PHP2Shell Exposure Hunting - Do you have it across your estate and where?? An Advanced Hunting pack for Defender XDR

The repository provides a set of six sequenced KQL advanced hunting queries for Defender XDR, three each for Windows and Linux, to detect active PHP instances that may be vulnerable to PHP2Shell exploits. The hunts check for PHP executables, engine DLLs, installed software, and active web serving processes on specific ports. The detection logic uses regex patterns to identify PHP-related processes and modules, extracting version information where available. The hunting pack aims to identify devices running PHP that could be exposed to the PHP2Shell vulnerabilities, enabling defenders to verify and respond to potential exposures within their environment.

The hunting pack itself does not describe a vulnerability or exploit but targets detection of exposure to known PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619). The impact is that organizations may have devices running vulnerable PHP versions that could be exploited if exposed. The hunting queries help identify such devices to enable timely remediation and reduce risk. No direct exploit or active compromise is indicated in the provided information.

This content provides detection capabilities rather than a direct fix. Organizations should use the advanced hunting queries in Defender XDR to identify devices running PHP that may be vulnerable to PHP2Shell. Once identified, affected systems should be updated or remediated according to vendor guidance for CVE-2026-109618 and CVE-2026-109619. Patch status for these CVEs is not provided here; check the official vendor advisories for remediation details. No direct patch or fix is included in this hunting pack. The vendor manages Defender XDR platform updates, but endpoint remediation is the organization's responsibility.