We think the rarity of successful attacks exploiting the PHP2Shell vulnerability can be attributed to the following three hurdles: 1. It is difficult to determine the version of the target PHP for various reasons. 2. Consequently, it is impossible to identify the necessary offsets for that specific PHP version. 3. As a result, bypassing ASLR and triggering a memory leak becomes difficult. Therefore, we anticipate that if the first hurdle is overcome, we could see large-scale attacks. #PHP2Shell, #CVE_2026_109618, #CVE_2026_109619

These are Snort and Suricata detection rules for the PHP2Shell (CVE-2026-109618/109619) attack. Although they were developed on short notice, @78_lab internal testing confirms that they are effective at detecting the threat. We hope these prove useful in your response to such attacks. (Detection rates may vary depending on certain host settings.) 1. Snort alert tcp any any -> any $HTTP_PORTS ( \ msg:"purplehound: PHP session upload progress field in multipart POST (CVE-2026-109618, CVE-2026-109619)"; \ flow:established,to_server; \ content:"POST"; http_method; \ content:"multipart/form-data"; http_header; nocase; \ content:"PHP_SESSION_UPLOAD_PROGRESS"; http_client_body; fast_pattern; \ pcre:"/(?i:content-disposition)[ \t]*:(?:[^\r\n]|\r?\n[ \t])*?\;\s*(?i:name)\s*=\s*(?:\x22PHP_SESSION_UPLOAD_PROGRESS\x22|PHP_SESSION_UPLOAD_PROGRESS(?=[\;\s]))/P"; \ reference:cve,2026-109618; \ reference:cve,2026-109619; \ classtype:web-application-attack; \ sid:1499040051; rev:1; \ ) 2. Suricata alert http any any -> any any ( \ msg:"purplehound: PHP session upload progress field in multipart POST (CVE-2026-109618, CVE-2026-109619)"; \ flow:established,to_server; \ http.method; content:"POST"; \ http.content_type; content:"multipart/form-data"; nocase; \ http.request_body; content:"PHP_SESSION_UPLOAD_PROGRESS"; fast_pattern; \ pcre:"/(?i:content-disposition)[ \t]*:(?:[^\r\n]|\r?\n[ \t])*?\;\s*(?i:name)\s*=\s*(?:\x22PHP_SESSION_UPLOAD_PROGRESS\x22|PHP_SESSION_UPLOAD_PROGRESS(?=[\;\s]))/"; \ reference:cve,2026-109618; \ reference:cve,2026-109619; \ classtype:web-application-attack; \ sid:1499040052; rev:1; \ ) #PHP2Shell, #CVE_2026_109618, #CVE_2026_109619, #Snort, #Suricata

PHPコアにおけるリモートコード実行の脆弱性 PHP2Shell（CVE-2026-109618/109619）に関する技術分析レポートを公開します。 - 脆弱性発生の詳細な原​​因 - Full-Chain Exploit - 検知ルールおよびIoC情報 blog.78researchlab.com/401db… #Exploit #PHP2Shell, #CVE_2026_109618, #CVE_2026_109619

Technical analysis report on the PHP core remote code execution vulnerability, PHP2Shell(CVE-2026-109618/109619). - Detailed root cause of the vulnerability - Full-chain exploit - Detection rules and IoC blog.78researchlab.com/401db… #Exploit #PHP2Shell, #CVE_2026_109618, #CVE_2026_109619

PHP2Shell(CVE-2026-109618/109619) Full-Chain RCE Exploit by @78_lab github.com/78ResearchLab/PHP… #Exploit #PHP2Shell, #CVE_2026_109618, #CVE_2026_109619