Changed since version 0

• poc_repo 2026-10-29: Public repo for CVE-2026-109618: ikow/php2shell-poc — CVE-2026-109618/109619 — 5 RCE chains + detection rules (Suricata, Sigma, ModSecurity). PHP session.upload

What happened

• PHP patched two unauthenticated RCEs tracked as PHP2Shell (CVE-2026-109618/109619) on Oct 21; CISA added them to KEV Oct 27 with exploitation beginning before patches shipped [S4].
• A separate unpatched RCE, CVE-2026-115560, has only a mitigation (session.upload_progress.enabled=0) and affects non-default session serialize_handler configs; no observed exploitation reported [S2][S3].
• A suspected China-nexus, AI-assisted operation (Oct 23–25) used a custom PHP2Shell exploit against PHP session.upload_progress on an undisclosed vendor's firewall appweb management server [S1].
• The actor chained the Fragnesia Linux kernel LPE (CVE-2026-46300) to root 25 devices across the US, Japan, Taiwan and South Korea [S1].
• Attackers planted PHP web shells in public directories, built a reverse SSH tunnel into a US gov-affiliated network, decrypted an LDAP service account password, enumerated AD, password-sprayed and attempted backdoor AD account creation; credential-theft and account-creation success is unconfirmed [S1].
• A public PoC repo (ikow/php2shell-poc) now hosts 5 RCE chains plus Suricata/Sigma/ModSecurity detection rules [changes].

Timeline

Detect

ad_spray_from_appliance_ip_then_account_creation · windows_eventlog → windows_eventlog · proposer hunt, speculative

index=<windows_eventlog> (EventCode=4625 OR EventCode=4720) | eval stage=if(EventCode==4625,"spray","create") | bin _time span=1h as hour | stats dc(eval(if(stage=="spray",TargetUserName,null()))) as sprayed_users count(eval(stage=="spray")) as failures values(eval(if(stage=="spray",src_ip,null()))) as spray_sources min(eval(if(stage=="spray",_time,null()))) as first_fail values(eval(if(stage=="create",TargetUserName,null()))) as created_accounts min(eval(if(stage=="create",_time,null()))) as first_create by Computer | where sprayed_users>=20 AND isnotnull(first_create) AND first_create>first_fail AND first_create-first_fail<86400 | sort - first_create

FROM <windows_eventlog> | WHERE event.code IN ("4625", "4720") | EVAL stage = CASE(event.code == "4625", "spray", "create"), fail_user = CASE(stage == "spray", user.name, NULL), fail_ts = CASE(stage == "spray", @timestamp, NULL), create_ts = CASE(stage == "create", @timestamp, NULL) | STATS sprayed_users = COUNT_DISTINCT(fail_user), failures = COUNT(*) WHERE stage == "spray", spray_sources = VALUES(source.ip) WHERE stage == "spray", first_fail = MIN(fail_ts), created_accounts = VALUES(user.target.name) WHERE stage == "create", first_create = MIN(create_ts) BY host.name | WHERE sprayed_users >= 20 AND first_create IS NOT NULL AND first_create > first_fail AND DATE_DIFF("seconds", first_fail, first_create) < 86400 | SORT first_create DESC

A hit means: A failed-logon burst against many users from a firewall/management IP followed by a new account on the same DC matches the actor's tunnelled spray and backdoor-account attempt; confirm the spray source is an appliance pivot IP before escalating. · Noise: Vulnerability scanners, misconfigured service accounts and help-desk provisioning produce both failed-logon bursts and routine 4720 events on busy DCs; restrict spray_sources to firewall/management appliance IPs (the story's pivot point), exclude known scanner IPs, and exclude 4720 events whose SubjectUserName is an approved provisioning/IAM service account.

Verify

• Confirm spray_sources are firewall or management-appliance IPs that should never authenticate to a DC; appliance-originated AD auth is the strong signal.
• Correlate any created account against change tickets and help-desk provisioning; legitimate 4720 on busy DCs is common.
• Check firewall web roots for new PHP files with recent timestamps and outbound SSH from appliances in the same window to tie the chain together.
• Benign look-alikes: vulnerability scanners and misconfigured service accounts produce 4625 bursts; routine provisioning produces 4720.

Scope

Affected

• Undisclosed large vendor's firewall OS using PHP 8.0.30 and newer branches
• PHP deployments on CVE-2026-109618/109619 (pre-patch)
• Linux systems vulnerable to Fragnesia CVE-2026-46300

Only if

• Firewall management interface exposed to the internet, or internally reachable via an already-compromised device
• PHP session.upload_progress reachable on the appweb management server

Not affected if

None stated by the sources.

Fixed in: PHP 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 for PHP2Shell; no fix for EOL ≤8.1; CVE-2026-115560 unpatched (mitigation only)

Enumerate

• Firewall appliances running affected PHP branches and their management-interface exposure
• PHP versions across the estate and any EOL ≤8.1 installs
• Linux kernel versions vulnerable to CVE-2026-46300
• PHP apps using non-default session serialize_handler php_binary/php_serialize with upload progress enabled (CVE-2026-115560)
• AD service accounts (esp. LDAP) and recently created accounts

Contain

• Restrict or remove internet exposure of firewall management interfaces; preserve appliance logs and memory before changes.
• Block outbound SSH from firewall/appliance networks except known-good destinations.
• Rotate the LDAP service account and any credentials reachable from a compromised appliance (rotation cannot be undone; capture evidence first).
• Disable session.upload_progress on exposed PHP where feasible and apply the CVE-2026-115560 mitigation (session.upload_progress.enabled=0).

Eradicate

• Remove planted PHP web shells from firewall/appliance web roots and any public directories.
• Remove reverse SSH tunnels and attacker infrastructure persistence on appliances.
• Delete any backdoor AD accounts created by the actor and reverse unauthorized changes.
• Patch PHP to fixed versions and the Linux kernel against Fragnesia CVE-2026-46300.

Recover

• Validate appliance integrity (rebuild rooted firewalls rather than clean in place where possible).
• Confirm PHP and kernel are patched and management interfaces are no longer exposed before returning devices to service.
• Monitor for renewed AD spraying, appliance-originated authentication, and new outbound SSH after recovery.

Re-enter the loop when

• A new firewall vendor or product is named as affected [S1].
• CVE-2026-115560 receives a patch or observed exploitation is reported [S2][S3].
• Evidence confirms successful credential theft or backdoor AD account creation [S1].
• New IoCs or exploit chains emerge from the public PoC repo [changes].

Debrief

• Record which appliances were rooted, web shell locations, tunnel endpoints, and the LDAP account rotation.
• Document AD spray scope and whether any account creation succeeded.
• Gaps: the firewall vendor is undisclosed, success of credential theft/account creation is unconfirmed, and the campaign rests on a single secondary report [S1].

Detection coverage — checked automatically

Checked automatically 2026-10-29 12:55Z from public sources: 29 published, 16 nothing found, 0 not machine-checkable, 0 failed. "Nothing found" means the public source answered and had nothing, as of that moment; a feed covers only its newest posts. Re-checked daily.

Exposure queries — generated automatically

vuln:CVE-2026-109618

vuln:CVE-2026-109619

vuln:CVE-2026-115560

cpe:"cpe:/a:php:php"

product:"Php"

host.services: (software.product = "Php")

cpe:"cpe:/a:paloaltonetworks:panorama_virtual_appliance"

product:"Panorama Virtual Appliance"

host.services: (software.product = "Panorama Virtual Appliance")

NVD names 2 more affected products (libraries and embedders); the CVE query covers them where Shodan has fingerprinted the version.

Scope every query in your own tool, never in a shared document: Shodan `net:<your_ranges>`, `org:"<your_org>"` or `hostname:<your_domain>` (or a Shodan Monitor network alert, which applies the scope for you); Censys `host.ip: <your_ranges>` or `host.dns.names: <your_domain>`. Then compare the banner version with the affected range. Generated automatically 2026-10-29 12:55Z from the CVE ids and NVD's CPE configurations; re-built daily with the coverage check.

Open questions

• Which firewall vendor and product are affected? [S1]
• Did credential theft and backdoor AD account creation succeed? [S1]
• Does CVE-2026-115560 overlap with the session.upload_progress vector used in this campaign? [S1][S2]

Sources

• [S1] https://thehackernews.com/2026/10/php2shell-attack-roots-25-servers.html · The Hacker News
• [S2] https://www.bleepingcomputer.com/news/security/php-shares-mitigation-for-new-and-unpatched-rce-vulnerability/ · BleepingComputer
• [S3] https://thehackernews.com/2026/10/urgent-php-warns-of-another-unpatched.html · The Hacker News
• [S4] https://www.bleepingcomputer.com/news/security/cisa-confirms-php2shell-vulnerabilities-now-exploited-in-attacks/ · BleepingComputer

Public OSINT only. AI-generated by the pipeline; structure follows the DAIR model from Dynamic Incident Response (Joshua Wright). Published automatically once it crosses the publish bar.