## CISA Threat Hunting ##

                            ############ README ###############
## Edit rules and queries as needed for your hunt and based on your environment.
## Ensure your EDR/SIEM instance has enough memory to run these AND/OR condition based queries. May take longer to run than conventional Sigma rule query. 
## Do not edit "logsource-product:" unless you are editing this rule to meet specific logsources/fields and know your environment.
## TLP GREEN + Please use local installation of Sigma to convert this rule.
## TLP CLEAR may convert rules using online converter of choice.
                            ###################################

title: Detects PHP2Shell CVE-2026-109618 CVE-2026-109619 RCE Exploitation Attempts
incident: 261429.r1.v1
tlp: CLEAR
id: 8cb1e757-5593-4f87-9e3d-79f17c89f799
status: test
description: Detects potential PHP2Shell exploitation associated with CVE-2026-109618 and CVE-2026-109619 using HTTP request patterns, public exploit markers, PHP error messages, and reported infrastructure and IOCs. 
references:
    - https://www.wiz.io/blog/php2shell-php-rce
    - https://github.com/9bie/php2shell-bypass-aslr-exp/blob/4586f5cc120c82fd468b17469202bac629810ad9/exploit.py
    - https://github.com/eness/php2shell-CVE-2026-109618-CVE-2026-109619-PoC/blob/main/poc_109618.py
    - https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/
    - https://www.sophos.com/en-us/blog/proof-of-concept-exploit-released-for-php-vulnerabilities-109618-109619
    - https://www.crowdstrike.com/en-us/blog/crowdstrike-protects-customers-from-php-rce-zero-days/
    - https://www.zestsecurity.io/resources/content/php2shell-mitigate-php-now-patch-when-it-ships
    - https://arcticwolf.com/resources/blog/php2shell-critical-php-vulnerabilities-enable-unauthenticated-remote-code-execution/
    - https://www.vulncheck.com/blog/php2shell-vulnerabilities
author: CISA
date: 2026-10-21
modified: 2026-10-23
tags: 
    - cve.2026.109618
    - cve.2026.109619
logsource:
    product: cisa
detection:
    keywords:
        - 'POST'
    keywords_1:
        - 'index.php'
    keywords_2:
        - 'PHPSESSID'
    keywords_3:
        - 'PHP_SESSION_UPLOAD_PROGRESS'
    keywords_4:
        - 'php2shell'
        - 'B7kQpoc61'
        - 'BNDRY12345'
        - 'filename'
        - 'multipart/form-data'
        - 'Content-Disposition: form-data'
        - 'application/x-www-form-urlencoded'
        - 'aaaaaaaaaaa'
        - 'AAAAAAAAAAA'
        - 'bbbbbbbbbbb'
        - 'BBBBBBBBBBB'
        - 'VVVVVVVVVVV'
        - 'SSSSSSSSSSS'
        - 'ppppppppppp'
        - 'pwn'

    keywords_5:
        - 'PHP_SESSION_UPLOAD_PROGRESS'
    keywords_6:
        - 'php-cgi'
        - 'apache2'
        - 'httpd'
        - 'php-fpm'
        - 'mod-php'
    keywords_7:
        - '/bin/sh'
        - '/bin/bash'
        - 'cmd'
        - 'powershell'
        - 'python'
        - 'curl'
        - 'wget'
        - 'netcat'
        - 'nc'
        - 'whoami'
        - 'id'
        - 'uname '

    keywords_8:
        - 'PHP Fatal error:'
    keywords_9:
        - 'Allowed memory'
    keywords_10:
        - ' in Unknown '

    keywords_11:
        - '<'
    keywords_12:
        - 'php'
    keywords_13:
        - 'echo'
    keywords_14:
        - 'system'
    keywords_15:
        - "($_GET['"
    keywords_16:
        - '>'

    keywords_17:
        - '103.216.220.92'
        - '31.223.184.166'
        - '37.19.200.5'
        - '134.209.159.64'
        - '103.114.163.188'
        - '95.217.98.37'
        - '45.198.224.169'
        - '92.118.112.100'
        - '134.199.154.64'
        - '117.55.202.115'
        - '85.11.167.243'
        - '221.14.159.134'
        - '109.71.252.97'
        - '91.90.123.25'
        - 'thunder.godofthunder.st'
        - 'hackattackkaboom.botlesscucks.st'
        - 'hik.gettingheadfromduckysmom.st'
        - 'b61a098fc62a2c2696e196dca78da71a'
        - 'c472dab4ff7c16782a8037f988d4daa6d4bdb343'
        - '0c5486f06620e26e316f4b33f318b0d646d5e1133789331aa2fed012360d1486'
        - '267a3c8ed021a0a52c29bf076617a0dfd5cd5285202b8d0bd9ad0712110ccae8'
        - 'e2529d4afa39ae4db2eb05d5176317c906289abf09660c75bdeec43e54c55aa3'
        - '150ae88f0999032e2a6113501d6082f54a3ed98d02427b21a96e773a27d7bf16'
        - '40caf199ca1ebe056a74427f8e9db06c66899e33ae09c0ec2769ec70bf6dd8e7'
        - '27d926a6708d6769d97d065e7a5a860ab496eab272c03d1cebc55ec71b954fa2'
        - '1485e14e0f62bc94664eec341cabd275dad7d30b1d496c40ec340c9a0d9f0ba8'
        - 'xqsuvwz3n97wu8j3emz1axuo5y'
        - 'p2s9rdme2st6guc9g0rafic'
        - 'php2shell-scan'
        - 'php2shell-scan/109618'
        - 'php2shell-verify'
        - 'php2shell-poc'
        - 'B7kQpoc618'
        - 'B7kQpoc619'
        - 'BGCTXBOUNDARY'
        - './nfs php'

    condition: keywords and keywords_1 and keywords_2 and keywords_3 and keywords_4 or keywords_5 and keywords_6 and keywords_7 or keywords_8 and keywords_9 and keywords_10 or keywords_11 and keywords_12 and keywords_13 and keywords_14 and keywords_15 and keywords_16 or keywords_17

falsepositives:
    - Rate of FP medium-high with some strings/branches. 
    - Use this rule in an infected environment/logs.
    - Analyst may need to tune and make adjustments to the query as required.

level: critical