[Unvalidated] Identifies a shell or reconnaissance tool spawned directly under a PHP worker process (php-fpm, lsphp, or Apache mod_php, where PHP runs in-process inside the apache2/httpd worker). This is a generic PHP child-process-monitoring indicator, useful against any PHP RCE regardless of root cause - it does not itself detect or confirm exploitation of CVE-2026-109618 or CVE-2026-109619 specifically. CVE attribution is unvalidated: the reference sample this rule's field-matching was checked against (https://github.com/rjmendez/phpup-2026/blob/master/examples/INDEX.md) was produced by a direct shell_exec() test endpoint, not by triggering either CVE''s actual longjmp/bailout mechanism (https://github.com/rjmendez/phpup-2026/blob/master/ANALYSIS.md). No representative malicious sample produced by exploiting either CVE has been validated against this query. Benign-use tuning: legitimate applications routinely invoke shells, Python, curl, or wget from PHP (build steps, package managers, image processing, health checks). Expect overlap with existing generic "process spawned a shell" content already present in most environments; this rule adds PHP-worker-specific parentage as a narrowing filter, not a new detection category. Tune the command-line tokens and account/parent filters to your own environment before enabling as an alert. 2026-10-21, same day, second fix: FileHash entity was mapped to this table's SHA256 column - Microsoft's own DeviceProcessEvents schema reference states that field "is usually not populated - use the SHA1 column when available". Switched to SHA1, confirmed as the convention a real, already-merged detection in this same repo uses for the same table (Detections/DeviceProcessEvents/ SolarWinds_SUNBURST_Process-IOCs.yaml). References: - https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp - https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w - https://github.com/rjmendez/phpup-2026

0 exclusive techniques.This is coverage no other published rule has; it is not this rule's total technique count.