PHP2SHELL Detection Coverage in THOR

THOR applies Sigma rules to supported log data on an endpoint during a scan. For PHP2SHELL, this means looking for exploit-related artifacts in web-server logs and for recorded post-exploitation activity. Private YARA rules provide additional checks for artifacts in log content. The vulnerabilities, CVE-2026-109618 and CVE-2026-109619, are documented in PHP’s advisories on out-of-memory corruption and stale global state . Our PHP2SHELL work adds specific log indicators…