PHP2Shell Attacks: Reproducing the Exploit and Detecting Threats with AhnLab EDR/XDR

AhnLab Reproduces Remote Command Execution via PHP2Shell and Outlines EDR/XDR-Based Detection and Response

1. PHP2Shell Vulnerabilities: Remote Code Execution Risks Arising from Different Root Causes

CVE-2026-109618 and CVE-2026-109619, collectively known as PHP2Shell, are vulnerabilities that arise during PHP's internal request processing. Both vulnerabilities can lead to unauthenticated remote code execution, although their underlying causes differ.

Table 1. Comparison of PHP2Shell Vulnerabilities

Both vulnerabilities stem from issues in PHP's internal processing. Successful exploitation could allow attackers to execute arbitrary commands on servers running PHP-based web services.

Therefore, in addition to applying security fixes for the vulnerabilities, it is important to monitor PHP services for abnormal activities.

2. PHP2Shell Reproduction Test Confirms Remote Command Execution on a Web Server

AhnLab reproduced a PHP2Shell attack using publicly available PoC code as a reference and examined the activities observed on both the attacker's system and the victim server.

The test began by identifying the IP addresses of the attacker and victim server. The attacker then executed a test script targeting a PHP website, which caused the victim server to establish a connection to the attacker's system.

Through this connection, the attacker was able to access a command shell on the victim server from their own system. The test also confirmed that commands were executed with the privileges of the web service account, www-data. The attacker further verified the connection to the victim server by checking its IP address.

Table 2. Key Steps in the PHP2Shell Reproduction Test

Analyzing Attack Activity Through the Process Tree

AhnLab also published the process tree observed during the reproduction test.

A process tree illustrates the parent-child relationships between processes. Security administrators can use this information to identify which process initiated a particular command and which programs were subsequently executed.

In remote code execution attacks such as PHP2Shell, abnormal commands may be executed through processes associated with PHP services. Examining process execution relationships within web services is therefore an important part of investigating potential attacks.

By analyzing these process execution details, administrators can investigate whether commands executed within PHP services are part of normal operations or potentially related to an external attack.

However, the execution of a particular process or command alone does not necessarily confirm an attack. Related events and process execution relationships must also be examined.

3. Detecting Malicious Activity with AhnLab EDR/XDR

Attackers exploiting PHP2Shell vulnerabilities may carry out malicious activities through PHP processes.

Considering these attack characteristics, AhnLab identified suspicious command execution, web shell creation and execution, abnormal file creation, and permission changes within PHP services as key monitoring targets.

AhnLab EDR/XDR detects related suspicious activities as threats or key events, helping security administrators identify root causes and establish appropriate response measures and procedures to prevent similar incidents.

AhnLab EDR: Endpoint Threat Detection and Response

AhnLab EDR (Endpoint Detection and Response) is a security solution that monitors activities across endpoints, including servers and PCs, to detect, analyze, and respond to advanced threats.

Powered by AhnLab's proprietary behavior analysis engine, the solution detects suspicious process execution and file activities while analyzing relationships between related behaviors to help identify the root causes of attacks. Its AI-powered analysis feature, AI Insight, also provides threat context and recommended response measures.

For attacks such as PHP2Shell, AhnLab EDR can help administrators identify abnormal command execution or file creation associated with PHP services and analyze process execution relationships.

AhnLab XDR: Correlated Threat Analysis and Response Across Multiple Security Domains

AhnLab XDR (Extended Detection and Response) is a security solution that collects and correlates data from multiple security domains, including endpoints, to support threat detection and response.

The solution correlates logs from heterogeneous security solutions with user and asset information, assesses the risk levels of detected threats, and helps security administrators prioritize their responses. Integration with AhnLab EDR, AhnLab TIP, and other security solutions also provides additional information for threat analysis.

In web server attacks such as PHP2Shell, AhnLab XDR can correlate suspicious endpoint activities with other security data to help administrators assess risks across their organization.

Key Monitoring Areas for PHP2Shell Attacks

AhnLab identified the following key monitoring areas in its analysis:

EDR focuses on analyzing suspicious endpoint activities and process execution relationships, while XDR correlates data from multiple security domains to provide broader threat context and support response prioritization.

4. AhnLab EDR/XDR Detection Names for PHP2Shell

AhnLab published seven AhnLab EDR/XDR detection names that can be used to identify suspicious activities associated with PHP2Shell.

Table 3. AhnLab EDR/XDR Detection Names Related to PHP2Shell

The following screenshot shows events detected by AhnLab EDR on the target PHP server during the execution of the PHP2Shell PoC.

Security administrators can use these detection events to identify suspicious activities within PHP services, such as abnormal command execution or file creation.

When threat events associated with PHP services occur, it is particularly important to investigate related processes and file activities to determine whether they are connected to an attack.

However, individual detection names alone cannot definitively confirm a PHP2Shell attack or guarantee detection of every attack variant.

5. PHP2Shell Mitigation: Combining Security Updates with Attack Activity Analysis

The primary mitigation for PHP2Shell vulnerabilities is to apply the patched versions released by the PHP Security Team.

The PHP Security Team released security updates for PHP versions 8.2 through 8.5 and recommended that affected users update their installations promptly.

Table 4. Security Update Versions for PHP2Shell Vulnerabilities

After applying the updates, web services must be restarted for the changes to take effect. Organizations unable to update immediately may consider the official temporary mitigation measures provided by the PHP Security Team.

However, regardless of whether the vulnerabilities have been patched, organizations should also examine related activities in environments where an attack may have already occurred or where exploitation is suspected.

References