{"id":81980,"date":"2026-10-23T10:57:48","date_gmt":"2026-10-23T18:57:48","guid":{"rendered":"http:\/\/www.sumologic.com\/blog\/sumo-logic%e3%81%a7php2shell%e9%96%a2%e9%80%a3%e3%81%ae%e3%82%a2%e3%82%af%e3%83%86%e3%82%a3%e3%83%93%e3%83%86%e3%82%a3%e3%82%92%e8%aa%bf%e6%9f%bb%e3%81%99%e3%82%8b%e6%96%b9%e6%b3%95"},"modified":"2026-10-29T16:07:32","modified_gmt":"2026-10-30T00:07:32","slug":"investigate-php2shell-activity","status":"publish","type":"blog","link":"https:\/\/www.sumologic.com\/ja\/blog\/investigate-php2shell-activity","title":{"rendered":"Sumo Logic\u3067PHP2Shell\u95a2\u9023\u306e\u30a2\u30af\u30c6\u30a3\u30d3\u30c6\u30a3\u3092\u8abf\u67fb\u3059\u308b\u65b9\u6cd5"},"content":{"rendered":"\n<section class=\"e-stn e-stn-0d652506f82b000a392973813b918ee25d5b4211 e-stn--glossary-inner-content e-stn--table-of-content\"><div class=\"container\">\n<div class=\"wp-block-b3rg-row e-row row\">\n<div class=\"wp-block-b3rg-column e-col e-col-1f7b3997080fc292474d26ff00c905d99d3520fa e-col--content-wrapper  col-sm-12 col-lg-12 col-xl-12\">\n<div class=\"e-div e-div-a1b32f66e1749758df41d5aea14f647cd10e362c e-div--card-btn-link\">\n<div class=\"wp-block-b3rg-column e-col e-col-ac00a9d18d9973e605ded8ae7af253f1808cf699  col-xs-10 col-sm-9 col-md-6\">\n<figure class=\"wp-block-image size-full w-50 mb-4\"><img loading=\"lazy\" decoding=\"async\" width=\"765\" height=\"291\" src=\"https:\/\/www.sumologic.com\/wp-content\/uploads\/log_threat_labs.png\" alt=\"\" class=\"wp-image-5388\" title=\"\"><\/figure>\n<\/div>\n\n\n<div class=\"e-img \">\n<figure class=\"wp-block-image size-full is-resized\"><img loading=\"lazy\" decoding=\"async\" width=\"900\" height=\"200\" src=\"https:\/\/www.sumologic.com\/wp-content\/uploads\/php2shell-header-1.png\" alt=\"\" class=\"wp-image-81433\" style=\"width:900px;height:auto\" title=\"\" srcset=\"https:\/\/www.sumologic.com\/wp-content\/uploads\/php2shell-header-1.png 900w, https:\/\/www.sumologic.com\/wp-content\/uploads\/php2shell-header-1-300x67.png 300w, https:\/\/www.sumologic.com\/wp-content\/uploads\/php2shell-header-1-765x170.png 765w, https:\/\/www.sumologic.com\/wp-content\/uploads\/php2shell-header-1-572x127.png 572w\" sizes=\"auto, (max-width: 900px) 100vw, 900px\" \/><\/figure>\n<\/div>\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>PHP<\/strong>\uff08PHP: Hypertext Preprocessor\u306e\u518d\u5e30\u7684\u982d\u5b57\u8a9e\uff09\u306f\u3001\u4e3b\u306b\u30a6\u30a7\u30d6\u958b\u767a\u306b\u4f7f\u7528\u3055\u308c\u308b\u7121\u6599\u306e\u30aa\u30fc\u30d7\u30f3\u30bd\u30fc\u30b9\u30b5\u30fc\u30d0\u30fc\u30b5\u30a4\u30c9\u30b9\u30af\u30ea\u30d7\u30c8\u8a00\u8a9e\u3067\u3059\u3002\u30a6\u30a7\u30d6\u30c6\u30af\u30ce\u30ed\u30b8\u30fc\u30c8\u30e9\u30c3\u30ab\u30fc\u306eW3Techs\u306b\u3088\u308b\u3068\u3001<a href=\"https:\/\/www.reuters.com\/technology\/what-is-php-why-did-it-take-government-websites-offline-2026-10-21\/\" target=\"_blank\" rel=\"noopener\">PHP\u306f\u300c\u30d7\u30ed\u30b0\u30e9\u30df\u30f3\u30b0\u8a00\u8a9e\u3092\u7279\u5b9a\u3067\u304d\u308b\u3059\u3079\u3066\u306e\u30a6\u30a7\u30d6\u30b5\u30a4\u30c8\u306e\u7d0470%\u3067\u5b9f\u884c\u3055\u308c\u3066\u3044\u308b\u300d<\/a>\u3068\u3055\u308c\u3066\u3044\u307e\u3059\u3002<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>PHP2Shell<\/strong>\u306fPHP\u30a4\u30f3\u30bf\u30fc\u30d7\u30ea\u30bf\u81ea\u4f53\u306e\u91cd\u5927\u306a\u6b20\u9665\u306e\u30da\u30a2\u3067\u3001\u305d\u308c\u305e\u308cCVSS v4.0\u30b9\u30b3\u30a2\u304c9.2\u3067\u3059\u3002\u3069\u3061\u3089\u3082\u3001\u8a8d\u8a3c\u3055\u308c\u3066\u3044\u306a\u3044\u653b\u6483\u8005\u304c\u3001\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u30b3\u30fc\u30c9\u304c\u5b9f\u884c\u3055\u308c\u308b\u524d\u306b\u3001\u5358\u4e00\u306e\u7d30\u5de5\u3055\u308c\u305f\u30a6\u30a7\u30d6\u30ea\u30af\u30a8\u30b9\u30c8\u3001\u307e\u305f\u306f\u305d\u306e\u30da\u30a2\u3067\u30a6\u30a7\u30d6\u30b5\u30fc\u30d0\u30fc\u4e0a\u306e\u30b3\u30fc\u30c9\u3092\u5b9f\u884c\u3067\u304d\u307e\u3059\u3002<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>CVE-2026-109618\u306fPHP\u306e\u30e1\u30e2\u30ea\u4e0d\u8db3\u51e6\u7406\u3092\u60aa\u7528\u3057\u307e\u3059\u3002<\/li>\n\n\n\n<li>CVE-2026-109619\u306f\u540c\u3058\u30ef\u30fc\u30ab\u30fc\u4e0a\u306e\u4ee5\u524d\u306e\u5931\u6557\u3057\u305f\u30ea\u30af\u30a8\u30b9\u30c8\u304b\u3089\u6b8b\u3055\u308c\u305f\u72b6\u614b\u3092\u60aa\u7528\u3057\u307e\u3059\u3002<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">\u30d0\u30b0\u306fWordPress\u3001Drupal\u3001Magento\u3067\u306f\u306a\u304f\u3001PHP\u81ea\u4f53\u306b\u5b58\u5728\u3059\u308b\u305f\u3081\u3001\u5f71\u97ff\u3092\u53d7\u3051\u305f\u30b5\u30fc\u30d0\u30fc\u4e0a\u306e\u3059\u3079\u3066\u306e\u30a2\u30af\u30bb\u30b9\u53ef\u80fd\u306aPHP\u30a8\u30f3\u30c9\u30dd\u30a4\u30f3\u30c8\uff08\u30ed\u30b0\u30a4\u30f3\u30da\u30fc\u30b8\u3001\u9759\u7684\u30d5\u30a9\u30fc\u30e0\u3001\u30d8\u30eb\u30b9\u30c1\u30a7\u30c3\u30af\u3092\u542b\u3080\uff09\u304c\u516c\u958b\u3055\u308c\u307e\u3059\u3002<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u904e\u53bb10\u5e74\u9593\u306e\u3059\u3079\u3066\u306ePHP\u30ea\u30ea\u30fc\u30b9\u304c\u5f71\u97ff\u3092\u53d7\u3051\u307e\u3059\uff085.4\u307e\u3067\u3055\u304b\u306e\u307c\u308a\u307e\u3059\uff09\u3002\u4fee\u6b63\u3055\u308c\u305f\u30d0\u30fc\u30b8\u30e7\u30f3\u306f8.5.12\u30018.4.27\u30018.3.36\u30018.2.35\u3067\u3059\u3002PHP 8.1\u4ee5\u524d\u306f\u6700\u5c0f\u9650\u306e\u30bd\u30fc\u30b9\u30d0\u30c3\u30af\u30dd\u30fc\u30c8\u306e\u307f\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002<\/p>\n\n\n\n<h2 id=\"php2shell-disclosure-timeline\" class=\"wp-block-heading\">PHP2Shell\u958b\u793a\u30bf\u30a4\u30e0\u30e9\u30a4\u30f3<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">2\u3064\u306e\u91cd\u5927\u306aPHP\u8106\u5f31\u6027CVE-2026-109618\u304a\u3088\u3073CVE-2026-109619\u306f\u3001\u30d7\u30e9\u30a4\u30d9\u30fc\u30c8\u7814\u7a76\u304b\u3089\u6570\u65e5\u4ee5\u5185\u306b\u30a2\u30af\u30c6\u30a3\u30d6\u306a\u60aa\u7528\u3078\u3068\u9032\u307f\u307e\u3057\u305f\u3002\u4ee5\u4e0b\u306f\u30a4\u30d9\u30f3\u30c8\u306e\u30bf\u30a4\u30e0\u30e9\u30a4\u30f3\u3067\u3059\u3002<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>2026\u5e748\u6708\uff1a<\/strong>Calif\u306f\u30ea\u30e2\u30fc\u30c8\u30b3\u30fc\u30c9\u5b9f\u884c\uff08RCE\uff09\u30d1\u30b9\u3092LLM\u652f\u63f4\u76e3\u67fb\u4e2d\u306b\u767a\u898b\u3057\u3001PHP\u306b\u5831\u544a\u3057\u307e\u3059\u3002Wiz\u306f\u72ec\u7acb\u3057\u3066\u6b20\u9665\u3092\u767a\u898b\u3057\u3001PHP\u306b\u5831\u544a\u3057\u307e\u3059\u3002<\/li>\n\n\n\n<li><strong>2026\u5e7410\u6708\u521d\u65ec\uff1a<\/strong>Cloudflare\u306f\u30a6\u30a7\u30d6\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u30d5\u30a1\u30a4\u30a2\u30a6\u30a9\u30fc\u30eb\uff08WAF\uff09\u4fdd\u8b77\u306e\u69cb\u7bc9\u3092\u958b\u59cb\u3057\u307e\u3059\u3002<\/li>\n\n\n\n<li><strong>2026\u5e7410\u670817\u65e5\uff1a<\/strong>AWS\u306f\u4e88\u5b9a\u3055\u308c\u3066\u3044\u305f\u8abf\u6574\u3055\u308c\u305f\u958b\u793a\u306e4\u65e5\u524d\u306b\u3001Amazon MadPot\u306b\u5bfe\u3059\u308b\u6700\u521d\u306e\u65e2\u77e5\u306e\u60aa\u7528\u8a66\u884c\u3092\u5831\u544a\u3057\u307e\u3059\u3002<\/li>\n\n\n\n<li><strong>2026\u5e7410\u670820\u65e5\uff1a<\/strong>PHP\u5185\u306e2\u3064\u306e\u91cd\u5927\u306a\u30ea\u30e2\u30fc\u30c8\u30b3\u30fc\u30c9\u8106\u5f31\u6027CVE-2026-109618\u304a\u3088\u3073CVE-2026-109619\u306e\u8a73\u7d30\u304c\u3001PHP Foundation\u306b\u3088\u3063\u3066\u4e88\u5b9a\u3055\u308c\u3066\u3044\u305f2026\u5e7410\u670822\u65e5\u306e\u8abf\u6574\u3055\u308c\u305f\u958b\u793a\u306e\u524d\u306b\u30ea\u30fc\u30af\u3055\u308c\u307e\u3057\u305f\u3002<\/li>\n\n\n\n<li><strong>2026\u5e7410\u670821\u65e5\uff1a<\/strong>PHP Foundation\u306f\u8106\u5f31\u6027\u3092\u65e9\u671f\u306b\u516c\u5f0f\u306b\u958b\u793a\u3057\u3001\u3059\u3079\u3066\u306e\u30e6\u30fc\u30b6\u30fc\u306b\u66f4\u65b0\u3092\u52e7\u544a\u3057\u307e\u3059\u3002\u5f71\u97ff\u3092\u53d7\u3051\u305f\u30bd\u30d5\u30c8\u30a6\u30a7\u30a2\u30d0\u30fc\u30b8\u30e7\u30f3\u306e\u7dca\u6025\u66f4\u65b0\u306f\u540c\u65e5\u5f8c\u306b\u914d\u4fe1\u3055\u308c\u307e\u3059\u3002<\/li>\n\n\n\n<li><strong>2026\u5e7410\u670821\u65e5\u4ee5\u964d\uff1a<\/strong>\u7814\u7a76\u8005\u306f\u5e83\u7bc4\u306a\u60aa\u7528\u8a66\u884c\u3092\u5831\u544a\u3057\u3066\u3044\u307e\u3059\u3002<\/li>\n<\/ul>\n\n\n\n<h2 id=\"how-to-search-for-php2shell-activity-in-your-environment\" class=\"wp-block-heading\">\u74b0\u5883\u5185\u306ePHP2Shell\u30a2\u30af\u30c6\u30a3\u30d3\u30c6\u30a3\u3092\u691c\u7d22\u3059\u308b\u65b9\u6cd5\u306f\uff1f<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Sumo Logic\u3092\u4f7f\u7528\u3057\u3066PHP2Shell\u30a2\u30af\u30c6\u30a3\u30d3\u30c6\u30a3\u3092\u691c\u7d22\u3057\u3066\u307f\u307e\u3057\u3087\u3046\u3002\u30a2\u30af\u30c6\u30a3\u30d3\u30c6\u30a3\u306e\u5404\u30bf\u30a4\u30d7\u306b\u3064\u3044\u3066\u30012\u3064\u306e\u691c\u7d22\u304c\u898b\u3064\u304b\u308a\u307e\u3059\u30021\u3064\u306f\u69d8\u3005\u306a\u30bf\u30a4\u30d7\u306e\u751f\u30ed\u30b0\u306b\u5bfe\u3059\u308b\u3082\u306e\u3067\u3001\u3082\u30461\u3064\u306f<a href=\"https:\/\/www.sumologic.com\/help\/docs\/cse\/schema\/record-processing-pipeline\/\">\u6b63\u898f\u5316\u3055\u308c\u305f\u30ec\u30b3\u30fc\u30c9<\/a>\u306b\u5bfe\u3059\u308b\u3082\u306e\u3067\u3001<a href=\"http:\/\/www.sumologic.com\/ja\/solutions\/siem\">Sumo Logic Cloud SIEM<\/a>\u3092\u4f7f\u7528\u3057\u3066\u3044\u308b\u304a\u5ba2\u69d8\u5411\u3051\u3067\u3059\u3002<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u958b\u59cb\u3059\u308b\u524d\u306b2\u3064\u306e\u6ce8\u610f\u4e8b\u9805\u304c\u3042\u308a\u307e\u3059\u3002<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>\u751f\u30ed\u30b0\u691c\u7d22\u306f\u30c1\u30e5\u30fc\u30cb\u30f3\u30b0\u304c\u5fc5\u8981\u3067\u3059\u3002<\/strong>\u751f\u30ed\u30b0\u691c\u7d22\u306e\u4f8b\u306b\u306f\u3001Apache\u30a2\u30af\u30bb\u30b9\u30ed\u30b0\u306a\u3069\u306e\u30ed\u30b0\u30bd\u30fc\u30b9\u30bf\u30a4\u30d7\u306b\u56fa\u6709\u306e\u89e3\u6790\u64cd\u4f5c\u304c\u542b\u307e\u308c\u3066\u3044\u307e\u3059\u3002\u307e\u305f\u3001\u30ed\u30b0\u30bd\u30fc\u30b9\u3092\u30aa\u30f3\u30dc\u30fc\u30c9\u3059\u308b\u969b\u306b\u5272\u308a\u5f53\u3066\u308b\u30ed\u30b0\u30ab\u30c6\u30b4\u30ea\u5316\uff08<code>_sourceCategory=linux\/system webserver<\/code>\u306a\u3069\uff09\u306b\u30b9\u30b3\u30fc\u30d7\u3055\u308c\u3066\u3044\u307e\u3059\u3002\u3053\u3053\u306b\u542b\u307e\u308c\u3066\u3044\u308b\u751f\u30ed\u30b0\u691c\u7d22\u306e\u4f8b\u3092\u4f7f\u7528\u3057\u305f\u3044\u5834\u5408\u306f\u3001\u74b0\u5883\u306b\u5408\u308f\u305b\u3066\u30ab\u30b9\u30bf\u30de\u30a4\u30ba\u3059\u308b\u5fc5\u8981\u304c\u3042\u308a\u307e\u3059\u3002<\/li>\n\n\n\n<li><strong>\u30ec\u30b3\u30fc\u30c9\u691c\u7d22\u306f\u305d\u306e\u307e\u307e\u6a5f\u80fd\u3057\u307e\u3059\u3002<\/strong>Sumo Logic Cloud SIEM\u306e<a href=\"https:\/\/www.sumologic.com\/help\/docs\/cse\/schema\/\">\u6b63\u898f\u5316\u30b9\u30ad\u30fc\u30de<\/a>\u306b\u57fa\u3065\u3044\u3066\u3044\u308b\u305f\u3081\u3001\u5909\u66f4\u306a\u3057\u3067\u4f7f\u7528\u3067\u304d\u307e\u3059\u3002<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">\u3053\u308c\u3089\u306e\u691c\u7d22\u306f\u3001\u521d\u671f\u60aa\u7528\u5f8c\u306e\u30a6\u30a7\u30d6\u30b5\u30fc\u30d0\u30fc\u4e0a\u306e\u52d5\u4f5c\u3092\u63a2\u3057\u307e\u3059\u3002\u60aa\u7528\u30da\u30a4\u30ed\u30fc\u30c9\u3092\u542b\u3080\u53ef\u80fd\u6027\u306e\u3042\u308bHTTP\u30c8\u30e9\u30f3\u30b6\u30af\u30b7\u30e7\u30f3\u3092\u691c\u7d22\u3057\u307e\u305b\u3093\u3002\u591a\u304f\u306e\u5834\u5408\u3001\u30a6\u30a7\u30d6\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u30d5\u30a1\u30a4\u30a2\u30a6\u30a9\u30fc\u30eb\u306a\u3069\u306e\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u88fd\u54c1\u304c\u30a4\u30f3\u30bf\u30fc\u30cd\u30c3\u30c8\u516c\u958b\u30a6\u30a7\u30d6\u30b5\u30fc\u30d0\u30fc\u306e\u300c\u524d\u306b\u300d\u3042\u308a\u3001\u3053\u308c\u3089\u306e\u88fd\u54c1\u306fHTTP\u5206\u6790\u3092\u4f7f\u7528\u3057\u305f\u30a6\u30a7\u30d6\u30b5\u30fc\u30d0\u30fc\u60aa\u7528\u306b\u95a2\u3059\u308b\u72ec\u81ea\u306e\u691c\u51fa\u30bb\u30c3\u30c8\u3092\u6301\u3063\u3066\u3044\u307e\u3059\u3002\u3053\u308c\u3089\u306e\u88fd\u54c1\u304b\u3089\u306e\u30c6\u30ec\u30e1\u30c8\u30ea\u306f\u3001\u76f8\u95a2\u3001\u30a2\u30e9\u30fc\u30c8\u3001\u304a\u3088\u3073\u8a73\u7d30\u306a\u5206\u6790\u306e\u305f\u3081\u306bSumo Logic\u306b\u53d6\u308a\u8fbc\u307e\u308c\u308b\u3079\u304d\u3067\u3059\u3002<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u3053\u306e\u30d6\u30ed\u30b0\u306e\u691c\u51fa\u30a8\u30f3\u30b8\u30cb\u30a2\u30ea\u30f3\u30b0\u306e\u7126\u70b9\u306f\u3001\u521d\u671f\u60aa\u7528\u3068\u6210\u529f\u3057\u305f\u653b\u6483\u304b\u3089\u306e\u30d5\u30a9\u30ed\u30fc\u30a2\u30c3\u30d7\u30a2\u30af\u30c6\u30a3\u30d3\u30c6\u30a3\u306b\u95a2\u9023\u3059\u308b\u30a6\u30a7\u30d6\u30b5\u30fc\u30d0\u30fc\u4e0a\u306e\u52d5\u4f5c\u89b3\u5bdf\u306b\u3042\u308a\u307e\u3059\u3002\u3053\u308c\u3089\u306e\u89b3\u5bdf\u306f\u3001\u305d\u306e\u5f8c\u3001\u4ed6\u306e\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u88fd\u54c1\u304b\u3089\u306e\u30c6\u30ec\u30e1\u30c8\u30ea\u3068\u76f8\u95a2\u3055\u305b\u308b\u3053\u3068\u304c\u3067\u304d\u307e\u3059\u3002<\/p>\n\n\n\n<h3 id=\"look-for-spikes-in-web-server-errors\" class=\"wp-block-heading\">\u30a6\u30a7\u30d6\u30b5\u30fc\u30d0\u30fc\u30a8\u30e9\u30fc\u306e\u30b9\u30d1\u30a4\u30af\u3092\u63a2\u3059<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">PHP2Shell\u8106\u5f31\u6027\u306fPHP\u30a8\u30e9\u30fc\u51e6\u7406\u306e\u6b20\u9665\u306b\u7531\u6765\u3059\u308b\u305f\u3081\u3001\u60aa\u7528\u8a66\u884c\u306f\u30a6\u30a7\u30d6\u30b5\u30fc\u30d0\u30fc\u4e0a\u306e\u30a8\u30e9\u30fc\u3068\u3057\u3066\u8868\u793a\u3055\u308c\u307e\u3059\u3002Sumo Logic\u306e<a href=\"https:\/\/www.sumologic.com\/help\/docs\/search\/search-query-language\/search-operators\/timeslice\/\">timeslice\u691c\u7d22\u6f14\u7b97\u5b50<\/a>\u3092\u4f7f\u7528\u3059\u308b\u3068\u3001\u30a6\u30a7\u30d6\u30b5\u30fc\u30d0\u30fc\u4e0a\u306e\u30a8\u30e9\u30fc\u30a2\u30af\u30c6\u30a3\u30d3\u30c6\u30a3\u306e\u30b9\u30d1\u30a4\u30af\u304c\u3042\u3063\u305f\u304b\u3069\u3046\u304b\u3092\u7c21\u5358\u306b\u8a55\u4fa1\u3067\u304d\u307e\u3059\u3002<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u4ee5\u4e0b\u306e\u4f8b\u3067\u306f\u3001\u30b5\u30fc\u30d0\u30fc\u30b5\u30a4\u30c9\u30a8\u30e9\u30fc\uff08HTTP\u5fdc\u7b54\u30b3\u30fc\u30c9500\uff5e599\u7bc4\u56f2\u3092\u751f\u6210\u3059\u308b\u3082\u306e\uff09\u306e\u6570\u30921\u6642\u9593\u3054\u3068\u306b\u30ab\u30a6\u30f3\u30c8\u3057\u3066\u3044\u307e\u3059\u3002\u7d50\u679c\u3092\u8996\u899a\u7684\u306b\u30b9\u30ad\u30e3\u30f3\u3057\u3066\u30b9\u30d1\u30a4\u30af\u3092\u63a2\u3059\u3053\u3068\u304c\u3067\u304d\u307e\u3059\u3002<\/p>\n\n\n\n<h5 id=\"example-1-syslog-wrapped-apache-access-logs\" class=\"wp-block-heading\"><strong>\u4f8b1\uff1a\uff08Syslog\u3067\u30e9\u30c3\u30d7\u3055\u308c\u305f\uff09Apache\u30a2\u30af\u30bb\u30b9\u30ed\u30b0<\/strong><\/h5>\n\n\n\n<pre class=\"wp-block-code\"><code>(_sourceCategory=linux\/system webserver_system=apache webserver_farm=* OR _sourceCategory=linux\/syslog) httpd-access HTTP (50* OR 51* OR 52* OR 53* OR 54* OR 55* OR 59*)\n| parse \"httpd-access: *\" as mesg nodrop\n| parse regex field=mesg \"^(?&lt;src_ip&gt;\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3})\\s+(?&lt;vhost&gt;\\S+)\" nodrop\n| parse regex field=mesg \"\\\"(?&lt;method&gt;&#091;A-Z]+)\\s(?&lt;uri&gt;\\S+)\\sHTTP\\\/&#091;\\d\\.]+\\\"\\s(?&lt;status_code&gt;\\d+)\\s(?&lt;size&gt;&#091;\\d-]+)\" nodrop\n| where !isNull(status_code) and status_code &gt;= 500 and status_code &lt;= 599\n| timeslice 1h\n| count by _timeslice, _sourceHost\n| sort by _timeslice, _count desc<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<h5 id=\"example-2-sumo-logic-cloud-siem-records\" class=\"wp-block-heading\">\u4f8b2\uff1aSumo Logic Cloud SIEM\u30ec\u30b3\u30fc\u30c9<\/h5>\n\n\n\n<p class=\"wp-block-paragraph\">\u4ee5\u4e0b\u306e\u30af\u30a8\u30ea\u306f\u3001\u30c7\u30d7\u30ed\u30a4\u30e1\u30f3\u30c8\u5185\u3067web_servers\u307e\u305f\u306fhttp_servers <a href=\"https:\/\/www.sumologic.com\/help\/docs\/cse\/match-lists-suppressed-lists\/standard-match-lists\/#standard-match-lists\">\u6a19\u6e96\u30de\u30c3\u30c1\u30ea\u30b9\u30c8<\/a>\u304c\u4f5c\u6210\u304a\u3088\u3073\u5165\u529b\u3055\u308c\u3066\u3044\u308b\u3053\u3068\u306b\u4f9d\u5b58\u3057\u3066\u3044\u308b\u3053\u3068\u306b\u6ce8\u610f\u3057\u3066\u304f\u3060\u3055\u3044\u3002<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>_index=sec_record*\n| where http_response_statusCode &gt;= 500 and http_response_statusCode &lt;= 599 \n| where jsonArrayContains(listMatches, \"web_servers\") or jsonArrayContains(listMatches, \"http_servers\")\n| timeslice 1h\n| count by _timeslice, dstDevice_ip\n| sort by _timeslice, _count desc<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n<div class=\"e-img \">\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"855\" height=\"683\" src=\"https:\/\/www.sumologic.com\/wp-content\/uploads\/PHP2Shell-img1-Searching-Environment.png\" alt=\"\" class=\"wp-image-81403\" title=\"\" srcset=\"https:\/\/www.sumologic.com\/wp-content\/uploads\/PHP2Shell-img1-Searching-Environment.png 855w, https:\/\/www.sumologic.com\/wp-content\/uploads\/PHP2Shell-img1-Searching-Environment-767x613.png 767w, https:\/\/www.sumologic.com\/wp-content\/uploads\/PHP2Shell-img1-Searching-Environment-300x240.png 300w, https:\/\/www.sumologic.com\/wp-content\/uploads\/PHP2Shell-img1-Searching-Environment-575x459.png 575w\" sizes=\"auto, (max-width: 855px) 100vw, 855px\" \/><\/figure>\n<\/div>\n\n\n<p class=\"wp-block-paragraph\"><em>\u56f31\uff1aWeb\u30b5\u30fc\u30d0\u30fc\u30a8\u30e9\u30fc\u30a2\u30af\u30c6\u30a3\u30d3\u30c6\u30a3\u306e\u30b9\u30d1\u30a4\u30af<\/em><\/p>\n\n\n\n<div style=\"height:20px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<h3 id=\"identify-web-server-processes-spawning-a-shell\" class=\"wp-block-heading\">Web\u30b5\u30fc\u30d0\u30fc\u30d7\u30ed\u30bb\u30b9\u304c\u30b7\u30a7\u30eb\u3092\u751f\u6210\u3057\u3066\u3044\u308b\u3053\u3068\u3092\u7279\u5b9a\u3059\u308b<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">\u653b\u6483\u8005\u304cPHP2Shell\u3092\u6b63\u5e38\u306b\u60aa\u7528\u3057\u305f\u5834\u5408\u3001Web\u30b5\u30fc\u30d0\u30fc\u307e\u305f\u306fPHP\u30d7\u30ed\u30bb\u30b9\u306e\u5b50\u30d7\u30ed\u30bb\u30b9\u3092\u901a\u3058\u3066\u60aa\u610f\u306e\u3042\u308b\u30b3\u30fc\u30c9\u3092\u5b9f\u884c\u3059\u308b\u53ef\u80fd\u6027\u304c\u3042\u308a\u307e\u3059\u3002\u4ee5\u4e0b\u306e\u30af\u30a8\u30ea\u306f\u3001Windows\u304a\u3088\u3073Linux\u74b0\u5883\u306e\u4e21\u65b9\u3067\u3001\u4e00\u822c\u7684\u306aWeb\u30b5\u30fc\u30d0\u30fc\u30d7\u30ed\u30bb\u30b9\u304c\u5b8c\u5168\u306aOS\u30b7\u30a7\u30eb\u3092\u8d77\u52d5\u3059\u308b\u5834\u5408\u3092\u7279\u5b9a\u3057\u307e\u3059\u3002<\/p>\n\n\n\n<h5 id=\"example-1-windows-process-logs\" class=\"wp-block-heading\">\u4f8b1\uff1aWindows\u30d7\u30ed\u30bb\u30b9\u30ed\u30b0<\/h5>\n\n\n\n<pre class=\"wp-block-code\"><code>_sourceCategory =\"windows\/eventlogs\"\n| parse \"&lt;EventID&gt;*&lt;\/EventID&gt;\" as eventId\n| where eventId = \"4688\"\n| parse \"&lt;Data Name='ParentProcessName'&gt;*&lt;\/Data&gt;\" as parentBaseImage nodrop\n| parse \"&lt;Data Name='NewProcessName'&gt;*&lt;\/Data&gt;\" as baseImage nodrop\n| parse \"&lt;Data Name='CommandLine'&gt;*&lt;\/Data&gt;\" as commandLine nodrop\n| parse \"&lt;Data Name='SubjectUserName'&gt;*&lt;\/Data&gt;\" as user_username nodrop\n| parse \"&lt;Data Name='SubjectDomainName'&gt;*&lt;\/Data&gt;\" as user_domain nodrop\n| parse regex \"&lt;Computer&gt;(?&lt;device_hostname&gt;&#091;^&lt;]+)&lt;\/Computer&gt;\" nodrop\n| where parentBaseImage matches \/(?i).*(w3wp\\.exe|httpd\\.exe|nginx\\.exe|php-cgi\\.exe|tomcat\\.exe)$\/\n| where baseImage matches \/(?i).*(cmd\\.exe|powershell\\.exe|bitsadmin\\.exe|pwsh\\.exe|powershell_ise\\.exe)$\/\n| fields device_hostname, user_domain, user_username, parentBaseImage, baseImage, commandLine<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<h5 id=\"example-2-sumo-logic-cloud-siem-records\" class=\"wp-block-heading\">\u4f8b2\uff1aSumo Logic Cloud SIEM\u30ec\u30b3\u30fc\u30c9<\/h5>\n\n\n\n<pre class=\"wp-block-code\"><code>_index=sec_record*\n| where parentBaseImage matches \/(?i).*(w3wp\\.exe|httpd\\.exe|nginx\\.exe|php-cgi\\.exe|tomcat\\.exe|\\\/httpd|\\\/nginx|\\\/php-cgi|\\\/tomcat|\\\/apache2|\\\/apache)$\/\n| where baseImage matches \/(?i).*(cmd\\.exe|sh\\.exe|bash\\.exe|powershell\\.exe|bitsadmin\\.exe|pwsh\\.exe|powershell_ise\\.exe|\\\/bash|\\\/sh|\\\/dash|\\\/zsh|\\\/ksh|\\\/csh|\\\/python3?|\\\/perl)$\/\n| fields device_hostname, device_ip, user_username, parentBaseImage, baseImage, commandLine<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n<div class=\"e-img \">\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"320\" src=\"https:\/\/www.sumologic.com\/wp-content\/uploads\/PHP2Shell-img2-Searching-Web-Shell-Activity-1024x320.png\" alt=\"\" class=\"wp-image-81410\" title=\"\" srcset=\"https:\/\/www.sumologic.com\/wp-content\/uploads\/PHP2Shell-img2-Searching-Web-Shell-Activity-1024x320.png 1024w, https:\/\/www.sumologic.com\/wp-content\/uploads\/PHP2Shell-img2-Searching-Web-Shell-Activity-300x94.png 300w, https:\/\/www.sumologic.com\/wp-content\/uploads\/PHP2Shell-img2-Searching-Web-Shell-Activity-767x240.png 767w, https:\/\/www.sumologic.com\/wp-content\/uploads\/PHP2Shell-img2-Searching-Web-Shell-Activity-572x179.png 572w, https:\/\/www.sumologic.com\/wp-content\/uploads\/PHP2Shell-img2-Searching-Web-Shell-Activity.png 1439w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n<\/div>\n\n\n<p class=\"wp-block-paragraph\"><em>\u56f32\uff1anginx\u304b\u3089\u8d77\u52d5\u3055\u308c\u308b\u30b7\u30a7\u30eb\u3092\u691c\u51fa<\/em><\/p>\n\n\n\n<div style=\"height:20px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<h3 id=\"look-for-web-server-processes-executing-common-web-shell-commands\" class=\"wp-block-heading\">Web\u30b5\u30fc\u30d0\u30fc\u30d7\u30ed\u30bb\u30b9\u304c\u4e00\u822c\u7684\u306aWeb\u30b7\u30a7\u30eb\u30b3\u30de\u30f3\u30c9\u3092\u5b9f\u884c\u3057\u3066\u3044\u308b\u3053\u3068\u3092\u78ba\u8a8d\u3059\u308b<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Web\u30b5\u30fc\u30d0\u30fc\u306f\u3001\u5b8c\u5168\u306aOS\u30b7\u30a7\u30eb\u3092\u7d4c\u7531\u3059\u308b\u306e\u3067\u306f\u306a\u304f\u3001\u30b7\u30a7\u30eb\u30b3\u30de\u30f3\u30c9\u3092\u76f4\u63a5\u5b9f\u884c\u3059\u308b\u3053\u3068\u3082\u3042\u308a\u307e\u3059\u3002\u4ee5\u4e0b\u306e\u30af\u30a8\u30ea\u306f\u3001Web\u30b5\u30fc\u30d0\u30fc\u30d7\u30ed\u30bb\u30b9\u306e\u5b50\u30d7\u30ed\u30bb\u30b9\u3068\u3057\u3066\u5b9f\u884c\u3055\u308c\u308b\u4e00\u822c\u7684\u306a\u691c\u51fa\u3001\u8a8d\u8a3c\u60c5\u5831\u306e\u53ce\u96c6\u3001\u304a\u3088\u3073\u6d41\u51fa\u30b3\u30de\u30f3\u30c9\u3092\u7279\u5b9a\u3057\u307e\u3059\u3002<\/p>\n\n\n\n<h5 id=\"example-1-windows-process-logs\" class=\"wp-block-heading\"><strong>\u4f8b1\uff1aWindows\u30d7\u30ed\u30bb<\/strong>\u30b9\u30ed\u30b0<strong><\/strong><\/h5>\n\n\n\n<pre class=\"wp-block-code\"><code>_sourceCategory =\"windows\/eventlogs\"\n| parse \"&lt;EventID&gt;*&lt;\/EventID&gt;\" as eventId\n| where eventId = \"4688\"\n| parse \"&lt;Data Name='ParentProcessName'&gt;*&lt;\/Data&gt;\" as parentBaseImage nodrop\n| parse \"&lt;Data Name='NewProcessName'&gt;*&lt;\/Data&gt;\" as baseImage nodrop\n| parse \"&lt;Data Name='CommandLine'&gt;*&lt;\/Data&gt;\" as commandLine nodrop\n| parse \"&lt;Data Name='SubjectUserName'&gt;*&lt;\/Data&gt;\" as user_username nodrop\n| parse \"&lt;Data Name='SubjectDomainName'&gt;*&lt;\/Data&gt;\" as user_domain nodrop\n| parse regex \"&lt;Computer&gt;(?&lt;device_hostname&gt;&#091;^&lt;]+)&lt;\/Computer&gt;\" nodrop\n| where parentBaseImage matches \/(?i).*(w3wp\\.exe|httpd\\.exe|nginx\\.exe|php-cgi\\.exe|tomcat\\.exe|apache).*\/\n| where commandLine matches \/(?i).*(whoami|net user |ping |systeminfo |netstat |arp -a|ipconfig |ifconfig |curl |wget ).*\/\n| fields device_hostname, user_domain, user_username, parentBaseImage, baseImage, commandLine<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<h5 id=\"example-2-sumo-logic-cloud-siem-records\" class=\"wp-block-heading\">\u4f8b2\uff1aSumo Logic Cloud SIEM\u30ec\u30b3\u30fc\u30c9<\/h5>\n\n\n\n<pre class=\"wp-block-code\"><code>_index=sec_record*\n| where parentBaseImage matches \/(?i).*(w3wp\\.exe|httpd\\.exe|nginx\\.exe|php-cgi\\.exe|tomcat\\.exe|apache|\\\/httpd|\\\/nginx|\\\/php-cgi|\\\/tomcat|\\\/apache2).*\/\n| where commandLine matches \/(?i).*(whoami|net user |ping |systeminfo |netstat |arp -a|ipconfig |ifconfig |curl |wget |id |uname |cat \\\/etc\\\/passwd|nc -).*\/\n| fields device_hostname, device_ip, user_username, parentBaseImage, commandLine<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n<div class=\"e-img \">\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"308\" src=\"https:\/\/www.sumologic.com\/wp-content\/uploads\/PHP2Shell-img3-Searching-Web-Shell-Activity-ex2-1024x308.png\" alt=\"\" class=\"wp-image-81417\" title=\"\" srcset=\"https:\/\/www.sumologic.com\/wp-content\/uploads\/PHP2Shell-img3-Searching-Web-Shell-Activity-ex2-1024x308.png 1024w, https:\/\/www.sumologic.com\/wp-content\/uploads\/PHP2Shell-img3-Searching-Web-Shell-Activity-ex2-300x90.png 300w, https:\/\/www.sumologic.com\/wp-content\/uploads\/PHP2Shell-img3-Searching-Web-Shell-Activity-ex2-765x230.png 765w, https:\/\/www.sumologic.com\/wp-content\/uploads\/PHP2Shell-img3-Searching-Web-Shell-Activity-ex2-572x172.png 572w, https:\/\/www.sumologic.com\/wp-content\/uploads\/PHP2Shell-img3-Searching-Web-Shell-Activity-ex2.png 1441w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n<\/div>\n\n\n<p class=\"wp-block-paragraph\"><em>\u56f33\uff1aInternet Information Server\u306e\u5b50\u30d7\u30ed\u30bb\u30b9\u3068\u3057\u3066\u306e\u30ea\u30e2\u30fc\u30c8wget\u30b3\u30de\u30f3\u30c9<\/em><\/p>\n\n\n\n<div style=\"height:20px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<h2 id=\"sumo-logic-cloud-siem-detections\" class=\"wp-block-heading\">Sumo Logic Cloud SIEM\u691c\u51fa<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Sumo Logic Cloud SIEM\u306b\u306f\u3001Web\u30b7\u30a7\u30eb\u30a2\u30af\u30c6\u30a3\u30d3\u30c6\u30a3\u3092\u691c\u51fa\u3057\u3001PHP2Shell\u306b\u3088\u3063\u3066\u6b63\u5e38\u306b\u60aa\u7528\u3055\u308c\u305fWeb\u30b5\u30fc\u30d0\u30fc\u3092\u7279\u5b9a\u3059\u308b\u306e\u306b\u5f79\u7acb\u3064\u3001\u3059\u3050\u306b\u4f7f\u7528\u3067\u304d\u308b\u30eb\u30fc\u30eb\u304c\u8907\u6570\u3042\u308a\u307e\u3059\u3002\u30eb\u30fc\u30eb\u306e\u691c\u51fa\u7406\u8ad6\u306f\u3001\u4e0a\u8a18\u3067\u8aac\u660e\u3057\u305f\u30af\u30a8\u30ea\u3068\u540c\u3058\u3067\u3059\u3002\u3064\u307e\u308a\u3001Web\u30b5\u30fc\u30d0\u30fc\u30d7\u30ed\u30bb\u30b9\u306e\u7570\u5e38\u306a\u5b50\u30d7\u30ed\u30bb\u30b9\u3068Web\u30b5\u30fc\u30d0\u30fc\u306e\u30a8\u30e9\u30fc\u7387\u306e\u30b9\u30d1\u30a4\u30af\u3067\u3059\u3002<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u4ee5\u4e0b\u306e\u691c\u51fa\u306f\u3001\u6f5c\u5728\u7684\u306a\u4fb5\u5bb3\u3092\u8abf\u67fb\u3059\u308b\u306e\u306b\u5f79\u7acb\u3061\u307e\u3059\u3002<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><thead><tr><th>Cloud SIEM\u30eb\u30fc\u30ebID<\/th><th>\u30eb\u30fc\u30eb\u540d<\/th><\/tr><\/thead><tbody><tr><td>MATCH-S00164<\/td><td>Web\u30b5\u30fc\u30d0\u30fc\u306b\u3088\u3063\u3066\u751f\u6210\u3055\u308c\u305f\u7591\u308f\u3057\u3044\u30b7\u30a7\u30eb<\/td><\/tr><tr><td>MATCH-S00174<\/td><td>\u4e00\u822c\u7684\u306aWeb\u30b7\u30a7\u30eb\u30b3\u30de\u30f3\u30c9\u3092\u5b9f\u884c\u3059\u308bWeb\u30b5\u30fc\u30d3\u30b9<\/td><\/tr><tr><td>MATCH-S00539<\/td><td>\u7591\u308f\u3057\u3044\u30d7\u30ed\u30bb\u30b9\u3092\u5b9f\u884c\u3059\u308bWeb\u30b5\u30fc\u30d0\u30fc*<\/td><\/tr><tr><td>OUTLIER-S00036\uff08\u65b0\u898f\uff09<\/td><td>\u9001\u4fe1\u5143IP\u304b\u3089\u306eHTTP\u30b5\u30fc\u30d0\u30fc\u30a8\u30e9\u30fc\u306e\u30b9\u30d1\u30a4\u30af<\/td><\/tr><tr><td>OUTLIER-S00037\uff08\u65b0\u898f\uff09<\/td><td>\u5b9b\u5148IP\u3078\u306eHTTP\u30b5\u30fc\u30d0\u30fc\u30a8\u30e9\u30fc\u306e\u30b9\u30d1\u30a4\u30af<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u524d\u8ff0\u306e\u3088\u3046\u306b\u3001CHAIN\u30eb\u30fc\u30eb\u3092\u4f5c\u6210\u3059\u308b\u3053\u3068\u3067\u3001PHP2Shell\u60aa\u7528\u306e\u691c\u51fa\u7cbe\u5ea6\u3092\u9ad8\u3081\u308b\u3053\u3068\u304c\u3067\u304d\u307e\u3059\u3002CHAIN\u30eb\u30fc\u30eb\u306f\u3001\u30a8\u30f3\u30c6\u30a3\u30c6\u30a3\u306ePHP2Shell\uff08WAF\u30a2\u30e9\u30fc\u30c8\u306a\u3069\uff09\u306e\u30a8\u30c3\u30b8\u30c7\u30d0\u30a4\u30b9\u89b3\u6e2c\u3068\u3001\u4e0a\u8a18\u306e\u8868\u306eWeb\u30b7\u30a7\u30eb\u691c\u51fa\u30ed\u30b8\u30c3\u30af\u3092\u76f8\u95a2\u3055\u305b\u307e\u3059\u3002<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u3053\u308c\u3089\u306e\u30eb\u30fc\u30eb\u306b\u306f\u3001<a href=\"https:\/\/www.sumologic.com\/help\/docs\/cse\/match-lists-suppressed-lists\/standard-match-lists\/#standard-match-lists\">\u6a19\u6e96\u30de\u30c3\u30c1\u30ea\u30b9\u30c8<\/a>\u306e\u4f5c\u6210\u3068\u5165\u529b\u304c\u5fc5\u8981\u3067\u3059\u3002MATCH-S00539\u306f\u300cweb_servers\u300d\u30de\u30c3\u30c1\u30ea\u30b9\u30c8\u3092\u4f7f\u7528\u3057\u3066\u3001Web\u30b5\u30fc\u30d0\u30fc\u4e0a\u306e\u30d7\u30ed\u30bb\u30b9\u5b9f\u884c\u3078\u306e\u691c\u51fa\u3092\u30b9\u30b3\u30fc\u30d7\u3057\u307e\u3059\u3002<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">OUTLIER-S00036\u304a\u3088\u3073OUTLIER-S00037\u306f\u3001\u30b5\u30fc\u30d0\u30fc\u5074\u30a8\u30e9\u30fc\u3092\u8ffd\u8de1\u3059\u308b\u305f\u3081\u306b\u300cweb_servers\u300d\u307e\u305f\u306f\u300chttp_servers\u300d\u30de\u30c3\u30c1\u30ea\u30b9\u30c8\u304c\u5fc5\u8981\u3067\u3059\u3002<a href=\"https:\/\/help.sumologic.com\/docs\/cse\/match-lists-suppressed-lists\/create-match-list\/\" target=\"_blank\" rel=\"noopener\">\u30de\u30c3\u30c1\u30ea\u30b9\u30c8\u3092\u4f5c\u6210\u3057\u3066\u5165\u529b\u3059\u308b\u65b9\u6cd5<\/a>\u3092\u3054\u89a7\u304f\u3060\u3055\u3044\u3002<\/p>\n\n\n\n<h2 id=\"recommendations-to-fix-and-mitigate-php2shell\" class=\"wp-block-heading\">PHP2Shell\u3092\u4fee\u6b63\u304a\u3088\u3073\u8efd\u6e1b\u3059\u308b\u305f\u3081\u306e\u63a8\u5968\u4e8b\u9805<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">PHP\u30b0\u30eb\u30fc\u30d7\u306e\u30ac\u30a4\u30c0\u30f3\u30b9\u306f\u660e\u78ba\u3067\u3059\u3002\u4eca\u3059\u3050\u66f4\u65b0\u3057\u3066\u304f\u3060\u3055\u3044\u3002<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u300c\u30ea\u30b9\u30af\u5bfe\u8c61\uff1aWeb\u30ea\u30af\u30a8\u30b9\u30c8\u3092\u63d0\u4f9b\u3059\u308b\u3059\u3079\u3066\u306ePHP\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb\uff08PHP-FPM\u3001mod_php\u4ed8\u304dApache\u3001php-cgi\u3001FrankenPHP\u3001LiteSpeed\u3092\u542b\u3080\uff09\u3002mod_php\u306e\u30ea\u30b9\u30af\u304c\u6700\u3082\u9ad8\u3044\u3068\u8003\u3048\u3089\u308c\u3066\u304a\u308a\u3001\u8a8d\u8a3c\u3055\u308c\u3066\u3044\u306a\u3044\u30ea\u30af\u30a8\u30b9\u30c8\u304c\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u30b3\u30fc\u30c9\u304c\u5b9f\u884c\u3055\u308c\u308b\u524d\u306b\u653b\u6483\u3092\u30c8\u30ea\u30ac\u30fc\u3067\u304d\u308b\u5b9f\u8a3c\u6e08\u307f\u306e\u60aa\u7528\u304c\u3042\u308a\u307e\u3059\u3002\u300dPHP\u30b0\u30eb\u30fc\u30d7\u306e\u5b8c\u5168\u306a\u30a2\u30c9\u30d0\u30a4\u30b6\u30ea\u3092<a href=\"https:\/\/www.php.net\/archive\/2026.php#2026-10-21-5\" target=\"_blank\" rel=\"noopener\">\u3053\u3061\u3089<\/a>\u3067\u3054\u89a7\u304f\u3060\u3055\u3044\u3002<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/www.crowdstrike.com\/en-us\/blog\/crowdstrike-protects-customers-from-php-rce-zero-days\/\" target=\"_blank\" rel=\"noopener\">\u30b3\u30df\u30e5\u30cb\u30c6\u30a3\u5206\u6790\u306b\u3088\u308b\u3068\u3001\u60aa\u7528\u304c\u6210\u529f\u3059\u308b\u3068Web\u30b5\u30fc\u30d0\u30fc\u30e6\u30fc\u30b6\u30fc\u30b3\u30f3\u30c6\u30ad\u30b9\u30c8\u3067\u30b3\u30de\u30f3\u30c9\u5b9f\u884c\u304c\u53ef\u80fd\u306b\u306a\u308a\u307e\u3059<\/a>\u3002\u305d\u3053\u304b\u3089\u3001\u653b\u6483\u8005\u306fWeb\u30b7\u30a7\u30eb\u3092\u30c7\u30d7\u30ed\u30a4\u3057\u3001\u8a2d\u5b9a\u30d5\u30a1\u30a4\u30eb\u304b\u3089API\u304a\u3088\u3073\u30c7\u30fc\u30bf\u30d9\u30fc\u30b9\u8a8d\u8a3c\u60c5\u5831\u3092\u53ce\u96c6\u3057\u3001\u5185\u90e8\u30cd\u30c3\u30c8\u30ef\u30fc\u30af\u306b\u79fb\u52d5\u3067\u304d\u307e\u3059\u3002<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u3059\u3050\u306b\u66f4\u65b0\u3059\u308b\u3053\u3068\u304c\u63a8\u5968\u3055\u308c\u307e\u3059\u3002\u307e\u3060\u66f4\u65b0\u3067\u304d\u306a\u3044\u5834\u5408\u306f\u3001\u4e0a\u8a18\u306e\u691c\u7d22\u3068\u691c\u51fa\u3092\u4f7f\u7528\u3057\u3066\u3001\u5f71\u97ff\u3092\u53d7\u3051\u308b\u30b5\u30fc\u30d0\u30fc\u3092\u76e3\u8996\u3057\u3001\u60aa\u7528\u304c\u6210\u529f\u3057\u305f\u3053\u3068\u3092\u793a\u3059\u60aa\u7528\u5f8c\u306e\u30a2\u30af\u30c6\u30a3\u30d3\u30c6\u30a3\u3092\u691c\u51fa\u3057\u3066\u304f\u3060\u3055\u3044\u3002<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Cloud SIEM\u3092\u307e\u3060\u304a\u6301\u3061\u3067\u306a\u304f\u3001\u3053\u308c\u3089\u306e\u3088\u3046\u306a\u8105\u5a01\u3092\u691c\u51fa\u304a\u3088\u3073\u5bfe\u5fdc\u3059\u308b\u306e\u306b\u3069\u306e\u3088\u3046\u306b\u5f79\u7acb\u3064\u304b\u3092\u7406\u89e3\u3057\u305f\u3044\u5834\u5408\u306f\u3001<a href=\"http:\/\/www.sumologic.com\/ja\/request-demo\">\u30c7\u30e2\u3092\u4e88\u7d04\u3057\u3066\u8a73\u7d30\u3092\u3054\u89a7\u304f\u3060\u3055\u3044<\/a>\u3002<\/p>\n\n\n\n<h2 id=\"references-and-further-resources\" class=\"wp-block-heading\">\u53c2\u8003\u8cc7\u6599\u3068\u305d\u306e\u4ed6\u306e\u30ea\u30bd\u30fc\u30b9<\/h2>\n\n\n\n<h4 id=\"nist-vulnerability-information\" class=\"wp-block-heading\">NIST\u8106\u5f31\u6027\u60c5\u5831<\/h4>\n\n\n\n<ol class=\"wp-block-list\">\n<li><a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/cve-2026-109618\" target=\"_blank\" rel=\"noopener\">https:\/\/nvd.nist.gov\/vuln\/detail\/cve-2026-109618<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/cve-2026-109619\" target=\"_blank\" rel=\"noopener\">https:\/\/nvd.nist.gov\/vuln\/detail\/cve-2026-109619<\/a><\/li>\n<\/ol>\n\n\n\n<h4 id=\"php-s-guidance\" class=\"wp-block-heading\">PHP\u306e\u30ac\u30a4\u30c0\u30f3\u30b9<\/h4>\n\n\n\n<ol start=\"3\" class=\"wp-block-list\">\n<li><a href=\"https:\/\/www.php.net\/archive\/2026.php#2026-10-20-1\" target=\"_blank\" rel=\"noopener\">https:\/\/www.php.net\/archive\/2026.php#2026-10-20-1<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/www.php.net\/archive\/2026.php#2026-10-21-5\" target=\"_blank\" rel=\"noopener\">https:\/\/www.php.net\/archive\/2026.php#2026-10-21-5<\/a><\/li>\n<\/ol>\n\n\n\n<h4 id=\"cybersecurity-community-resources-and-reports\" class=\"wp-block-heading\">\u30b5\u30a4\u30d0\u30fc\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30b3\u30df\u30e5\u30cb\u30c6\u30a3\u306e\u30ea\u30bd\u30fc\u30b9\u3068\u30ec\u30dd\u30fc\u30c8<\/h4>\n\n\n\n<ol start=\"5\" class=\"wp-block-list\">\n<li><a href=\"https:\/\/calif.io\/php2shell\/\" target=\"_blank\" rel=\"noopener\">https:\/\/calif.io\/php2shell\/<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/www.wiz.io\/blog\/php2shell-php-rce\" target=\"_blank\" rel=\"noopener\">https:\/\/www.wiz.io\/blog\/php2shell-php-rce<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/www.huntress.com\/blog\/php2shell-leaked-critical-php-vulnerabilities\" target=\"_blank\" rel=\"noopener\">https:\/\/www.huntress.com\/blog\/php2shell-leaked-critical-php-vulnerabilities<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/www.crowdstrike.com\/en-us\/blog\/crowdstrike-protects-customers-from-php-rce-zero-days\/\" target=\"_blank\" rel=\"noopener\">https:\/\/www.crowdstrike.com\/en-us\/blog\/crowdstrike-protects-customers-from-php-rce-zero-days\/<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/thehackernews.com\/2026\/10\/someone-tried-to-exploit-php2shell-4.html\" target=\"_blank\" rel=\"noopener\">https:\/\/thehackernews.com\/2026\/10\/someone-tried-to-exploit-php2shell-4.html<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/openai.com\/index\/coordinated-disclosure-of-critical-vulnerabilities\/\" target=\"_blank\" rel=\"noopener\">https:\/\/openai.com\/index\/coordinated-disclosure-of-critical-vulnerabilities\/<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/aws.amazon.com\/blogs\/security\/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot\/\" target=\"_blank\" rel=\"noopener\">https:\/\/aws.amazon.com\/blogs\/security\/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot\/<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/blog.checkpoint.com\/security\/php2shell-what-we-know-about-the-leaked-critical-php-vulnerabilities-cve-2026-109618-cve-2026-109619\/\" target=\"_blank\" rel=\"noopener\">https:\/\/blog.checkpoint.com\/security\/php2shell-what-we-know-about-the-leaked-critical-php-vulnerabilities-cve-2026-109618-cve-2026-109619\/<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/blog.cloudflare.com\/php-vulnerabilities-waf-protection\" target=\"_blank\" rel=\"noopener\">https:\/\/blog.cloudflare.com\/php-vulnerabilities-waf-protection<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/research.jfrog.com\/post\/php2shell-all-you-need-to-know-about-cve-2026-109618-and-cve-2026-109619\/\" target=\"_blank\" rel=\"noopener\">https:\/\/research.jfrog.com\/post\/php2shell-all-you-need-to-know-about-cve-2026-109618-and-cve-2026-109619\/<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/www.reuters.com\/technology\/what-is-php-why-did-it-take-government-websites-offline-2026-10-21\/\" target=\"_blank\" rel=\"noopener\">https:\/\/www.reuters.com\/technology\/what-is-php-why-did-it-take-government-websites-offline-2026-10-21\/<\/a><\/li>\n<\/ol>\n<\/div>\n<\/div>\n<\/div>\n<\/div><\/section>\n","protected":false},"excerpt":{"rendered":"","protected":false},"author":345,"featured_media":81429,"template":"","meta":{"_acf_changed":false,"show_custom_date":false,"custom_date":"","featured":false,"featured_image":0,"learn_more_label":"","image_alt_text":"","learn_more_type":"","show_popup":false,"learn_more_link_file":0,"event_date":false,"event_start_date":"","event_end_date":"","place_holder_image_url":"","post_reading_time":"3","notification_enabled":false,"notification_text":"","notification_logo":"","notification_expiration_time":0,"is_enable_transparent_header":false,"selected_taxonomy_terms":{"blog-category":[322,323],"blog-tag":[],"translation_priority":[221]},"selected_primary_terms":[],"learn_more_link":[],"featured_page_list":[],"notification_enabled_post_list":[],"_gspb_post_css":"","_relevanssi_hide_post":"","_relevanssi_hide_content":"","_relevanssi_pin_for_all":"","_relevanssi_pin_keywords":"","_relevanssi_unpin_keywords":"","_relevanssi_related_keywords":"","_relevanssi_related_include_ids":"","_relevanssi_related_exclude_ids":"","_relevanssi_related_no_append":"","_relevanssi_related_not_related":"","_relevanssi_related_posts":"80877,80891,81989","_relevanssi_noindex_reason":"","inline_featured_image":false,"footnotes":""},"blog-category":[322,323],"blog-tag":[],"class_list":["post-81980","blog","type-blog","status-publish","has-post-thumbnail","hentry","blog-category-cloud-siem","blog-category-secops-security"],"acf":[],"permalink_manager":null,"_links":{"self":[{"href":"https:\/\/www.sumologic.com\/ja\/wp-json\/wp\/v2\/blog\/81980","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.sumologic.com\/ja\/wp-json\/wp\/v2\/blog"}],"about":[{"href":"https:\/\/www.sumologic.com\/ja\/wp-json\/wp\/v2\/types\/blog"}],"author":[{"embeddable":true,"href":"https:\/\/www.sumologic.com\/ja\/wp-json\/wp\/v2\/users\/345"}],"version-history":[{"count":2,"href":"https:\/\/www.sumologic.com\/ja\/wp-json\/wp\/v2\/blog\/81980\/revisions"}],"predecessor-version":[{"id":81982,"href":"https:\/\/www.sumologic.com\/ja\/wp-json\/wp\/v2\/blog\/81980\/revisions\/81982"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.sumologic.com\/ja\/wp-json\/wp\/v2\/media\/81429"}],"wp:attachment":[{"href":"https:\/\/www.sumologic.com\/ja\/wp-json\/wp\/v2\/media?parent=81980"}],"wp:term":[{"taxonomy":"blog-category","embeddable":true,"href":"https:\/\/www.sumologic.com\/ja\/wp-json\/wp\/v2\/blog-category?post=81980"},{"taxonomy":"blog-tag","embeddable":true,"href":"https:\/\/www.sumologic.com\/ja\/wp-json\/wp\/v2\/blog-tag?post=81980"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}