Hunt or be Hunted: HuntIQ Hunters Take on php2shell

Key takeaways

php2shell is two critical flaws in the PHP core that reach code before any application runs, exploitation attempts began before the fix existed, and the usual check for exposure, reading a version number, gives the wrong answer on patched Linux packages and misses PHP that was never formally installed.
Tanium HuntIQ reproduced both remote code execution chains in an isolated lab on the night of the release, then pressure-tested PHP's fix and found no bypass in the paths it tested.
Tanium Guardian's php2shell dashboard, with a new sensor that reads the version straight from each Windows PHP binary, reached every Tanium Cloud tenant about eight hours after PHP published the fix, with nothing for customers to import.
While organizations were still asking where PHP ran, Tanium customers had a fleet-wide inventory sorted by vulnerable version and a behavior hunt for what an attacker would do next.

What happened

On October 20, 2026, the identifiers for two critical PHP vulnerabilities leaked online a day before their coordinated release, and PHP pulled its fix forward to the next morning. By then the first exploitation attempt had already hit Amazon's honeypots on October 17. The patch itself is one package update. The hard part was knowing where every copy of PHP lived.

Threat	Response team	Outcome
php2shell (CVE-2026-109618, CVE-2026-109619): PHP core RCE reachable by an unauthenticated multipart POST; fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35; exploitation attempts seen before disclosure; public exploits unreliable	HuntIQ threat hunters + Tanium Guardian + Tanium Atlas + Tanium Threat Response: human hunters backed by AI-assisted tooling	Exposure found fleet-wide, both chains reproduced, and the fix pressure-tested; visibility live in every Tanium Cloud tenant ~8 hours after PHP released the fix

PHP runs a large share of the web, which is why SANS raised its Internet Storm Center threat level to yellow on release day (SANS ISC (opens in a new tab)). Wiz, one of the reporting teams, estimates the flaws reach about 70% of the internet (Wiz (opens in a new tab)). PHP's own advisories put the highest risk on Apache's built-in PHP module, where a single request can reach the flaw before any application code runs, and warn that configuration changes are only a partial mitigation (PHP advisory (opens in a new tab)).

How the first day went

HuntIQ hunters were briefed the evening the identifiers leaked, and the Guardian team opened a response channel that night. PHP published the fixes around 14:00 UTC on October 21. Within the hour, HuntIQ's hunt content carried three post-exploitation hunts: shells and discovery tools started by a PHP or web server worker, PHP code and executables written by those workers, and PHP binaries older than the fixed releases.

That night, in an isolated lab, a HuntIQ researcher reproduced both remote code execution chains against PHP 8.5.11 and got command execution as Apache's web service account. Within a day the team went a step further than the public exploits had: it drove the attack over HTTP alone, defeating address randomization with an in-band memory leak, against a server it had no inside knowledge of. Run against the fixed PHP 8.5.12, the same chains and their variations failed, and the team found no bypass. That told HuntIQ two things at once: the public exploits were failing, but a capable attacker could still reach code execution, so the failure of the public proofs-of-concept was no reason to wait; and the patch itself was sound. The full research write-up is linked at the end.

At the same time, Tanium Guardian shipped a dashboard for the two CVEs and a new Windows PHP Installations sensor that reads the version from each PHP binary without running it. The content reached the first Tanium Cloud customer tenants at 19:38 UTC and finished rolling out to every Tanium Cloud tenant at 21:59 UTC, about eight hours after PHP's release. On-premises customers had an import package and a public knowledge article by 01:58 UTC on October 22.

Nobody in those Tanium Cloud tenants had to build a question or import a file. The dashboard arrived sorted by vulnerable version on Windows, Linux and macOS, and HuntIQ hunters handed their customers a behavior hunt written for Tanium Atlas, so the follow-up question, whether anyone had already used the flaw, could be asked in natural language across the fleet.

Why finding PHP was the hard part

Version scanners struggle with PHP in two directions. Linux distributions fix it by backporting the patch into an older version string: Ubuntu 24.04's fixed package still reports PHP 8.3.6, so a version check calls a patched server vulnerable. On Windows, PHP is usually unpacked from a zip file rather than installed, so it never appears in the installed-software list. In the field, many Windows copies turned up embedded inside third-party applications. HuntIQ's lab work found a third gap: inventory of a host's packages describes the host, not the container images it runs, and a vulnerable PHP image can sit on a server whose own PHP is patched.

Attackers were scanning before the fix existed. The organizations that came out of release day in good shape were the ones that could find and list every host running PHP, rank them by exposure, and patch the internet-facing ones first. That is a question Tanium answers across the whole fleet in one pass, and HuntIQ supplies the judgment about which answers matter.

Learn how you can stay ahead of the next zero-day with Tanium Security Operations and HuntIQ
Read the full technical breakdown: HuntIQ Tradecraft: Hunting php2shell post-exploitation with Tanium (opens in a new tab)
Read about our research: HuntIQ Tradecraft: Why php2shell Is Real and Still Hard to Exploit (opens in a new tab)