{ "hunt": { "meta": { "tlp": "clear", "hunt": { "handoff": "keep-as-periodic-hunt", "trigger": "intel-report", "methodology": "model-assisted", "applicability": "campaign-specific", "justification": "PHP core RCE flaws represent a massive cross-platform exposure; confirming the absence of the convergent 'web-to-shell' execution pattern across the estate is a high-value negative result for the business." }, "name": "PHP2Shell: Web-to-Shell Staging", "type": "investigation", "labels": [ "hunt", "attack.t1059", "attack.t1190", "attack.t1505.003", "attack.t1087", "attack.t1082", "attack.t1105", "command and control", "credential access", "discovery", "execution", "initial access", "persistence" ], "series": { "slug": "php2shell-assessing-elastic-detection-coverage-relevant-to-cve-2026-109618-and-cve-2026-109619", "index": 1, "title": "php2shell: Assessing Elastic detection coverage relevant to CVE-2026-109618 and CVE-2026-109619", "total": 2 }, "related": [ { "hunt": "php2shell-persistence-and-c2", "reason": "This hunt focuses on the beachhead; a follow-on hunt is required for reverse shells and persistence mechanisms.", "relation": "follows" } ], "targets": { "hunter": { "name": "Hunt agent", "agent": true }, "analyst": { "name": "Tier-2 analyst", "role": "analyst" }, "endpoint": { "name": "Endpoint telemetry (hb_ surfaces)", "category": "endpoint", "telemetry": [ "endpoint" ] } }, "analysis": "While static rules catch common shells, this hunt adds context by stack-counting rare children across the fleet and correlating vulnerability finding data with staging tools, distinguishing true compromises from administrative noise.", "coverage": [ { "stage": "initial-access-php-rce", "steps": [ "vulnerable-php-assets" ], "status": "covered" }, { "stage": "execution-web-worker-shell", "steps": [ "web-worker-shell", "rare-web-children" ], "status": "covered" }, { "stage": "discovery-system-enumeration", "steps": [ "follow-on-staging" ], "status": "covered" }, { "stage": "execution-payload-staging", "steps": [ "follow-on-staging" ], "status": "covered" }, { "stage": "c2-reverse-shell-primitives", "reason": "Belongs to another part of the 'php2shell: Assessing Elastic detection coverage relevant to CVE-2026-109618 and CVE-2026-109619' series.", "status": "out_of_scope" }, { "stage": "credential-access-harvesting", "reason": "Belongs to another part of the 'php2shell: Assessing Elastic detection coverage relevant to CVE-2026-109618 and CVE-2026-109619' series.", "status": "out_of_scope" }, { "stage": "persistence-webshell-and-system", "reason": "Belongs to another part of the 'php2shell: Assessing Elastic detection coverage relevant to CVE-2026-109618 and CVE-2026-109619' series.", "status": "out_of_scope" } ], "scenario": { "stages": [ { "name": "PHP core RCE exploitation", "slug": "initial-access-php-rce", "tactic": "initial-access", "techniques": [ "T1190" ], "observables": [ "CVE-2026-109618", "CVE-2026-109619", "unauthenticated HTTP request targeting PHP worker (php-fpm, mod_php, php-cgi)" ] }, { "name": "Web worker spawning shell", "slug": "execution-web-worker-shell", "tactic": "execution", "techniques": [ "T1059" ], "observables": [ "parent_process_name in ('apache2', 'httpd', 'nginx', 'php-cgi', 'php-fpm', 'lsphp')", "process_name in ('bash', 'dash', 'sh', 'zsh', 'ksh')", "process_args in ('-c', '-cl', '-lc')" ] }, { "name": "System and identity enumeration", "slug": "discovery-system-enumeration", "tactic": "discovery", "techniques": [ "T1087", "T1082" ], "observables": [ "id", "whoami", "uname -a", "hostname", "cat /etc/os-release", "sudo -l", "find / -perm -u=s -type f", "getcap -r /", "reading /etc/passwd", "reading /etc/shadow" ] }, { "name": "Payload staging and interpreter pivot", "slug": "execution-payload-staging", "tactic": "execution", "techniques": [ "T1059", "T1105" ], "observables": [ "python3 -c", "perl -e", "ruby -e", "node -e", "php -r", "curl -O", "wget -O", "echo | base64 -d | sh", "openssl enc -d", "xxd -r" ] }, { "name": "Reverse shell communication", "slug": "c2-reverse-shell-primitives", "tactic": "command-and-control", "techniques": [ "T1071.001" ], "observables": [ "/dev/tcp/", "mkfifo", "nc", "socat", "pty.spawn", "fsockopen" ] }, { "name": "Credential and identity harvesting", "slug": "credential-access-harvesting", "tactic": "credential-access", "techniques": [ "T1552.001", "T1552.005" ], "observables": [ "reading .env files", "reading ~/.aws/credentials", "accessing /var/run/secrets/kubernetes.io/", "HTTP request to 169.254.169.254 (IMDS)" ] }, { "name": "Webshell and system persistence", "slug": "persistence-webshell-and-system", "tactic": "persistence", "techniques": [ "T1505.003", "T1133", "T1053.003" ], "observables": [ "writing .php or .phtml to web root", "avatar.php.jpg (polyglot/double extension)", "adding cron entries", "creating systemd units", "modifying ~/.ssh/authorized_keys" ] } ], "summary": "Unauthenticated remote code execution vulnerabilities in PHP core (CVE-2026-109618 and CVE-2026-109619) allow attackers to gain code execution in the context of web worker processes. Post-exploitation involves web servers spawning shells for system discovery, staging second-stage payloads via interpreters, and establishing persistence through webshells or system configuration." }, "severity": "high", "rationale": "Focus on internet-facing assets running common PHP platforms like WordPress, Magento, or custom web applications. Priority should be given to servers running mod_php or PHP-FPM without container isolation.", "guardrails": { "claims": "no_unsupported", "evidence": "citation_required", "telemetry": "untrusted", "missing_data": "not_benign" }, "hypothesis": "An attacker is exploiting PHP core RCE vulnerabilities (CVE-2026-109618/19) to force web server processes to spawn shells or interpreters, which then perform system discovery and payload staging.", "parameters": { "cve_ids": { "from": { "ref": "https://www.elastic.co/security-labs/threat-command/php2shell-php-rce-detection", "kind": "article", "observed": "2026-10-21" }, "type": "list[string]", "default": [ "CVE-2026-109618", "CVE-2026-109619" ], "description": "The PHP core RCE identifiers." }, "scope_hosts": { "type": "list[host]", "default": [], "description": "Optional list of hostnames to narrow the search; leave empty to hunt across the entire estate." }, "shell_names": { "type": "list[string]", "default": [ "bash", "dash", "sh", "zsh", "ksh" ], "description": "Standard Unix shells used for post-exploitation." }, "lookback_days": { "type": "number", "default": "14", "description": "Days of history to examine." }, "staging_tools": { "type": "list[string]", "default": [ "curl", "wget", "python", "python3", "perl", "ruby", "node", "php", "id", "whoami", "uname", "hostname" ], "description": "Interpreters, downloaders, and discovery tools used for staging." }, "web_server_parents": { "type": "list[string]", "default": [ "apache2", "httpd", "nginx", "php-cgi" ], "description": "Common PHP-driving web server process names." } }, "provenance": { "authors": [ { "org": "huntbase.io", "name": "Huntbase hunt generation" } ], "generated": { "by": "huntbase-hunt-generation", "from": "https://www.elastic.co/security-labs/threat-command/php2shell-php-rce-detection", "gates": [ "dry-run", "lint" ], "model": "hb_google/gemini-3-flash-preview" } }, "references": [ { "url": "https://www.elastic.co/security-labs/threat-command/php2shell-php-rce-detection", "name": "Elastic Security Labs \u2014 php2shell: Assessing Elastic detection coverage relevant to CVE-2026-109618 and CVE-2026-109619" } ], "blind_spots": [ { "id": "no-agent-coverage", "risk": "A host without an agent provides no process telemetry, making it a complete blind spot for behavioral execution hunting.", "stage": "execution-web-worker-shell", "question": "Are there web servers in the estate that are not enrolled in endpoint monitoring?", "requires": "Complete endpoint agent coverage on all web-facing assets." }, { "id": "memory-only-exploitation", "risk": "Sophisticated exploits staying within the process address space are invisible to process-launch telemetry.", "stage": "initial-access-php-rce", "question": "Did the attacker execute malicious code entirely within the PHP worker process memory without spawning a child?", "requires": "PHP engine-level tracing or APM instrumentation." } ] }, "name": "PHP2Shell: Web-to-Shell Staging", "description": "This hunt targets the convergent post-exploitation footprint of PHP core vulnerabilities, where unauthenticated requests trigger a PHP worker to execute arbitrary code. The hunt begins by identifying vulnerable assets and then uses a phased approach to detect the transition from web server processes (like php-fpm or nginx) to shells and language interpreters. By stack-counting unusual parent-child relationships and corroborating them with discovery commands and staging tools, the hunt identifies active compromises where traditional static rules might be bypassed." }, "nodes": [ { "id": "hypothesis", "type": "hypothesis", "label": "Hypothesis", "config": { "tags": [], "series": { "slug": "php2shell-assessing-elastic-detection-coverage-relevant-to-cve-2026-109618-and-cve-2026-109619", "index": 1, "title": "php2shell: Assessing Elastic detection coverage relevant to CVE-2026-109618 and CVE-2026-109619", "total": 2 }, "coverage": [ { "stage": "initial-access-php-rce", "steps": [ "vulnerable-php-assets" ], "status": "covered" }, { "stage": "execution-web-worker-shell", "steps": [ "web-worker-shell", "rare-web-children" ], "status": "covered" }, { "stage": "discovery-system-enumeration", "steps": [ "follow-on-staging" ], "status": "covered" }, { "stage": "execution-payload-staging", "steps": [ "follow-on-staging" ], "status": "covered" }, { "stage": "c2-reverse-shell-primitives", "reason": "Belongs to another part of the 'php2shell: Assessing Elastic detection coverage relevant to CVE-2026-109618 and CVE-2026-109619' series.", "status": "out_of_scope" }, { "stage": "credential-access-harvesting", "reason": "Belongs to another part of the 'php2shell: Assessing Elastic detection coverage relevant to CVE-2026-109618 and CVE-2026-109619' series.", "status": "out_of_scope" }, { "stage": "persistence-webshell-and-system", "reason": "Belongs to another part of the 'php2shell: Assessing Elastic detection coverage relevant to CVE-2026-109618 and CVE-2026-109619' series.", "status": "out_of_scope" } ], "rationale": "An attacker is exploiting PHP core RCE vulnerabilities (CVE-2026-109618/19) to force web server processes to spawn shells or interpreters, which then perform system discovery and payload staging.", "blind_spots": [ { "id": "no-agent-coverage", "risk": "A host without an agent provides no process telemetry, making it a complete blind spot for behavioral execution hunting.", "stage": "execution-web-worker-shell", "question": "Are there web servers in the estate that are not enrolled in endpoint monitoring?", "requires": "Complete endpoint agent coverage on all web-facing assets." }, { "id": "memory-only-exploitation", "risk": "Sophisticated exploits staying within the process address space are invisible to process-launch telemetry.", "stage": "initial-access-php-rce", "question": "Did the attacker execute malicious code entirely within the PHP worker process memory without spawning a child?", "requires": "PHP engine-level tracing or APM instrumentation." } ], "scoping_notes": "Focus on internet-facing assets running common PHP platforms like WordPress, Magento, or custom web applications. Priority should be given to servers running mod_php or PHP-FPM without container isolation.", "beyond_detection": "While static rules catch common shells, this hunt adds context by stack-counting rare children across the fleet and correlating vulnerability finding data with staging tools, distinguishing true compromises from administrative noise." } }, { "id": "vulnerable-php-assets", "type": "query", "label": "Identify vulnerable PHP assets", "config": { "dsl": "sqlite", "role": "scoping", "source": "endpoint", "content": "SELECT resource_uid, device_uid, cve_uid, severity, status FROM hb_vulnerability_finding WHERE instr(',' || '{{cve_ids}}' || ',', ',' || cve_uid || ',') > 0 AND status != 'suppressed'", "surface": "hb_vulnerability_finding", "description": "Locate hosts with active vulnerability findings for the PHP2Shell CVEs to focus the hunt.", "expected_signal": "Rows identify specific device UIDs and resources that are unpatched for the target CVEs. Silence suggests a lower exposure, but is not evidence of absence if scans are not current." }, "parents": [ { "id": "hypothesis" } ], "primitive_config": { "dsl": "sqlite", "role": "scoping", "label": "Identify vulnerable PHP assets", "reads": [ "resource_uid", "device_uid", "cve_uid", "severity", "status" ], "source": "hb_vulnerability_finding", "target": "endpoint", "content": "SELECT resource_uid, device_uid, cve_uid, severity, status FROM hb_vulnerability_finding WHERE instr(',' || '{{cve_ids}}' || ',', ',' || cve_uid || ',') > 0 AND status != 'suppressed'", "silence": "not_evidence_of_absence", "expected": "Rows identify specific device UIDs and resources that are unpatched for the target CVEs. Silence suggests a lower exposure, but is not evidence of absence if scans are not current.", "verified": "dry-run", "verified_at": "2026-10-22" } }, { "id": "web-worker-shell", "type": "query", "label": "Web workers spawning shells", "config": { "dsl": "sqlite", "role": "detection-candidate", "source": "endpoint", "content": "SELECT device_hostname, parent_process_name, process_name, process_cmd_line, time FROM hb_process_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND (instr(',' || '{{web_server_parents}}' || ',', ',' || LOWER(parent_process_name) || ',') > 0 OR LOWER(parent_process_name) LIKE 'php-fpm%' OR LOWER(parent_process_name) LIKE 'lsphp%') AND instr(',' || '{{shell_names}}' || ',', ',' || LOWER(process_name) || ',') > 0 AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_process_activity", "description": "Detect the most direct indicator of RCE: a web worker process spawning a shell.", "expected_signal": "A shell running as a child of a web server. Benign hits include maintenance scripts or scheduled backups." }, "parents": [ { "id": "vulnerable-php-assets" } ], "primitive_config": { "dsl": "sqlite", "role": "detection-candidate", "label": "Web workers spawning shells", "reads": [ "device_hostname", "parent_process_name", "process_name", "process_cmd_line", "time" ], "source": "hb_process_activity", "target": "endpoint", "content": "SELECT device_hostname, parent_process_name, process_name, process_cmd_line, time FROM hb_process_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND (instr(',' || '{{web_server_parents}}' || ',', ',' || LOWER(parent_process_name) || ',') > 0 OR LOWER(parent_process_name) LIKE 'php-fpm%' OR LOWER(parent_process_name) LIKE 'lsphp%') AND instr(',' || '{{shell_names}}' || ',', ',' || LOWER(process_name) || ',') > 0 AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "A shell running as a child of a web server. Benign hits include maintenance scripts or scheduled backups.", "verified": "dry-run", "verified_at": "2026-10-22" } }, { "id": "rare-web-children", "type": "query", "label": "Rare web server children", "config": { "dsl": "sqlite", "role": "baseline", "source": "endpoint", "content": "SELECT LOWER(parent_process_name) AS parent, LOWER(process_name) AS child, COUNT(DISTINCT device_hostname) AS hosts, MIN(time) AS first_seen FROM hb_process_activity WHERE (instr(',' || '{{web_server_parents}}' || ',', ',' || LOWER(parent_process_name) || ',') > 0 OR LOWER(parent_process_name) LIKE 'php-fpm%' OR LOWER(parent_process_name) LIKE 'lsphp%') AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY 1, 2 HAVING hosts <= 2", "surface": "hb_process_activity", "description": "Stack-count children of web processes to identify rare pivots across the fleet that behavior rules might miss.", "expected_signal": "One or two hosts where a web process spawns an unusual child. Silence means the web tier behaves uniformly across the fleet." }, "parents": [ { "id": "vulnerable-php-assets" } ], "primitive_config": { "dsl": "sqlite", "role": "baseline", "label": "Rare web server children", "reads": [ "device_hostname", "parent_process_name", "process_name", "time" ], "source": "hb_process_activity", "target": "endpoint", "content": "SELECT LOWER(parent_process_name) AS parent, LOWER(process_name) AS child, COUNT(DISTINCT device_hostname) AS hosts, MIN(time) AS first_seen FROM hb_process_activity WHERE (instr(',' || '{{web_server_parents}}' || ',', ',' || LOWER(parent_process_name) || ',') > 0 OR LOWER(parent_process_name) LIKE 'php-fpm%' OR LOWER(parent_process_name) LIKE 'lsphp%') AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY 1, 2 HAVING hosts <= 2", "silence": "not_evidence_of_absence", "baseline": { "window": "{{lookback_days}}d", "compare": "first_seen" }, "expected": "One or two hosts where a web process spawns an unusual child. Silence means the web tier behaves uniformly across the fleet.", "verified": "dry-run", "prevalence": { "by": "device_hostname", "key": [ "parent_process_name", "process_name" ], "rare_below": 3 }, "verified_at": "2026-10-22" } }, { "id": "agent-triage-early", "type": "analytic", "label": "Triage early execution", "config": { "cite": "required", "tools": [ "endpoint" ], "context": [ "vulnerable-php-assets", "web-worker-shell", "rare-web-children" ], "objective": "Identify hosts where the transition from a web process to a child (shell or rare binary) is suspicious, citing specific rows and process command lines.", "description": "Evaluate whether the shells or rare children found represent legitimate administrative tasks or high-risk post-exploitation.", "max_iterations": 4, "expected_signal": "A per-host judgment of initial execution risk.", "success_criteria": "A list of hosts and processes that warrant follow-on hunting for staging behavior." }, "parents": [ { "id": "web-worker-shell", "kind": "merge" }, { "id": "rare-web-children", "kind": "merge" } ] }, { "id": "follow-on-staging", "type": "query", "label": "Follow-on discovery and staging", "config": { "dsl": "sqlite", "role": "triage", "source": "endpoint", "content": "SELECT device_hostname, parent_process_name, process_name, process_cmd_line, time FROM hb_process_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND (instr(',' || '{{staging_tools}}' || ',', ',' || LOWER(process_name) || ',') > 0 OR LOWER(process_cmd_line) LIKE '%/etc/os-release%' OR LOWER(process_cmd_line) LIKE '%/etc/shadow%') AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_process_activity", "description": "Search for follow-on actions (enumeration and downloading) on the hosts identified in the early triage.", "expected_signal": "Discovery commands like whoami or downloaders like curl running on the same hosts that showed suspicious early execution." }, "parents": [ { "id": "agent-triage-early" } ], "primitive_config": { "dsl": "sqlite", "role": "triage", "label": "Follow-on discovery and staging", "reads": [ "device_hostname", "parent_process_name", "process_name", "process_cmd_line", "time" ], "source": "hb_process_activity", "target": "endpoint", "content": "SELECT device_hostname, parent_process_name, process_name, process_cmd_line, time FROM hb_process_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND (instr(',' || '{{staging_tools}}' || ',', ',' || LOWER(process_name) || ',') > 0 OR LOWER(process_cmd_line) LIKE '%/etc/os-release%' OR LOWER(process_cmd_line) LIKE '%/etc/shadow%') AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "Discovery commands like whoami or downloaders like curl running on the same hosts that showed suspicious early execution.", "verified": "dry-run", "verified_at": "2026-10-22" } }, { "id": "agent-final-verdict", "type": "analytic", "label": "Correlate end-to-end execution", "config": { "cite": "required", "tools": [ "endpoint" ], "context": [ "agent-triage-early", "follow-on-staging" ], "objective": "Determine if the suspicious initial execution and subsequent staging activity on a host indicate a successful PHP RCE compromise. Prioritize hosts where both stages are present.", "description": "Combine the early execution patterns with follow-on staging evidence to reach a final verdict.", "max_iterations": 4, "expected_signal": "Validated compromise chains from RCE to staging.", "success_criteria": "A final verdict of malicious | suspicious | benign for each examined host, citing the complete process chain." }, "parents": [ { "id": "follow-on-staging" } ] }, { "id": "decision-route", "type": "checkpoint", "label": "Route on final verdict", "config": { "fuzzy": true, "judge": "hunter", "question": "the verdict of agent-final-verdict is malicious for at least one host", "condition": "the verdict of agent-final-verdict is malicious for at least one host", "blind_spot": "no-agent-coverage", "confidence": "high", "description": "Direct confirmed compromises to immediate containment.", "checkpoint_type": "mandatory" }, "parents": [ { "id": "agent-final-verdict" } ] }, { "id": "action-isolate", "type": "action", "label": "Isolate compromised host", "config": { "target": "endpoint", "description": "Sever the attacker's staging path by isolating the host.", "instructions": "Isolate the host and preserve memory for forensic analysis to identify the specific PHP script that was targeted.", "action_approval": "required" }, "parents": [ { "id": "decision-route", "branch": "on_supports" } ] }, { "id": "task-manual-review", "type": "task", "label": "Manual forensic review", "config": { "assignee": "analyst", "description": "Verify the entry point and assess the extent of the staging.", "instructions": "Review the hb_process_activity and hb_linux_audit logs for the isolated host. Cross-reference the shell launch time with hb_http_activity to find the unauthenticated request that triggered the RCE." }, "parents": [ { "id": "decision-route", "branch": "default" }, { "id": "decision-route", "branch": "on_unavailable" }, { "id": "decision-route", "branch": "on_refutes" }, { "id": "action-isolate" } ] }, { "id": "task-remediation", "type": "task", "label": "Patch and remediate", "config": { "assignee": "analyst", "description": "Apply long-term fixes to prevent re-exploitation.", "instructions": "Update PHP to versions 8.5.12, 8.4.27, 8.3.36, or 8.2.35 across all identified assets." }, "parents": [ { "id": "task-manual-review" } ] } ] }