CYFIRMA Threat Advisory: Suspected DPRK Campaign staging PHP2Shell Targeting ...

Korean-speaking operators plan sector-targeted exploitation of CVE-2026-109618 and CVE-2026-109619 (CVSS v4.0 9.2, unauthenticated RCE in PHP core)

PUBLISHED 23 October 2026

CONFIDENCE HIGH (campaign activity) · MODERATE (Lazarus-ecosystem link)

1 · DOES THIS AFFECT ME? Any organisation running internet-facing PHP below 8.5.12, 8.4.27, 8.3.36 or 8.2.35. The June 2026 Minjun actors’ tasking prioritises government, banking and finance, manufacturing, logistics and shipping, airports and aviation, online transaction and trading platforms, trading companies and construction across the US, Japan, Thailand, Indonesia, Korea, Australia, Taiwan, India, Singapore, UAE, Saudi Arabia and the EU.

2 · HOW EXPOSED AM I? One unauthenticated multipart POST can reach code execution before any application code runs. Apache mod_php is the highest-risk configuration. End-of-life PHP (8.1 and older) receives no official upstream fix. Exploitation attempts are confirmed globally, and CYFIRMA has observed 17 further source IPs attempting web shell tooling and upload-progress session poisoning.

3 · WHAT SHOULD I DO NOW? Patch and restart every PHP worker. Isolate what cannot be patched within hours. Hunt from 17 October 2026. Deploy the IOCs, Sigma and YARA content in Sections 09 and 10, and apply the interim controls in Section 11.

BOTTOM LINE Treat every internet-facing PHP host below 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 as exposed. Patch immediately and restart all workers; hunt back to 17 October 2026, the earliest known exploitation. Organisations in the sectors and geographies prioritised by the June 2026 Minjun actors should assume they are in scope for deliberate targeting.

01. WHAT WE DISCOVERED

On 22 October 2026 (≈11:00 JST / 10:00 SGT), CYFIRMA closed-source collection surfaced a Korean-speaking threat actor coordinating, through a closed I2P channel named █████ ██ ██ (████████████████), global reconnaissance and attack planning against all web-accessible assets carrying the two critical PHP vulnerabilities known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619). CYFIRMA tracks this activity as the June 2026 Minjun campaign, named after the channel.

CYFIRMA assesses with high confidence that the June 2026 Minjun campaign is being actively staged, and with moderate confidence that the operator is linked to the North Korean Lazarus Group ecosystem (tracked across industry as Lazarus, APT38, Hidden Cobra, ZINC / Diamond Sleet).

The tasking explicitly prioritises national government agencies, banks and financial institutions, manufacturing, logistics, shipping, airports and aviation, online transaction platforms, trading companies and construction firms across the United States, Japan, Thailand, Indonesia, Korea, Australia, Taiwan, India, Singapore, UAE, Saudi Arabia and the European Union. Fifteen pieces of campaign infrastructure were shared in-channel for staging and launch. No launch date has been stated; the actors’ first filtered target list is due by 25 October 2026.

On 23 October 2026, CYFIRMA identified 17 suspected source IP addresses that, within an 8-hour window, were performing PHP web shell tooling and upload-progress session poisoning attempts. This activity is consistent with the exploitation and post-exploitation behaviour anticipated for the campaign. On its own it does not link these addresses to the DPRK-nexus channel, and they are published as additional hunting and blocking indicators.

Why it is significant

It moves PHP2Shell from opportunistic to targeted. Public telemetry to date shows broad, unattributed scanning and exploitation attempts. This is the first case CYFIRMA has observed of an actor planning deliberate, sector- and country-prioritised targeting of PHP2Shell, with government and financial institutions first.

The exposed population is very large. PHP is used by 69.3% of websites whose server-side language is known (W3Techs, 21 October 2026). The flaw sits in the PHP runtime itself, not in any application or framework, so updating WordPress, Drupal, Magento or Laravel does not fix it.

The tradecraft is disciplined. The actors are harvesting public proof-of-concept code, ranking it with a local AI model, validating it in a lab before use and deliberately avoiding noisy scanning. That compresses the gap between disclosure and reliable weaponisation.

The consequence ceiling is higher. The Lazarus ecosystem’s dual financial-and-espionage mandate means access gained here could feed initial-access resale, cryptocurrency theft, ransomware precursors, credential theft and long-term espionage.

02. HOW WE DISCOVERED IT

DeCYFIR visibility. The June 2026 Minjun campaign was identified through CYFIRMA’s closed-source human-intelligence monitoring of underground I2P channels, delivered to customers through DeCYFIR early-warning arrangements.

Collection. Continuous monitoring of the closed I2P channel and associated direct-message exchanges between the two handlers on 22 October 2026, 11:00 to 11:31 JST.

Translation and extraction. Korean-language tasking was translated, and targeting priorities, infrastructure and timelines were extracted.

Correlation. Channel content was correlated with verified vulnerability intelligence (PHP Security Team advisories GHSA-w8hw-w9fx-j79w and GHSA-6wmf-4rv5-p3rp) and with open-source in-the-wild exploitation telemetry (Amazon MadPot, Cloudflare, Hadrian, Patchstack, VulnCheck, ELLIO, Vega).

Structured link assessment. Evidence supporting the Lazarus-ecosystem link was separated from uncertainties and alternative explanations (Section 06).

Follow-up detection. CYFIRMA identified 17 suspected source IPs engaged in related exploitation behaviour within an 8-hour window on 23 October 2026.

No exploit code was executed or independently tested in this assessment.

01. A Korean-speaking, suspected DPRK state-nexus actor behind the June 2026 Minjun campaign is in the reconnaissance-to-weaponisation phase against the global PHP estate. CYFIRMA adversary monitoring confirms explicit intent to mass-identify web-accessible assets carrying CVE-2026-109618 and CVE-2026-109619, de-conflict them by country and sector, and adapt public exploit code rather than develop novel primitives.

CONFIDENCE : HIGH (intent and activity), MODERATE (Lazarus link)

02. The most likely initial access vector is exploitation of public-facing PHP services via crafted multipart/form-data requests abusing the session upload-progress path (CVE-2026-109619) or out-of-memory corruption (CVE-2026-109618), with the highest success probability against Apache mod_php in its default prefork configuration. Expected tradecraft aligns with historical Lazarus use of PHP/ASP web shells and compromised web infrastructure for first-stage command-and-control.

CONFIDENCE : MODERATE

03. Timing is opportunistic and tied to exploit readiness rather than an external trigger. The operation fuses financial motivation (initial-access resale, cryptocurrency theft, ransomware precursors, credential theft) with state-nexus espionage objectives. Deliberate sector and geographic prioritisation, with government and financial institutions first, distinguishes this activity from commodity opportunistic scanning and raises the consequence ceiling for targeted organisations.

CONFIDENCE : MODERATE

04. AI-assisted triage is being used by the actor to rank public proof-of-concept repositories and accelerate reconnaissance, compressing the historical gap between disclosure and reliable weaponisation. Patch and mitigation timelines should be measured in hours, not days.

CONFIDENCE : MODERATE

IMMINENCE INDEX 78 / 100. Targets identified (all internet-facing PHP); public exploit tooling circulating; active scanning and early in-the-wild exploitation observed globally; the channel is discussing launch readiness and sector prioritisation. The absence of confirmed mass successful compromise attributable to this specific actor keeps the index below 90.

04. TECHNICAL ANALYSIS: PHP2SHELL

THREAT ACTOR DPRK state-nexus operator / small team. Suspected link to Lazarus Group (APT38 / Hidden Cobra / ZINC)

MOTIVATION Financial gain · Espionage · Disruption. Initial-access brokerage, crypto theft, ransomware; state-nexus espionage; operational disruption

SEVERITY CRITICAL. Global internet-facing PHP estate

ASSESSED LAUNCH WINDOW Not yet stated. Reconnaissance ongoing since 22 Oct 2026. First filtered target list expected by 25 Oct 2026. Rapid weaponisation anticipated.

TARGETED SECTORS & GEOGRAPHY Government, BFSI, manufacturing, logistics/shipping, aviation, e-commerce, trading, construction, hosting/SaaS. Priority geographies: US, JP, TH, ID, KR, AU, TW, IN, SG, UAE, KSA, EU

CONFIDENCE HIGH (campaign activity). Language, channel activity, targeting pattern. MODERATE (Lazarus link). Historical Lazarus web-shell tradecraft.

The vulnerabilities PHP2Shell refers to two critical unauthenticated remote code execution vulnerabilities in the PHP runtime itself. Both carry a CVSS v4.0 score of 9.2 (PHP Security Team). Technical details leaked publicly on 20 October 2026, ahead of coordinated disclosure; the PHP project released fixes on 21 October 2026.

Both one root cause: PHP’s longjmp()-based “bailout” aborts a request mid-operation and leaves internal state half-built or pointing at freed memory. In worker-based deployments, a subsequent request handled by the same worker inherits that stale state.

CVE-2026-109618: RCE via out-of-memory corruption (GHSA-w8hw-w9fx-j79w) When a request exceeds memory_limit, PHP bails out of the allocator; some execution contexts leave request memory partially initialised, and shutdown cleanup then reads or branches on it.

The attacker controls when memory is exhausted through the multipart parser.

Confirmed full unauthenticated RCE on Apache mod_php with default settings and prefork. Reported by Calif, Wiz, OpenAI and Quarkslab.

CVE-2026-109619: RCE via stale global state (GHSA-6wmf-4rv5-p3rp) A request that dies at the wrong moment (fatal error, timeout or OOM) leaves request-owned global state pointing at freed memory; a later request on the same worker reads it before initialisation, a use-after-free.

Confirmed consumers: session upload progress (PHP_SESSION_UPLOAD_PROGRESS) and PHP 8.5’s fatal_error_backtraces. Validated against both mod_php and PHP-FPM.

NOTE Early coverage tied the session upload-progress field to CVE-2026-109618. Per PHP’s advisories it belongs to CVE-2026-109619 only; disabling upload progress does nothing for -109618. The two bugs require different interim controls (Section 11).

Exposure by deployment (SAPI)

Affected and fixed versions

Exploitability Triggering the bug is easy; reliable code execution is not. The attacker must land a follow-up request on the same worker and shape heap data into the freed space, otherwise the worker crashes or responds normally. Non-RCE outcomes already demonstrated: worker crash (DoS), arbitrary file read via OPcache, and ~67 KB process-memory disclosure.

VULNCHECK UPDATE (22 OCTOBER 2026, 19:00 ET) VulnCheck updated its findings on 22 October 2026. It now reports that its exploit achieves RCE on x86-64 with ASLR enabled against PHP 8.4.10 to 8.4.26, that its memory leak works on ARM64 but RCE is not yet functional there, and that at least one public PoC bypassed ASLR on x86-64 for a single version (8.4.26). This supersedes its earlier position that no public PoC bypassed ASLR on x86-64.

Public exploit and PoC evidence Source-checked as of 22 October 2026. Public repositories should be treated as untrusted; validated research is not equivalent to a validated, production-ready exploit, and several circulating “PoCs” are fake and distribute malware (per JFrog, AhnLab ASEC).

05. CAMPAIGN ANALYSIS: JUNE 2026 MINJUN

Collection source: closed I2P channel

Handles are operator aliases, not confirmed identities.

Evidence and artifacts On 22 October 2026 the handlers shared campaign infrastructure and tasking related to exploit readiness. No specific customer hosts or victims were listed.

FIGURE 1 I2P forum thread “PHP runtime issue leak (20th) and recon plan”, 전███████ (Je██████████) and 최█████ (C███████), 22 Oct 2026, 11:00 to 11:31 JST.

FIGURE 2 Direct-message exchange between 전███████ (Je██████████) and 최█████ (C███████), 22 Oct 2026, 11:00 to 11:31 JST: target sectors and countries, staging IPs, AI-assisted PoC ranking, first spreadsheet due 25/10.

PLANNED LAUNCH No specific launch date or window has been stated by the handlers as of 22 October 2026. The closest statement is C███████’s: “█████ country-and-sector target spreadsheet █████.” The channel remains under continuous monitoring.

Translated transcript (loose translation from Korean) THREAT ACTOR 1 = 전███████ (Je██████████). THREAT ACTOR 2 = 최█████ (C███████). All times 22 October 2026, JST.

Je██████████ · ~11:00 JST █████ PHP runtime issues █████ internet-facing systems █████ national agencies, banks and financial institutions, manufacturing, logistics, shipping, airports and aviation, online transaction platforms, trading companies, and construction firms. Priority regions: USA, Japan, Thailand, Indonesia, Korea, Australia, Taiwan, India, Singapore, UAE, Saudi Arabia, and the EU.

C███████ · ~11:04 JST █████ passive collection of public banners and version strings for anything advertising PHP. █████ stay off anything that looks already heavily monitored.

Je██████████ · ~11:07 JST █████ Separate the list by country and sector █████ government and financial sites first, then logistics, ports, airports, and manufacturing. █████ staging and collection points █████

C███████ · ~11:12 JST █████ intermediaries for hosting the target lists. █████ not perform active scans. █████ public GitHub notes and researcher write-ups █████

Je██████████ · ~11:15 JST █████ public information only. Do not invent new primitives. █████ out-of-memory path █████ stale-state path. █████ common Apache and FPM setups without needing local access.

C███████ · ~11:19 JST █████ public technical descriptions █████ local AI for reconnaissance and to rank █████ public repositories █████ manually verify █████ controlled lab █████

Je██████████ · ~11:23 JST AI is only for speed on sorting and validation of open material. █████ shortlist of likely-vulnerable hosts █████ No broad noisy scanning █████

C███████ · ~11:27 JST █████ country-and-sector target spreadsheet █████ Collection points stay on the infrastructure █████ flag any hosts that appear to have already applied the 21 October patches.

Je██████████ · ~11:31 JST █████ first filtered list █████ public approaches █████ worth adapting.

Source: CYFIRMA closed-source collection, I2P channel █████ ██ ██ (████████████████), 22 October 2026.

Expected attack path (MITRE ATT&CK) Mapped from intercepted tasking, open-source exploitation telemetry and historical Lazarus web tradecraft. One unauthenticated multipart POST can reach code execution before any application code runs; there is no vulnerable route to discover and little application-layer trace.

06. LINKS TO KNOWN ADVERSARIES

Assessment: June 2026 Minjun is linked to the Lazarus Group ecosystem (DPRK) with MODERATE confidence. The assessment rests on behavioural and linguistic indicators rather than definitive infrastructure or malware-family overlap. Public reporting as of 22 October 2026 had not attributed PHP2Shell exploitation to any named actor; this assessed link is based on CYFIRMA collection.

DESIGNATION Lazarus Group ecosystem. Korean-speaking operator / small team; handles 전███████ (Je██████████) and 최█████ (C███████)

ATTRIBUTION State-nexus · North Korea (DPRK). Reconnaissance General Bureau (RGB) / Bureau 121 and subordinate offensive cyber units

KNOWN ALIASES APT38, Hidden Cobra, ZINC, Diamond Sleet. Related clusters: BlueNoroff, Andariel, Kimsuky

ACTIVE SINCE Handles active since March 2026. Campaign discussion first observed 22 Oct 2026 (≈11:00 JST)

LINK CONFIDENCE MODERATE

OPERATIONAL STYLE Disciplined, access-focused. Harvests public PoCs, ranks them with AI, lab-validates before use, avoids noisy scanning

CYFIRMA assesses with moderate confidence that the operator is linked to the North Korean state- threat ecosystem directed by the Reconnaissance General Bureau (RGB), the DPRK military intelligence organisation widely assessed to oversee Bureau 121 and its subordinate offensive cyber units. The Lazarus Group is the umbrella designation most consistent with the observed language, operational style and historical targeting of web infrastructure.

Assessed objectives. Monetise broad, opportunistic PHP2Shell access through deliberate, high-value targeting: initial-access resale, cryptocurrency theft, ransomware precursors and credential theft, fused with state-nexus espionage against government and financial institutions first, then logistics, ports, airports and manufacturing.

Historical targeting and PHP / web tradecraft

Compromised web infrastructure for C2: Lazarus has repeatedly abused legitimate, compromised web servers, including PHP/WordPress environments, as first-stage command-and-control relays and malware distribution points.

Web-shell persistence: the group has deployed ASP and PHP web shells (publicly documented variants include the “RedHat Hacker” web-shell family) to maintain access after initial exploitation.

Watering-hole operations: Andariel’s SyncHole activity compromised legitimate South Korean websites to stage payloads.

Financial heists and crypto theft: APT38/BlueNoroff operations (SWIFT-network heists including the Bangladesh Bank theft, AppleJeus, and sustained DeFi/exchange intrusions) underline the group’s appetite for BFSI and crypto targets, the sectors prioritised in the intercepted tasking.

Destructive and disruptive capability: from DarkSeoul to WannaCry, the ecosystem has shown willingness to escalate from access to disruption.

The Lazarus ecosystem at a glance “Lazarus” is best understood as a family of related RGB-directed clusters that tooling, infrastructure and tasking. Any of the clusters below, or a shared access team feeding them, could operationalise PHP2Shell access.

Structured assessment of the Lazarus link

Net assessment: MODERATE confidence in a Lazarus-ecosystem link. Confidence will be revised upward on observation of infrastructure or tooling overlap with a named cluster, a launch statement, or confirmed compromises; and revised downward if collection indicates an unaffiliated Korean-speaking criminal group.

Industries and geographies (from June 2026 Minjun tasking, 22 October 2026)

Technologies All internet-facing PHP runtimes: PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, LiteSpeed (LSAPI), and embedded PHP in appliances and hosting control panels (cPanel, Plesk). Highest risk: unpatched Apache mod_php. No specific customer hosts were named in-channel; the campaign is global and begins opportunistic before narrowing to a filtered, prioritised list.

Technical note: no host-level verification (ASN / provider, port, path, response, certificate CN/O, stack) is possible at this stage because the handlers have not yet produced a filtered host list.

08. IMPACT ASSESSMENT

09. INDICATORS OF COMPROMISE

Indicators are defanged in tables. Several addresses are shared or anonymising infrastructure; investigate sightings before blocking.

A. June 2026 Minjun campaign infrastructure (captured from adversary conversation, 22 October 2026) Fifteen IPv4 addresses shared in-channel for staging, target-list hosting and launch, plus one possible variant (entry 16). Infrastructure roles are not fully differentiated. Entry 16 appears once, only in the direct-message exchange, and may be an actor typo of entry 4; it is included as a precaution. Priority: MONITOR & HUNT.

B. Suspected source IPs: web shell tooling and upload-progress session poisoning (identified 23 October 2026) Identified within an 8-hour window. Not, on their own, linked to the DPRK-nexus channel. Priority: BLOCK / MONITOR; hunt in logs for prior .

C. Corroborating open-source exploitation infrastructure Published by primary sources (Amazon, ELLIO, VulnCheck, Vega) as corroborating evidence of active PHP2Shell exploitation.

E. Behavioural and host indicators (highest value)

Unusual multipart/form-data POSTs to non-upload endpoints (e.g. ‘/’, ‘/index.php’); PHP_SESSION_UPLOAD_PROGRESS fields on endpoints that never take uploads.

Very high multipart part/field counts or field names nested dozens of levels deep; bodies of a few hundred KB.

PHP worker crashes / OOM fatals in bursts (‘Allowed memory size exhausted’, ‘zend_mm_heap corrupted’, SIGSEGV) correlated with preceding multipart POSTs; HTTP 500 on PHP endpoints.

Web-server/PHP processes (php-fpm, php-cgi, httpd, apache2, lsphp) spawning shells, interpreters or download tools (sh, bash, curl, wget, nc, busybox), or executing from /tmp, /var/tmp, /dev/shm.

New or modified .php / .phtml / .phar files in web roots; .user.ini / .htaccess changes adding auto_prepend_file; new cron jobs, local users or SSH authorized_keys.

Abnormally large PHPSESSID values in Set-Cookie (memory disclosure); outbound connections from web workers to uncommon destinations or I2P egress.

The strongest single signal is a PHP or web-server process spawning something it never normally spawns. Request-side signals are useful but noisy; application logs will usually show nothing because no application code ran. Hunt from 17 October 2026 onward.

Sigma: PHP worker spawns shell or download tool

title: PHP2Shell – Shell/Download Tool Spawned by PHP Worker status: experimental logsource: product: linux category: process_creation detection: parent: ParentImage|endswith: [‘/php-fpm’, ‘/php-cgi’, ‘/httpd’, ‘/apache2’, ‘/lsphp’, ‘/frankenphp’] child: Image|endswith: [‘/sh’, ‘/bash’, ‘/dash’, ‘/curl’, ‘/wget’, ‘/nc’, ‘/busybox’, ‘/python3’, ‘/perl’] tmp: Image|startswith: [‘/tmp/’, ‘/var/tmp/’, ‘/dev/shm/’] condition: parent and (child or tmp) level: high tags: – attack.t1190 – attack.t1059.004

Sigma: request-side tool indicators (web/WAF logs)

title: PHP2Shell – Known Tool User-Agents / Upload-Progress Field status: experimental logsource: category: webserver detection: ua: cs-user-agent|contains: [‘php2shell-scan’, ‘php2shell-109618’, ‘php2shell-verify’, ‘php2shell-poc’] post: cs-method: ‘POST’ body: cs-body|contains: [‘PHP_SESSION_UPLOAD_PROGRESS’, ‘—-p2s’, ‘JACKALPOC’] condition: ua or (post and body) level: medium

Splunk: PHP worker child processes

index=edr parent_process_name IN (“php-fpm*”,”php-cgi*”,”httpd”,”apache2″,”lsphp”,”frankenphp”) (process_name IN (“sh”,”bash”,”curl”,”wget”,”nc”,”busybox”,”python3″,”perl”) OR process_path=”/tmp/*” OR process_path=”/dev/shm/*”) earliest=”10/17/2026:00:00:00″ | stats count min(_time) as first values(process) as cmd by host user | sort – count

Quick host triage (read-only)

php -v # confirm the SERVING binary, not only CLI php -i | grep -E ‘session.upload_progress|memory_limit|post_max_size|max_input_nesting_level|fatal_error_backtraces|opcache.enable’ find /var/www -type f -name ‘*.php’ -newermt ‘2026-10-17’ -ls find /tmp /var/tmp /dev/shm -type f -perm -u+x -newermt ‘2026-10-17’ -ls grep -rIl -e ‘92.118.112.100’ -e ‘JACKALPOC’ /var/log 2>/dev/null

YARA PHP2Shell exploitation happens in PHP worker memory before application code runs and writes no file by itself, so YARA cannot detect the exploit directly. It covers what the attack leaves behind: captured requests and logs, PHP session files, second-stage payloads and web shells dropped after successful RCE, and staged exploit tooling.

Validation status: the set compiles cleanly with yara-python 4.5.4 with warnings treated as errors, and passed a 72-case synthetic regression suite. It has not yet been tested against real application code; run it against clean WordPress, Drupal, and Magento installations before deploying for alerting. Full rule text is in Appendix A.

Deployment notes: seven of the nine rules match the rule file itself and other detection content; exclude rule repositories and threat-intelligence feeds from scans. User-agent, boundary and marker strings are trivially changed by attackers; weight the request-shape, session-file and payload rules over string matches.

11. MITIGATION AND RECOMMENDED ACTIONS

12. SOURCING AND CONFIDENCE

This report consolidates CYFIRMA closed-source channel collection (I2P human-intelligence monitoring), verified vulnerability intelligence (PHP Security Team advisories GHSA-w8hw-w9fx-j79w and GHSA-6wmf-4rv5-p3rp), open-source in-the-wild exploitation telemetry (Amazon MadPot, Cloudflare, Hadrian, Patchstack, VulnCheck, ELLIO, Vega), public exploit/PoC evidence (Wiz / Calif / OpenAI, Datadog Security Labs, VulnCheck, GitHub, JFrog, AhnLab ASEC), and historical Lazarus tradecraft analysis. No exploit code has been executed or independently tested in this assessment.

Confidence justification. PHP2Shell technical details, the June 2026 Minjun campaign’s targeting intent and channel activity are directly observed or independently verified, supporting HIGH confidence in the vulnerability and the general threat. Confidence in the link to the Lazarus ecosystem is MODERATE because it rests on language, operational pattern, and historical tradecraft rather than definitive infrastructure or tooling overlap with a named Lazarus cluster. No confirmed mass successful exploitation by this actor has been observed. CYFIRMA will revise this assessment on further tasking, infrastructure differentiation, or confirmed compromises. The channel remains under continuous monitoring; review 25 October 2026.

Media and analyst : [email protected]

A. APPENDIX A: PHP2SHELL YARA RULES

Place the rules in one .yar file that starts with the import line below, which the two hash-based rules (A.1 and A.2) require.

rule PHP2Shell_SecondStage_ELF_SHA256 { meta: description = “Detects the PHP2Shell second-stage ELF x86-64 binary delivered by the observed loader” author = “CYFIRMA Research” date = “2026-10-22” category = “Threat Intelligence” severity = “High” hash = “0c5486f06620e26e316f4b33f318b0d646d5e1133789331aa2fed012360d1486” source_note = “Single honeypot vendor, 21 Oct 2026; not independently corroborated” scan_scope = “/tmp, /var/tmp, /dev/shm, web roots. The loader writes to /tmp and executes; the file may be deleted after launch” condition: uint32(0) == 0x464C457F and filesize == 179632 and hash.sha256(0, filesize) == “0c5486f06620e26e316f4b33f318b0d646d5e1133789331aa2fed012360d1486” }

rule PHP2Shell_Captured_Request_Body_SHA256 { meta: description = “Matches saved PHP2Shell scanner and OOM-tool HTTP request bodies by SHA-256” author = “CYFIRMA Research” date = “2026-10-22” category = “Threat Intelligence” severity = “Medium” note = “Hashes of HTTP request bodies, not files. Matches only a body extracted byte-for-byte (PCAP, WAF or proxy capture); any change to boundary or field values changes the hash. A.4 is the durable alternative” condition: filesize = 10) or ($field and #array_part >= 100) ) }

rule PHP2Shell_Log_Crash_Signatures { meta: description = “PHP error-log and PHP-FPM log lines consistent with PHP2Shell trigger attempts (pre-request OOM, session decode failure, worker segfault)” author = “CYFIRMA Research” date = “2026-10-22” category = “Threat Hunting” severity = “Low” note = “Side-effect indicators, not proof of exploitation. Derived from community lab testing (largely PHP CLI server; nginx/FPM/Apache mappings provisional). Correlate with multipart POSTs from the same source. A memory-limit fatal with memory_limit=-1 set is a strong signal” strings: $oom = /Allowed memory size of [0-9]{1,12} bytes exhausted[^\n]{0,200} in Unknown on line 0/ ascii $decode = “Failed to decode session object” ascii $segv = “exited on signal 11 (SIGSEGV)” ascii condition: $oom or ($decode and $segv) }

rule PHP2Shell_Session_File_Anomaly { meta: description = “PHP session file containing PHP code or a residual upload-progress entry with an empty-filename spray” author = “CYFIRMA Research” date = “2026-10-22” category = “Threat Hunting” severity = “Medium” scan_scope = “Session save_path, e.g. /var/lib/php/sessions or /tmp (sess_* files)” note = “Branch A (PHP code) covers webshell staging via a poisoned session file, which the upload-progress feature makes possible. Branch B is unvalidated: upload-progress entries are normally removed on completion (session.upload_progress.cleanup=On), so a residual entry with many empty filenames is an anomaly worth review. Prefix is configurable (session.upload_progress.prefix). Covers php, php_serialize and php_binary handlers. Branch A can match applications that keep code snippets in session data” strings: $prefix = “upload_progress_” ascii $php1 = “ = 10) ) }

rule PHP_Webshell_Input_To_Exec_Heuristic { meta: description = “PHP files that pass request input to command execution or code evaluation, use an execution function as a string callback, evaluate the raw request body, or open a reverse shell” author = “CYFIRMA Research” date = “2026-10-22” category = “Behavioural Detection” severity = “Medium” note = “Post-exploitation webshell detection in web roots; not PHP2Shell-specific. Validate hits against legitimate application code” strings: $php1 = “ :$](system|exec|shell_exec|passthru|popen|proc_open|pcntl_exec|assert|eval)\s*\(\s*((base64_decode|str_rot13|gzinflate|gzuncompress|rawurldecode)\s*\(\s*)*\$_(GET|POST|REQUEST|COOKIE|SERVER)/ nocase // backtick operator executing request input $backtick = /`[^`\n]{0,200}\$_(GET|POST|REQUEST|COOKIE)/ // variable function called with request input, e.g. $f($_REQUEST[‘x’]) $var_func = /\$[a-zA-Z_][a-zA-Z0-9_]*\s*\(\s*\$_(GET|POST|REQUEST|COOKIE)\s*\[/ // request input used as the function name, e.g. $_GET[‘f’]($_GET[‘c’]) $input_func = /\$_(GET|POST|REQUEST|COOKIE)\s*\[[^\]\n]{1,40}\]\s*\(/ // execution function passed as a string callback, e.g. call_user_func(‘system’, …) // (callback as first argument; method callbacks such as array($pdo, ‘exec’) are deliberately not matched) $str_cb1 = /(call_user_func(_array)?|array_map|register_shutdown_function)\s*\(\s*[‘”](system|exec|shell_exec|passthru|popen|proc_open|assert)[‘”]/ nocase // (callback as second argument after an array variable) $str_cb2 = /(array_filter|array_walk|usort|uasort|uksort)\s*\(\s*\$[A-Za-z0-9_]{1,40}\s*,\s*[‘”](system|exec|shell_exec|passthru|popen|proc_open|assert)[‘”]/ nocase // raw request body evaluated or included $php_input = /(eval|assert|include|include_once|require|require_once)\s*\(?\s*(file_get_contents\s*\(\s*)?[‘”]php:\/\/input/ nocase // reverse shell: socket plus interactive shell $fsock = /fsockopen\s*\(/ nocase $shell_i = /\/bin\/(ba)?sh -i|\/dev\/tcp\// condition: filesize :$]shell_exec\s*\(/ nocase $exec2 = /[^A-Za-z0-9_>:$]proc_open\s*\(/ nocase $exec3 = /[^A-Za-z0-9_>:$]popen\s*\(/ nocase $exec4 = /[^A-Za-z0-9_>:$]passthru\s*\(/ nocase $exec5 = /[^A-Za-z0-9_>:$]system\s*\(/ nocase $exec6 = /[^A-Za-z0-9_>:$]exec\s*\(/ nocase $exec7 = /[^A-Za-z0-9_>:$]pcntl_exec\s*\(/ nocase $shell1 = “/bin/sh” ascii $shell2 = “/bin/bash” ascii $shell3 = “sh -c” ascii nocase $in1 = “$_GET[” ascii $in2 = “$_POST[” ascii $in3 = “$_REQUEST[” ascii $in4 = “$_COOKIE[” ascii $decode1 = /[^A-Za-z0-9_>:$]base64_decode\s*\(/ nocase $decode2 = /[^A-Za-z0-9_>:$]eval\s*\(/ nocase $decode3 = /[^A-Za-z0-9_>:$](gzinflate|gzuncompress|str_rot13)\s*\(/ nocase condition: filesize < 5MB and any of ($php*) and ( (2 of ($exec*) and 1 of ($shell*)) or (1 of ($exec*) and 1 of ($shell*) and 1 of ($in*)) or (1 of ($exec*) and 1 of ($decode*) and 1 of ($in*)) or // small file calling an execution function with request input anywhere (indirect webshells, e.g. $c=$_GET['c']; system($c);) (filesize < 8KB and 1 of ($exec*) and 1 of ($in*)) or // small file evaluating decoded request input indirectly, e.g. $p=base64_decode($_POST['p']); eval($p); (filesize < 8KB and $decode2 and 1 of ($decode1, $decode3) and 1 of ($in*)) ) } rule PHP2Shell_Public_PoC_Script { meta: description = "Scripts that reference PHP2Shell CVEs or tooling strings together with the upload-progress field" author = "CYFIRMA Research" date = "2026-10-22" category = "Threat Hunting" severity = "Low" note = "Finds staged exploit tooling on compromised hosts or analyst systems. Security firms warned that circulating PoCs may contain malware; treat hits on analyst systems as possible infection too. Matches detection-content files holding the same strings; exclude rule repositories" strings: $field = "PHP_SESSION_UPLOAD_PROGRESS" ascii wide $t1 = "php2shell" ascii wide nocase $t2 = "CVE-2026-109618" ascii wide nocase $t3 = "CVE-2026-109619" ascii wide nocase $t4 = "B7kQpoc619" ascii wide $t5 = "JACKALPOC" ascii wide $code1 = "import requests" ascii $code2 = "requests.post" ascii $code3 = "socket.socket" ascii $code4 = "curl_init" ascii condition: filesize < 1MB and uint32(0) != 0x464C457F and $field and 1 of ($t*) and 1 of ($code*) }