[![Logo](https://www.paloaltonetworks.com/wp-content/uploads/2021/07/PANW_Parent.png)](https://www.paloaltonetworks.jp/) [![Unit42 Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/unit42-logo-white.svg)](https://unit42.paloaltonetworks.com/ja/) Menu * [セキュリティ コンサルティング](https://www.paloaltonetworks.com/unit42) * [**現在、攻撃を受けていますか?**](https://start.paloaltonetworks.com/contact-unit42.html) Japanese * [English](https://unit42.paloaltonetworks.com/cve-2026-109618-cve-2026-109619/) * [Japanese](https://unit42.paloaltonetworks.com/ja/cve-2026-109618-cve-2026-109619/) * [Threat Research Center](https://unit42.paloaltonetworks.com/ja/ "Threat Research") * [主なサイバー脅威](https://unit42.paloaltonetworks.com/ja/category/top-cyberthreats-ja/ "主なサイバー脅威") * [脆弱性](https://unit42.paloaltonetworks.com/ja/category/vulnerabilities-ja/ "脆弱性") [脆弱性](https://unit42.paloaltonetworks.com/ja/category/vulnerabilities-ja/) # 脅威の概要: PHP における重大な脆弱性: CVE-2026-109618、CVE-2026-109619 (10月29日更新) ![Clock Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-clock.svg) 5 分で読めます Related Products [![Advanced Threat Prevention icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Advanced Threat Prevention](https://unit42.paloaltonetworks.com/ja/product-category/advanced-threat-prevention-ja/ "Advanced Threat Prevention")[![Advanced WildFire icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Advanced WildFire](https://unit42.paloaltonetworks.com/ja/product-category/advanced-wildfire-ja/ "Advanced WildFire")[![Cloud-Delivered Security Services icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Cloud-Delivered Security Services](https://unit42.paloaltonetworks.com/ja/product-category/cloud-delivered-security-services-ja/ "Cloud-Delivered Security Services")[![Cortex icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/cortex_RGB_logo_Icon_Color.png)Cortex](https://unit42.paloaltonetworks.com/ja/product-category/cortex-ja/ "Cortex")[Cortex Cloud](https://unit42.paloaltonetworks.com/ja/product-category/cortex-cloud-ja/ "Cortex Cloud")[![Cortex XDR icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/cortex_RGB_logo_Icon_Color.png)Cortex XDR](https://unit42.paloaltonetworks.com/ja/product-category/cortex-xdr-ja/ "Cortex XDR")[![Cortex Xpanse icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/cortex_RGB_logo_Icon_Color.png)Cortex Xpanse](https://unit42.paloaltonetworks.com/ja/product-category/cortex-xpanse-ja/ "Cortex Xpanse")[![Cortex XSIAM icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/cortex_RGB_logo_Icon_Color.png)Cortex XSIAM](https://unit42.paloaltonetworks.com/ja/product-category/cortex-xsiam-ja/ "Cortex XSIAM")[![Next-Generation Firewall icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Next-Generation Firewall](https://unit42.paloaltonetworks.com/ja/product-category/next-generation-firewall-ja/ "Next-Generation Firewall")[![Prisma Cloud icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/prisma_RGB_logo_Icon_Color.png)Prisma Cloud](https://unit42.paloaltonetworks.com/ja/product-category/prisma-cloud-ja/ "Prisma Cloud")[![Prisma Cloud Compute icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/prisma_RGB_logo_Icon_Color.png)Prisma Cloud Compute](https://unit42.paloaltonetworks.com/ja/product-category/prisma-cloud-compute-ja/ "Prisma Cloud Compute")[![Unit 42 Incident Response icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/unit42_RGB_logo_Icon_Color.png)Unit 42 Incident Response](https://unit42.paloaltonetworks.com/ja/product-category/unit-42-incident-response-ja/ "Unit 42 Incident Response") * ![Profile Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-profile-grey.svg) 著者: * [Unit 42](https://unit42.paloaltonetworks.com/ja/author/unit42/) * ![Published Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-calendar-grey.svg) 公開日:2026年10月29日 * ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-category.svg) カテゴリー * [主なサイバー脅威](https://unit42.paloaltonetworks.com/ja/category/top-cyberthreats-ja/) * [脆弱性](https://unit42.paloaltonetworks.com/ja/category/vulnerabilities-ja/) * ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-tags-grey.svg) タグ: * [CVE-2026-109618](https://unit42.paloaltonetworks.com/ja/tag/cve-2026-109618/) * [CVE-2026-109619](https://unit42.paloaltonetworks.com/ja/tag/cve-2026-109619/) * [PHP2Shell](https://unit42.paloaltonetworks.com/ja/tag/php2shell/) * [![Download Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-download.svg)](https://unit42.paloaltonetworks.com/ja/cve-2026-109618-cve-2026-109619/?pdf=download&lg=ja&_wpnonce=d1bc81bb86 "Click here to download") * [![Print Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-print.svg)](https://unit42.paloaltonetworks.com/ja/cve-2026-109618-cve-2026-109619/?pdf=print&lg=ja&_wpnonce=d1bc81bb86 "Click here to print") 共有![Down arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/down-arrow.svg) * ![Link Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-share-link.svg) * [![Link Email](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-sms.svg)]( "Share in email") * [![Facebook Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-fb-share.svg)](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Funit42.paloaltonetworks.com%2Fja%2Fcve-2026-109618-cve-2026-109619%2F "Share in Facebook") * [![LinkedIn Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-linkedin-share.svg)]( "Share in LinkedIn") * [![Twitter Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-twitter-share.svg)]( "Share in Twitter") * [![Reddit Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-reddit-share.svg)](https://www.paloaltonetworks.com//www.reddit.com/submit?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Fja%2Fcve-2026-109618-cve-2026-109619%2F&ts=markdown "Share in Reddit") * [![Mastodon Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-mastodon-share.svg)]( "Share in Mastodon") ## エグゼクティブサマリ Unit 42 は、PHP における 2 つの重大な脆弱性、CVE-2026-109618 および CVE-2026-109619 (PHP2Shell と呼称) を認識しています。両者ともに、CVSS 4.0 で 9.2 と評価されているリモートコード実行 (RCE) の脆弱性です。[PHP Group のセキュリティアドバイザリおよびパッチ適用ガイダンス](https://www.php.net/index.php)を確認することを推奨します。 PHP は、世界中の Web サーバーやコンテンツ管理システム (CMS) で広く使用されています。これらの脆弱性に対するエクスポージャー (露出) を評価し、直ちにパッチを適用することを推奨します。 パロアルトネットワークスは、この問題に関して自社の製品ポートフォリオを評価しました。最新の詳細については、弊社の[セキュリティアドバイザリ](https://security.paloaltonetworks.com/CVE-2026-109618)を参照してください。 * [CVE-2026-109618](https://nvd.nist.gov/vuln/detail/cve-2026-109618) は、不適切な制御フロー管理により、longjmp() を介したメモリ不足 (out-of-memory) エラーの処理時にリクエストメモリが初期化されないままになるというリモートコード実行の脆弱性であり、攻撃者は OOM (メモリ不足) トリガーを使用して確実に RCE を実行できるようになります。 * [CVE-2026-109619](https://nvd.nist.gov/vuln/detail/cve-2026-109619) は、longjmp() の致命的なエラー (fatal error) 処理により、グローバルメモリが解放済みのメモリ領域を指したままになるというリモートコード実行の脆弱性です。これらの領域は、後続のリクエスト中に読み取られたり分岐されたりする可能性があり、攻撃者による任意のコード実行を可能にします。 最初の公開時点で、パロアルトネットワークスの[Cortex Xpanse](https://docs-cortex.paloaltonetworks.com/p/XPANSE) は、当社のテレメトリに基づき、CVE-2026-109618 および CVE-2026-109619 に対して潜在的に脆弱な 2,200 万を超える公開インスタンスの存在を特定しています。 #### 2026年10月29日 弊社の[セキュリティアドバイザリ](https://security.paloaltonetworks.com/CVE-2026-109618)で開示されているように、PHP2Shell の脆弱性は、インターネットに公開されている PAN-OS 管理インターフェースに対して積極的に悪用されています。[Dream Research](https://dreamgroup.com/blog/chained-php2shell-exploit-roots-25-servers) は、攻撃者が PHP2Shell と Linux カーネルの特権昇格の脆弱性を連鎖 (チェーン) させて root アクセスを取得するキャンペーンを報告しました。Unit 42 は、同一の攻撃者のツールを独自に検証し、報告された結果を確認しました。 [セキュリティのベストプラクティス](https://docs.paloaltonetworks.com/best-practices/10-1/administrative-access-best-practices/administrative-access-best-practices/deploy-administrative-access-best-practices)に従い、デフォルトでは管理インターフェースはインターネットに公開されていません。パブリックインターネットから管理インターフェースへのアクセスが有効になっている場合、お客様は直ちにこれを削除する必要があります。また、お客様は信頼できる内部 IP アドレスへのアクセスを制限し、PHP2Shell に対処する利用可能な PAN-OS の修正プログラムを適用する必要があります。利用可能なパッチを適用したお客様は影響を受けません。これらの修正により、観測されたエクスプロイトチェーンは遮断されます。弊社のセキュリティアドバイザリでは、影響を受けるバージョン、パッチの提供状況、および緩和策の要件を提供しています。弊社の[セキュリティアドバイザリ](https://security.paloaltonetworks.com/CVE-2026-109618)の「回避策と緩和策 (Workarounds and Mitigations)」セクションでは、Advanced Threat Prevention のシグネチャがこの脆弱性に対してどのようにカバレッジを提供するかについての詳細も記載されています。 当社の全世界のインストールベースのうち、インターネットに面した管理インターフェースを設定しており、高い露出リスクにさらされていたのはごく一部 (約 0.02%) に過ぎません。これらの各お客様には、当社のチームが個別に連絡を取っています。我々は引き続き調査を行い、必要に応じてアップデートが利用可能になり次第提供します。 パロアルトネットワークスのお客様は、以下の方法で CVE-2026-109618 および CVE-2026-109619 に対する保護と緩和策を受けることができます： * [Advanced WildFire](https://docs.paloaltonetworks.com/wildfire) * [Cortex XDR](https://docs-cortex.paloaltonetworks.com/p/XDR) および[XSIAM](https://docs-cortex.paloaltonetworks.com/p/XSIAM) * [Cortex Cloud](https://cortex-docs.paloaltonetworks.com/cortex-cloud-docs) および[Prisma Cloud](https://www.paloaltonetworks.com/prisma/cloud) * [Cortex Xpanse](https://docs-cortex.paloaltonetworks.com/p/XPANSE) * [Advanced Threat Prevention Plus with Frontier Virtual Patching](https://www.paloaltonetworks.com/blog/network-security/harnessing-ai-for-prevention-introducing-frontier-virtual-patching/) * [Advanced Threat Prevention](https://www.paloaltonetworks.com/network-security/advanced-threat-prevention) セキュリティサブスクリプションを搭載した[Next-Generation Firewall](https://www.paloaltonetworks.com/network-security/next-generation-firewall) * [Device Security](https://docs.paloaltonetworks.com/iot/getting-started/iot-security-solution) * [Unit 42 Continuous Frontier AI Defense](https://www.paloaltonetworks.ca/unit42/prepare-for-emerging-risks/continuous-frontier-ai-defense) また、パロアルトネットワークスは、これらの脆弱性に対するエクスポージャーを評価し、直ちにパッチを適用することを推奨します。 組織は、[Unit 42 Threat Intel Services](https://www.paloaltonetworks.com/unit42/threat-intelligence) およびその[Deep and Dark Web Service](https://www.paloaltonetworks.com/resources/datasheets/unit-42-deep-and-dark-web-service) を通じて、カスタマイズされた攻撃者インテリジェンス、アナリストへの直接相談、および専門的なエクスポージャー追跡にアクセスできます。 侵害への対応や、リスク低減のためのプロアクティブな評価については、[Unit 42 インシデントレスポンスチーム](https://start.paloaltonetworks.com/contact-unit42.html)にご相談いただくことも可能です。 |-------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | **解説する脆弱性** | [**CVE-2026-109618**](https://unit42.paloaltonetworks.com/ja/tag/cve-2026-109618/), [**CVE-2026-109619**](https://unit42.paloaltonetworks.com/ja/tag/cve-2026-109619/), **[PHP2Shell](https://unit42.paloaltonetworks.com/ja/tag/php2shell/)** | ## Unit 42 マネージドスレットハンティングクエリ Unit 42 マネージドスレットハンティングチームは、Cortex XDR および以下の XQL クエリを使用して、お客様環境全体でこれらの CVE を悪用しようとする試みを追跡し続けています。Cortex XDR のお客様は、これらの XQL クエリを使用して悪用の兆候を検索することもできます。 // Description: This query attempts to identify post-exploitation command execution within the context of a PHP web server or worker process. // Notes: This hunting query is not specific to CVE-2026-109618 and CVE-2026-109619. It is capable of identifying exploitation of various web application vulnerabilities. This query may also produce false positive findings depending on the specific web applications running. We recommend validating if any identified activity is expected for the web applications running on systems. config case\_sensitive = false | dataset = xdr\_data | filter event\_type = ENUM.PROCESS and event\_sub\_type = ENUM.PROCESS\_START and action\_process\_image\_name != null | fields _time, agent\_hostname, agent\_id, event\_id, actor\_effective\_username, actor\_process\_image\_name, actor\_process\_command\_line, action\_process\_image\_name, action\_process\_image\_path, action\_process\_image\_command\_line, causality\_actor\_process\_image\_name, causality\_actor\_process\_command\_line // Lowercase fields once | alter actor\_effective\_username = lowercase(actor\_effective\_username), actor\_process\_image\_name = lowercase(actor\_process\_image\_name), actor\_process\_command\_line = lowercase(actor\_process\_command\_line), action\_process\_image\_name = lowercase(action\_process\_image\_name), action\_process\_image\_path = lowercase(action\_process\_image\_path), action\_process\_image\_command\_line = lowercase(action\_process\_image\_command\_line), causality\_actor\_process\_image\_name = lowercase(causality\_actor\_process\_image\_name) // Anchor: PHP web worker (or the launcher that started it) as causality, PHP worker as direct parent, // a shell directly under an IIS worker, or the web service account outside an interactive login session | filter causality\_actor\_process\_image\_name ~= "^(?:apache2|httpd|apachectl|php-fpm\[0-9.\]\*|php-cgi\[0-9.\]\*(?:\\.cagefs)?|php-fcgi|sw-engine(?:-fpm)?|frankenphp|lsphp\[0-9\]\*|lshttpd|litespeed|xampp-control|wampmanager|laragon|de\\.appsolute\\.mampprohelper)(?:\\.exe)?$" or actor\_process\_image\_name ~= "^(?:apache2|httpd|php-fpm\[0-9.\]\*|php-cgi\[0-9.\]\*(?:\\.cagefs)?|php-fcgi|sw-engine(?:-fpm)?|frankenphp|lsphp\[0-9\]\*|lshttpd|litespeed)(?:\\.exe)?$" or (causality\_actor\_process\_image\_name = "w3wp.exe" and actor\_process\_image\_name in ("cmd.exe", "powershell.exe", "pwsh.exe")) or (actor\_effective\_username ~= "(?:^|\[^a-z0-9_-\])(?:www-data|apache|nginx|wwwrun|iusr)$" and coalesce(causality\_actor\_process\_image\_name, "") !~= "^(?:sshd(?:-session)?|screen|tmux|login|mosh-server|dropbear)$") or actor\_effective\_username contains "iis apppool" // Known-benign workloads (monitoring plugins, hosting control panels) and commands launched directly by CDK Drive DMS scripts | filter action\_process\_image\_command\_line !~= "(?:\\/usr\\/lib(?:64)?\\/nagios\\/plugins\\/|\\/usr\\/local\\/cpanel\\/|\\/usr\\/local\\/psa\\/|\\/opt\\/psa\\/|\\/usr\\/local\\/directadmin\\/|\\/usr\\/local\\/ispconfig\\/|\\/usr\\/local\\/virtualizor\\/|richdocumentscode|phpsysinfo|librenms|zabbix)" and coalesce(actor\_process\_command\_line, "") !~= "^(?:\\S+\\s+)?(?:\\/adp\\/(?:bin|3party|etc)\\/|\\/local\\/bin\\/uminfo)" // Phusion Passenger app spawns run id/uname/env from their spawn helpers | filter coalesce(action\_process\_image\_command\_line, "") !~= "^(?:\\/usr\\/bin\\/)?(?:id(?:\\s+-\[a-z\]+)?|uname(?:\\s+-\[a-z\]+)?|hostname|env)$|passenger-config\\s+system-metrics" or lowercase(coalesce(actor\_process\_command\_line, "")) !~= "passengeragent\\s+spawn-|spawn(?:preparer|envsetupper)shell|\\/helper-scripts\\/rack-preloader\\.rb|passenger\_ruby\_wrapper|phusion\_passenger" // RHEL-family /etc/profile runs these in every bash login shell | filter coalesce(action\_process\_image\_command\_line, "") !~= "^\\/usr\\/bin\\/(?:id\\s+-\[ug\]n|hostname)$" or lowercase(coalesce(actor\_process\_command\_line, "")) !~= "^(?:\\S\*\\/)?bash\\s+-\[a-z\]\*l|^-bash$" // parsed\_lookup: the tool is the first command of its parent "sh -c" and its output is piped into a text filter (scripted lookup) | alter tool = replace(action\_process\_image\_name, ".exe", ""), shell\_first\_cmd = arrayindex(regextract(coalesce(actor\_process\_command\_line, ""), "^-?(?:\\S\*\\/)?(?:ba|da|k)?sh\\s+-c\\s+(\\S+)"), 0) | alter parsed\_lookup = if(arrayindex(regextract(coalesce(shell\_first\_cmd, ""), "(\[^\\/\]+)$"), 0) = tool and actor\_process\_command\_line ~= "^-?(?:\\S\*\\/)?(?:ba|da|k)?sh\\s+-c\\s+\[^;\&|\]+\\|\\s\*(?:e?grep|awk|cut|sed|wc|head|tail|sort|tr)\\b", 1, 0) // Signals - one event can carry several | alter signals = concat( // SCORED - host/user/network/container recon, excluding scripted lookups (distinct tools are counted later) if(parsed\_lookup = 0 and (tool in ("whoami", "hostname", "hostnamectl", "ifconfig", "netstat", "ss", "arp", "route", "w", "who", "last", "lastlog", "getent", "lsb\_release", "lscpu", "printenv", "env", "getcap", "capsh", "systeminfo", "ipconfig", "nltest", "tasklist", "quser", "qwinsta") or (tool = "uname" and action\_process\_image\_command\_line ~= "\\buname\\s+(?:-\[a-z\]\*\[arv\]|--all|--kernel-)") or (tool = "id" and action\_process\_image\_command\_line !~= "\\bid\\s+-\[ugnrz\]+\\b") or (tool = "ip" and action\_process\_image\_command\_line ~= "\\bip\\s+(?:-\[a-z0-9\]+\\s+)\*(?:a|addr|address|r|route|n|neigh|link)\\b") or (tool = "ps" and action\_process\_image\_command\_line ~= "\\bps\\s+(?:-?aux|-ef|-e\\b|axjf|-auxf)") or (tool in ("net", "net1") and action\_process\_image\_command\_line ~= "\\bnet1?(?:\\.exe)?\\s+(?:user|group|localgroup|accounts|view|share)\\b") or (tool = "cat" and action\_process\_image\_command\_line ~= "\\/etc\\/(?:passwd|shadow|group|issue|os-release|hosts|hostname|resolv\\.conf|crontab|sudoers)|\\/proc\\/(?:version|net\\/|(?:self|\[0-9\]+)\\/(?:cgroup|mountinfo))|\\/\\.dockerenv") or (tool = "find" and action\_process\_image\_command\_line ~= "-perm\\s+(?:-4000|-u=s|\\/4000|-2000)") or (tool = "sudo" and action\_process\_image\_command\_line ~= "\\bsudo\\s+-l\\b")), "recon,", ""), // SCORED - payload transfer to a file (curl with an output file, wget not to stdout), excluding /dev/null and localhost if(((tool = "curl" and action\_process\_image\_command\_line ~= "\\s(?:-\[a-z\]\*o\\b|--output\\b|--remote-name)|\>\\s\*\\S") or (tool = "wget" and action\_process\_image\_command\_line !~= "\\s-\[a-z\]\*o\\s\*-(?:\\s|$)|--output-document=-|--spider") or (tool in ("tftp", "fetch") and action\_process\_image\_command\_line ~= "(?:https?|ftp|tftp):\\/\\/|\\s-\[a-z\]\*o(?:\\s|-|$)") or (tool = "certutil" and action\_process\_image\_command\_line ~= "urlcache|verifyctl") or (tool = "bitsadmin" and action\_process\_image\_command\_line contains "/transfer") or (tool in ("powershell", "pwsh") and action\_process\_image\_command\_line ~= "downloadstring|downloadfile|invoke-webrequest|\\biwr\\b|net\\.webclient|start-bitstransfer")) and action\_process\_image\_command\_line !~= "-o\\s\*\\/dev\\/null|--output-document=\\/dev\\/null|:\\/\\/(?:localhost|127\\.0\\.0\\.1|\\\[::1\\\])?\[:\\/\]", "download,", ""), // SCORED - chmod making a file in a tmp-class directory executable if(tool = "chmod" and action\_process\_image\_command\_line ~= "\\bchmod\\s+(?:-\[a-z\]+\\s+)\*(?:\[0-7\]?(?:\[1357\]\[0-7\]{2}|\[0-7\]\[1357\]\[0-7\]|\[0-7\]{2}\[1357\])|\[ugoa,+=rwst-\]\*\[+=\]\[rwst\]\*x\[ugoa,+=rwxst-\]\*)\\s" and action\_process\_image\_command\_line ~= "\\s\\/(?:tmp|var\\/tmp|dev\\/shm|run\\/shm)\\/", "staging,", ""), // STANDALONE - binary executed from a writable/memory-backed dir, or from a deleted/memfd image if(action\_process\_image\_path ~= "^\\/(?:tmp|var\\/tmp|dev\\/shm|run\\/shm|run\\/user)\\/|^\\/proc\\/(?:self|\[0-9\]+)\\/fd\\/|^\\/memfd:|\\(deleted\\)\\s\*$", "writable\_exec,", ""), // STANDALONE - reverse/bind shell constructs if(action\_process\_image\_command\_line ~= "\\/dev\\/(?:tcp|udp)\\/|(?:^|\[\\s;\&|(\\/\])(?:nc|ncat|netcat)(?:\\.\[a-z\]+)?\\s+(?:\\S+\\s+){0,6}?(?:-\[a-z\]{0,3}\[ec\]|--exec|--sh-exec)\\s+\\S\*(?:sh|bash|cmd|python\[0-9.\]\*|perl)\\b|\\bsocat\\b\[^;\&|\]{0,80}exec:|\\bmkfifo\\b|\\b(?:ba|da|z|a)?sh\\s+-i\\b|socket\\.socket\\(|fsockopen\\(|\\bpty\\.spawn\\(", "revshell,", ""), // STANDALONE - remote content piped straight into an interpreter if(action\_process\_image\_command\_line ~= "(?:curl|wget|fetch)\\b\[^|\]\*\\|\\s\*(?:\\/\\S\*\\/)?(?:(?:ba|da|z|a)?sh|python\[23\]?|perl|php)\\b", "pipe\_to\_shell,", ""), // SCORED - encoded/obfuscated execution if(action\_process\_image\_command\_line ~= "base64\\s+(?:-d|--decode)|frombase64string|-e(?:nc|ncodedcommand)?\\s+\[a-z0-9+\\/\]{40,}|echo\\s+\[a-z0-9+\\/\]{40,}|\\bopenssl\\s+(?:enc\\b\[^|;\]\*\\s-d\\b|base64\\s+-d\\b)|\\bxxd\\s+(?:-\[a-z\]+\\s+)\*-\[a-z\]\*r", "encoded,", ""), // SCORED - persistence / backgrounding (crontab edits, authorized\_keys writes, new users, nohup/setsid of tmp-class binaries or shells, // scheduled tasks, Run keys, systemd units, chattr +i) if((tool = "crontab" and action\_process\_image\_command\_line !~= "\\bcrontab\\s+-l\\s\*$") or (action\_process\_image\_command\_line ~= "(?:\>\>?\\s\*|\\btee\\s+(?:-a\\s+)?|\\b(?:cp|mv|install|ln)\\s+(?:-\\S+\\s+)\*\\S+\\s+)\\S\*authorized\_keys" and action\_process\_image\_command\_line !~= "\\bcp\\s+\\S\*\\/\\.ssh\\/id\_\[a-z0-9\]+\\.pub\\s+\\S\*\\/\\.ssh\\/authorized\_keys") or action\_process\_image\_command\_line ~= "\\b(?:useradd|adduser)\\b|\\b(?:nohup|setsid)\\s+(?:-\\S+\\s+)\*(?:\\.\\/|\\/(?:tmp|var\\/tmp|dev\\/shm|run\\/shm)\\/|(?:ba|da|z)?sh\\s+-\[ci\]\\b)|schtasks\\s+\\/create|currentversion.run\\b|\\bsystemctl\\s+(?:--user\\s+)?enable\\b|\\.config\\/systemd\\/user\\/|\\/etc\\/systemd\\/system\\/|\\bchattr\\s+\\+\[a-z\]\*i", "persistence,", ""), // SCORED - inline interpreter one-liners, excluding PHP version/feature probes and Ruby gem-path probes if(action\_process\_image\_command\_line ~= "(?:^|\[^a-z0-9.\_-\])(?:python\[23\]?(?:\\.\[0-9\]+)?\\s+-c|perl\\s+-e|ruby\\s+-e|node(?:js)?\\s+-e|lua\\s+-e|php\[0-9.\]\*\\s+-r)\\b" and action\_process\_image\_command\_line !~= "phpversion\\(|php\_version|date\\('t'\\)|function\_exists\\(|extension\_loaded\\(|gem\\.path", "interpreter,", ""), // SCORED - cloud/container credential and secret access (credential files, env-var names, instance metadata service, .env reads) if(action\_process\_image\_command\_line ~= "\\.aws\\/(?:credentials|config)|aws\_secret\_access\_key|aws\_session\_token|\\/\\.azure\\/|azure\_client\_secret|identity\_endpoint|\\/\\.config\\/gcloud\\/|application\_default\_credentials\\.json|\\/secrets\\/kubernetes\\.io\\/serviceaccount|\\/run\\/secrets\\/|\\/\\.docker\\/config\\.json|169\\.254\\.169\\.254|metadata\\.google\\.internal|\\/proc\\/(?:self|\[0-9\]+)\\/environ|\\b(?:cat|head|tail|less|more|strings|grep)\\b\[^|;\]\*\\.env\\b", "cred\_access,", "") ) | filter signals != "" | alter recon\_tool = if(signals contains "recon", tool, null) // Group per host, PHP worker and account in 1-hour buckets | bin \_time span = 1h | comp count() as events, count\_distinct(recon\_tool) as recon\_tool\_count, values(recon\_tool) as recon\_tools, values(signals) as signals, values(action\_process\_image\_command\_line) as action\_process\_image\_command\_line, values(actor\_process\_command\_line) as actor\_process\_command\_line, values(causality\_actor\_process\_command\_line) as causality\_actor\_process\_command\_line, first(event\_id) as event\_id by \_time, agent\_id, agent\_hostname, causality\_actor\_process\_image\_name, actor\_effective\_username | alter all\_signals = arraystring(signals, ",") // Threshold: any standalone signal, OR 3+ distinct recon tools, OR recon plus a follow-on scored signal | filter all\_signals ~= "revshell|pipe\_to\_shell|writable\_exec" or recon\_tool\_count \>= 3 or (recon\_tool\_count \>= 1 and all\_signals ~= "download|staging|encoded|persistence|interpreter|cred\_access") |-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 | // Description: This query attempts to identify post-exploitation command execution within the context of a PHP web server or worker process. // Notes: This hunting query is not specific to CVE-2026-109618 and CVE-2026-109619. It is capable of identifying exploitation of various web application vulnerabilities. This query may also produce false positive findings depending on the specific web applications running. We recommend validating if any identified activity is expected for the web applications running on systems. config case\_sensitive = false | dataset = xdr\_data | filter event\_type = ENUM.PROCESS and event\_sub\_type = ENUM.PROCESS\_START and action\_process\_image\_name != null | fields _time, agent\_hostname, agent\_id, event\_id, actor\_effective\_username, actor\_process\_image\_name, actor\_process\_command\_line, action\_process\_image\_name, action\_process\_image\_path, action\_process\_image\_command\_line, causality\_actor\_process\_image\_name, causality\_actor\_process\_command\_line // Lowercase fields once | alter actor\_effective\_username = lowercase(actor\_effective\_username), actor\_process\_image\_name = lowercase(actor\_process\_image\_name), actor\_process\_command\_line = lowercase(actor\_process\_command\_line), action\_process\_image\_name = lowercase(action\_process\_image\_name), action\_process\_image\_path = lowercase(action\_process\_image\_path), action\_process\_image\_command\_line = lowercase(action\_process\_image\_command\_line), causality\_actor\_process\_image\_name = lowercase(causality\_actor\_process\_image\_name) // Anchor: PHP web worker (or the launcher that started it) as causality, PHP worker as direct parent, // a shell directly under an IIS worker, or the web service account outside an interactive login session | filter causality\_actor\_process\_image\_name ~= "^(?:apache2|httpd|apachectl|php-fpm\[0-9.\]\*|php-cgi\[0-9.\]\*(?:\\.cagefs)?|php-fcgi|sw-engine(?:-fpm)?|frankenphp|lsphp\[0-9\]\*|lshttpd|litespeed|xampp-control|wampmanager|laragon|de\\.appsolute\\.mampprohelper)(?:\\.exe)?$" or actor\_process\_image\_name ~= "^(?:apache2|httpd|php-fpm\[0-9.\]\*|php-cgi\[0-9.\]\*(?:\\.cagefs)?|php-fcgi|sw-engine(?:-fpm)?|frankenphp|lsphp\[0-9\]\*|lshttpd|litespeed)(?:\\.exe)?$" or (causality\_actor\_process\_image\_name = "w3wp.exe" and actor\_process\_image\_name in ("cmd.exe", "powershell.exe", "pwsh.exe")) or (actor\_effective\_username ~= "(?:^|\[^a-z0-9_-\])(?:www-data|apache|nginx|wwwrun|iusr)$" and coalesce(causality\_actor\_process\_image\_name, "") !~= "^(?:sshd(?:-session)?|screen|tmux|login|mosh-server|dropbear)$") or actor\_effective\_username contains "iis apppool" // Known-benign workloads (monitoring plugins, hosting control panels) and commands launched directly by CDK Drive DMS scripts | filter action\_process\_image\_command\_line !~= "(?:\\/usr\\/lib(?:64)?\\/nagios\\/plugins\\/|\\/usr\\/local\\/cpanel\\/|\\/usr\\/local\\/psa\\/|\\/opt\\/psa\\/|\\/usr\\/local\\/directadmin\\/|\\/usr\\/local\\/ispconfig\\/|\\/usr\\/local\\/virtualizor\\/|richdocumentscode|phpsysinfo|librenms|zabbix)" and coalesce(actor\_process\_command\_line, "") !~= "^(?:\\S+\\s+)?(?:\\/adp\\/(?:bin|3party|etc)\\/|\\/local\\/bin\\/uminfo)" // Phusion Passenger app spawns run id/uname/env from their spawn helpers | filter coalesce(action\_process\_image\_command\_line, "") !~= "^(?:\\/usr\\/bin\\/)?(?:id(?:\\s+-\[a-z\]+)?|uname(?:\\s+-\[a-z\]+)?|hostname|env)$|passenger-config\\s+system-metrics" or lowercase(coalesce(actor\_process\_command\_line, "")) !~= "passengeragent\\s+spawn-|spawn(?:preparer|envsetupper)shell|\\/helper-scripts\\/rack-preloader\\.rb|passenger\_ruby\_wrapper|phusion\_passenger" // RHEL-family /etc/profile runs these in every bash login shell | filter coalesce(action\_process\_image\_command\_line, "") !~= "^\\/usr\\/bin\\/(?:id\\s+-\[ug\]n|hostname)$" or lowercase(coalesce(actor\_process\_command\_line, "")) !~= "^(?:\\S\*\\/)?bash\\s+-\[a-z\]\*l|^-bash$" // parsed\_lookup: the tool is the first command of its parent "sh -c" and its output is piped into a text filter (scripted lookup) | alter tool = replace(action\_process\_image\_name, ".exe", ""), shell\_first\_cmd = arrayindex(regextract(coalesce(actor\_process\_command\_line, ""), "^-?(?:\\S\*\\/)?(?:ba|da|k)?sh\\s+-c\\s+(\\S+)"), 0) | alter parsed\_lookup = if(arrayindex(regextract(coalesce(shell\_first\_cmd, ""), "(\[^\\/\]+)$"), 0) = tool and actor\_process\_command\_line ~= "^-?(?:\\S\*\\/)?(?:ba|da|k)?sh\\s+-c\\s+\[^;\&|\]+\\|\\s\*(?:e?grep|awk|cut|sed|wc|head|tail|sort|tr)\\b", 1, 0) // Signals - one event can carry several | alter signals = concat( // SCORED - host/user/network/container recon, excluding scripted lookups (distinct tools are counted later) if(parsed\_lookup = 0 and (tool in ("whoami", "hostname", "hostnamectl", "ifconfig", "netstat", "ss", "arp", "route", "w", "who", "last", "lastlog", "getent", "lsb\_release", "lscpu", "printenv", "env", "getcap", "capsh", "systeminfo", "ipconfig", "nltest", "tasklist", "quser", "qwinsta") or (tool = "uname" and action\_process\_image\_command\_line ~= "\\buname\\s+(?:-\[a-z\]\*\[arv\]|--all|--kernel-)") or (tool = "id" and action\_process\_image\_command\_line !~= "\\bid\\s+-\[ugnrz\]+\\b") or (tool = "ip" and action\_process\_image\_command\_line ~= "\\bip\\s+(?:-\[a-z0-9\]+\\s+)\*(?:a|addr|address|r|route|n|neigh|link)\\b") or (tool = "ps" and action\_process\_image\_command\_line ~= "\\bps\\s+(?:-?aux|-ef|-e\\b|axjf|-auxf)") or (tool in ("net", "net1") and action\_process\_image\_command\_line ~= "\\bnet1?(?:\\.exe)?\\s+(?:user|group|localgroup|accounts|view|share)\\b") or (tool = "cat" and action\_process\_image\_command\_line ~= "\\/etc\\/(?:passwd|shadow|group|issue|os-release|hosts|hostname|resolv\\.conf|crontab|sudoers)|\\/proc\\/(?:version|net\\/|(?:self|\[0-9\]+)\\/(?:cgroup|mountinfo))|\\/\\.dockerenv") or (tool = "find" and action\_process\_image\_command\_line ~= "-perm\\s+(?:-4000|-u=s|\\/4000|-2000)") or (tool = "sudo" and action\_process\_image\_command\_line ~= "\\bsudo\\s+-l\\b")), "recon,", ""), // SCORED - payload transfer to a file (curl with an output file, wget not to stdout), excluding /dev/null and localhost if(((tool = "curl" and action\_process\_image\_command\_line ~= "\\s(?:-\[a-z\]\*o\\b|--output\\b|--remote-name)|\>\\s\*\\S") or (tool = "wget" and action\_process\_image\_command\_line !~= "\\s-\[a-z\]\*o\\s\*-(?:\\s|$)|--output-document=-|--spider") or (tool in ("tftp", "fetch") and action\_process\_image\_command\_line ~= "(?:https?|ftp|tftp):\\/\\/|\\s-\[a-z\]\*o(?:\\s|-|$)") or (tool = "certutil" and action\_process\_image\_command\_line ~= "urlcache|verifyctl") or (tool = "bitsadmin" and action\_process\_image\_command\_line contains "/transfer") or (tool in ("powershell", "pwsh") and action\_process\_image\_command\_line ~= "downloadstring|downloadfile|invoke-webrequest|\\biwr\\b|net\\.webclient|start-bitstransfer")) and action\_process\_image\_command\_line !~= "-o\\s\*\\/dev\\/null|--output-document=\\/dev\\/null|:\\/\\/(?:localhost|127\\.0\\.0\\.1|\\\[::1\\\])?\[:\\/\]", "download,", ""), // SCORED - chmod making a file in a tmp-class directory executable if(tool = "chmod" and action\_process\_image\_command\_line ~= "\\bchmod\\s+(?:-\[a-z\]+\\s+)\*(?:\[0-7\]?(?:\[1357\]\[0-7\]{2}|\[0-7\]\[1357\]\[0-7\]|\[0-7\]{2}\[1357\])|\[ugoa,+=rwst-\]\*\[+=\]\[rwst\]\*x\[ugoa,+=rwxst-\]\*)\\s" and action\_process\_image\_command\_line ~= "\\s\\/(?:tmp|var\\/tmp|dev\\/shm|run\\/shm)\\/", "staging,", ""), // STANDALONE - binary executed from a writable/memory-backed dir, or from a deleted/memfd image if(action\_process\_image\_path ~= "^\\/(?:tmp|var\\/tmp|dev\\/shm|run\\/shm|run\\/user)\\/|^\\/proc\\/(?:self|\[0-9\]+)\\/fd\\/|^\\/memfd:|\\(deleted\\)\\s\*$", "writable\_exec,", ""), // STANDALONE - reverse/bind shell constructs if(action\_process\_image\_command\_line ~= "\\/dev\\/(?:tcp|udp)\\/|(?:^|\[\\s;\&|(\\/\])(?:nc|ncat|netcat)(?:\\.\[a-z\]+)?\\s+(?:\\S+\\s+){0,6}?(?:-\[a-z\]{0,3}\[ec\]|--exec|--sh-exec)\\s+\\S\*(?:sh|bash|cmd|python\[0-9.\]\*|perl)\\b|\\bsocat\\b\[^;\&|\]{0,80}exec:|\\bmkfifo\\b|\\b(?:ba|da|z|a)?sh\\s+-i\\b|socket\\.socket\\(|fsockopen\\(|\\bpty\\.spawn\\(", "revshell,", ""), // STANDALONE - remote content piped straight into an interpreter if(action\_process\_image\_command\_line ~= "(?:curl|wget|fetch)\\b\[^|\]\*\\|\\s\*(?:\\/\\S\*\\/)?(?:(?:ba|da|z|a)?sh|python\[23\]?|perl|php)\\b", "pipe\_to\_shell,", ""), // SCORED - encoded/obfuscated execution if(action\_process\_image\_command\_line ~= "base64\\s+(?:-d|--decode)|frombase64string|-e(?:nc|ncodedcommand)?\\s+\[a-z0-9+\\/\]{40,}|echo\\s+\[a-z0-9+\\/\]{40,}|\\bopenssl\\s+(?:enc\\b\[^|;\]\*\\s-d\\b|base64\\s+-d\\b)|\\bxxd\\s+(?:-\[a-z\]+\\s+)\*-\[a-z\]\*r", "encoded,", ""), // SCORED - persistence / backgrounding (crontab edits, authorized\_keys writes, new users, nohup/setsid of tmp-class binaries or shells, // scheduled tasks, Run keys, systemd units, chattr +i) if((tool = "crontab" and action\_process\_image\_command\_line !~= "\\bcrontab\\s+-l\\s\*$") or (action\_process\_image\_command\_line ~= "(?:\>\>?\\s\*|\\btee\\s+(?:-a\\s+)?|\\b(?:cp|mv|install|ln)\\s+(?:-\\S+\\s+)\*\\S+\\s+)\\S\*authorized\_keys" and action\_process\_image\_command\_line !~= "\\bcp\\s+\\S\*\\/\\.ssh\\/id\_\[a-z0-9\]+\\.pub\\s+\\S\*\\/\\.ssh\\/authorized\_keys") or action\_process\_image\_command\_line ~= "\\b(?:useradd|adduser)\\b|\\b(?:nohup|setsid)\\s+(?:-\\S+\\s+)\*(?:\\.\\/|\\/(?:tmp|var\\/tmp|dev\\/shm|run\\/shm)\\/|(?:ba|da|z)?sh\\s+-\[ci\]\\b)|schtasks\\s+\\/create|currentversion.run\\b|\\bsystemctl\\s+(?:--user\\s+)?enable\\b|\\.config\\/systemd\\/user\\/|\\/etc\\/systemd\\/system\\/|\\bchattr\\s+\\+\[a-z\]\*i", "persistence,", ""), // SCORED - inline interpreter one-liners, excluding PHP version/feature probes and Ruby gem-path probes if(action\_process\_image\_command\_line ~= "(?:^|\[^a-z0-9.\_-\])(?:python\[23\]?(?:\\.\[0-9\]+)?\\s+-c|perl\\s+-e|ruby\\s+-e|node(?:js)?\\s+-e|lua\\s+-e|php\[0-9.\]\*\\s+-r)\\b" and action\_process\_image\_command\_line !~= "phpversion\\(|php\_version|date\\('t'\\)|function\_exists\\(|extension\_loaded\\(|gem\\.path", "interpreter,", ""), // SCORED - cloud/container credential and secret access (credential files, env-var names, instance metadata service, .env reads) if(action\_process\_image\_command\_line ~= "\\.aws\\/(?:credentials|config)|aws\_secret\_access\_key|aws\_session\_token|\\/\\.azure\\/|azure\_client\_secret|identity\_endpoint|\\/\\.config\\/gcloud\\/|application\_default\_credentials\\.json|\\/secrets\\/kubernetes\\.io\\/serviceaccount|\\/run\\/secrets\\/|\\/\\.docker\\/config\\.json|169\\.254\\.169\\.254|metadata\\.google\\.internal|\\/proc\\/(?:self|\[0-9\]+)\\/environ|\\b(?:cat|head|tail|less|more|strings|grep)\\b\[^|;\]\*\\.env\\b", "cred\_access,", "") ) | filter signals != "" | alter recon\_tool = if(signals contains "recon", tool, null) // Group per host, PHP worker and account in 1-hour buckets | bin \_time span = 1h | comp count() as events, count\_distinct(recon\_tool) as recon\_tool\_count, values(recon\_tool) as recon\_tools, values(signals) as signals, values(action\_process\_image\_command\_line) as action\_process\_image\_command\_line, values(actor\_process\_command\_line) as actor\_process\_command\_line, values(causality\_actor\_process\_command\_line) as causality\_actor\_process\_command\_line, first(event\_id) as event\_id by \_time, agent\_id, agent\_hostname, causality\_actor\_process\_image\_name, actor\_effective\_username | alter all\_signals = arraystring(signals, ",") // Threshold: any standalone signal, OR 3+ distinct recon tools, OR recon plus a follow-on scored signal | filter all\_signals ~= "revshell|pipe\_to\_shell|writable\_exec" or recon\_tool\_count \>= 3 or (recon\_tool\_count \>= 1 and all\_signals ~= "download|staging|encoded|persistence|interpreter|cred\_access") | // Description: This query identifies potential inbound exploitation attempts from publicly routed IP addresses using Palo Alto Networks NGFW Threat Logs. config case\_sensitive = false | dataset = panw\_ngfw\_threat\_raw | filter sub\_type = "vulnerability" | filter to\_zone !~= "internet|untrust|outside|external|wan" | filter not (incidr(source\_ip, "10.0.0.0/8") or incidr(source\_ip, "172.16.0.0/12") or incidr(source\_ip, "192.168.0.0/16")) | filter to\_string(threat\_id) contains "543004" or threat\_name ~= "php|multipart|upload.progress|longjmp|CVE-2026-10961\[89\]" | comp count() as hits, count\_distinct(source\_ip) as sources, values(source\_ip) as source\_ips, values(action) as actions, values(severity) as severities, min(\_time) as first\_seen, max(\_time) as last\_seen by threat\_name, threat\_id, dest\_ip, nat\_dest, dest\_port, to\_zone | sort desc hits |----------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | 1 2 3 4 5 6 7 8 9 10 11 12 | // Description: This query identifies potential inbound exploitation attempts from publicly routed IP addresses using Palo Alto Networks NGFW Threat Logs. config case\_sensitive = false | dataset = panw\_ngfw\_threat\_raw | filter sub\_type = "vulnerability" | filter to\_zone !~= "internet|untrust|outside|external|wan" | filter not (incidr(source\_ip, "10.0.0.0/8") or incidr(source\_ip, "172.16.0.0/12") or incidr(source\_ip, "192.168.0.0/16")) | filter to\_string(threat\_id) contains "543004" or threat\_name ~= "php|multipart|upload.progress|longjmp|CVE-2026-10961\[89\]" | comp count() as hits, count\_distinct(source\_ip) as sources, values(source\_ip) as source\_ips, values(action) as actions, values(severity) as severities, min(\_time) as first\_seen, max(\_time) as last\_seen by threat\_name, threat\_id, dest\_ip, nat\_dest, dest\_port, to\_zone | sort desc hits | ## CVE-2026-109618 および CVE-2026-109619 に対するパロアルトネットワークス製品の保護 パロアルトネットワークスのお客様は、いくつかの製品の保護とアップデートを活用して、これらの脆弱性を特定し防御することができます。 [Unit 42 Continuous Frontier AI Defense](https://www.paloaltonetworks.ca/unit42/prepare-for-emerging-risks/continuous-frontier-ai-defense) は、組織が動的な環境における隠れた未知のエクスポージャーを継続的に発見し、エージェンティックなテストと専門家の分析を通じて攻撃経路全体での現実世界での悪用可能性を検証し、リスク緩和を加速するための優先順位付けされた修復および仮想パッチ適用のガイダンスを提供できるように設計されたオフェンシブセキュリティサービスです。 組織は、[Unit 42 Threat Intel Services](https://www.paloaltonetworks.com/unit42/threat-intelligence) および当社の[Deep and Dark Web Service](https://www.paloaltonetworks.com/resources/datasheets/unit-42-deep-and-dark-web-service) を通じて、カスタマイズされた攻撃者インテリジェンス、アナリストへの直接相談、および専門的なエクスポージャー追跡にアクセスできます。 侵害された可能性がある場合、または緊急の事態が発生した場合は、[Unit 42 インシデントレスポンスチーム](https://start.paloaltonetworks.com/contact-unit42.html)にご連絡いただくか、以下にお電話ください： * 北米 (フリーダイヤル): +1 (866) 486-4842 (866.4.UNIT42) * 英国: +44.20.3743.3660 * 欧州および中東: +31.20.299.3130 * アジア: +65.6983.8730 * 日本: +81.50.1790.0200 * オーストラリア: +61.2.4062.7950 * インド: 000 800 050 45107 * 韓国: +82.080.467.8774 ### Advanced WildFire [Advanced WildFire](https://docs.paloaltonetworks.com/wildfire) の機械学習モデルおよび解析手法は、PHP とカーネルの連鎖した脆弱性に関連するインジケーター (IoC) に基づき、精査および更新されました。 ### Cortex XDR および XSIAM [Cortex XDR](https://docs-cortex.paloaltonetworks.com/p/XDR) および[XSIAM](https://docs-cortex.paloaltonetworks.com/p/XSIAM) は、悪用後の活動に対して多層的な保護を提供するように設計されています。また、Cortex XDR は、オンプレミス環境やレガシー環境を含むエンドポイントおよびサーバー全体にインストールされているソフトウェアの可視性を提供し、セキュリティチームが脆弱な PHP バージョンを実行しているシステムを特定して修復の優先順位を付けるのを支援します。 ### Cortex Cloud および Prisma Cloud [Cortex Cloud](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/vunerability-management/vulnerability-management-in-cortex-cloud) および[Prisma Cloud](https://docs.prismacloud.io/) は、コード、レジストリイメージ、およびランタイムインスタンス全体で脆弱な PHP バージョンを特定するのに役立ちます。Cortex Cloud の Supply Chain Attacks Portal は、チームが影響を受ける資産を特定し、脆弱なコンポーネントが再び導入されるのを防ぐための対策を講じるのを支援します。さらに、Cortex CLI は CI/CD パイプラインに統合され、イメージをスキャンして、レジストリやランタイム環境に到達する前に脆弱なイメージをブロックするポリシーを適用します。 ### Cortex Xpanse [Cortex Xpanse](https://docs-cortex.paloaltonetworks.com/p/XPANSE) は、パブリックインターネット上で公開されているデバイスを特定し、防御者にその結果をエスカレーションすることができます。お客様は、PHP Attack Surface Rule が有効になっていることを確認することで、このリスクに対するアラートを有効にできます。特定された結果は、Threat Response Center または Expander のインシデントビューで表示できます。これらの結果は、ASM モジュールを購入した Cortex XSIAM のお客様も利用可能です。 ### Next-Generation Firewall 以下のセキュリティサブスクリプションを搭載した[Next-Generation Firewall](https://www.paloaltonetworks.com/network-security/next-generation-firewall) は、攻撃のブロックに役立ちます： * [Advanced Threat Prevention Plus with Frontier Virtual Patching](https://www.paloaltonetworks.com/blog/network-security/harnessing-ai-for-prevention-introducing-frontier-virtual-patching/): 2026年10月20日午後10時21分 (太平洋標準時) 以降、脅威 ID[543004](https://threatvault.paloaltonetworks.com/?query=543004) を介して。 * [Advanced Threat Prevention](https://www.paloaltonetworks.com/network-security/advanced-threat-prevention): 2026年10月21日以降、弊社の[セキュリティアドバイザリ](https://security.paloaltonetworks.com/CVE-2026-109618)に完全にリストされている Threat Prevention シグネチャとベストプラクティスを介して。 ### Device Security [Device Security](https://docs.paloaltonetworks.com/iot/getting-started/iot-security-solution) は、運用環境における特殊なデバイスのアタックサーフェス (攻撃対象領域) をプロアクティブに保護するように設計されており、産業用プロトコルへの深い可視性、実用的なリスクの洞察、およびすべての OT および IoT 資産に対する適応型のセキュリティ適用を提供します。 ## 追加リソース * [Impact of Critical Vulnerabilities in PHP on Palo Alto Networks Products](https://security.paloaltonetworks.com/CVE-2026-109618) -- アドバイザリ, パロアルトネットワークス * [Millions of PHP Instances Exposed: What Organizations Need To Do Right Now](https://www.paloaltonetworks.com/blog/2026/10/millions-of-php-instances-exposed-what-organizations-need-to-do-right-now/) -- Lee Klarich, パロアルトネットワークス * [Security advisory: Critical remote code execution vulnerabilities, update now](https://www.php.net/archive/2026.php#2026-10-21-5) -- PHP * [Chained PHP2Shell Exploit Roots 25 Servers, including US Government Servers](https://dreamgroup.com/blog/chained-php2shell-exploit-roots-25-servers) --- Dream Research *2026年10月21日 午前9時30分 (太平洋標準時) 更新: パロアルトネットワークスのセキュリティアドバイザリを追加し、追加リソースのリンクを更新、製品保護のセクションを更新しました。* *2026年10月21日 午後1時 (太平洋標準時) 更新: 製品保護のセクションを更新しました。* *2026年10月22日 午後4時45分 (太平洋標準時) 更新: Advanced Threat Prevention、Cortex Cloud、および Prisma Cloud の追加の製品保護情報を追加し、軽微なコピーエディットを行いました。* *2026年10月23日 午後12時30分 (太平洋標準時) 更新: エージェンティック AI による悪用後の活動の詳細と、マネージドスレットハンティングクエリを追加しました。* *2026年10月25日 午後2時45分 (太平洋標準時) 更新: 10月23日の更新を撤回しました。* *2026年10月29日 午前11時 (太平洋標準時) 更新: 攻撃者が PHP2Shell と Linux カーネルの特権昇格の脆弱性を連鎖させ、インターネットに公開されている PAN-OS 管理インターフェースに対して root アクセスを取得するキャンペーンの詳細を追加しました。* *** ** * ** *** #### 10月25日 更新 Unit 42 は以前、当初 PHP2Shell の脆弱性に関連していると考えられていた侵害後の活動を観測したと報告しました。研究者らが確認したのは、脆弱な PHP アプリケーションのコンテキストで実行された欧州の政府機関に対する攻撃でした。これにより、我々はそれがこれらの脆弱性の悪用であると考えました。初期アクセスが特定の PHP2Shell CVE に関連していることは確認できていません。我々は 10月23日の以前の更新を撤回しました。 トップに戻る ### タグ * [CVE-2026-109618](https://unit42.paloaltonetworks.com/ja/tag/cve-2026-109618/ "CVE-2026-109618") * [CVE-2026-109619](https://unit42.paloaltonetworks.com/ja/tag/cve-2026-109619/ "CVE-2026-109619") * [PHP2Shell](https://unit42.paloaltonetworks.com/ja/tag/php2shell/ "PHP2Shell") [Threat Research Center](https://unit42.paloaltonetworks.com/ja/ "Threat Research") [次ページ:脅威概要: NetScaler Zero Days CVE-2026-88771およびCVE-2026-88772が実環境で悪用されている(9月30日更新)](https://unit42.paloaltonetworks.com/ja/netscaler-zero-days-exploited/ "脅威概要: NetScaler Zero Days CVE-2026-88771およびCVE-2026-88772が実環境で悪用されている(9月30日更新)") ### 目次 * ### 関連記事 ## 関連項目 脆弱性 リソース ![Pictorial representation of NetScaler zero days. Digital illustration of a map of North America with interconnected glowing lines and dots symbolizing network connections across the continent.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/06_Vulnerabilities_1920x900-5-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/07/top-threats.svg)主なサイバー脅威](https://unit42.paloaltonetworks.com/ja/category/top-cyberthreats-ja/) 2026年9月30日 [#### 脅威概要: NetScaler Zero Days CVE-2026-88771およびCVE-2026-88772が実環境で悪用されている(9月30日更新)](https://unit42.paloaltonetworks.com/ja/netscaler-zero-days-exploited/) * [Citrix](https://unit42.paloaltonetworks.com/ja/tag/citrix-ja/ "Citrix") * [Denial of service](https://unit42.paloaltonetworks.com/ja/tag/denial-of-service-ja/ "denial of service") * [Remote Code Execution](https://unit42.paloaltonetworks.com/ja/tag/remote-code-execution-ja/ "Remote Code Execution") [今すぐ読む ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ja/netscaler-zero-days-exploited/ "脅威概要: NetScaler Zero Days CVE-2026-88771およびCVE-2026-88772が実環境で悪用されている(9月30日更新)") ![Pictorial representation of a severe Linux vulnerability. Close-up of a woman wearing glasses and focusing intently on a computer screen.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/05/05_Vulnerabilities_1920x900-2-1-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/07/top-threats.svg)主なサイバー脅威](https://unit42.paloaltonetworks.com/ja/category/top-cyberthreats-ja/) 2026年5月5日 [#### Copy Fail:ここ数年で最も深刻なLinuxの脅威について必要な知識](https://unit42.paloaltonetworks.com/ja/cve-2026-31431-copy-fail/) * [Containers](https://unit42.paloaltonetworks.com/ja/tag/containers-ja/ "Containers") * [CVE-2026-31431](https://unit42.paloaltonetworks.com/ja/tag/cve-2026-31431/ "CVE-2026-31431") * [Kubernetes](https://unit42.paloaltonetworks.com/ja/tag/kubernetes-ja/ "Kubernetes") [今すぐ読む ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ja/cve-2026-31431-copy-fail/ "Copy Fail:ここ数年で最も深刻なLinuxの脅威について必要な知識") ![Pictorial representation of BeyondTrust vulnerability CVE-2026-1731. Digital art depicting a stylized mountain range with vibrant blue and red hues. The peaks are accentuated by glowing particles and an abstract, starry backdrop, creating a futuristic landscape.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/02/14_Overview_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/07/top-threats.svg)主なサイバー脅威](https://unit42.paloaltonetworks.com/ja/category/top-cyberthreats-ja/) 2026年2月19日 [#### BeyondTrustの深刻な脆弱性（CVE-2026-1731）の悪用においてVShellおよびSparkRATを確認](https://unit42.paloaltonetworks.com/ja/beyondtrust-cve-2026-1731/) * [Bash](https://unit42.paloaltonetworks.com/ja/tag/bash-ja/ "bash") * [CVE-2026-1731](https://unit42.paloaltonetworks.com/ja/tag/cve-2026-1731/ "CVE-2026-1731") * [Powershell](https://unit42.paloaltonetworks.com/ja/tag/powershell-ja/ "Powershell") [今すぐ読む ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ja/beyondtrust-cve-2026-1731/ "BeyondTrustの深刻な脆弱性（CVE-2026-1731）の悪用においてVShellおよびSparkRATを確認") ![](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/02/AdobeStock_1020436911-786x440.jpeg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/07/top-threats.svg)主なサイバー脅威](https://unit42.paloaltonetworks.com/ja/category/top-cyberthreats-ja/) 2026年2月17日 [#### 野放し状態で悪用されているIvanti EPMMの深刻な脆弱性](https://unit42.paloaltonetworks.com/ja/ivanti-cve-2026-1281-cve-2026-1340/) * [CVE-2026-1281](https://unit42.paloaltonetworks.com/ja/tag/cve-2026-1281/ "CVE-2026-1281") * [CVE-2026-1340](https://unit42.paloaltonetworks.com/ja/tag/cve-2026-1340/ "CVE-2026-1340") * [Ivanti](https://unit42.paloaltonetworks.com/ja/tag/ivanti-ja/ "Ivanti") [今すぐ読む ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ja/ivanti-cve-2026-1281-cve-2026-1340/ "野放し状態で悪用されているIvanti EPMMの深刻な脆弱性") ![Pictorial representation of CVE-2025-0921. Digital illustration of a map of North America with interconnected glowing lines and dots symbolizing network connections across the continent.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/01/06_Vulnerabilities_1920x900-2-1-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)脅威リサーチ](https://unit42.paloaltonetworks.com/ja/category/threat-research-ja/) 2026年1月30日 [#### SCADAシステムに存在する特権ファイルシステムの脆弱性](https://unit42.paloaltonetworks.com/ja/iconics-suite-cve-2025-0921/) * [CVE-2025-0921](https://unit42.paloaltonetworks.com/ja/tag/cve-2025-0921/ "CVE-2025-0921") * [Privilege escalation](https://unit42.paloaltonetworks.com/ja/tag/privilege-escalation-ja/ "privilege escalation") * [SCADA](https://unit42.paloaltonetworks.com/ja/tag/scada/ "SCADA") [今すぐ読む ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ja/iconics-suite-cve-2025-0921/ "SCADAシステムに存在する特権ファイルシステムの脆弱性") ![Pictorial representation of remote code execution in AI and machine learning libraries. Close-up of a woman wearing glasses and focusing intently on a computer screen.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/01/05_Vulnerabilities_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)脅威リサーチ](https://unit42.paloaltonetworks.com/ja/category/threat-research-ja/) 2026年1月13日 [#### 最新のAI/MLフォーマットとライブラリによるリモート コード実行](https://unit42.paloaltonetworks.com/ja/rce-vulnerabilities-in-ai-python-libraries/) * [Apple](https://unit42.paloaltonetworks.com/ja/tag/apple-ja/ "Apple") * [CVE-2025-23304](https://unit42.paloaltonetworks.com/ja/tag/cve-2025-23304/ "CVE-2025-23304") * [CVE-2026-22584](https://unit42.paloaltonetworks.com/ja/tag/cve-2026-22584/ "CVE-2026-22584") [今すぐ読む ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ja/rce-vulnerabilities-in-ai-python-libraries/ "最新のAI/MLフォーマットとライブラリによるリモート コード実行") ![Pictorial representation of MongoBleed, CVE-2025-14847. Digital image featuring a glowing padlock icon superimposed on a background of streaming blue binary code, symbolizing cybersecurity.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/01/AdobeStock_233494953-786x429.jpeg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/07/top-threats.svg)主なサイバー脅威](https://unit42.paloaltonetworks.com/ja/category/top-cyberthreats-ja/) 2026年1月13日 [#### 脅威ブリーフ: MongoDB の脆弱性 (CVE-2025-14847)](https://unit42.paloaltonetworks.com/ja/mongobleed-cve-2025-14847/) * [CVE-2025-14847](https://unit42.paloaltonetworks.com/ja/tag/cve-2025-14847/ "CVE-2025-14847") * [MongoDB](https://unit42.paloaltonetworks.com/ja/tag/mongodb-ja/ "MongoDB") [今すぐ読む ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ja/mongobleed-cve-2025-14847/ "脅威ブリーフ: MongoDB の脆弱性 (CVE-2025-14847)") ![Pictorial representation of CVE-2025-55182 (React) and CVE-2025-66478 (Next.js). Close-up of a digital display on electronic equipment with illuminated text reading "SYSTEM HACKED" in red, set against a blurred background of blue and red lights.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/12/02_Vulnerabilities_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/07/top-threats.svg)主なサイバー脅威](https://unit42.paloaltonetworks.com/ja/category/top-cyberthreats-ja/) 2025年12月12日 [#### React Server Components における重大な脆弱性の悪用 (12月12日更新)](https://unit42.paloaltonetworks.com/ja/cve-2025-55182-react-and-cve-2025-66478-next/) * [Cobalt Strike](https://unit42.paloaltonetworks.com/ja/tag/cobalt-strike-ja/ "Cobalt Strike") * [CVE-2025-55182](https://unit42.paloaltonetworks.com/ja/tag/cve-2025-55182-ja/ "CVE-2025-55182") * [CVE-2025-66478](https://unit42.paloaltonetworks.com/ja/tag/cve-2025-66478-ja/ "CVE-2025-66478") [今すぐ読む ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ja/cve-2025-55182-react-and-cve-2025-66478-next/ "React Server Components における重大な脆弱性の悪用 (12月12日更新)") ![Pictorial representation of an authentication coercion attack. Panoramic view of a city skyline at night, featuring vibrant light beams from skyscrapers and a deep blue sky.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/11/07_Vulnerabilities_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)脅威リサーチ](https://unit42.paloaltonetworks.com/ja/category/threat-research-ja/) 2025年11月10日 [#### 新たなアップデート。進化し続ける強制認証テクニック](https://unit42.paloaltonetworks.com/ja/authentication-coercion/) * [Mimikatz](https://unit42.paloaltonetworks.com/ja/tag/mimikatz-ja/ "Mimikatz") * [PrintNightmare](https://unit42.paloaltonetworks.com/ja/tag/printnightmare-ja/ "PrintNightmare") * [Privilege escalation](https://unit42.paloaltonetworks.com/ja/tag/privilege-escalation-ja/ "privilege escalation") [今すぐ読む ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ja/authentication-coercion/ "新たなアップデート。進化し続ける強制認証テクニック") * ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg) * ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg) ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg) ![Enlarged Image]() ![Newsletter](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/04/Unit-42_get-updates-banner.png) ![UNIT 42 Small Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/palo-alto-logo-small.svg) Unit 42 からの最新情報を取得 ## 進化する脅威の状況を常に先取り メール アドレス 本フォームを送信することにより、[利用規約](https://www.paloaltonetworks.jp/legal-notices/terms-of-use)に同意し、[プライバシー ポリシー](https://www.paloaltonetworks.jp/legal-notices/privacy)を承認したことになります。 本サイトは reCAPTCHA で保護されており、Googleの[プライバシー ポリシー](https://policies.google.com/privacy) と[サービス利用規約](https://policies.google.com/terms)が適用されます。 Invalid captcha! サブスクライブ ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg) ![loader](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-loader.svg) {#footer} 製品とサービス * [AI利用ネットワーク セキュリティ プラットフォーム](https://www.paloaltonetworks.jp/network-security) * [AIのセキュア バイ デザイン](https://www.paloaltonetworks.jp/precision-ai-security/secure-ai-by-design) * [Prisma AIRS](https://www.paloaltonetworks.jp/prisma/prisma-ai-runtime-security) * [AI Access Security](https://www.paloaltonetworks.jp/sase/ai-access-security) * [クラウド提供型セキュリティ サービス](https://www.paloaltonetworks.jp/network-security/security-subscriptions) * [Advanced Threat Prevention](https://www.paloaltonetworks.jp/network-security/advanced-threat-prevention) * [Advanced URL Filtering](https://www.paloaltonetworks.jp/network-security/advanced-url-filtering) * [Advanced WildFire](https://www.paloaltonetworks.jp/network-security/advanced-wildfire) * [Advanced DNS Security](https://www.paloaltonetworks.jp/network-security/advanced-dns-security) * [Enterprise Data Loss Prevention](https://www.paloaltonetworks.jp/sase/enterprise-data-loss-prevention) * [Enterprise IoT Security](https://www.paloaltonetworks.jp/content/pan/ja_JP/network-security/enterprise-iot-security) * [Medical IoT Security](https://www.paloaltonetworks.jp/network-security/medical-device-security) * [Industrial OT Security](https://www.paloaltonetworks.jp/content/pan/ja_JP/network-security/industrial-ot-security) * [SaaS Security](https://www.paloaltonetworks.jp/sase/saas-security) * [次世代ファイアウォール](https://www.paloaltonetworks.jp/network-security/next-generation-firewall) * [ハードウェア ファイアウォール](https://www.paloaltonetworks.jp/network-security/hardware-firewall-innovations) * [ソフトウェア ファイアウォール](https://www.paloaltonetworks.jp/network-security/software-firewalls) * [Strata Cloud Manager](https://www.paloaltonetworks.jp/network-security/strata-cloud-manager) * [SD-WAN for NGFW](https://www.paloaltonetworks.jp/network-security/sd-wan-subscription) * [PAN-OS](https://www.paloaltonetworks.jp/network-security/pan-os) * [Panorama](https://www.paloaltonetworks.jp/network-security/panorama) * [セキュア アクセス サービス エッジ](https://www.paloaltonetworks.jp/sase) * [Prisma SASE](https://www.paloaltonetworks.jp/sase) * [App Acceleration](https://www.paloaltonetworks.jp/sase/app-acceleration) * [自律型デジタルエクスペリエンス管理](https://www.paloaltonetworks.jp/sase/adem) * [Enterprise DLP](https://www.paloaltonetworks.jp/sase/enterprise-data-loss-prevention) * [Prisma Access](https://www.paloaltonetworks.jp/sase/access) * [Prisma Browser](https://www.paloaltonetworks.jp/sase/prisma-browser) * [Prisma SD-WAN](https://www.paloaltonetworks.jp/sase/sd-wan) * [リモート ブラウザ分離](https://www.paloaltonetworks.jp/sase/remote-browser-isolation) * [SaaS Security](https://www.paloaltonetworks.jp/sase/saas-security) * [AI駆動型セキュリティ運用プラットフォーム](https://www.paloaltonetworks.jp/cortex) * [Cloud Security](https://www.paloaltonetworks.jp/cortex/cloud) * [Cortex Cloud](https://www.paloaltonetworks.jp/cortex/cloud) * [Application Security](https://www.paloaltonetworks.jp/cortex/cloud/application-security) * [Cloud Posture Security](https://www.paloaltonetworks.jp/cortex/cloud/cloud-posture-security) * [Cloud Runtime Security](https://www.paloaltonetworks.jp/cortex/cloud/runtime-security) * [Prisma Cloud](https://www.paloaltonetworks.jp/prisma/cloud) * [AI駆動型SOC](https://www.paloaltonetworks.jp/cortex) * [Cortex XSIAM](https://www.paloaltonetworks.jp/cortex/cortex-xsiam) * [Cortex XDR](https://www.paloaltonetworks.jp/cortex/cortex-xdr) * [Cortex XSOAR](https://www.paloaltonetworks.jp/cortex/cortex-xsoar) * [Cortex Xpanse](https://www.paloaltonetworks.jp/cortex/cortex-xpanse) * [Unit 42マネージド ディテクション\&レスポンス](https://www.paloaltonetworks.jp/cortex/managed-detection-and-response) * [マネージドXSIAM](https://www.paloaltonetworks.jp/cortex/managed-xsiam) * [次世代のアイデンティティ セキュリティ](https://www.paloaltonetworks.jp/idira) * [特権アクセス管理](https://www.paloaltonetworks.jp/idira/human/privileged-access-management) * [アイデンティティ管理とアクセス管理](https://www.paloaltonetworks.jp/idira/human/identity-and-access-management) * [Endpoint Privilege Manager](https://www.paloaltonetworks.jp/idira/human/endpoint-privilege-manager) * [アイデンティティ ガバナンス](https://www.paloaltonetworks.jp/idira/human/identity-governance) * [従業員パスワード管理](https://www.paloaltonetworks.jp/idira/human/workforce-password-management) * [エージェンティック アイデンティティ](https://www.paloaltonetworks.jp/idira/agentic) * [シークレット管理](https://www.paloaltonetworks.jp/idira/machine/secrets-management) * [統合型シークレット ガバナンス](https://www.paloaltonetworks.jp/idira/machine/unified-secrets-governance) * [アプリケーションの認証情報配信](https://www.paloaltonetworks.jp/idira/machine/application-credentials-delivery) * [ベンダーの特権アクセス](https://www.paloaltonetworks.jp/idira/human/vendor-privileged-access) * [脅威インテリジェンス\&インシデント レスポンス サービス](https://www.paloaltonetworks.jp/unit42) * [予防評価](https://www.paloaltonetworks.jp/unit42/assess) * [インシデント レスポンス](https://www.paloaltonetworks.jp/unit42/respond) * [セキュリティ戦略を変革](https://www.paloaltonetworks.jp/unit42/transform) * [脅威インテリジェンスについて](https://www.paloaltonetworks.jp/unit42/threat-intelligence-partners) 会社名 * [パロアルトネットワークスについて](https://www.paloaltonetworks.jp/about-us) * [採用情報](https://jobs.paloaltonetworks.com/en/) * [お問合せ](https://www.paloaltonetworks.jp/company/contact-sales) * [企業責任](https://www.paloaltonetworks.com/about-us/corporate-responsibility) * [お客様向け](https://www.paloaltonetworks.jp/customers) * [IR](https://investors.paloaltonetworks.com/) * [拠点](https://www.paloaltonetworks.com/about-us/locations) * [ニュースルーム](https://www.paloaltonetworks.jp/company/newsroom) 人気のあるリンク * [ブログ](https://www.paloaltonetworks.com/blog/?lang=ja) * [コミュニティ](https://www.paloaltonetworks.com/communities) * [コンテンツライブラリ](https://www.paloaltonetworks.jp/resources) * [Cyberpedia](https://www.paloaltonetworks.jp/cyberpedia) * [イベントセンター](https://events.paloaltonetworks.com/) * [電子メール設定の管理](https://start.paloaltonetworks.com/preference-center) * [製品A〜Z](https://www.paloaltonetworks.jp/products/products-a-z) * [製品認証](https://www.paloaltonetworks.com/legal-notices/trust-center/compliance) * [脆弱性の報告](https://www.paloaltonetworks.com/security-disclosure) * [サイトマップ](https://www.paloaltonetworks.jp/sitemap) * [テクニカル ドキュメント](https://docs.paloaltonetworks.com/) * [Unit 42](https://unit42.paloaltonetworks.jp/) * [個人情報の販売および共有禁止](https://panwedd.exterro.net/portal/dsar.htm?target=panwedd) ![Palo Alto Networks Logo](https://www.paloaltonetworks.jp/etc/clientlibs/clean/imgs/pan-logo-dark.svg) * [プライバシー](https://www.paloaltonetworks.jp/legal-notices/privacy) * [トラスト センター](https://www.paloaltonetworks.jp/legal-notices/trust-center) * [利用規約](https://www.paloaltonetworks.jp/legal-notices/terms-of-use) * [ドキュメント](https://www.paloaltonetworks.jp/legal-notices) Copyright © 2026 Palo Alto Networks. All Rights Reserved * [![](https://www.paloaltonetworks.jp/etc/clientlibs/clean/imgs/social/youtube-black.svg)](https://www.youtube.com/user/paloaltonetworks) * [![](https://www.paloaltonetworks.jp/etc/clientlibs/clean/imgs/social/twitter-x-black.svg)](https://twitter.com/PaloAltoNtwks) * [![](https://www.paloaltonetworks.jp/etc/clientlibs/clean/imgs/social/facebook-black.svg)](https://www.facebook.com/PaloAltoNetworksJapan/) * [![](https://www.paloaltonetworks.jp/etc/clientlibs/clean/imgs/social/linkedin-black.svg)](https://www.linkedin.com/company/palo-alto-networks) * [![](https://www.paloaltonetworks.jp/content/dam/pan/en_US/images/icons/podcast.svg)](https://unit42.paloaltonetworks.com/unit-42-threat-vector-podcast/) * JP Select your language ![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg) ![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg) ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg) ### Default Heading Read the article ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg) Seekbar ![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg) ![Volume](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-volume.svg) Volume ![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg)