LoFP / application defects, stress tests, or intentionally low php memory limits may generate similar errors. confirm the complete signature, source, timing, and surrounding requests before escalating.

Techniques

• T1190

Sample rules

Potential PHP2Shell Exploitation Attempt

• source: elastic
• technicques:
  • T1190

Description

This rule detects a distinctive PHP out-of-memory fatal error associated with PHP2Shell exploitation attempts. The combination of an allowed-memory-size exhaustion and the location “Unknown on line 0” is produced before normal application execution and is an indicator of attempts to exploit PHP memory-safety vulnerabilities, including CVE-2026-109618 and CVE-2026-109619. The rule can detect unsuccessful as well as successful attempts and does not, by itself, confirm remote code execution.

Detection logic

event.dataset:("apache.error" or "nginx.error" or "apache_tomcat.catalina" or "apache_tomcat.localhost") and
message:("PHP Fatal error" and "Allowed memory size" and "bytes exhausted" and "Unknown on line 0")