PHP2Shell: Detecting Compromise and Incident Response

After learning about PHP2Shell, administrators need to determine whether the server was updated and whether there is activity worth investigating. CVE-2026-109618 and CVE-2026-109619 affect the PHP core. Version checks help establish exposure; logs and host inspection help assess whether a compromise may have occurred.

Understand what logs can and cannot tell you

HTTP access logs may show unusual request volume, scanning patterns, or traffic to endpoints that are rarely used. PHP and web server error logs can help connect requests with crashes or application errors. A single IP address or log entry is not enough to confirm exploitation. Attackers can route through intermediaries, and logs may be incomplete.

Review the period from when the affected runtime was first exposed until the fix was active. Correlate web logs with authentication records, system processes, file changes, outbound connections, and service account activity. Preserve copies of logs before rotation or cleanup removes them.

Indicators worth reviewing

• Unscheduled changes to application files, configuration, or upload directories.
• New processes or child processes that do not match normal web service behavior.
• Outbound connections to unknown hosts, especially after an anomalous web request.
• Accounts, SSH keys, cron jobs, or service configuration created without an authorized change.
• PHP-FPM errors or restarts that coincide with suspicious request activity.

These indicators are not proof on their own and can have legitimate explanations. Compare them with a baseline, release activity, and team changes.

Establish the exposure timeline

Determine when the vulnerable runtime was active and reachable. Combine package update dates, worker restart times, configuration changes, and log retention windows. Record the timezone for each log source before comparing timestamps; a mix of UTC and local time can make events appear out of order.

Map all entry points: public domains, APIs, upload endpoints, administration panels, reverse proxies, and internal services reachable from other networks. An organization may use multiple PHP handlers. Include staging systems, old servers, workers, and containers that are not part of routine deployments.

Review logs systematically

Start with reverse proxy and web server logs for timestamp, host, method, status code, request size, user agent, and source address. Look for traffic that departs from the normal baseline, bursts of errors, repeated requests, or activity against rarely used endpoints. Correlate interesting time windows with PHP-FPM, operating system, authentication, DNS, firewall, and cloud telemetry.

Do not rely on one simple indicator such as HTTP 500 or a particular user agent. Normal application failures can produce similar errors, while malicious requests can resemble ordinary web traffic. Access logs may not record request bodies or runtime internals. Check whether logging changed, stopped, was deleted, or failed to cover a relevant path.

Inspect the host and service account

• Compare application files and configuration with trusted release artifacts or source control.
• Review new or changed files in application, upload, cache, temporary, and server configuration directories.
• Inspect running processes, child processes of PHP or the web server, network connections, and unusual resource use.
• Audit system accounts, SSH keys, cron jobs, service units, deployment tokens, and credentials available to the PHP account.
• Review firewall, DNS, proxy, and cloud configuration changes during the exposure period.

Use a baseline and compare similar systems. New files or unfamiliar processes are not automatically malicious: deployments, backups, and monitoring can create changes too. Record the evidence and reasoning behind each conclusion.

Incident response when indicators are strong

1. Engage the incident owner. Set a coordination channel, technical lead, incident recorder, and escalation path.
2. Contain the impact. Isolate the host or restrict traffic according to policy. Avoid shutting it down abruptly if volatile evidence is needed, unless active risk requires immediate shutdown.
3. Preserve evidence. Secure logs, disk or VM snapshots, container metadata, configuration, and cloud records. Record when and by whom each copy was collected.
4. Close the access path. Restrict unnecessary public access, install a verified update, restart workers, and block network indicators based on analysis.
5. Rotate secrets. From a trusted device, replace database credentials, API tokens, deployment keys, and other secrets the web process could read. Revoke active sessions or tokens where possible.
6. Restore integrity. If the host cannot be trusted, rebuild from a known-good image, patch before restoring traffic, and restore only reviewed data.
7. Monitor and document. Increase monitoring after recovery and record impact, detection time, decisions, and follow-up controls.

After the incident

Review why the runtime was not inventoried or why patching was delayed. Maintain a central list of PHP versions across sites and containers, route security advisories to the responsible team, define an emergency patch process, and account for restarting long-running processes. Centralized logs with adequate retention make future investigations less dependent on files stored only on the affected host.

Use the PHP2Shell patch and verification checklist to confirm that the runtime is updated. If you find no evidence of compromise, document the scope of your review and any log gaps; “not found” is not absolute proof that an incident never happened.

Source: PHP security advisory, October 21, 2026.