Has Your Server Been Attacked via the PHP Emergency Vulnerability "php2shell"? Three Traces Left on Servers and How to Check

Checking for attacks that already happened

The writer, an infrastructure engineer, explains that updating PHP does not remove bad files or bad programs that attackers may have already placed or started. The article says attack attempts were seen on October 17, four days before the bug was made public on October 21. So the safe plan is to check server logs from October 17 until the time the update was finished.

Start by deciding which logs to check

Before you look for traces, decide the time range. Log rotation may delete old logs after about one week, so check whether old logs still exist and copy them somewhere safe. Then look at three places: the web requests received, the PHP error logs, and the processes the web server started.

Key facts to remember

• Attack attempts were seen on October 17, 2026, four days before the public release on October 21.
• A bad form request can be about 3.5 MB long, with a field name that is extremely long.
• A normal error message with "Unknown on line 0" can mean memory ran out before the script even started.
• A web server process running a shell (a program that runs commands) is the most direct sign of a successful attack.

Why this matters

A single clue is not proof. A memory error can happen during normal large uploads, and a successful attack may still return a normal HTTP 200 response. Experts must compare the times of requests, errors, and processes together. Good habits, such as logging request size now, will make future checks much easier.

What to watch next

• Look for form requests with very long field names or strange control characters.
• Search PHP and Apache logs for "Unknown on line 0", "Allowed memory size", and "Segmentation fault."
• Check whether the web server process started a shell, especially one that connects to an outside server.
• Confirm that the WAF (web firewall) inspects large requests fully, and that its limits match the application's limits.