Potential PHP2Shell Exploitation Attempt

Last updated an hour ago on 2026-10-24

Created 2 days ago on 2026-10-22

About

This rule detects a distinctive PHP out-of-memory fatal error associated with PHP2Shell exploitation attempts. The combination of an allowed-memory-size exhaustion and the location "Unknown on line 0" is produced before normal application execution and is an indicator of attempts to exploit PHP memory-safety vulnerabilities, including CVE-2026-109618 and CVE-2026-109619. The rule can detect unsuccessful as well as successful attempts and does not, by itself, confirm remote code execution.

Tags

Domain: WebUse Case: Threat DetectionUse Case: VulnerabilityTactic: Initial AccessData Source: NginxData Source: ApacheData Source: Apache TomcatThreat: Vulnerability ExploitRule Type: QueryService: NginxService: Apache TomcatService: Apache HTTP ServerVuln: CVE-2026-109618Vuln: CVE-2026-109619Language: kuery

Severity

medium

Risk Score

MITRE ATT&CK™

Initial Access (TA0001)(external, opens in a new tab or window)

↳ Exploit Public-Facing Application (T1190)(external, opens in a new tab or window)

False Positive Examples

Application defects, stress tests, or intentionally low PHP memory limits may generate similar errors. Confirm the complete signature, source, timing, and surrounding requests before escalating. Authorized vulnerability research or penetration testing of PHP2Shell will trigger this rule.

License

Elastic License v2(external, opens in a new tab or window)

Definition

Rule Type

Query (Kibana Query Language)

Integration Pack

Prebuilt Security Detection Rules

Index Patterns

logs-apache.error-*logs-apache_tomcat.*logs-nginx.error-*

Related Integrations

nginx(external, opens in a new tab or window)

apache(external, opens in a new tab or window)

apache_tomcat(external, opens in a new tab or window)

Query

✄𐘗text code block:
✄𐘗event.dataset:("apache.error" or "nginx.error" or "apache_tomcat.catalina" or "apache_tomcat.localhost") and
message:("PHP Fatal error" and "Allowed memory size" and "bytes exhausted" and "Unknown on line 0")

Install detection rules in Elastic Security

Detect Potential PHP2Shell Exploitation Attempt in the Elastic Security detection engine by installing this rule into your Elastic Stack.

To setup this rule, check out the installation guide for Prebuilt Security Detection Rules(external, opens in a new tab or window).