Critical "PHP2Shell" Core RCE Vulnerabilities (CVE-2026-109618 & CVE-2026-109619)

Date: 10/23/2026

Severity: Critical

Summary

On October 21, 2026, the PHP Group disclosed and patched two critical unauthenticated remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively tracked as PHP2Shell, affecting PHP deployments since version 5.4. The flaws allow attackers to execute arbitrary code through crafted HTTP requests before application-level code or authentication checks run, potentially exposing platforms such as WordPress, Drupal, Magento, and Laravel. Exploitation attempts were observed before public disclosure, followed by widespread scanning, so organizations should promptly apply the relevant PHP patches and monitor for suspicious requests, PHP worker crashes, memory-leak indicators, and unexpected shell or network utility execution.

Indicators of Compromise (IOC) List

Domains/URLs

z-cg.com

godofthunder.st

thunder.godofthunder.st

rootkit.net.cn

hik.gettingheadfromduckysmom.st

hackattackkaboom.botlesscucks.st

IP Address

185.5.70.233

92.118.112.100

64.199.134.154

150.251.112.208

134.154.64.199

117.55.202.115

103.216.220.92

31.223.184.166

37.19.200.5

134.209.159.64

103.114.163.188

95.217.98.37

5.191.140.240

158.69.113.75

94.154.43.149

143.246.223.124

45.198.224.169

85.11.167.243

Hash

dd98bf48899aa385035352688357742c73ddc5e47ec4ecc7d7b74c53c2e3ca3d

7133612558a5d0f257ca6bdb4f765453af9465bc5298acdcf33b5761b8c59aac

43898a0a53bbd25d31ad9f5018ed3182be98a66109b22c9cab545a9fc447992a

17758cf05e3376f8448dff926564e038b763b4a46668455e2ccb5ac0839e629c

0c5486f06620e26e316f4b33f318b0d646d5e1133789331aa2fed012360d1486

b61a098fc62a2c2696e196dca78da71a

Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection

Detection Query 1 :	domainname like "godofthunder.st" or url like "godofthunder.st" or siteurl like "godofthunder.st" or domainname like "hik.gettingheadfromduckysmom.st" or url like "hik.gettingheadfromduckysmom.st" or siteurl like "hik.gettingheadfromduckysmom.st" or domainname like "hackattackkaboom.botlesscucks.st" or url like "hackattackkaboom.botlesscucks.st" or siteurl like "hackattackkaboom.botlesscucks.st" or domainname like "thunder.godofthunder.st" or url like "thunder.godofthunder.st" or siteurl like "thunder.godofthunder.st" or domainname like "rootkit.net.cn" or url like "rootkit.net.cn" or siteurl like "rootkit.net.cn" or domainname like "z-cg.com" or url like "z-cg.com" or siteurl like "z-cg.com"
Detection Query 2 :	dstipaddress IN ("5.191.140.240","185.5.70.233","134.209.159.64","95.217.98.37","37.19.200.5","117.55.202.115","45.198.224.169","64.199.134.154","94.154.43.149","31.223.184.166","143.246.223.124","134.154.64.199","85.11.167.243","103.114.163.188","103.216.220.92","92.118.112.100","158.69.113.75","150.251.112.208") or srcipaddress IN ("5.191.140.240","185.5.70.233","134.209.159.64","95.217.98.37","37.19.200.5","117.55.202.115","45.198.224.169","64.199.134.154","94.154.43.149","31.223.184.166","143.246.223.124","134.154.64.199","85.11.167.243","103.114.163.188","103.216.220.92","92.118.112.100","158.69.113.75","150.251.112.208")
Detection Query 3 :	`md5hash IN ("b61a098fc62a2c2696e196dca78da71a")`
Detection Query 4 :	`sha256hash IN ("0c5486f06620e26e316f4b33f318b0d646d5e1133789331aa2fed012360d1486","dd98bf48899aa385035352688357742c73ddc5e47ec4ecc7d7b74c53c2e3ca3d","7133612558a5d0f257ca6bdb4f765453af9465bc5298acdcf33b5761b8c59aac","43898a0a53bbd25d31ad9f5018ed3182be98a66109b22c9cab545a9fc447992a","17758cf05e3376f8448dff926564e038b763b4a46668455e2ccb5ac0839e629c")`
Detection Query 5 :	datasourcename = "Windows Security" and eventtype = "4688" and ((parentprocessname like "php-fpm" or parentprocessname like "php-fpm8.2" or parentprocessname like "php-fpm8.3" or parentprocessname like "php-fpm8.4" or parentprocessname like "php-fpm8.5" or parentprocessname like "php-cgi" or parentprocessname like "apache" or parentprocessname like "apache2" or parentprocessname like "httpd" or parentprocessname like "nginx" or parentprocessname like "lsphp") AND (processname like "cmd.exe" or processname like "powershell.exe" or processname like "sh" or processname like "bash" or processname like "dash" or processname like "python" or processname like "python3" or processname like "perl" or processname like "wget" or processname like "curl" or processname like "nc" or processname like "/ncat" or processname like "/netcat" or processname like "/socat"))
Detection Query 6 :	technologygroup like "EDR" and ((parentprocessname like "php-fpm" or parentprocessname like "php-fpm8.2" or parentprocessname like "php-fpm8.3" or parentprocessname like "php-fpm8.4" or parentprocessname like "php-fpm8.5" or parentprocessname like "php-cgi" or parentprocessname like "apache" or parentprocessname like "apache2" or parentprocessname like "httpd" or parentprocessname like "nginx" or parentprocessname like "lsphp") AND (processname like "cmd.exe" or processname like "powershell.exe" or processname like "sh" or processname like "bash" or processname like "dash" or processname like "python" or processname like "python3" or processname like "perl" or processname like "wget" or processname like "curl" or processname like "nc" or processname like "/ncat" or processname like "/netcat" or processname like "/socat"))
Detection Query 7 :	datasourcename = "Linux" AND (processname like "/sh" or processname like "/bash" or processname like "/dash" or processname like "/python" or processname like "/python3" or processname like "/perl" or processname like "/curl" or processname like "/wget" or processname like "/nc" or processname like "/ncat" or processname like "/netcat" or processname like "/socat")
Detection Query 8 :	datasourcename = "IIS Web Server" and ((requestmethod = "POST" or requestmethod = "PUT" or requestmethod = "PATCH" or requestmethod = "DELETE") AND (contenttype like "multipart/form-data") AND (statuscode = "500"))
Detection Query 9 :	datasourcename = "Web Server" and ((requestmethod = "POST" or requestmethod = "PUT" or requestmethod = "PATCH" or requestmethod = "DELETE") AND (contenttype like "multipart/form-data") AND (url like "/api" or url like "/admin" or url like "/login" or url like "/auth"))
Detection Query 10 :	datasourcename = "Cloudflare" and ((requestmethod = "POST" or requestmethod = "PUT" or requestmethod = "PATCH" or requestmethod = "DELETE") AND (contenttype like "multipart/form-data") AND (url like "/api" or url like "/admin" or url like "/login" or url like "/auth"))
Detection Query 11 :	datasourcename = "Windows Security" and eventtype = "4688" and ((parentprocessname like "php-fpm" or parentprocessname like "php-cgi" or parentprocessname like "apache" or parentprocessname like "httpd" or parentprocessname like "nginx" or parentprocessname like "lsphp") AND (processname like "whoami" or processname like "systeminfo" or processname like "ipconfig" or processname like "uname" or processname like "id" or processname like "ifconfig" or processname like "phpinfo")) AND (commandline like "wp-config.php" or commandline like ".env" or commandline like "config/database.php")
Detection Query 12 :	datasourcename = "Windows Security" and eventtype = "4663" and ((processname like "php-fpm" or processname like "php-cgi" or processname like "apache" or processname like "httpd" or processname like "nginx" or processname like "lsphp") AND (objectname like "/var/www/html" or objectname like "wwwroot" or objectname like ".php" or processname like "xmrig"))