CVE-2026-109618 and CVE-2026-109619 are critical remote code execution vulnerabilities in PHP core that leaked prior to official disclosure. The article examines the nature of these flaws and why exploitation consistently results in web servers spawning interactive shells. Elastic Security Labs analyzes the attack patterns associated with these vulnerabilities and details the detection logic developed to identify exploitation attempts. The convergence of exploitation behavior around web-server-to-shell patterns makes detection feasible through behavioral analysis. Elastic has developed specific detections targeting this behavior to provide coverage for affected organizations. The article serves both as a technical assessment and a practical guide for defenders using Elastic's security tooling.
