# PHP2Shell Detection Opportunities

https://data.sierraechocharlie.com/php-shell-rules/
Potential detections for CVE-2026-109618 and CVE-2026-109619.
Automatically generated templates. Adapt for your environment as appropriate.

One searchable catalog of memory errors, IP sets grouped by traffic role,
reported indicators, behavioral detections and optional hunts. Previdian supplies 13 source IPs and six request rules/hunts, credited at
https://previdian.com/. These observations remain Unconfirmed. GreyNoise's PHP2SHELL event page
(https://php.events.greynoise.io/) supplies 202 block-candidate sources, exploit fingerprints and two
request rules, credited to GreyNoise. One source-IP set
contains 254 distinct addresses with 300 observations from seven providers. Payload/C2
destinations are a separate set. Each address retains per-source references, dates,
confidence and evidence in the interface and JSON/Markdown exports. Group-level
references do not imply that every source supports every address. Old group links work.
Choose a format, copy a template or export Markdown/JSON.
Event correlations are available in Kusto KQL and Splunk SPL. No live telemetry connection.

Formats: Microsoft Kusto KQL, Splunk SPL, CrowdStrike CQL/LogScale, Kibana KQL, Sigma,
Loki, Wazuh, Suricata, Snort 3, YARA, regex. Unsupported combinations explain the gap.
FQL is not a universal raw-log substitute for CQL. Kibana uses broader phrase/wildcard
matching. Replace all [PLACEHOLDER] values before use.

Referenced indicates source support. Unconfirmed indicates an interpretation not
independently established for these CVEs. Primary report references remain attached to
indicators. Source IPs on shared infrastructure warrant investigation, not blanket blocking.
No diagnostic or process event is automatically classified as confirmed compromise.

Use rule and platform URL parameters to share a selection. Legacy variant/platform
URLs are supported. Export scope is the complete catalog regardless of search filters.
Credit and required-telemetry metadata are omitted. No sample-input or appearance UI.

CISA (https://www.cisa.gov/) is credited for the 25 October coverage review and new
hunts derived from its PHP2Shell Sigma rule and references. The optional CISA keyword
hunt preserves five independent branches and 36 standalone indicators. It requires
one complete event and has medium-high false positives. Existing field-specific
detections remain available. An indicator or command string does not prove compromise.

Feedback or IoCs: letsgo@sierraechocharlie.com

Multipart boundaries, User-Agents, JA4H, response markers, payload URLs/domains and
hashes are grouped with per-indicator evidence. File, request-body and MIME-part hash
scopes remain separate. Compound request hunts preserve their original predicates.
Top navigation links to downloads/php2shell-master.yml (70 independent Sigma rules).
The coverage manifest remains available at downloads/sigma-manifest.json. Nine event correlations are excluded from Sigma; available query formats vary by entry.
Additional coverage: configured upload-progress names, repeated array parts,
serialized filenames, large POST/500, request/OOM correlation, rotating sessions,
Cloudflare managed-rule IDs and Corelight version exposure notices.

GreyNoise (https://www.greynoise.io/) is credited for the 54-IP CSV supplied via
the SlimKQL mirror. Three IPs overlap existing evidence; 51 are newly included.
Latest alert dates and occurrence counts retain their upstream meanings.

Previdian Research is credited for its 28 October public report:
https://blog.previdian.com/php2shell-activity-across-previdian-network/
Added 2.59.133.151 as both a source and attempted-download destination, with separate
role evidence. This report remains distinct from the older Unconfirmed export.
New opportunities: observed decimal/dotted host download commands in web-worker
descendants; unusual-port downloader attempts including failures; session startup
diagnostics; exact-request session-error/cookie correlation; multipart-memory-cookie
and service-associated shell correlation. The last two are Kusto-only and do not
establish same-worker causality. No 500, crash or successful download is required.
Cookie byte lengths require a documented raw-encoded or decoded representation.

Arctic Wolf’s 5.175.189.76 is grouped with source IPs under the catalog owner’s
explicit source-role assumption. Original role uncertainty and attribution remain
in per-address evidence; the former standalone hunt link resolves to the source set.