[ctx]ctxseccontext security: attacks on the harness and context layer of AI agents, plus exploited-now news, hunting and playbooks.

← Threat Hunting · markdown

hunt guidance from Amazon Threat Intelligence and Datadog Security Labs (Oct 21)

Hunt: PHP2Shell is exploited in the wild, so look back to Oct 17 for oversized form posts, "Unknown on line 0" memory errors and shells spawned by PHP workers

Amazon saw the first PHP2Shell attempt on Oct 17 from 103.216.220[.]92 (a commercial anonymization network), so the patch date isn't a safe starting point. Datadog's reproduction shows a successful exploit can return HTTP 200 and leave the worker running, so don't wait for crashes.

  1. Requests: application/x-www-form-urlencoded POSTs with a single field name in the megabytes (Datadog's was about 3.5 MB, ending in [x]) and raw null or control bytes in an empty-named field. Check that your WAF or proxy actually inspects bodies that large.
  2. PHP error log: Allowed memory size of ... exhausted ... in Unknown on line 0. "Unknown on line 0" means it failed during request start-up, before any script ran. Correlate with big POSTs.
  3. Apache/FPM logs: bursts of AH00052: child pid ... exit signal Segmentation fault (11), which point to failed address guesses.
  4. Process telemetry: any sh/bash child of apache2, php-fpm, php-cgi, FrankenPHP or LiteSpeed workers, especially with outbound connections. This is the strongest signal.
  5. CVE-2026-109619: review early config warnings, shutdown diagnostics, fatal errors and timeouts on internet-reachable routes.
  6. Network: search edge and WAF logs for 103.216.220[.]92 from Oct 17 onward. One IP from an anonymizer isn't a strong IOC, so treat a hit as a lead.

Sources: AWS Security Blog: PHP2Shell exploitation prior to public disclosure · Datadog Security Labs: PHP2Shell detection, analysis and remediation · AWS Security Blog: AWS WAF mitigations for PHP2Shell