php2shell: Zeek and Suricata Detections for PHP RCE | Corelight

We recently collaborated with OpenAI, PHP, and a number of other organizations to respond to a pair of serious remote code execution vulnerabilities in PHP that are likely to impact the majority of the world's public web servers. PHP underpins a large part of the web, powering content management systems, online stores, and business applications. Its security matters to vital services that millions of people and organizations rely on daily.

Our contribution to this broad effort was developing network detections for Zeek® and Suricata®. Today, in the spirit of equipping as many defensive teams as possible with these detections, we are releasing them as open source repositories alongside the coordinated disclosure. You can find our work here: https://github.com/corelight/php2shell-detect.

The new vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both exploit memory-handling issues in PHP that can lead to remote code execution, under two different attack strategies. The advisory offers much more detail and assigns both vulnerabilities a CVSS 4.0 score of 9.2.

In designing our detection strategy, we wanted to give analysts two useful starting points: suspicious HTTP activity to investigate, and advertised PHP versions to prioritize for patch review. To that end, we used each open source platform (Zeek and Suricata) in slightly different ways.

Zeek detections package

Zeek’s ability to access, parse, and maintain cross-connection state gives remarkable insight into what is occurring on a network. This underlying power enabled us to create a package with a high degree of notice granularity. Our Zeek detections are based on behavioral analysis, not pattern matching. We hope that these correlated behavioral insights lead to faster and more accurate analysis in the SOC.

To further assist incident response teams, we included a sample of the network event triggering each detection in the sub field of our notices. This is a subtle but powerful evidentiary anchor for incident teams who need more than an opaque and unverifiable "Possibly Vulnerable system detection” notice.

Our Zeek detections package currently encompasses nine distinct notice types. Each describes a high-fidelity observation that an analyst can investigate:

Version inventory

Creating a real-time inventory of software versions within a given environment is particularly important in responding to a vulnerability such as ‘php2shell’. A PHP server can advertise its version through Server or X-Powered-By HTTP response headers, giving defenders a way to find systems that warrant patch review even when no suspicious request has been observed.

Version inventories are particularly useful when created by parsing live network traffic, a technique that will catch unmanaged and potentially unknown hosts running vulnerable software. Given how widely-deployed PHP is across IT environments, it’s critical to obtain visibility about all hosts, not just known hosts. Accurate inventories can help incident response teams quickly answer the first questions they will inevitably be asked after a significant vulnerability disclosure:

• “Where are we running vulnerable software versions that should be patched?”
• “How do we prioritize our patching efforts so that we can defend high-risk systems first?”
• “How do we empirically measure and report progress of our patching efforts?”

Suricata rules and detections

Our Suricata content provides three simple and complementary rules in two classes:

• First, we identify a unique and rare marker seen in HTTP POST bodies. Our observations so far have indicated this string is rarely seen in benign traffic, and so while it is a broader detection than our behavioral Zeek notices, any appearance of this string is well worth escalation for further investigation.
• Second, we identify PHP versions by examining PHP banners in response headers, and also in the normal HTML page content produced by phpinfo(). Each version rule limits alerts to one per server IP per hour.

Both Zeek and Suricata detections described above require HTTP visibility, which may be provided in architectures that decrypt traffic for inspection, or when attackers themselves use HTTP. It should be noted that attackers, scanners and bots frequently do use HTTP, rather than HTTPS.

Open sourcing

The Zeek package and Suricata rules described above are now available in Corelight's php2shell repository. Our release includes detection code, configuration guidance, and a public HTTP regression test. We invite you to use Corelight’s detections for monitoring your traffic and collecting version findings to support patch review. We also invite you to contribute feedback about detection efficacy, false positives, log content, or other topics. We’ll update the repository as our own understanding develops.

Finally, we want to thank OpenAI, PHP, and all the other organizations who have worked together in advance of this disclosure to prepare defenders for responding as effectively as possible. We hope that by releasing open source detections broadly, we can be part of the solution.

To keep up with future detections packages from our Corelight team, subscribe to our newsletter at the bottom of our blog feed. For more helpful information like this, check out our blog.

PHP advisory references

https://www.php.net/archive/2026.php#2026-10-20-1