title: PHP-FPM Worker Exited on Signal 11
id: 22b0c487-9b4c-499e-8c83-6c39d104b1a5
status: experimental
description: |
    Base rule for the correlation below. Detects a PHP-FPM log line saying a child exited on signal 11 (segmentation fault).
    Tested offline on synthetic log lines on 2026-10-22; on 2026-10-24 it fired on logs from real lab PHP containers (6 PHP-FPM and 6 Apache lines matched, 12 in the busiest five minutes against a threshold of 5), not on production traffic.
references:
    - https://cyray.io/attack-to-detection/t1190-php2shell-php-multipart-rce
author: CyRay
date: 2026-10-21
tags:
    - attack.initial-access
    - attack.t1190
    - attack.impact
    - attack.t1499.004
logsource:
    product: linux
    service: php-fpm
detection:
    keywords:
        - 'exited on signal 11'
    condition: keywords
falsepositives:
    - A broken PHP extension or a memory problem
level: low
---
title: Apache mod_php Child Exited on Signal 11
id: 5e8f1c3a-7d2b-4c61-9a0e-2f4b6d8c1e73
status: experimental
description: |
    Base rule for the correlation below. Detects an Apache error-log line saying a child process exited
    on SIGSEGV (AH00052), which is how a crashed mod_php worker is reported. The PHP-FPM rule above
    does not match this line (lab T-887046 synthetic test H, 2026-10-22).
references:
    - https://cyray.io/attack-to-detection/t1190-php2shell-php-multipart-rce
author: CyRay
date: 2026-10-22
tags:
    - attack.initial-access
    - attack.t1190
    - attack.impact
    - attack.t1499.004
logsource:
    product: apache
    service: error
detection:
    keywords:
        - 'exit signal Segmentation fault (11)'
    condition: keywords
falsepositives:
    - A broken Apache module or PHP extension, or a memory problem
level: low
---
title: PHP Worker Crash Burst (PHP-FPM or Apache mod_php)
id: 3c2b877a-4478-478f-8125-2a85873500a0
status: experimental
description: |
    Five or more PHP workers (PHP-FPM or Apache mod_php children) exiting on signal 11 within five minutes. The threshold is a starting value, not measured.
    Weakest of the five php2shell detections: no public source says the flaw crashes workers. Tested offline on synthetic log lines on 2026-10-22; on 2026-10-24 it fired on logs from real lab PHP containers (6 PHP-FPM and 6 Apache lines matched, 12 in the busiest five minutes against a threshold of 5), not on production traffic.
references:
    - https://cyray.io/attack-to-detection/t1190-php2shell-php-multipart-rce
author: CyRay
date: 2026-10-21
tags:
    - attack.initial-access
    - attack.t1190
    - attack.impact
    - attack.t1499.004
correlation:
    type: event_count
    rules:
        - 22b0c487-9b4c-499e-8c83-6c39d104b1a5
        - 5e8f1c3a-7d2b-4c61-9a0e-2f4b6d8c1e73
    timespan: 5m
    condition:
        gte: 5
falsepositives:
    - A faulty extension after an upgrade
level: low