Alongside patching, the SOC recommends a retroactive review of exposed systems at least from 17 Oct 2026, where telemetry exists. Correlate suspicious access with process execution, file changes, outbound connections and authentication events. The absence of telemetry or alerts does not prove exploitation did not occur.
1. Process telemetry / EDR
Alert on any process spawned by php-fpm, php-cgi, httpd or apache2 that starts a shell or download tools (sh, bash, dash, curl, wget, nc, python, perl). In normal operation this behavior is rare and should be treated as possible compromise.
2. Web and PHP logs
• Bursts of POST multipart/form-data requests from the same source, especially with an unusual number of parts or headers.
• Deeply nested field names or requests that include PHP_SESSION_UPLOAD_PROGRESS, including to endpoints that should not accept uploads.
• Repeated HTTP 500 responses, crashes or unexpected restarts of PHP workers.
• Malformed or unusually long PHPSESSID cookies and repeated errors (SIGSEGV, AH00052, zend_mm_heap corrupted, "Allowed memory size … in Unknown on line 0") in the PHP, Apache or FPM logs.
3. File system and persistence
• New or modified PHP files in upload, cache or web-accessible directories; check timestamp, owner and content.
• New cron jobs for the web server user, recently added SSH keys or accounts; unusual outbound connections initiated by web workers.
4. How to use indicators of compromise (IOCs)
Treat IOCs as starting points for correlation, not as standalone proof: some addresses may belong to anonymization infrastructure or appear in legitimate traffic. A match does not confirm compromise and does not justify automatic blocking. Validate the source, date and context of each indicator, comparing it against host/network telemetry.
Incident response: if there are credible signs of compromise
1. Isolate the affected system and limit network access without destroying evidence.
2. Preserve logs and, where possible, a disk image and relevant memory/process artifacts.
3. Rotate all credentials accessible to the web process: database passwords, API keys, tokens and .env secrets.
4. Continue the investigation for persistence, exfiltration and lateral movement. Updating PHP alone does not remove an attacker's access if the system was already compromised.
5. Escalate to the SOC/IR team and assess applicable notification obligations (GDPR, NIS2).
For PHP 8.1 and older, check whether your distributor provides documented backported patches. If no supported fix exists, plan a migration. Rebuild container images from updated base images and redeploy them; updating the host does not update PHP inside the container.
