PHP2Shell v2.8.1

PHP2Shell v2.8.1

Published: 25 October 2026
Tag: v2.8.1

Focused security-detection maintenance update informed by public PHP2Shell exploitation research from ReliaQuest and Palo Alto Networks Unit 42. Research was published / widely covered 22–25 October 2026; that research timeline is independent of this product release date (25 October 2026).

Preserves the v2.8.0 discovery surface, exit codes, HTML/CSV/status JSON, fleet CSV v3, and CVE vulnerability thresholds. Does not overwrite v2.8.0 (or earlier) release assets. Offline and read-only by default. No active exploitation, network probing, new telemetry sources, new PHP discovery, DFIR platform expansion, or CVE threshold changes.

Field validation: Automated unit/regression and CI (Linux / Windows / macOS + Windows legacy Go 1.20 cross-build) are green on the detection merge (PR #44 tip / merge 7205591) and this finalize tip. Interactive Windows PowerShell 5.1 and Windows Terminal ANSI/colour matrix remains NOT TESTED (outstanding from earlier releases) — do not record that scenario as PASS. Compile-time Windows/legacy PE builds are not a substitute for interactive console runtime testing.

Downloads

• php2shell-windows-amd64.zip — Windows 10 / Server 2016+ (primary Go toolchain)
• php2shell-windows-legacy-amd64.zip — Go 1.20.14 build for Windows Server 2012 R2 testing (see limitations below)
• php2shell-linux-amd64.tar.gz / php2shell-linux-arm64.tar.gz
• php2shell-darwin-amd64.tar.gz / php2shell-darwin-arm64.tar.gz (developer convenience)

Verify SHA256SUMS. Binaries are not code-signed. Confirm php2shell version prints 2.8.1 (and (legacy) for the legacy Windows EXE). License: Apache License 2.0.

What is new

PHP memory-corruption and Apache worker-abort indicators

• Detect PHP zend_mm_heap corrupted (php_zend_mm_heap_corrupted)
• Detect Apache AH00052 Abort / SIGABRT (apache_child_abort) in addition to existing Segmentation fault
• Existing Datadog-backed patterns retained: OOM Unknown on line 0, AH00052 Segmentation fault
• Individual heap / OOM / Abort matches are suspected research patterns only — not proof of exploitation or host compromise; they never set CONFIRMED_COMPROMISE

Improved multi-signal error correlation

• correlated_error_sequence when OOM Unknown on line 0 appears with heap corruption and/or worker crash/abort within ≤2 minutes on the same error-log file
• Cross-file / cross-host error joins are refused
• Duplicate identical kind sets emit once (repeated log lines do not multiply sequence findings)
• Apache child pid is extracted when present and disclosed

Conservative handling of time-only evidence

Evidence	Confidence
≥3 distinct research kinds (same file, ≤2m)	suspected
Same Apache WorkerPID on ≥2 distinct crash/abort pattern kinds	suspected (still not same-request proof; duplicate same-kind lines do not count)
Two-kind time-only sequence	unconfirmed
POST 5xx ↔ research error (±15m)	unconfirmed (correlation-only; ordinary apps also return 5xx)
Long POST request-target ↔ error	unconfirmed (unchanged)

POST 5xx events are never standalone attempt leads. Missing or unreliable timestamps cannot create correlations. Missing PID is disclosed and keeps weaker pairings at unconfirmed. Temporal proximity is never presented as proof of one shared HTTP request or process.

Unit 42-related process telemetry markers

• Exact published delimiters ==SHELLUSER== / ==PASSWD== → agentic_section_delimiter only when a web/PHP parent is present
• Raw command lines, credentials, and tokens are never retained
• Lowercase / partial / bare passwd strings and non-web parents do not match

Honesty ladder (unchanged contracts)

• Per-finding confidence (suspected / unconfirmed) is shown separately from host statuses
• Independent statuses: ExploitationAttemptStatus, PossibleCompromiseStatus, InvestigationCoverage, legacy signed-IOC CompromiseStatus
• Missing investigation inputs stay NOT_ASSESSED (not a negative clearance)
• The tool never emits CONFIRMED_COMPROMISE or CLEAN

Explicitly out of scope for v2.8.1

• Detection of every technique described in October 2026 research articles (LDAP/AD tooling inventories, request-body p2s-rider markers, multipart upload-progress values, or access↔error same-request identity when PID is absent)
• Changes to CVE-2026-109618 / CVE-2026-109619 upstream thresholds (still 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35)
• New PHP discovery, nginx/FPM expansion, RPM/Homebrew/Docker inventory, live EDR/WAF APIs, or new telemetry formats
• Exit-code / status-JSON / fleet CSV schema changes
• Authenticode signing (still unsigned + SHA256SUMS)

Preserved from v2.8.0

• Bounded nginx / PHP-FPM configuration discovery; Unix PHP symlink discovery; console UX; enterprise quiet/status JSON; legacy Windows artifact; Apache-2.0

Limitations (read before deploying)

• Process completion / exit 0 is not a vulnerability or compromise clearance
• Suspected activity ≠ confirmed compromise; unconfirmed correlations ≠ clearance
• PID on Apache crash/abort lines is not proof that OOM/heap lines or access-log POSTs shared that worker or one HTTP request
• Ordinary access logs typically lack worker PID and never expose request bodies
• WAF query-string presence of PHP_SESSION_UPLOAD_PROGRESS remains presence-only; body/multipart values are unavailable in supported schemas
• Vendor backports require separate verification
• Binaries remain unsigned; verify SHA256SUMS
• Interactive Windows console colour behaviour on PowerShell 5.1 / Windows Terminal remains NOT TESTED

Research sources (publication dates ≠ this release date)

Research	Published / covered	Role in v2.8.1
ReliaQuest Threat Spotlight — PHP2Shell	2026-10-22 (widely covered through 2026-10-25)	Heap corruption, Abort, multi-signal sequence, POST 5xx correlation-only assist
Palo Alto Networks Unit 42 — CVE-2026-109618 / CVE-2026-109619	October 2026 (Oct 25 industry coverage)	Agentic section delimiters in process cmdline classification
The Hacker News roundup	2026-10-25	Industry context only (not a primary pattern source)
Datadog / AWS MadPot patterns	2026-10-21	Prior OOM Unknown line 0 / segfault / investigation floor (retained)

See also

• COMPROMISE-INVESTIGATION.md · Prior: v2.8.0