The PHP2Shell Playbook: Detecting and Defeating PHP RCE

The PHP2Shell Playbook: Defending Against PHP RCE Exploitation

Immediate Remediation Directives

Your incident response and IT teams should prioritize the following actions immediately:

• Audit Your Attack Surface: Catalog every server and third-party appliance in your environment that bundles PHP. Prioritize infrastructure that is directly exposed to the public internet.
• Apply Emergency Patches: Upgrade to the secured PHP releases: 8.5.12, 8.4.27, 8.3.36, and 8.2.35 (or deploy the equivalent patched packages from your specific vendor). Note: PHP 8.1 and legacy versions will not receive official upstream releases; you must consult your OS distribution or Long-Term Support (LTS) vendor for security backports.

Behavioral Threat Hunting (Without Mendel)

Static IOCs and network signatures degrade in reliability almost immediately. If you are not utilizing the Mendel platform for advanced detection, your security operations center (SOC) must pivot to behavioral hunting. Look for the following anomalies:

• Suspicious Payloads: Monitor for Multipart POST requests that artificially inject the PHP_SESSION_UPLOAD_PROGRESS variable.
• Error Bursts: Watch for sudden clusters of 5xx HTTP errors (specifically 502 Bad Gateway or 503 Service Unavailable) immediately following multipart POST requests originating from a single client IP. Cross-reference this with Allowed memory size ... exhausted fatal errors in your backend PHP logs.
• Memory Leakage Indicators: Scrutinize HTTP responses for oversized or structurally malformed PHPSESSID strings within Set-Cookie headers, which strongly suggest memory is being successfully leaked.
• Post-Exploitation Spawning: Look for web server child processes illegitimately spawning shells (sh, bash) or command-line web clients (curl, wget). Furthermore, monitor the web server for novel outbound connections or internal network reconnaissance probes.

Incident Response Protocol for Compromised Hosts

If your behavioral hunt confirms a compromise, you must act decisively. Isolate the affected server from the network immediately, preserve all packet captures and system logs for forensics, and apply the patch. Crucially, because a memory leak exploit leaves no forensic footprint of what was stolen, you must assume total credential compromise. You are required to rotate every single secret that the PHP workers might have held in memory at the time of the attack. This includes database passwords, API keys, session secrets, and TLS private keys. Rotation is the only mathematically safe response to memory exposure. A final note on visibility: TLS encryption inherently blinds network intrusion sensors to the contents of web requests. If your architecture prevents you from decrypting traffic at the edge for inspection, you must rely entirely on the backend behavioral indicators and log anomalies detailed above.