PHP Web Shell Drop on Linux (CVE-2026-109618, CVE-2026-109619)
Finds .php, .phtml, .phar and .inc files written by PHP workers or Apache on Linux, the typical web shell drop after an RCE such as php2shell.
in(#event_simpleName, values=["NewScriptWritten", "WebScriptFileWritten"])
| event_platform=Lin
| ContextBaseFileName=/^(php(-fpm|-cgi)?[0-9.]*|lsphp[0-9.]*|httpd|apache2)$/i
| TargetFileName=/\.(php[0-9]?|phtml|phar|inc)$/i
// exclude known update/cache paths here, e.g. | TargetFileName!=/\/wp-content\/cache\//i
| groupBy([aid, ContextBaseFileName, TargetFileName, SHA256HashData], function=[count(as=Writes), min(@timestamp, as=FirstSeen), max(@timestamp, as=LastSeen)], limit=max)
| match(file="aid_master_main.csv", field=aid, include=[ComputerName], strict=false)
| FirstSeen := formatTime("%Y-%m-%d %H:%M:%S", field=FirstSeen)
| LastSeen := formatTime("%Y-%m-%d %H:%M:%S", field=LastSeen)
| table([ComputerName, aid, ContextBaseFileName, TargetFileName, SHA256HashData, Writes, FirstSeen, LastSeen], limit=20000)What it looks for: NewScriptWritten and WebScriptFileWritten events on Linux where the writing process (ContextBaseFileName) is a PHP binary (php, php-fpm, php-cgi, lsphp, with or without version suffix) or httpd/apache2 for mod_php, and TargetFileName ends in a PHP extension. After code execution through a PHP flaw, the worker writing a new PHP file into the web root is the usual way to keep access.
Telemetry needed: Falcon sensor file telemetry, Linux only. ComputerName comes from aid_master_main.csv.
False positives / tuning: CMS core and plugin updates, template caches (Twig, Smarty, Blade) and Composer runs from the web process all write PHP files. Some apps also write empty index.php stubs into their own tmp and cache folders to block directory listing, Matomo does this after every upgrade and from its archiving cron. Exclude those directories on TargetFileName with the commented line in the query. SHA256HashData was 0 for all hits in testing, so do not rely on it for grouping or allowlisting.
Notes: CERT-EU Advisory 2026-018
