PHP2Shell: critical PHP remote code execution under active exploitation

Advisory Information

Executive Summary

Every internet-facing PHP web server that has not been upgraded to a fixed release since 21 October 2026 should be treated as exposed to unauthenticated remote code execution and memory disclosure, and investigated for compromise back to 17 October 2026.

PHP2Shell is the name given to two memory-safety flaws in the PHP engine itself, not in any application or plugin. An attacker can trigger them with a single crafted multipart/form-data HTTP request, before any application code runs and without credentials. Successful exploitation gives the attacker code execution as the web-server worker account, or lets them read process memory containing passwords, session tokens, API keys and TLS private keys belonging to other users' requests.

The flaws affect PHP releases dating back to 5.4 (2012), under PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed. Researchers demonstrated pre-authentication RCE against current releases of WordPress, Drupal, Joomla, Magento, MediaWiki, Roundcube, phpMyAdmin, Nextcloud, Laravel, Symfony and WHMCS. The embargo leaked: Amazon Threat Intelligence recorded the first exploitation attempt on 17 October 2026, public proof-of-concept code appeared around 02:00 UTC on 21 October, and exploitation is now described as broad.

TechPace recommends the following within 24 hours:

1. Upgrade every PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (or the vendor-backported package) and restart all PHP workers.
2. Where patching is not immediately possible, isolate the server from the internet or apply the interim controls under Remediation and Mitigation, which reduce but do not eliminate exposure.
3. Ingest the 665 indicators under Indicators of Compromise into SIEM, EDR and WAF watchlists and hunt retrospectively from 17 October 2026.
4. If exploitation is confirmed or suspected, rotate all secrets held by or passing through the affected PHP process, including TLS private keys.

Vulnerability Details

Both CVEs are use-after-free conditions created when a fatal error — typically an out-of-memory error from exceeding memory_limit — interrupts PHP's native code mid-request, leaving freed or half-initialised internal state that a later request on the same worker then trusts as valid.

The public exploit tool, credited to Calif, chains both flaws into one unauthenticated attack. Pre-release CVE records briefly showed CVSS 10.0, which the PHP Foundation stated was incorrect; 9.2 is authoritative.

Affected and fixed versions

Linux distributions and LTS vendors received patches before disclosure and may backport fixes without changing the upstream version string. Validate package status against the vendor advisory, not the version number alone. The Remi repository (rpms.remirepo.net) had not published fixes at disclosure; affected users should switch to distribution packages or build from source.

Affected deployment models

• Apache mod_php — highest risk per the PHP team; a single unauthenticated request triggers the chain before application code runs.
• PHP-FPM — RCE confirmed; long-lived, reused workers are the precondition for CVE-2026-109619.
• php-cgi, FrankenPHP, LiteSpeed — affected.
• Containers, managed hosting and bundled appliances — affected wherever an embedded PHP runtime serves web requests; application dependency inventories alone will not reveal exposure.

Patching application code, CMS cores or plugins does not remediate PHP2Shell. Only the PHP runtime update does.

Threat Activity and Exploitation Timeline

Exploitation began four days before the patch existed, so a fully patched server today may already have been compromised between 17 and 21 October 2026.

Threat assessment

• Actors: No attribution yet. Varied payloads and infrastructure point to several independent actors, from opportunistic scanners to at least one actor with pre-disclosure access.
• Expected follow-on activity: Based on prior PHP mass-exploitation (CVE-2024-4577, CVE-2019-11043, both on the CISA KEV list with known ransomware use), TechPace expects web-shell deployment, credential harvesting from leaked memory, cryptominer installation, botnet enrolment and ransomware initial access brokering.
• Proof-of-concept reliability: The PHP Foundation found no functional exploits among the earliest leaked PoCs, and the full chain needs per-target tuning. This lowers, but does not remove, the risk from unskilled actors — the memory-disclosure path is simpler and largely application-agnostic. Unverified PoC code circulating publicly may itself contain malware.
• KEV status: Neither CVE was on the CISA KEV catalogue at the time of writing. TechPace assesses addition as likely.
• Regional relevance: PHP underpins a large share of Qatar and GCC government portals, e-commerce, higher-education and media sites, typically on WordPress, Drupal, Joomla and Magento — all demonstrated RCE targets. Hosting providers running shared mod_php stacks carry multi-tenant risk.

MITRE ATT&CK Mapping

Observed techniques are confirmed in vendor reporting; anticipated techniques reflect TechPace's assessment of likely post-exploitation and should drive hunting scope.

Detection and Threat Hunting

PHP2Shell executes below the application layer, so application logs will show little; detection depends on correlating web-tier request telemetry, PHP/FPM error logs and endpoint process telemetry from 17 October 2026 onward.

Detection opportunities

Standard access logs do not record request bodies. Confirm WAF or proxy body inspection is active, or rely on the response and endpoint indicators.

Hunting queries

Splunk — multipart POSTs followed by server errors from the same source

index=web sourcetype IN (access_combined, nginx:plus:access, aws:elb:accesslogs) method=POST earliest="10/17/2026:00:00:00"
| eval is_err=if(status>=500,1,0)
| stats count AS posts sum(is_err) AS errors values(uri_path) AS uris BY src_ip, dest_host
| where errors>=3 AND errors/posts>0.5
| lookup techpace_php2shell_ioc ip AS src_ip OUTPUT source AS ioc_source
| sort - errors

Microsoft Sentinel (KQL) — web worker spawning a shell or downloader

DeviceProcessEvents
| where Timestamp >= datetime(2026-10-17)
| where InitiatingProcessFileName in~ ("php-fpm","php-fpm8.2","php-fpm8.3","php-fpm8.4","php-fpm8.5","httpd","apache2","php-cgi","lsphp","frankenphp")
| where FileName in~ ("sh","bash","dash","curl","wget","python3","perl","nc","ncat","base64")
| project Timestamp, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, AccountName

SentinelOne Deep Visibility (S1QL)

SrcProcName In Contains Anycase ("php-fpm","httpd","apache2","php-cgi","lsphp","frankenphp") AND EventType = "Process Creation" AND TgtProcName In Contains Anycase ("sh","bash","curl","wget","python","perl","nc","base64")

Linux host triage

# PHP OOM fatals and FPM segfaults since 17 Oct 2026
grep -hE "Allowed memory size of [0-9]+ bytes exhausted" /var/log/php*/*.log /var/log/httpd/error_log* /var/log/apache2/error.log* 2>/dev/null
grep -hE "exited on signal (11|7)" /var/log/php*-fpm*.log* 2>/dev/null

# PHP files created or modified in web roots since 17 Oct 2026
find /var/www /srv /usr/share/nginx -name "*.php" -newermt "2026-10-17" -ls 2>/dev/null

# Access-log hits from TechPace IOC list (one IP per line in php2shell_ioc.txt)
grep -hFf php2shell_ioc.txt /var/log/nginx/access.log* /var/log/httpd/access_log* /var/log/apache2/access.log* 2>/dev/null

Vulnerable-asset identification

• Run php -v and php-fpm -v on every host and container image; compare against the fixed-release table, then confirm vendor backport status with rpm -q --changelog php | grep -i CVE-2026-1096 or apt changelog php8.x | grep -i CVE-2026-1096.
• Tenable: Nessus plugin 369483; Web App Scanning 115719–115722; PHP detection 48243, 216936 (Unix), 200476 (Windows).
• External attack-surface sweep for X-Powered-By: PHP/* headers and known CMS fingerprints across all public IP space and domains.

Remediation and Mitigation

Upgrading the PHP runtime and restarting every worker is the only complete fix; every other control below is a temporary measure that narrows, but does not close, the attack surface.

Priority actions

Interim controls where patching is delayed

Apply these in combination; PHP's own security team and Calif state that configuration alone is not sufficient.

1. PHP configuration (php.ini or a conf.d drop-in for mod_php; restart Apache)

session.upload_progress.enabled = 0   ; CVE-2026-109619 / upload-progress path
memory_limit = -1                     ; CVE-2026-109618 — pair with cgroup v2 memory.max
fatal_error_backtraces = 0            ; PHP 8.5 only
display_errors = Off
opcache.enable = 0                    ; optional, reduces OPcache type-confusion path; performance cost
post_max_size = 8M                    ; keep well below the memory budget

PHP-FPM — set per pool so applications cannot override, then reload:

php_admin_flag[session.upload_progress.enabled] = off
php_admin_value[memory_limit] = -1

memory_limit = -1 lets a single request consume all host memory. Enforce a container or cgroup v2 memory.max limit (not RLIMIT_AS / RLIMIT_DATA), monitor memory, and restore the original limit after patching.

2. Block multipart uploads at the web tier (breaks file uploads and some checkout forms — test first)

# nginx (server block)
if ($http_content_type ~* "multipart/form-data") { return 403; }

# Apache (vhost or .htaccess)
RewriteEngine On
RewriteCond %{HTTP:Content-Type} multipart/form-data [NC]
RewriteRule .* - [F]

Where uploads are business-critical, instead block request bodies containing PHP_SESSION_UPLOAD_PROGRESS at the WAF.

3. Reduce worker reuse — lower pm.max_requests in FPM pools (for example to 50) to shorten the window in which stale state persists.

4. WAF virtual patching — Cloudflare has deployed seven "Generic Rules – Anomalous Execution" rules in both the Free and paid Managed Rulesets; paid customers must confirm they are in Block mode. Imperva, Fastly, Google Cloud Armor and others have published equivalent protections. These only cover traffic that passes through the WAF.

5. Last resort — serve a static maintenance page, or permit only GET and HEAD. CMS maintenance modes (WordPress, Magento) do not help, because the flaw triggers before application code runs.

If compromise is suspected

1. Isolate the host and preserve memory, disk and web, PHP and FPM logs before patching or rebooting.
2. Assume all secrets reachable by the PHP process are exposed: rotate database credentials, API keys, OAuth and SMTP secrets, application salts (for example WordPress AUTH_KEY values), and reissue TLS certificates with new private keys.
3. Invalidate all active user sessions and force re-authentication.
4. Search for web shells, new cron entries, modified .htaccess files, unexpected SSH keys and new local users.
5. Rebuild from a known-good image rather than cleaning in place, then patch before returning to service.
6. Report confirmed incidents to Qatar's National Cyber Security Agency (NCSA) in line with national reporting obligations.

Indicators of Compromise

This advisory carries 665 unique IPv4 indicators: 6 published by Amazon Threat Intelligence from MadPot honeypot observations, and 659 from the TechPace CTI feed of IPs associated with exploitation of critical PHP vulnerabilities. No overlap exists between the two sets. No file hashes or domains have yet been published by any source; this section will be updated as post-exploitation artefacts emerge.

Amazon Threat Intelligence — confirmed PHP2Shell exploitation sources

Source: Amazon Threat Intelligence. Amazon advises investigating traffic from these shared anonymisation IPs rather than relying on blocking alone.

Network and host artefacts

TechPace CTI — IP indicators associated with critical PHP vulnerability exploitation (659)

Over two-thirds of these addresses sit in hyperscale cloud ranges (predominantly 34[.]0[.]0[.]0/8, 35[.]0[.]0[.]0/8 and 136.x blocks), typical of attacker-rented scanning infrastructure. Block them inbound at the web tier and WAF; before applying outbound or enterprise-wide blocks, validate against business dependencies hosted on the same providers. Set a 30-day review on cloud-hosted entries, as these addresses rotate. The full list is available below and as TXT and CSV downloads.

• 1[.]95[.]73[.]195
• 8[.]220[.]129[.]148
• 8[.]228[.]70[.]0
• 8[.]229[.]9[.]185
• 8[.]229[.]27[.]200
• 8[.]229[.]135[.]44
• 8[.]234[.]214[.]137
• 8[.]235[.]113[.]39
• 13[.]140[.]80[.]140
• 13[.]140[.]242[.]159
• 13[.]143[.]174[.]142
• 13[.]143[.]188[.]149
• 23[.]94[.]144[.]9
• 27[.]123[.]253[.]81
• 27[.]123[.]253[.]167
• 27[.]123[.]253[.]206
• 27[.]220[.]190[.]221
• 34[.]6[.]37[.]38
• 34[.]6[.]84[.]234
• 34[.]6[.]190[.]73
• 34[.]7[.]46[.]81
• 34[.]7[.]77[.]17
• 34[.]7[.]94[.]217
• 34[.]7[.]228[.]89
• 34[.]9[.]92[.]98
• 34[.]9[.]116[.]86
• 34[.]11[.]75[.]74
• 34[.]12[.]95[.]191
• 34[.]12[.]96[.]179
• 34[.]12[.]141[.]85
• 34[.]12[.]156[.]255
• 34[.]12[.]249[.]202
• 34[.]13[.]137[.]190
• 34[.]13[.]153[.]188
• 34[.]19[.]148[.]2
• 34[.]19[.]156[.]226
• 34[.]19[.]179[.]78
• 34[.]19[.]206[.]202
• 34[.]19[.]208[.]243
• 34[.]19[.]226[.]199
• 34[.]19[.]230[.]199
• 34[.]19[.]252[.]55
• 34[.]19[.]254[.]241
• 34[.]21[.]5[.]217
• 34[.]21[.]31[.]241
• 34[.]21[.]109[.]199
• 34[.]21[.]143[.]44
• 34[.]21[.]189[.]99
• 34[.]21[.]197[.]23
• 34[.]21[.]222[.]75
• 34[.]22[.]168[.]4
• 34[.]22[.]183[.]181
• 34[.]22[.]226[.]10
• 34[.]23[.]56[.]252
• 34[.]24[.]9[.]239
• 34[.]24[.]37[.]154
• 34[.]24[.]178[.]204
• 34[.]24[.]190[.]69
• 34[.]26[.]95[.]76
• 34[.]26[.]225[.]1
• 34[.]32[.]171[.]197
• 34[.]34[.]28[.]161
• 34[.]34[.]43[.]160
• 34[.]34[.]55[.]86
• 34[.]34[.]60[.]252
• 34[.]38[.]87[.]66
• 34[.]38[.]241[.]44
• 34[.]39[.]129[.]246
• 34[.]39[.]131[.]95
• 34[.]39[.]136[.]220
• 34[.]39[.]163[.]213
• 34[.]39[.]169[.]21
• 34[.]39[.]170[.]223
• 34[.]39[.]189[.]230
• 34[.]39[.]196[.]106
• 34[.]39[.]197[.]235
• 34[.]39[.]210[.]128
• 34[.]39[.]211[.]156
• 34[.]39[.]214[.]95
• 34[.]39[.]216[.]210
• 34[.]39[.]217[.]2
• 34[.]39[.]220[.]247
• 34[.]39[.]231[.]98
• 34[.]39[.]237[.]75
• 34[.]39[.]248[.]94
• 34[.]40[.]60[.]74
• 34[.]40[.]65[.]192
• 34[.]40[.]106[.]240
• 34[.]40[.]113[.]52
• 34[.]47[.]0[.]253
• 34[.]47[.]16[.]34
• 34[.]47[.]26[.]173
• 34[.]47[.]28[.]211
• 34[.]47[.]30[.]101
• 34[.]47[.]43[.]120
• 34[.]47[.]51[.]141
• 34[.]47[.]51[.]191
• 34[.]47[.]60[.]169
• 34[.]47[.]62[.]242
• 34[.]48[.]2[.]95
• 34[.]48[.]51[.]38
• 34[.]48[.]162[.]128
• 34[.]48[.]223[.]214
• 34[.]52[.]251[.]185
• 34[.]53[.]92[.]198
• 34[.]53[.]147[.]48
• 34[.]53[.]162[.]201
• 34[.]53[.]214[.]124
• 34[.]53[.]245[.]46
• 34[.]53[.]252[.]42
• 34[.]57[.]18[.]143
• 34[.]62[.]34[.]3
• 34[.]62[.]167[.]195
• 34[.]62[.]203[.]66
• 34[.]62[.]224[.]17
• 34[.]62[.]232[.]103
• 34[.]74[.]15[.]154
• 34[.]74[.]40[.]252
• 34[.]74[.]79[.]239
• 34[.]75[.]129[.]110
• 34[.]75[.]155[.]23
• 34[.]77[.]7[.]212
• 34[.]80[.]121[.]128
• 34[.]80[.]135[.]175
• 34[.]80[.]200[.]168
• 34[.]80[.]202[.]207
• 34[.]80[.]236[.]90
• 34[.]80[.]254[.]44
• 34[.]81[.]5[.]43
• 34[.]81[.]6[.]171
• 34[.]81[.]23[.]140
• 34[.]81[.]27[.]13
• 34[.]81[.]33[.]248
• 34[.]81[.]45[.]85
• 34[.]81[.]46[.]151
• 34[.]81[.]94[.]10
• 34[.]81[.]178[.]159
• 34[.]81[.]186[.]246
• 34[.]81[.]190[.]147
• 34[.]81[.]191[.]236
• 34[.]81[.]221[.]84
• 34[.]82[.]130[.]149
• 34[.]82[.]235[.]150
• 34[.]83[.]2[.]251
• 34[.]83[.]60[.]58
• 34[.]83[.]66[.]181
• 34[.]84[.]28[.]17
• 34[.]84[.]84[.]184
• 34[.]84[.]125[.]196
• 34[.]84[.]142[.]236
• 34[.]84[.]248[.]173
• 34[.]85[.]23[.]32
• 34[.]85[.]37[.]21
• 34[.]85[.]68[.]154
• 34[.]85[.]81[.]102
• 34[.]85[.]110[.]188
• 34[.]86[.]15[.]76
• 34[.]86[.]97[.]97
• 34[.]86[.]150[.]159
• 34[.]87[.]21[.]213
• 34[.]87[.]90[.]216
• 34[.]87[.]137[.]23
• 34[.]89[.]162[.]226
• 34[.]89[.]170[.]20
• 34[.]89[.]213[.]199
• 34[.]89[.]214[.]5
• 34[.]89[.]229[.]69
• 34[.]89[.]235[.]29
• 34[.]89[.]245[.]114
• 34[.]90[.]87[.]206
• 34[.]90[.]107[.]164
• 34[.]90[.]108[.]204
• 34[.]90[.]174[.]88
• 34[.]90[.]204[.]87
• 34[.]90[.]207[.]149
• 34[.]90[.]246[.]60
• 34[.]90[.]254[.]179
• 34[.]91[.]87[.]50
• 34[.]91[.]133[.]21
• 34[.]91[.]233[.]34
• 34[.]95[.]43[.]65
• 34[.]95[.]48[.]207
• 34[.]95[.]49[.]219
• 34[.]95[.]148[.]68
• 34[.]95[.]148[.]192
• 34[.]95[.]150[.]200
• 34[.]95[.]166[.]25
• 34[.]95[.]169[.]189
• 34[.]95[.]177[.]83
• 34[.]95[.]188[.]6
• 34[.]95[.]197[.]50
• 34[.]95[.]206[.]136
• 34[.]95[.]213[.]121
• 34[.]95[.]214[.]130
• 34[.]100[.]153[.]150
• 34[.]104[.]138[.]183
• 34[.]104[.]141[.]20
• 34[.]104[.]148[.]7
• 34[.]104[.]160[.]36
• 34[.]104[.]161[.]170
• 34[.]104[.]171[.]175
• 34[.]104[.]203[.]249
• 34[.]104[.]217[.]182
• 34[.]104[.]223[.]96
• 34[.]107[.]35[.]18
• 34[.]107[.]43[.]64
• 34[.]107[.]110[.]212
• 34[.]118[.]134[.]92
• 34[.]118[.]155[.]197
• 34[.]118[.]177[.]60
• 34[.]118[.]181[.]111
• 34[.]118[.]196[.]103
• 34[.]124[.]155[.]214
• 34[.]124[.]221[.]40
• 34[.]126[.]108[.]82
• 34[.]126[.]135[.]191
• 34[.]126[.]174[.]200
• 34[.]127[.]6[.]25
• 34[.]133[.]232[.]249
• 34[.]138[.]78[.]102
• 34[.]139[.]34[.]3
• 34[.]141[.]15[.]231
• 34[.]141[.]150[.]44
• 34[.]142[.]212[.]50
• 34[.]143[.]140[.]172
• 34[.]143[.]149[.]128
• 34[.]143[.]153[.]195
• 34[.]143[.]163[.]137
• 34[.]143[.]226[.]143
• 34[.]143[.]233[.]155
• 34[.]143[.]254[.]176
• 34[.]146[.]45[.]160
• 34[.]146[.]80[.]211
• 34[.]146[.]86[.]137
• 34[.]146[.]109[.]172
• 34[.]146[.]131[.]23
• 34[.]146[.]157[.]194
• 34[.]146[.]198[.]30
• 34[.]146[.]244[.]192
• 34[.]147[.]9[.]145
• 34[.]148[.]118[.]59
• 34[.]150[.]136[.]2
• 34[.]150[.]216[.]166
• 34[.]150[.]239[.]190
• 34[.]151[.]192[.]129
• 34[.]151[.]196[.]35
• 34[.]151[.]204[.]44
• 34[.]151[.]205[.]161
• 34[.]151[.]221[.]183
• 34[.]151[.]224[.]220
• 34[.]151[.]234[.]92
• 34[.]151[.]235[.]215
• 34[.]151[.]249[.]231
• 34[.]152[.]9[.]109
• 34[.]152[.]21[.]75
• 34[.]152[.]35[.]118
• 34[.]152[.]45[.]192
• 34[.]153[.]201[.]44
• 34[.]156[.]16[.]104
• 34[.]156[.]61[.]57
• 34[.]156[.]103[.]50
• 34[.]156[.]139[.]4
• 34[.]156[.]194[.]143
• 34[.]156[.]209[.]1
• 34[.]156[.]236[.]236
• 34[.]158[.]38[.]172
• 34[.]158[.]41[.]183
• 34[.]159[.]2[.]77
• 34[.]159[.]55[.]185
• 34[.]159[.]58[.]63
• 34[.]159[.]70[.]147
• 34[.]159[.]86[.]33
• 34[.]159[.]114[.]82
• 34[.]159[.]148[.]122
• 34[.]159[.]153[.]97
• 34[.]159[.]167[.]237
• 34[.]159[.]199[.]254
• 34[.]159[.]235[.]26
• 34[.]168[.]218[.]1
• 34[.]168[.]228[.]28
• 34[.]168[.]248[.]96
• 34[.]172[.]9[.]102
• 34[.]177[.]97[.]180
• 34[.]178[.]60[.]69
• 34[.]178[.]119[.]101
• 34[.]178[.]133[.]15
• 34[.]178[.]163[.]194
• 34[.]178[.]172[.]50
• 34[.]178[.]215[.]179
• 34[.]179[.]153[.]201
• 34[.]179[.]185[.]147
• 34[.]179[.]210[.]121
• 34[.]179[.]248[.]182
• 34[.]180[.]68[.]8
• 34[.]180[.]73[.]113
• 34[.]180[.]80[.]74
• 34[.]180[.]82[.]252
• 34[.]180[.]96[.]128
• 34[.]180[.]122[.]99
• 34[.]181[.]136[.]181
• 34[.]181[.]179[.]9
• 34[.]181[.]213[.]128
• 34[.]181[.]218[.]43
• 34[.]181[.]218[.]133
• 34[.]181[.]234[.]204
• 34[.]181[.]249[.]63
• 34[.]182[.]140[.]203
• 34[.]182[.]155[.]7
• 34[.]182[.]241[.]91
• 34[.]185[.]177[.]165
• 34[.]185[.]196[.]17
• 34[.]185[.]218[.]203
• 34[.]186[.]113[.]100
• 34[.]186[.]201[.]69
• 34[.]186[.]203[.]161
• 34[.]186[.]207[.]146
• 34[.]187[.]25[.]73
• 34[.]187[.]119[.]56
• 34[.]187[.]169[.]24
• 34[.]187[.]210[.]221
• 35[.]185[.]77[.]35
• 35[.]185[.]118[.]188
• 35[.]189[.]135[.]71
• 35[.]190[.]146[.]89
• 35[.]193[.]29[.]161
• 35[.]194[.]130[.]82
• 35[.]194[.]214[.]9
• 35[.]194[.]247[.]186
• 35[.]195[.]132[.]81
• 35[.]196[.]41[.]154
• 35[.]196[.]128[.]16
• 35[.]196[.]153[.]23
• 35[.]196[.]190[.]119
• 35[.]196[.]252[.]168
• 35[.]198[.]6[.]169
• 35[.]198[.]11[.]22
• 35[.]198[.]14[.]227
• 35[.]198[.]17[.]248
• 35[.]198[.]29[.]58
• 35[.]198[.]32[.]128
• 35[.]198[.]37[.]200
• 35[.]198[.]60[.]29
• 35[.]198[.]64[.]79
• 35[.]198[.]79[.]68
• 35[.]198[.]85[.]212
• 35[.]198[.]92[.]138
• 35[.]198[.]136[.]30
• 35[.]198[.]187[.]101
• 35[.]198[.]201[.]80
• 35[.]198[.]210[.]241
• 35[.]199[.]99[.]150
• 35[.]199[.]108[.]206
• 35[.]199[.]120[.]56
• 35[.]200[.]12[.]8
• 35[.]200[.]19[.]250
• 35[.]200[.]25[.]156
• 35[.]200[.]66[.]99
• 35[.]201[.]131[.]36
• 35[.]201[.]173[.]66
• 35[.]201[.]243[.]0
• 35[.]201[.]254[.]66
• 35[.]203[.]26[.]153
• 35[.]203[.]33[.]76
• 35[.]203[.]63[.]146
• 35[.]203[.]97[.]87
• 35[.]203[.]105[.]207
• 35[.]204[.]20[.]70
• 35[.]204[.]112[.]146
• 35[.]221[.]0[.]20
• 35[.]221[.]75[.]146
• 35[.]221[.]91[.]113
• 35[.]221[.]101[.]183
• 35[.]221[.]109[.]53
• 35[.]221[.]122[.]164
• 35[.]221[.]178[.]81
• 35[.]222[.]167[.]213
• 35[.]229[.]153[.]176
• 35[.]230[.]96[.]215
• 35[.]230[.]175[.]26
• 35[.]231[.]230[.]44
• 35[.]233[.]5[.]72
• 35[.]233[.]42[.]237
• 35[.]233[.]112[.]19
• 35[.]233[.]214[.]179
• 35[.]234[.]19[.]132
• 35[.]234[.]43[.]68
• 35[.]234[.]103[.]121
• 35[.]234[.]171[.]110
• 35[.]236[.]140[.]188
• 35[.]236[.]226[.]48
• 35[.]236[.]243[.]208
• 35[.]237[.]23[.]249
• 35[.]237[.]181[.]76
• 35[.]238[.]249[.]149
• 35[.]240[.]137[.]206
• 35[.]240[.]156[.]86
• 35[.]240[.]217[.]183
• 35[.]240[.]217[.]222
• 35[.]241[.]154[.]172
• 35[.]241[.]164[.]37
• 35[.]242[.]222[.]173
• 35[.]242[.]248[.]44
• 35[.]243[.]74[.]14
• 35[.]243[.]100[.]85
• 35[.]243[.]101[.]196
• 35[.]243[.]116[.]141
• 35[.]243[.]155[.]113
• 35[.]243[.]161[.]121
• 35[.]245[.]104[.]86
• 35[.]245[.]131[.]226
• 35[.]245[.]203[.]0
• 35[.]246[.]203[.]72
• 35[.]246[.]214[.]28
• 35[.]247[.]129[.]72
• 35[.]247[.]146[.]93
• 35[.]247[.]195[.]30
• 35[.]247[.]211[.]10
• 35[.]247[.]218[.]3
• 35[.]247[.]228[.]169
• 35[.]247[.]245[.]80
• 35[.]247[.]247[.]159
• 35[.]247[.]247[.]220
• 37[.]120[.]186[.]231
• 37[.]120[.]213[.]13
• 38[.]60[.]216[.]218
• 38[.]148[.]20[.]75
• 41[.]223[.]139[.]111
• 43[.]108[.]120[.]121
• 43[.]128[.]100[.]146
• 43[.]155[.]183[.]44
• 43[.]173[.]38[.]56
• 43[.]226[.]36[.]132
• 43[.]230[.]211[.]12
• 45[.]8[.]132[.]75
• 45[.]33[.]28[.]47
• 45[.]43[.]36[.]172
• 45[.]43[.]37[.]254
• 45[.]56[.]103[.]154
• 45[.]137[.]194[.]154
• 45[.]140[.]193[.]140
• 45[.]141[.]26[.]3
• 45[.]148[.]10[.]15
• 45[.]148[.]10[.]95
• 45[.]153[.]34[.]122
• 45[.]153[.]34[.]149
• 45[.]156[.]87[.]6
• 45[.]156[.]87[.]16
• 45[.]203[.]220[.]220
• 47[.]77[.]204[.]57
• 50[.]31[.]235[.]102
• 50[.]114[.]236[.]142
• 51[.]159[.]4[.]12
• 59[.]153[.]202[.]112
• 62[.]146[.]226[.]80
• 64[.]226[.]84[.]77
• 65[.]109[.]215[.]207
• 66[.]175[.]208[.]166
• 69[.]164[.]207[.]173
• 79[.]124[.]58[.]82
• 82[.]156[.]186[.]122
• 85[.]203[.]21[.]14
• 85[.]203[.]21[.]21
• 85[.]203[.]21[.]24
• 85[.]203[.]21[.]25
• 85[.]203[.]21[.]27
• 85[.]203[.]21[.]30
• 85[.]203[.]21[.]38
• 85[.]203[.]21[.]53
• 85[.]203[.]21[.]93
• 85[.]203[.]21[.]96
• 85[.]203[.]21[.]100
• 85[.]203[.]21[.]116
• 85[.]203[.]21[.]135
• 85[.]203[.]21[.]139
• 85[.]203[.]21[.]150
• 85[.]203[.]21[.]170
• 85[.]203[.]21[.]197
• 89[.]126[.]211[.]166
• 89[.]247[.]33[.]110
• 92[.]242[.]198[.]105
• 93[.]123[.]109[.]163
• 93[.]123[.]109[.]228
• 93[.]123[.]109[.]247
• 93[.]152[.]221[.]26
• 95[.]130[.]227[.]78
• 96[.]126[.]117[.]80
• 97[.]107[.]140[.]120
• 102[.]129[.]255[.]213
• 102[.]244[.]97[.]185
• 103[.]7[.]120[.]63
• 103[.]46[.]186[.]148
• 103[.]56[.]232[.]39
• 103[.]59[.]160[.]245
• 103[.]63[.]101[.]24
• 103[.]79[.]184[.]145
• 103[.]81[.]105[.]186
• 103[.]84[.]59[.]230
• 103[.]84[.]133[.]248
• 103[.]84[.]133[.]255
• 103[.]122[.]250[.]20
• 103[.]127[.]29[.]111
• 103[.]130[.]113[.]177
• 103[.]133[.]201[.]241
• 103[.]133[.]206[.]190
• 103[.]135[.]90[.]94
• 103[.]138[.]144[.]223
• 103[.]146[.]16[.]13
• 103[.]147[.]107[.]50
• 103[.]159[.]51[.]70
• 103[.]159[.]172[.]76
• 103[.]160[.]205[.]37
• 103[.]163[.]139[.]125
• 103[.]167[.]208[.]215
• 103[.]178[.]67[.]53
• 103[.]185[.]25[.]41
• 103[.]187[.]68[.]236
• 103[.]220[.]204[.]169
• 103[.]242[.]219[.]88
• 104[.]196[.]17[.]69
• 104[.]199[.]150[.]237
• 104[.]199[.]172[.]176
• 104[.]199[.]218[.]8
• 104[.]199[.]230[.]95
• 104[.]199[.]235[.]85
• 104[.]234[.]186[.]154
• 107[.]150[.]123[.]48
• 107[.]155[.]48[.]46
• 107[.]170[.]13[.]163
• 107[.]175[.]132[.]47
• 114[.]130[.]98[.]165
• 115[.]191[.]32[.]57
• 118[.]145[.]104[.]37
• 118[.]145[.]104[.]105
• 118[.]193[.]33[.]239
• 119[.]15[.]169[.]38
• 119[.]28[.]84[.]193
• 120[.]48[.]152[.]13
• 120[.]211[.]74[.]131
• 121[.]43[.]148[.]69
• 122[.]155[.]166[.]90
• 123[.]253[.]36[.]170
• 124[.]158[.]13[.]141
• 129[.]146[.]23[.]7
• 130[.]12[.]180[.]32
• 136[.]66[.]72[.]44
• 136[.]66[.]134[.]148
• 136[.]66[.]158[.]66
• 136[.]67[.]165[.]186
• 136[.]67[.]219[.]199
• 136[.]69[.]215[.]213
• 136[.]69[.]227[.]88
• 136[.]70[.]72[.]114
• 136[.]70[.]95[.]65
• 136[.]70[.]191[.]162
• 136[.]70[.]194[.]91
• 136[.]85[.]7[.]70
• 136[.]85[.]31[.]180
• 136[.]85[.]42[.]250
• 136[.]85[.]60[.]38
• 136[.]85[.]70[.]76
• 136[.]85[.]76[.]174
• 136[.]86[.]169[.]10
• 136[.]87[.]7[.]143
• 136[.]87[.]66[.]131
• 136[.]87[.]81[.]206
• 136[.]87[.]112[.]149
• 136[.]87[.]123[.]94
• 136[.]87[.]129[.]47
• 136[.]87[.]135[.]6
• 136[.]87[.]157[.]25
• 136[.]90[.]28[.]120
• 136[.]90[.]101[.]46
• 136[.]107[.]27[.]201
• 136[.]107[.]32[.]213
• 136[.]107[.]149[.]15
• 136[.]107[.]152[.]22
• 136[.]107[.]167[.]225
• 136[.]107[.]176[.]196
• 136[.]107[.]206[.]240
• 136[.]107[.]207[.]183
• 136[.]108[.]100[.]115
• 136[.]108[.]138[.]216
• 136[.]108[.]205[.]8
• 136[.]109[.]22[.]166
• 136[.]110[.]28[.]221
• 136[.]110[.]49[.]251
• 136[.]116[.]138[.]1
• 138[.]197[.]85[.]193
• 140[.]245[.]43[.]35
• 140[.]245[.]61[.]25
• 144[.]31[.]7[.]15
• 144[.]91[.]81[.]102
• 144[.]225[.]6[.]184
• 146[.]148[.]122[.]37
• 147[.]15[.]15[.]226
• 147[.]93[.]171[.]213
• 147[.]182[.]183[.]163
• 149[.]78[.]186[.]49
• 152[.]32[.]225[.]117
• 152[.]32[.]236[.]102
• 157[.]10[.]186[.]28
• 157[.]66[.]54[.]190
• 157[.]245[.]84[.]42
• 160[.]154[.]31[.]234
• 160[.]187[.]108[.]193
• 160[.]187[.]211[.]90
• 160[.]187[.]211[.]233
• 160[.]202[.]146[.]232
• 160[.]202[.]146[.]238
• 160[.]236[.]58[.]116
• 160[.]250[.]132[.]238
• 161[.]132[.]49[.]125
• 162[.]35[.]28[.]121
• 163[.]7[.]1[.]156
• 163[.]61[.]17[.]82
• 163[.]128[.]210[.]228
• 165[.]99[.]207[.]153
• 165[.]154[.]173[.]148
• 165[.]154[.]218[.]226
• 167[.]71[.]233[.]141
• 167[.]254[.]79[.]1
• 169[.]58[.]111[.]93
• 169[.]58[.]206[.]194
• 169[.]239[.]75[.]138
• 171[.]34[.]139[.]222
• 172[.]233[.]190[.]104
• 172[.]234[.]143[.]92
• 172[.]234[.]155[.]181
• 172[.]235[.]245[.]36
• 172[.]236[.]233[.]65
• 173[.]249[.]6[.]158
• 177[.]10[.]160[.]46
• 178[.]128[.]97[.]205
• 180[.]93[.]54[.]84
• 180[.]181[.]122[.]134
• 184[.]154[.]245[.]42
• 185[.]18[.]215[.]184
• 185[.]122[.]171[.]146
• 185[.]126[.]202[.]85
• 185[.]177[.]72[.]50
• 185[.]177[.]72[.]51
• 185[.]194[.]178[.]92
• 185[.]201[.]227[.]49
• 190[.]171[.]189[.]85
• 192[.]3[.]90[.]20
• 193[.]148[.]56[.]90
• 194[.]163[.]173[.]251
• 195[.]178[.]110[.]22
• 196[.]238[.]51[.]120
• 198[.]12[.]89[.]177
• 202[.]134[.]10[.]131
• 202[.]134[.]10[.]137
• 203[.]195[.]82[.]138
• 209[.]141[.]51[.]90
• 212[.]18[.]114[.]31
• 217[.]60[.]7[.]209
• 217[.]142[.]187[.]160
• 223[.]83[.]183[.]254
• 223[.]123[.]65[.]54

TechPace Support

TechPace, operating from Doha, can support PHP2Shell response with the following services.

To engage TechPace for any of the above, contact your TechPace account manager, the TechPace SOC or sales@techpace.net.

Sources

• Wiz Research — PHP2Shell: AI uncovers critical RCE vulnerabilities
• PHP2Shell disclosure site
• Amazon Threat Intelligence — PHP2Shell exploitation prior to public disclosure
• Sansec — PHP2Shell: Critical PHP RCE
• Cloudflare — WAF protections against php2shell
• Tenable — php2shell FAQ
• Help Net Security — PHP2Shell patched
• Imperva — PHP2Shell vulnerability updates
• watchTowr — PHP RCE FAQ
• SecurityOnline — PHP2Shell exploited in the wild
• JFrog Security Research — PHP2Shell

Disclaimer: This advisory is provided for information and defensive purposes based on open-source and TechPace intelligence available at the time of writing. Indicators should be validated in the recipient's environment before enforcement.