Potential PHP2Shell Exploitation Attempt

[metadata]
creation_date = "2026/10/22"
integration = ["nginx", "apache", "apache_tomcat"]
maturity = "production"
updated_date = "2026/10/24"

[rule]
author = ["Elastic"]
description = """
This rule detects a distinctive PHP out-of-memory fatal error associated with PHP2Shell exploitation attempts. The
combination of an allowed-memory-size exhaustion and the location "Unknown on line 0" is produced before normal
application execution and is an indicator of attempts to exploit PHP memory-safety vulnerabilities,
including CVE-2026-109618 and CVE-2026-109619. The rule can detect unsuccessful as well as successful attempts and does
not, by itself, confirm remote code execution.
"""
false_positives = [
    """
    Application defects, stress tests, or intentionally low PHP memory limits may generate similar errors. Confirm the
    complete signature, source, timing, and surrounding requests before escalating.
    """,
    "Authorized vulnerability research or penetration testing of PHP2Shell will trigger this rule.",
]
from = "now-9m"
index = [
    "logs-apache.error-*",
    "logs-apache_tomcat.*",
    "logs-nginx.error-*",
]
language = "kuery"
license = "Elastic License v2"
name = "Potential PHP2Shell Exploitation Attempt"
note = """## Triage and analysis

### Investigating Potential PHP2Shell Exploitation Attempt

PHP2Shell chains PHP memory-safety flaws that are triggered while PHP processes fatal out-of-memory conditions. The
combination of `PHP Fatal error`, `Allowed memory size`, `bytes exhausted`, and `Unknown on line 0` is substantially more
specific than a generic PHP fatal error. The alert represents an exploitation attempt; use corroborating web and endpoint
telemetry to determine whether code execution or process-memory disclosure succeeded.

### Possible investigation steps

- Identify `host.id`, `host.name`, `event.dataset`, `log.file.path`, and the complete `message` or `event.original` value.
- Treat `source.ip` as the immediate client observed by the web server. If a proxy, CDN, load balancer, or container bridge
  is present, recover the original client from trusted proxy or edge logs rather than assuming `source.ip` is the attacker.
- Review web access and error events around the alert for multipart requests, upload-progress session fields, repeated HTTP
  500 responses, unusual or malformed `PHPSESSID` cookies, worker churn, and repeated memory-limit errors.
- Correlate the alert with process telemetry for shells, interpreters, downloaders, or other unusual children of Apache,
  Nginx, IIS, PHP-CGI, or PHP-FPM workers. Review outbound network connections and recent file modifications on the host.
- Establish the installed PHP version and determine whether it includes the PHP security updates published on October 21, 2026.
  PHP2Shell affects PHP itself and does not require a vulnerability in the hosted application.

### False positive analysis

- A genuine application memory leak or deliberately constrained `memory_limit` can cause memory exhaustion, but the
  complete `Unknown on line 0` signature is unusual. Compare the event with historical fatal errors on the same host.
- Confirm whether an approved security assessment was active and whether its source and timing match the alert.

### Response and remediation

- If the server runs an affected PHP release, remove it from public traffic or isolate it until PHP is updated.
- Preserve web, PHP, process, network, and file telemetry before restarting workers or rebuilding the host.
- If follow-on execution or memory disclosure is suspected, rotate credentials and secrets accessible to the PHP worker,
  rebuild from a trusted image, and hunt for the same activity across other PHP servers.
"""
references = [
    "https://www.wiz.io/blog/php2shell-php-rce",
    "https://nvd.nist.gov/vuln/detail/CVE-2026-109618",
    "https://nvd.nist.gov/vuln/detail/CVE-2026-109619",
]
risk_score = 47
rule_id = "b05dfacd-b6c9-4b13-a669-2619867547f9"
severity = "medium"
tags = [
    "Domain: Web",
    "Use Case: Threat Detection",
    "Use Case: Vulnerability",
    "Tactic: Initial Access",
    "Data Source: Nginx",
    "Data Source: Apache",
    "Data Source: Apache Tomcat",
    "Resources: Investigation Guide",
    "Threat: Vulnerability Exploit",
    "Rule Type: Query",
    "Service: Nginx",
    "Service: Apache Tomcat",
    "Service: Apache HTTP Server",
    "Vuln: CVE-2026-109618",
    "Vuln: CVE-2026-109619",
]
timestamp_override = "event.ingested"
type = "query"

query = '''
event.dataset:("apache.error" or "nginx.error" or "apache_tomcat.catalina" or "apache_tomcat.localhost") and
message:("PHP Fatal error" and "Allowed memory size" and "bytes exhausted" and "Unknown on line 0")
'''


[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1190"
name = "Exploit Public-Facing Application"
reference = "https://attack.mitre.org/techniques/T1190/"


[rule.threat.tactic]
id = "TA0001"
name = "Initial Access"
reference = "https://attack.mitre.org/tactics/TA0001/"

[rule.investigation_fields]
field_names = [
    "@timestamp",
    "host.id",
    "host.name",
    "host.ip",
    "source.ip",
    "event.dataset",
    "log.file.path",
    "message",
]