Two critical PHP RCEs are patched: CVE-2026-109618 and CVE-2026-109619, both CVSS 9.2. • Fixed in 8.5.12, 8.4.27, 8.3.36, and 8.2.35. You can still focus on detection coverage today. Security Labs writeup (coverage + guidance): elastic.co/security-labs/thr… Most PHP RCEs converge on the same outcome, whatever the bug: a web server process (php-fpm, php-cgi, apache2, httpd) doing something a request-serving daemon almost never does legitimately. • a shell to confirm access: id, whoami, uname -a • a second stage pulled in: curl http://... | bash • a reverse shell: bash -i >& /dev/tcp// • a webshell written into the web root The bug class is public now: out-of-memory corruption, and stale state reused by the same worker. The behavior is what you detect. We recently ran a different PHP RCE end-to-end (wp2shell): apache2 spawning dash to run id; whoami; hostname fired the exact rules that we suspect to catch php2shell. Payload Execution by Web Server kills the shell on the endpoint. The Suspicious/Unusual Command, Child, and File Creation via Web Server rules stack on top. (PHP did confirm partial php.ini mitigations. session.upload_progress.enabled=0 blocks the confirmed session paths only. Patch is still the fix.) Patch to 8.5.12, 8.4.27, 8.3.36, or 8.2.35. Verify that the stack is enabled now. Guidance + every rule link below.