eMudhra TLS Compromise and PHP2Shell: How to Detect Both with Plixer One

You're probably aware of the recent TLS compromise and PHP vulnerabilities and have wondered what you can do to protect your network from these security incidents. In this blog we'll go into each issue and talk about how Plixer One protects your network from each of them.

TLS Compromise

The problem

Eight intermediate certificates issued by eMudhra were protected by weak private keys, meaning anyone could recover them from the public certificates. Someone holding those keys could issue fraudulent TLS certificates for any domain, impersonate websites, and intercept or modify encrypted traffic from a man-in-the-middle position.

Risks to your network

There are two risks to your network associated with the weak private keys. The first is if you have a web server and its TLS chain includes a compromised intermediate certificate, its certificate may be revoked so the web service becomes unavailable. The second is if you have clients that still trust the compromised intermediates, an attacker on the network path could forge a certificate for your server's hostname and gain a man-in-the-middle position. This exposes credentials, tokens, and data, as well as allows responses to be altered to benefit the attacker.

How to detect on your network

To detect the risks, server or client side, you can inspect TLS 1.2 headers (since TLS 1.3 encrypts the certificate, inspection of TLS 1.3 traffic requires decryption). Within the TLS header, information is included that allows you to identify the certificate issuer (eMudhra) as well as the specific intermediate certificates.

How detection is done with Plixer One

FlowPro keeps track of the certificate issuer for the TLS connections it sees, so you can search the last 48 hours of flow data for the use of these certificates.

The first step is to set up the report:

1. In Reports, open the Designer tab and start a new report. Name it something like TLS Certificate Issuers.
2. Choose your FlowPro as the device and FlowPro: Defender TLS as the template.
3. Add four rows set to Group By: sourceipaddress (Source), destinationipaddress (Destination), sslcertificateissuer (Issuer) and sslservernameindication (Server Name).
4. Add a fifth row, flowid (Flows), set to Count Distinct, and select it as the trend. Then save the report.

The second step is to run the report:

1. In Reports, open the Create tab, choose your FlowPro as the device, and pick TLS Certificate Issuers from Designed Reports.
2. Set the time window to cover the last 48 hours.
3. Add an Advanced Filter on sslcertificateissuer, set to "Like", with the value "eMudhra". It is case sensitive so make sure to get the capitalization correct.
4. Run the report.

You'll want to look for any row with one of the following Issuer values:

C=NL, O=eMudhra BV, CN=EM DV TLS CA - G3B
C=NL, O=eMudhra BV, CN=EM EV TLS CA - G3B
C=NL, O=eMudhra BV, CN=EM OV TLS CA - G3B
C=US, O=eMudhra Inc, CN=EM DV TLS CA - G3C
C=US, O=eMudhra Inc, CN=EM EV TLS CA - G3C
C=US, O=eMudhra Inc, CN=EM OV TLS CA - G3C

Any row with an Issuer including one of these values is a client (Source) that was handed one of these certificates, and the server it got it from (Destination).

If you want to be more proactive about the detections, you can add six Suricata rules to check the certificate a server sends against each of the compromised intermediates, and if one matches an alarm will get sent to Scrutinizer with the server and the client.

# eMudhra compromised ICA
alert tls any any -> any any (msg:"eMudhra compromised ICA - EM DV TLS CA G3B"; tls.cert_issuer; pcre:"/CN=EM DV TLS CA . G3B/"; classtype:policy-violation; sid:9200001; rev:1;)
alert tls any any -> any any (msg:"eMudhra compromised ICA - EM DV TLS CA G3C"; tls.cert_issuer; pcre:"/CN=EM DV TLS CA . G3C/"; classtype:policy-violation; sid:9200002; rev:1;)
alert tls any any -> any any (msg:"eMudhra compromised ICA - EM EV TLS CA G3B"; tls.cert_issuer; pcre:"/CN=EM EV TLS CA . G3B/"; classtype:policy-violation; sid:9200003; rev:1;)
alert tls any any -> any any (msg:"eMudhra compromised ICA - EM EV TLS CA G3C"; tls.cert_issuer; pcre:"/CN=EM EV TLS CA . G3C/"; classtype:policy-violation; sid:9200004; rev:1;)
alert tls any any -> any any (msg:"eMudhra compromised ICA - EM OV TLS CA G3B"; tls.cert_issuer; pcre:"/CN=EM OV TLS CA . G3B/"; classtype:policy-violation; sid:9200005; rev:1;)
alert tls any any -> any any (msg:"eMudhra compromised ICA - EM OV TLS CA G3C"; tls.cert_issuer; pcre:"/CN=EM OV TLS CA . G3C/"; classtype:policy-violation; sid:9200006; rev:1;)

PHP Vulnerabilities

The problem

Two vulnerabilities were reported in PHP, CVE-2026-109618 and CVE-2026-109619, that allow data disclosure and remote code execution, together known as PHP2Shell. All versions of PHP, from 5.4 through 8.5.11, are vulnerable.

Risks to your network

The risk of PHP2Shell to your network is extremely high. Anything exposed to the internet that runs PHP can be taken over by an unauthenticated attacker with just 2 HTTP requests. Active exploitation attempts are already underway, so it's likely that any exposure you have is currently being probed. These exposure points are instant footholds for attackers, giving them a starting point to perform reconnaissance and move laterally to targets with high value. Internal-only servers are lower risk, but can provide a high value target for attackers once they already have a foothold.

How to detect on your network

Detecting PHP2Shell on your network includes two parts: investigating attempts at exploitation, and investigating hosts that may already be compromised.

Detecting an attempt at exploitation is not deterministic, but indicative of an attack and should be investigated immediately. Indicators include large POST requests or POST requests that use specific PHP functions that are affected by the vulnerability.

Investigating hosts that have already been compromised includes looking for behaviors on the host that deviate from their baseline. This includes servers making outbound connections they normally wouldn't, unusual input and output traffic patterns, or exhibiting other malicious behaviors like lateral movement, data exfiltration, or remote ransomware.

How detection is done with Plixer One

Plixer One can detect clients attempting exploitation by identifying a specific PHP_SESSION_UPLOAD_PROGRESS field in a POST body, which is the second request that a potential threat may try to make to exploit the PHP2Shell vulnerability. Plixer One can also alert when a PHP connection is reporting an unpatched server version either in the X-Powered-By header or in the response from a phpinfo() call. The three Suricata rules below check for both of these, and can be applied to your FlowPro instance at /home/plixer/flowpro/rules/custom.rules. If detected, these will show up in Scrutinizer as a Web Application Attack policy alarm.

# php2shell CVE-2026-109618 / CVE-2026-109619 RCE in PHP
alert http any any -> any any (msg:"CORELIGHT EXPLOIT php2shell CVE-2026-109618 / CVE-2026-109619 Potential RCE in PHP longjmp() memory handling - PHP_SESSION_UPLOAD_PROGRESS in HTTP POST Body"; flow:established,to_server; http.method; content:"POST"; http.request_body; content:"PHP_SESSION_UPLOAD_PROGRESS"; fast_pattern; reference:cve,2026-109618; reference:cve,2026-109619; reference:url,corelight.com/blog/php2shell-detection-before-disclosure; reference:url,github.com/corelight/php2shell-detect; reference:url,php2shell.com; classtype:misc-activity; sid:3000650; rev:1; metadata:created_at 2026_10_16, mitre_tactic_id TA0001, mitre_technique_id T1190, deployment Perimeter, deployment Internal;)
alert http any any -> any any (msg:"CORELIGHT EXPLOIT php2shell CVE-2026-109618 / CVE-2026-109619 Potential RCE in PHP longjmp() memory handling - PHP advertises a potentially affected version in HTTP response header"; flow:established,to_client; http.response_header; content:"PHP/"; nocase; fast_pattern; pcre:"/^(?:X-Powered-By|Server):(?:[ \t]*|[^\r\n]*[ \t,\x3b(])PHP\/(?!(?:8\.2\.(?:3[5-9]|[4-9][0-9]|[1-9][0-9]{2,3})|8\.3\.(?:3[6-9]|[4-9][0-9]|[1-9][0-9]{2,3})|8\.4\.(?:2[7-9]|[3-9][0-9]|[1-9][0-9]{2,3})|8\.5\.(?:1[2-9]|[2-9][0-9]|[1-9][0-9]{2,3})))(?:5\.(?:[4-9]|[1-9][0-9]{1,2})|(?:[6-9]|[1-9][0-9])\.(?:0|[1-9][0-9]{0,2}))\.(?:0|[1-9][0-9]{0,3})(?:[-+][a-z0-9.+~_-]+)?(?:[ \t,\x3b)]|$)/i"; threshold: type limit, track by_src, count 1, seconds 3600; reference:cve,2026-109618; reference:cve,2026-109619; reference:url,corelight.com/blog/php2shell-detection-before-disclosure; reference:url,github.com/corelight/php2shell-detect; reference:url,php2shell.com; classtype:misc-activity; sid:3000651; rev:3; metadata:created_at 2026_10_16, mitre_tactic_id TA0043, mitre_technique_id T1592.002, deployment Perimeter, deployment Internal;)
alert http any any -> any any (msg:"CORELIGHT EXPLOIT php2shell CVE-2026-109618 / CVE-2026-109619 Potential RCE in PHP longjmp() memory handling - PHP phpinfo content advertises a potentially affected version"; flow:established,to_client; http.response_body; content:"PHP Version"; nocase; fast_pattern; pcre:"/<h1(?:[ \t\r\n]+[^>]{0,128})?>[ \t\r\n]*PHP Version[ \t]+(?!(?:8\.2\.(?:3[5-9]|[4-9][0-9]|[1-9][0-9]{2,3})|8\.3\.(?:3[6-9]|[4-9][0-9]|[1-9][0-9]{2,3})|8\.4\.(?:2[7-9]|[3-9][0-9]|[1-9][0-9]{2,3})|8\.5\.(?:1[2-9]|[2-9][0-9]|[1-9][0-9]{2,3})))(?:5\.(?:[4-9]|[1-9][0-9]{1,2})|(?:[6-9]|[1-9][0-9])\.(?:0|[1-9][0-9]{0,2}))\.(?:0|[1-9][0-9]{0,3})(?:[-+][a-z0-9.+~_-]+)?[ \t\r\n]*<\/h1>/i"; threshold: type limit, track by_src, count 1, seconds 3600; reference:cve,2026-109618; reference:cve,2026-109619; reference:url,corelight.com/blog/php2shell-detection-before-disclosure; reference:url,github.com/corelight/php2shell-detect; reference:url,php2shell.com; classtype:misc-activity; sid:3000652; rev:3; metadata:created_at 2026_10_16, mitre_tactic_id TA0043, mitre_technique_id T1592.002, deployment Perimeter, deployment Internal;)

Reference: corelight/php2shell-detect on GitHub

To help investigate hosts, Plixer One monitors commonly used services to identify anomalous and malicious activity. If a host is making outbound connections it normally wouldn't, Plixer One's anomaly detection will raise an alert on suspicious host communication, lateral movement behavior, or worm behavior. Anomalous data transmission is flagged as data accumulation or data exfiltration, and service behavior changes detect tunneling or brute force activity.

With the rise of AI use in penetration testing we've seen a lot of recent security incidents, and this trend is predicted to continue. Securing your network against emerging threats isn't an easy task, but Plixer One gives you the tools you need to stay ahead of the attackers.