---
title: Hunt: get ready for php2shell (CVE-2026-109618/109619) by baselining what PHP workers spawn before Wednesday's fix | ctxsec
url: https://ctxsec.com/items/hunt-php2shell-pre-patch-child-processes
description: "No root cause is public yet, so the best pre-patch hunt is behavioural: alert on php-fpm, php-cgi, httpd or apache2 spawning shells, interpreters or download tools, and baseline normal PHP child processes now. CERT-EU advises isolating internet-facing PHP if you can't patch right away."
status: "hunt idea (Huntress, CERT-EU); root cause unpublished"
published: 2026-10-20
---

> No root cause is public yet, so the best pre-patch hunt is behavioural: alert on php-fpm, php-cgi, httpd or apache2 spawning shells, interpreters or download tools, and baseline normal PHP child processes now. CERT-EU advises isolating internet-facing PHP if you can't patch right away.

[← Threat Hunting](/hunting) · [markdown](/items/hunt-php2shell-pre-patch-child-processes.md)

hunt idea (Huntress, CERT-EU); root cause unpublished

2026-10-20

### Hunt: get ready for php2shell (CVE-2026-109618/109619) by baselining what PHP workers spawn before Wednesday's fix

Context: [PHP's emergency release](/news#php-critical-security-release-oct-21-leaked-rce) lands Oct 21 at 14:00 UTC. [CERT-EU advisory 2026-018](https://cert.europa.eu/publications/security-advisories/2026-018) says no technical details are public and recommends identifying PHP apps, patching as soon as fixes ship, and isolating internet-facing apps where you can't. [Huntress](https://www.huntress.com/blog/php2shell-leaked-critical-php-vulnerabilities) says it has seen no in-the-wild exploitation and is not aware of public exploit code as of its post.

**Hunt ideas (from Huntress):**

- Parent process `php-fpm`, `php-cgi`, `php-cgi.exe`, `httpd` or `apache2` spawning `sh`, `bash`, `cmd.exe`, `powershell.exe`, `python`, `perl`, `curl`, `wget`, `nc` or `certutil.exe`.
- Command lines from the web server containing `/dev/tcp/`, `fsockopen` or `mkfifo`, and quick recon like `whoami`, `id`, `uname -a`, `ipconfig`.
- New PHP files in web roots or temp dirs, new cron jobs, scheduled tasks or accounts on PHP hosts.
- On Linux web servers with no EDR, Huntress suggests Florian Roth's free process-watcher in observe mode to get this visibility before the patch.

**Capture a baseline tonight** of normal PHP child processes so post-release exploitation stands out.

**Unconfirmed workaround (community, not PHP):** some researchers on X suggest setting `session.upload_progress.enabled = Off` as a pre-patch mitigation. PHP, CERT-EU and Huntress have not confirmed the affected component, so treat this as a low-risk hardening guess, not a fix, and still patch.

Sources: [Huntress: php2shell rapid response](https://www.huntress.com/blog/php2shell-leaked-critical-php-vulnerabilities) · [CERT-EU Security Advisory 2026-018](https://cert.europa.eu/publications/security-advisories/2026-018) · [php.net advance notice](https://www.php.net/archive/2026.php#2026-10-20-1)