114.163.188 PHP2Shell-associated anonymisation network IP (via https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-glocal-php-infrastructure/)
IP Address 103.216.220.92 PHP2Shell-associated anonymisation network IP (via https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-glocal-php-infrastructure/)
IP Address 109.71.252.97 PHP2Shell scanner/exploitation IP (via https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-glocal-php-infrastructure/)
IP Address 130.12.180.51 RedTail · confidence 75% · first seen 2026-10-23
IP Address 134.199.154.64 Mirai · confidence 75% · first seen 2026-10-22
IP Address 134.209.159.64 PHP2Shell-associated anonymisation network IP (via https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-glocal-php-infrastructure/)
IP Address 217.60.102.5 RedTail · confidence 100% · first seen 2026-10-23
IP Address 221.14.159.134 Exploitation attempt IP for CVE-2026-109618 (via https://www.vulncheck.com/blog/php2shell-vulnerabilities)
IP Address 31.223.184.166 PHP2Shell-associated anonymisation network IP (via https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-glocal-php-infrastructure/)
IP Address 37.19.200.5 PHP2Shell-associated anonymisation network IP (via https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-glocal-php-infrastructure/)
IP Address 45.198.224.169 PHP2Shell scanner/exploitation IP (via https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-glocal-php-infrastructure/)
IP Address 85.11.167.243 PHP2Shell scanner/exploitation IP (via https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-glocal-php-infrastructure/)
IP Address 91.90.123.25 Verification IP for CVE-2026-109618 (via https://www.vulncheck.com/blog/php2shell-vulnerabilities)
IP Address 92.118.112.100 PHP2Shell second-stage payload staging host IP (via https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-glocal-php-infrastructure/)
IP Address 95.217.98.37 PHP2Shell-associated anonymisation network IP (via https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-glocal-php-infrastructure/)
Domain p.2137gang.net RedTail · confidence 100% · first seen 2026-10-23
Domain p.2137gang.pl RedTail · confidence 100% · first seen 2026-10-23
Domain p.2137gang.shop RedTail · confidence 100% · first seen 2026-10-23
Domain p.2137gang.st RedTail · confidence 100% · first seen 2026-10-23
Domain p.2137gang.store RedTail · confidence 100% · first seen 2026-10-23
Domain proxies.identities.network RedTail · confidence 100% · first seen 2026-10-23
Domain proxy.identities.network RedTail · confidence 100% · first seen 2026-10-23
Domain proxy.insanecppdev.com RedTail · confidence 100% · first seen 2026-10-23
Domain proxy.insanitycpp.cx RedTail · confidence 100% · first seen 2026-10-23
Domain thunder.godofthunder.st Mirai · confidence 90% · first seen 2026-10-22
URL http://92.118.112.100/nfs Mirai · confidence 100% · first seen 2026-10-22
URL http://92.118.112.100/s Mirai · confidence 100% · first seen 2026-10-22
URL http://hackattackkaboom.botlesscucks.st/x86_64 Mirai · confidence 100% · first seen 2026-10-22
URL https://217.60.102.5/sh RedTail · confidence 100% · first seen 2026-10-23
URL https://217.60.103.56/sh RedTail · confidence 100% · first seen 2026-10-23

MITRE ATT&CK

  • T1190 — Exploit Public-Facing Application
  • T1059.004 — Unix Shell
  • T1059.003 — Windows Command Shell
  • T1059.006 — Python
  • T1059.001 — PowerShell
  • T1505.003 — Web Shell
  • T1590.005 — IP Addresses
  • T1053.003 — Cron
  • T1005 — Data from Local System
  • T1608.001 — Upload Malware
  • T1595.002 — Vulnerability Scanning
  • T1583.004 — Server
  • T1098.004 — SSH Authorized Keys
  • T1552.001 — Credentials In Files
  • T1041 — Exfiltration Over C2 Channel
  • T1210 — Exploitation of Remote Services
  • T1486 — Data Encrypted for Impact
  • T1496 — Resource Hijacking
  • T1105 — Ingress Tool Transfer
  • T1588.005 — Exploits
  • T1592 — Gather Victim Host Information
  • T1133 — External Remote Services
  • T1071.004 — DNS
  • T1036.005 — Match Legitimate Resource Name or Location
  • T1499.004 — Application or System Exploitation
  • T1071 — Application Layer Protocol
  • T1036 — Masquerading
  • T1595 — Active Scanning
  • T1090.002 — External Proxy
  • T1090 — Proxy
  • T1059 — Command and Scripting Interpreter
  • T1078 — Valid Accounts
  • T1573 — Encrypted Channel
  • T1592.002 — Software
  • T1203 — Exploitation for Client Execution
  • T1499 — Endpoint Denial of Service
  • T1071.001 — Web Protocols
  • T1046 — Network Service Discovery
  • T1082 — System Information Discovery
  • T1583.003 — Virtual Private Server
  • T1102 — Web Service
  • T1562.001 — Disable or Modify Tools
  • T1070.004 — File Deletion
  • T1021 — Remote Services
  • T1083 — File and Directory Discovery
  • T1136 — Create Account
  • T1018 — Remote System Discovery
  • T1003.003 — NTDS
  • T1021.001 — Remote Desktop Protocol
  • T1567.002 — Exfiltration to Cloud Storage
  • T1587.001 — Malware
  • T1489 — Service Stop
  • T1087.002 — Domain Account
  • T1053.005 — Scheduled Task
  • T1219 — Remote Access Tools
  • T1558.003 — Kerberoasting
  • T1583.001 — Domains
  • T1135 — Network Share Discovery
  • T1588.002 — Tool
  • T1490 — Inhibit System Recovery
  • T1110 — Brute Force
  • T1204.002 — Malicious File
  • T1114.001 — Local Email Collection
  • T1572 — Protocol Tunneling
  • T1021.002 — SMB/Windows Admin Shares
  • T1072 — Software Deployment Tools
  • T1566.001 — Spearphishing Attachment
  • T1070.006 — Timestomp
  • T1074.001 — Local Data Staging
  • T1555.003 — Credentials from Web Browsers
  • T1056.002 — GUI Input Capture
  • T1003.006 — DCSync
  • T1057 — Process Discovery
  • T1591 — Gather Victim Org Information
  • T1056.001 — Keylogging
  • T1555 — Credentials from Password Stores
  • T1132.001 — Standard Encoding
  • T1566.002 — Spearphishing Link
  • T1573.001 — Symmetric Cryptography
  • T1218.011 — Rundll32
  • T1497.001 — System Checks
  • T1539 — Steal Web Session Cookie
  • T1027 — Obfuscated Files or Information
  • T1102.002 — Bidirectional Communication
  • T1140 — Deobfuscate/Decode Files or Information
  • T1055.012 — Process Hollowing
  • T1110.001 — Password Guessing
  • T1087.001 — Local Account
  • T1021.004 — SSH
  • T1040 — Network Sniffing
  • T1567 — Exfiltration Over Web Service
  • T1552 — Unsecured Credentials
  • T1552.004 — Private Keys
  • T1087 — Account Discovery
  • T1087.004 — Cloud Account
🤖 AI Attribution
Generated by gemini-2.5-flash ·
2,689 input / 2,444 output tokens ·
Reviewed and approved by a human analyst before publication
Posted in vulnerabilityTagged critical, dprk, memory-corruption, php, ransomware, rce, vulnerability, web-application, webshellLeave a comment
Proudly powered by WordPress | Theme: micro, developed by DevriX.