Detecting PHP2Shell: Telemetry and Choke Points From Web Shell to Root
A 55-second defensive walkthrough of the detection model for PHP2Shell: a web shell on a PHP host that becomes root through a Linux kernel exploit, and the telemetry that exposes each step. In this video: - Why the access log's path, status and byte-count triple beats any User-Agent or keyword rule, and how a 41-byte probe becomes a 2 MB dump on the same PHP URL. - php-fpm's request slow log: a five-second timeout turns a blocked enumeration request into a stack trace naming system() and eval() inside an uploads directory. - File integrity beyond mtime: attackers can copy a file's modified time, but the change time records when utimes() was called, so an old mtime next to a fresh ctime is a triage filter, not a verdict. - Process ancestry: on a well-built PHP fleet the web user almost never executes anything, which makes execve accounting for uid 33 a low-volume, high-value feed rather than a firehose. - The choke points to ship first, and why kernel patch cadence, not WAF rules or disable_functions, is the control that decides whether a web shell stays an annoyance or becomes a root compromise. On sourcing: this is a detection model built for the shape of the attack, not a reconstruction of a specific incident. The public reporting (CyberSecurityNews, 29 October 2026; The Hacker News, 28 October 2026) establishes a chain referred to as PHP2Shell plus Linux kernel exploits, root on 25 servers, and one U.S. government-affiliated network. It does not give a CVE identifier, affected kernel ranges, the vulnerable PHP component, dwell time or indicators of compromise, so none of that is invented here. Commands and log output were collected on a reproduction host with a deliberately planted dispatcher; all addresses and paths are documentation placeholders. All content is defensive and lab-scoped: detect the shell, scope the process ancestry, close the escalation path. Full write-up: https://hackyjs.com/posts/detecting-php2shell-telemetry-and-choke-points-from-web-shell-to-root