Reproducing the PHP2Shell Vulnerability and Detection Using AhnLab EDR/XDR

On October 22, 2026, the PHP Security Team announced in an advisory that it would release security updates addressing the vulnerabilities CVE-2026-109618 and CVE-2026-109619. Although the causes of the two vulnerabilities differ, they are both remote code execution vulnerabilities that allow an unauthenticated threat actor to execute arbitrary code remotely.

AhnLab SEcurity intelligence Center (ASEC) conducted reproduction tests based on the publicly released proof-of-concept (PoC). This document summarizes the relevant information based on those tests to help administrators use AhnLab EDR to identify the cause of a vulnerability attack and establish appropriate response and prevention processes. 

 

1. PHP2Shell (CVE-2026-109618, CVE-2026-109619) Vulnerabilities

PHP (PHP: Hypertext Preprocessor) is a server-side scripting language widely used in the development of websites and web applications. When a user accesses a website, PHP code execution occurs on the server, and the result is delivered to the user in the form of a web page. This enables the implementation of various web functions, such as login, user information management, message boards, database integration, and online payments. The functions are implemented through PHP code execution on the server.

The CVE-2026-109618 and CVE-2026-109619 vulnerabilities, disclosed on October 21, 2026, arise during PHP’s internal request processing and allow an unauthenticated threat actor to remotely perform arbitrary code execution.

Classification	CVE-2026-109618	CVE-2026-109619
Vulnerability Type	Data corruption in the out-of-memory handling process	Reuse of internal state related to deallocated memory
Main Cause	Processing is interrupted due to a memory shortage before the request data is fully initialized, creating the possibility that incorrect data will be treated as valid during the subsequent cleanup process	Internal state used for request processing remains even after memory is deallocated, creating a possibility that it will be reused in subsequent requests before being initialized
Potential Impact	Unauthenticated Remote Code Execution	Unauthenticated remote code execution
Severity	CVSS v4.0 9.2	CVSS v4.0 9.2

Table 1. Details of Each Vulnerability

 

Figure 1. Vulnerability Exploitation Process

 

2. PHP2Shell Reproduction Test

The video of the reproduction test is as follows.

• 0–6 Seconds: Verify the IP addresses of the threat actor’s and victim’s servers.
• 6–16 Seconds: The threat actor executes a test script targeting a PHP website.
• 16–20 Seconds: The victim’s server connects to the threat actor’s PC, allowing the threat actor to use a command shell on the victim’s server from their own PC.
• 20–23 Seconds: You can verify that command execution occurs with the server’s web account (www-data) privileges.
• 23–29 Seconds: The server’s IP address is verified to confirm that a connection to the victim’s server has actually been established.

Video 1. Php2shell Reproduction Test Video

 

3. Mitigation Measures

3.1. Latest Updates

On October 21, 2026, the PHP Security Team released a security update to address these two vulnerabilities. Fixed versions were provided for each version series from PHP 8.2 Through 8.5, And the PHP Security Team recommended that all users running these versions update immediately.

The fixed versions, as per the official announcement, are as follows; restart your web service after applying the latest update. 

PHP Version Series	Security Update Version
PHP 8.5	8.5.12
PHP 8.4	8.4.27
PHP 8.3	8.3.36
PHP 8.2	8.2.35

Table 2. Security Update Versions for Critical PHP Vulnerabilities

 

3.2. Temporary Measures

Apply the web server settings provided by PHP and restart the server

• Https://www.Php.Net/archive/2026.Php#2026-10-21-5
• Https://github.Com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w
• Https://github.Com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp

 

3.3. EDR/XDR and Security Monitoring

• Detection of Abnormal Behavior in PHP Processes
• Detection of Web Shell Creation/Execution
• Monitoring for Suspicious File Creation and Permission Changes

 

4. Response Using AhnLab EDR/XDR

AhnLab EDR/XDR detects suspicious behaviors related to PHP services as threats or key events, helping administrators identify the root cause and establish appropriate response and recurrence prevention processes. Threat actors can exploit vulnerabilities to target PHP processes, which may result in malicious behaviors being carried out by those processes. Administrators can use the detection rules as follows to identify and respond to suspicious behavior in PHP services, such as suspicious command execution or file creation. 

 

[EDR/XDR Detection Name]

• Suspicious/MDP.Behavior.M12823
• InitialAccess/DETECT.Event.M13289
• InitialAccess/DETECT.Event.M13291
• InitialAccess/DETECT.Event.M13361
• InitialAccess/DETECT.Upload.M13367
• InitialAccess/EDR.Upload.M13395
• InitialAccess/DETECT.Event.M11450