PHP2Shell Part 3: Early IoCs in Google Threat Intelligence & Retro-Hunting with 23 Curated Detections in Google SecOps 🕵️‍♂️🛡️

Over the past 24 hours, we covered how to shield your perimeter with Google Cloud Armor in Part 1 and how to roll out the emergency PHP patches (8.5.12, 8.4.27, 8.3.36, 8.2.35) in Part 2. But once the patch is installed, every CISO and SOC team asks the exact same question: “Did anyone already probe or exploit our PHP servers before our patch went live?” Today, I want to share how Google Threat Intelligence (GTI) had the early Indicators of Compromise (IoCs) for PHP2Shell right from day one—and how Google SecOps has already launched 23 curated detections so you can immediately detect and retro-hunt for PHP2Shell activity across your environment.

---

Why Patching Alone Doesn’t Answer the “Were We Hit?” Question

When a vulnerability as severe as PHP2Shell (CVE-2026-109618 and CVE-2026-109619) drops, defenders are racing against the clock. As we saw yesterday, CVE-2026-109618 doesn’t just allow unauthenticated Remote Code Execution (RCE)—its first primitive is a pre-auth live worker memory disclosure that leaks 256-byte chunks of PHP heap memory (including session cookies, API keys, and credentials) inside an oversized PHPSESSID response cookie.

Even if an attacker didn’t drop a persistent web shell on your server, they may have already:

• Probed your endpoints with hyper-compressed decompression bombs or PHP_SESSION_UPLOAD_PROGRESS payloads to trigger an Out-of-Memory (zend_bailout()) crash, or
• Harvested sensitive tokens from your worker memory hours before your Linux team ran apt-get dist-upgrade.

That is where Google Threat Intelligence (GTI) and Google SecOps come together as a massive force multiplier.

---

Early Warning: Google Threat Intelligence Campaign GLOBAL.26.015

What impressed me most during this response is how fast Google Threat Intelligence Group (GTIG) had actionable intelligence live in the platform. On October 21, 2026—as opportunistic threat actors began mass scanning and as functional RCE proof-of-concept (PoC) scripts targeting the zend_bailout() OOM vector surfaced online—GTI published the global multitarget campaign GLOBAL.26.015: Opportunistic Threat Actors Attempt Exploitation of CVE-2026-109618 and CVE-2026-109619 in PHP.

Instead of waiting days for third-party feeds to catch up, GTI customers immediately had visibility into the early scanning and exploitation infrastructure, including IP indicators linked to opportunistic mass scanners and tracked threat actor UNC5638:

Indicator (IP)	ASN / Subnet	GTI Association	What It Tells Your SOC
116.98.243.14	116.98.224.0/19	GLOBAL.26.015 (Opportunistic Campaign)	Early PHP2Shell mass scanning & OOM probing source
176.236.127.109	176.236.0.0/17	GLOBAL.26.015 (Opportunistic Campaign)	Early opportunistic recon & payload testing
176.236.127.37	176.236.0.0/17	GLOBAL.26.015 (Opportunistic Campaign)	Sibling scanner node in the same /17 range
49.87.220.67	49.87.0.0/16	GLOBAL.26.015 & UNC5638	Known threat actor infrastructure probing PHP endpoints

In GTI, you can click Create Hunt Plan or Open in Graph directly from the campaign banner to pivot across related infrastructure and check if any of these IPs touched your load balancers or firewalls.

---

Google SecOps Launches 23 Curated Detections for Live Detection & Retro-Hunting

Having IoCs is step one—Step two is detecting the behavioral mechanics of the exploit, even when an attacker rotates to a brand-new IP address.

Inside Google SecOps under Emerging Threats, the GLOBAL.26.015 campaign automatically correlates GTI’s indicators against your telemetry (giving you an instant IOCs: Matches / No Matches check over the last 7+ days) and ships with 23 Curated Detections (23/23 Enabled) built specifically for PHP2Shell!

Look at how deeply these 23 curated YARA-L rules cover every single stage of the PHP2Shell attack chain (MITRE ATT&CK T1190 / TA0001):

1. Catching the Memory Bleed (Critical Severity):
   • PHP Anomalous Oversized Set-Cookie Memory Disclosure: Directly detects the CVE-2026-109618 PS(id) dangling-pointer leak where freed worker heap memory is URL-encoded into an abnormally large PHPSESSID response header.
2. Catching the OOM Bailout & Memory Exhaustion Triggers (High Severity):
   • PHP Multipart or Session Upload Progress Memory Exhaustion Attempt
   • PHP GZIP or Deflate Decompression Bomb Attempt
   • PHP Deserialization, JSON, or XML Memory Exhaustion Bomb Attempt
   • PHP Pre-Execution Memory Exhaustion Bailout
3. Catching the Use-After-Free & OPcache RCE Primitives (High Severity):
   • PHP Fatal Error Backtrace UAF Execution Behavior (targeting CVE-2026-109619 EG(last_fatal_error_backtrace))
   • PHP OPcache Persistence Bailout and Heap Spray Sequence (targeting zend_accel_script_persist() shared-memory corruption)
   • Linux Web Worker Abnormal Process Termination Burst (detecting worker churn from repeated OOM crashes and heap grooming)

---

How to Retro-Hunt in Google SecOps Right Now

If you are using Google SecOps, here is what I recommend doing today:

1. Open Emerging Threats in Google SecOps and select Opportunistic Threat Actors Attempt Exploitation of CVE-2026-109618 and CVE-2026-109619 in PHP (GLOBAL.26.015).
2. Verify that all 23/23 Associated Rules are enabled in your curated detections set.
3. Click + New Threat Hunt (and run a Retrohunt across your Cloud Load Balancing, Cloud Armor, Apache/Nginx, and EDR telemetry going back at least 7–14 days) to confirm no attacker triggered an oversized Set-Cookie memory leak or worker crash burst before your patch landed.

Combining Google Cloud Armor at the edge (Part 1), runtime patching (Part 2), and GTI + Google SecOps retro-hunting gives you complete end-to-end defense. Want to see this in action? Reach out on LinkedIn or via my contact page—VAMOS! 🛡️🚀