{"id":81983,"date":"2026-10-23T10:57:48","date_gmt":"2026-10-23T18:57:48","guid":{"rendered":"http:\/\/www.sumologic.com\/blog\/sumo-logic%ec%9c%bc%eb%a1%9c-php2shell-%ea%b4%80%eb%a0%a8-%ed%99%9c%eb%8f%99%ec%9d%84-%ec%a1%b0%ec%82%ac%ed%95%98%eb%8a%94-%eb%b0%a9%eb%b2%95"},"modified":"2026-10-29T16:12:34","modified_gmt":"2026-10-30T00:12:34","slug":"investigate-php2shell-activity","status":"publish","type":"blog","link":"https:\/\/www.sumologic.com\/ko\/blog\/investigate-php2shell-activity","title":{"rendered":"Sumo Logic\uc73c\ub85c PHP2Shell \uad00\ub828 \ud65c\ub3d9\uc744 \uc870\uc0ac\ud558\ub294 \ubc29\ubc95"},"content":{"rendered":"\n<section class=\"e-stn e-stn-0d652506f82b000a392973813b918ee25d5b4211 e-stn--glossary-inner-content e-stn--table-of-content\"><div class=\"container\">\n<div class=\"wp-block-b3rg-row e-row row\">\n<div class=\"wp-block-b3rg-column e-col e-col-1f7b3997080fc292474d26ff00c905d99d3520fa e-col--content-wrapper  col-sm-12 col-lg-12 col-xl-12\">\n<div class=\"e-div e-div-a1b32f66e1749758df41d5aea14f647cd10e362c e-div--card-btn-link\">\n<div class=\"wp-block-b3rg-column e-col e-col-ac00a9d18d9973e605ded8ae7af253f1808cf699  col-xs-10 col-sm-9 col-md-6\">\n<figure class=\"wp-block-image size-full w-50 mb-4\"><img loading=\"lazy\" decoding=\"async\" width=\"765\" height=\"291\" src=\"https:\/\/www.sumologic.com\/wp-content\/uploads\/log_threat_labs.png\" alt=\"\" class=\"wp-image-5388\" title=\"\"><\/figure>\n<\/div>\n\n\n<div class=\"e-img \">\n<figure class=\"wp-block-image size-full is-resized\"><img loading=\"lazy\" decoding=\"async\" width=\"900\" height=\"200\" src=\"https:\/\/www.sumologic.com\/wp-content\/uploads\/php2shell-header-1.png\" alt=\"\" class=\"wp-image-81433\" style=\"width:900px;height:auto\" title=\"\" srcset=\"https:\/\/www.sumologic.com\/wp-content\/uploads\/php2shell-header-1.png 900w, https:\/\/www.sumologic.com\/wp-content\/uploads\/php2shell-header-1-300x67.png 300w, https:\/\/www.sumologic.com\/wp-content\/uploads\/php2shell-header-1-765x170.png 765w, https:\/\/www.sumologic.com\/wp-content\/uploads\/php2shell-header-1-572x127.png 572w\" sizes=\"auto, (max-width: 900px) 100vw, 900px\" \/><\/figure>\n<\/div>\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>PHP<\/strong>(PHP: Hypertext Preprocessor\uc758 \uc7ac\uadc0 \uc57d\uc790)\ub294 \uc8fc\ub85c \uc6f9 \uac1c\ubc1c\uc5d0 \uc0ac\uc6a9\ub418\ub294 \ubb34\ub8cc \uc624\ud508\uc18c\uc2a4 \uc11c\ubc84 \uce21 \uc2a4\ud06c\ub9bd\ud305 \uc5b8\uc5b4\uc785\ub2c8\ub2e4. \uc6f9 \uae30\uc220 \ucd94\uc801 \uae30\uad00\uc778 W3Techs\uc5d0 \ub530\ub974\uba74, <a href=\"https:\/\/www.reuters.com\/technology\/what-is-php-why-did-it-take-government-websites-offline-2026-10-21\/\" target=\"_blank\" rel=\"noopener\">PHP\ub294 \ud504\ub85c\uadf8\ub798\ubc0d \uc5b8\uc5b4\ub97c \uc2dd\ubcc4\ud560 \uc218 \uc788\ub294 \ubaa8\ub4e0 \uc6f9\uc0ac\uc774\ud2b8\uc758 \uc57d 70%\uc5d0\uc11c \uc2e4\ud589\ub418\ub294 \uac83\uc73c\ub85c \uc54c\ub824\uc838 \uc788\uc2b5\ub2c8\ub2e4<\/a>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>PHP2Shell<\/strong>\uc740 PHP \uc778\ud130\ud504\ub9ac\ud130 \uc790\uccb4\uc758 \ub450 \uac00\uc9c0 \uc911\ub300\ud55c \uacb0\ud568\uc73c\ub85c, \uac01\uac01 CVSS v4.0 \uc810\uc218\uac00 9.2\uc785\ub2c8\ub2e4. \ub450 \uacb0\ud568 \ubaa8\ub450 \uc778\uc99d\ub418\uc9c0 \uc54a\uc740 \uacf5\uaca9\uc790\uac00 \uc560\ud50c\ub9ac\ucf00\uc774\uc158 \ucf54\ub4dc\uac00 \uc2e4\ud589\ub418\uae30 \uc804\uc5d0 \ub2e8\uc77c \ub610\ub294 \uc30d\uc758 \uc6f9 \uc694\uccad\uc73c\ub85c \uc6f9 \uc11c\ubc84\uc5d0\uc11c \ucf54\ub4dc\ub97c \uc2e4\ud589\ud560 \uc218 \uc788\uac8c \ud569\ub2c8\ub2e4.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>CVE-2026-109618\uc740 PHP\uc758 \uba54\ubaa8\ub9ac \ubd80\uc871 \ucc98\ub9ac\ub97c \uc545\uc6a9\ud569\ub2c8\ub2e4.<\/li>\n\n\n\n<li>CVE-2026-109619\ub294 \ub3d9\uc77c\ud55c \uc6cc\ucee4\uc5d0\uc11c \uc774\uc804\uc758 \uc2e4\ud328\ud55c \uc694\uccad\uc73c\ub85c\ubd80\ud130 \ub0a8\uaca8\uc9c4 \uc0c1\ud0dc\ub97c \uc545\uc6a9\ud569\ub2c8\ub2e4.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">\ubc84\uadf8\uac00 WordPress, Drupal \ub610\ub294 Magento\uac00 \uc544\ub2cc PHP \uc790\uccb4\uc5d0 \uc788\uae30 \ub54c\ubb38\uc5d0, \uc601\ud5a5\uc744 \ubc1b\ub294 \uc11c\ubc84\uc758 \ubaa8\ub4e0 \ub3c4\ub2ec \uac00\ub2a5\ud55c PHP \uc5d4\ub4dc\ud3ec\uc778\ud2b8(\ub85c\uadf8\uc778 \ud398\uc774\uc9c0, \uc815\uc801 \uc591\uc2dd \ubc0f \uc0c1\ud0dc \ud655\uc778 \ud3ec\ud568)\uac00 \ub178\ucd9c\ub429\ub2c8\ub2e4.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\uc9c0\ub09c 10\ub144\uac04\uc758 \ubaa8\ub4e0 PHP \ub9b4\ub9ac\uc2a4\uac00 \uc601\ud5a5\uc744 \ubc1b\uc2b5\ub2c8\ub2e4(5.4\uae4c\uc9c0 \uac70\uc2ac\ub7ec \uc62c\ub77c\uac11\ub2c8\ub2e4). \uc218\uc815\ub41c \ubc84\uc804\uc740 8.5.12, 8.4.27, 8.3.36, 8.2.35\uc785\ub2c8\ub2e4. PHP 8.1 \uc774\uc0c1\uc740 \ucd5c\uc18c\ud55c\uc758 \uc18c\uc2a4 \ubc31\ud3ec\ud2b8\ub9cc \uc81c\uacf5\ub429\ub2c8\ub2e4.<\/p>\n\n\n\n<h2 id=\"php2shell-disclosure-timeline\" class=\"wp-block-heading\">PHP2Shell \uacf5\uac1c \ud0c0\uc784\ub77c\uc778<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">\ub450 \uac00\uc9c0 \uc911\ub300\ud55c PHP \ucde8\uc57d\uc810\uc778 CVE-2026-109618\uacfc CVE-2026-109619\ub294 \ube44\uacf5\uac1c \uc5f0\uad6c\uc5d0\uc11c \ud65c\ubc1c\ud55c \uc545\uc6a9\uae4c\uc9c0 \uba70\uce60 \ub9cc\uc5d0 \uc9c4\ud589\ub418\uc5c8\uc2b5\ub2c8\ub2e4. \ub2e4\uc74c\uc740 \uc0ac\uac74\uc758 \ud0c0\uc784\ub77c\uc778\uc785\ub2c8\ub2e4.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>2026\ub144 8\uc6d4:<\/strong> Calif\ub294 LLM \uc9c0\uc6d0 \uac10\uc0ac \uc911\uc5d0 \uccab \ubc88\uc9f8 \uc6d0\uaca9 \ucf54\ub4dc \uc2e4\ud589(RCE) \uacbd\ub85c\ub97c \ubc1c\uacac\ud558\uace0 PHP\uc5d0 \ubcf4\uace0\ud569\ub2c8\ub2e4. Wiz\ub294 \ub3c5\ub9bd\uc801\uc73c\ub85c \uacb0\ud568\uc744 \ubc1c\uacac\ud558\uace0 PHP\uc5d0 \ubcf4\uace0\ud569\ub2c8\ub2e4.<\/li>\n\n\n\n<li><strong>2026\ub144 10\uc6d4 \ucd08:<\/strong> Cloudflare\ub294 \uc6f9 \uc560\ud50c\ub9ac\ucf00\uc774\uc158 \ubc29\ud654\ubcbd(WAF) \ubcf4\ud638 \uad6c\ucd95\uc744 \uc2dc\uc791\ud569\ub2c8\ub2e4.<\/li>\n\n\n\n<li><strong>2026\ub144 10\uc6d4 17\uc77c:<\/strong> AWS\ub294 \uacc4\ud68d\ub41c \uc870\uc815\ub41c \uacf5\uac1c 4\uc77c \uc804 Amazon MadPot\uc5d0 \ub300\ud55c \uccab \ubc88\uc9f8 \uc54c\ub824\uc9c4 \uc545\uc6a9 \uc2dc\ub3c4\ub97c \ubcf4\uace0\ud569\ub2c8\ub2e4.<\/li>\n\n\n\n<li><strong>2026\ub144 10\uc6d4 20\uc77c:<\/strong> PHP\uc758 \ub450 \uac00\uc9c0 \uc911\ub300\ud55c \uc6d0\uaca9 \ucf54\ub4dc \ucde8\uc57d\uc810\uc778 CVE-2026-109618\uacfc CVE-2026-109619\uc758 \uc138\ubd80 \uc815\ubcf4\uac00 PHP \uc7ac\ub2e8\uc5d0\uc11c \uacc4\ud68d\ud55c 2026\ub144 10\uc6d4 22\uc77c \uc870\uc815\ub41c \uacf5\uac1c \uc804\uc5d0 \uc720\ucd9c\ub418\uc5c8\uc2b5\ub2c8\ub2e4.<\/li>\n\n\n\n<li><strong>2026\ub144 10\uc6d4 21\uc77c:<\/strong> PHP \uc7ac\ub2e8\uc740 \ucde8\uc57d\uc810\uc744 \uc870\uae30\uc5d0 \uacf5\uc2dd \uacf5\uac1c\ud558\uace0 \ubaa8\ub4e0 \uc0ac\uc6a9\uc790\uc5d0\uac8c \uc5c5\ub370\uc774\ud2b8\ub97c \uad8c\uace0\ud569\ub2c8\ub2e4. \uc601\ud5a5\uc744 \ubc1b\ub294 \uc18c\ud504\ud2b8\uc6e8\uc5b4 \ubc84\uc804\uc5d0 \ub300\ud55c \uae34\uae09 \uc5c5\ub370\uc774\ud2b8\ub294 \uac19\uc740 \ub0a0 \ub098\uc911\uc5d0 \ubc30\ud3ec\ub429\ub2c8\ub2e4.<\/li>\n\n\n\n<li><strong>2026\ub144 10\uc6d4 21\uc77c \uc774\ud6c4:<\/strong> \uc5f0\uad6c\uc6d0\ub4e4\uc774 \uad11\ubc94\uc704\ud55c \uc545\uc6a9 \uc2dc\ub3c4\ub97c \ubcf4\uace0\ud569\ub2c8\ub2e4.<\/li>\n<\/ul>\n\n\n\n<h2 id=\"how-to-search-for-php2shell-activity-in-your-environment\" class=\"wp-block-heading\">\ud658\uacbd\uc5d0\uc11c PHP2Shell \ud65c\ub3d9\uc744 \uac80\uc0c9\ud558\ub294 \ubc29\ubc95\uc740?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Sumo Logic\uc744 \uc0ac\uc6a9\ud558\uc5ec PHP2Shell \ud65c\ub3d9\uc744 \uac80\uc0c9\ud574 \ubcf4\uaca0\uc2b5\ub2c8\ub2e4. \uac01 \ud65c\ub3d9 \uc720\ud615\uc5d0 \ub300\ud574 \ub450 \uac00\uc9c0 \uac80\uc0c9\uc744 \ucc3e\uc744 \uc218 \uc788\uc2b5\ub2c8\ub2e4. \ud558\ub098\ub294 \ub2e4\uc591\ud55c \uc720\ud615\uc758 \uc6d0\ubcf8 \ub85c\uadf8\uc5d0 \ub300\ud55c \uac80\uc0c9\uc774\uace0, \ub2e4\ub978 \ud558\ub098\ub294 <a href=\"https:\/\/www.sumologic.com\/help\/docs\/cse\/schema\/record-processing-pipeline\/\">\uc815\uaddc\ud654\ub41c \ub808\ucf54\ub4dc<\/a>\uc5d0 \ub300\ud55c \uac80\uc0c9\uc785\ub2c8\ub2e4. <a href=\"http:\/\/www.sumologic.com\/ko\/solutions\/siem\">Sumo Logic Cloud SIEM<\/a>\uc744 \uc0ac\uc6a9\ud558\ub294 \uace0\uac1d\uc758 \uacbd\uc6b0\uc785\ub2c8\ub2e4.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\uc2dc\uc791\ud558\uae30 \uc804\uc5d0 \ub450 \uac00\uc9c0 \ucc38\uace0 \uc0ac\ud56d\uc774 \uc788\uc2b5\ub2c8\ub2e4.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>\uc6d0\ubcf8 \ub85c\uadf8 \uac80\uc0c9\uc740 \uc870\uc815\uc774 \ud544\uc694\ud569\ub2c8\ub2e4.<\/strong> \uc6d0\ubcf8 \ub85c\uadf8 \uac80\uc0c9 \uc608\uc81c\uc5d0\ub294 Apache \uc561\uc138\uc2a4 \ub85c\uadf8\uc640 \uac19\uc740 \ub85c\uadf8 \uc18c\uc2a4 \uc720\ud615\uc5d0 \ud2b9\uc815\ud55c \uad6c\ubb38 \ubd84\uc11d \uc791\uc5c5\uc774 \ud3ec\ud568\ub429\ub2c8\ub2e4. \ub610\ud55c \ub85c\uadf8 \uc18c\uc2a4\ub97c \uc628\ubcf4\ub529\ud560 \ub54c \ud560\ub2f9\ud558\ub294 \ub85c\uadf8 \ubd84\ub958(\uc608: <code>_sourceCategory=linux\/system webserver<\/code>)\ub85c \ubc94\uc704\ub97c \uc9c0\uc815\ud569\ub2c8\ub2e4. \uc5ec\uae30\uc5d0 \ud3ec\ud568\ub41c \uc6d0\ubcf8 \ub85c\uadf8 \uac80\uc0c9 \uc608\uc81c\ub97c \uc0ac\uc6a9\ud558\ub824\uba74 \ud658\uacbd\uc5d0 \ub9de\uac8c \uc0ac\uc6a9\uc790 \uc815\uc758\ud574\uc57c \ud560 \uac00\ub2a5\uc131\uc774 \ub192\uc2b5\ub2c8\ub2e4.<\/li>\n\n\n\n<li><strong>\ub808\ucf54\ub4dc \uac80\uc0c9\uc740 \uc791\uc131\ub41c \uadf8\ub300\ub85c \uc791\ub3d9\ud569\ub2c8\ub2e4.<\/strong> Sumo Logic Cloud SIEM <a href=\"https:\/\/www.sumologic.com\/help\/docs\/cse\/schema\/\">\uc815\uaddc\ud654\ub41c \uc2a4\ud0a4\ub9c8<\/a>\ub97c \uae30\ubc18\uc73c\ub85c \ud558\ubbc0\ub85c \uc218\uc815 \uc5c6\uc774 \uc0ac\uc6a9\ud560 \uc218 \uc788\uc2b5\ub2c8\ub2e4.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">\uc774\ub7ec\ud55c \uac80\uc0c9\uc740 \ucd08\uae30 \uc545\uc6a9 \ud6c4 \uc6f9 \uc11c\ubc84\uc758 \ub3d9\uc791\uc744 \ucc3e\uc2b5\ub2c8\ub2e4. \uc545\uc6a9 \ud398\uc774\ub85c\ub4dc\ub97c \ud3ec\ud568\ud560 \uc218 \uc788\ub294 HTTP \ud2b8\ub79c\uc7ad\uc158\uc744 \uac80\uc0c9\ud558\uc9c0 \uc54a\uc2b5\ub2c8\ub2e4. \ub9ce\uc740 \uacbd\uc6b0 \uc6f9 \uc560\ud50c\ub9ac\ucf00\uc774\uc158 \ubc29\ud654\ubcbd\uacfc \uac19\uc740 \ubcf4\uc548 \uc81c\ud488\uc774 \uc778\ud130\ub137\uc5d0 \ub178\ucd9c\ub41c \uc6f9 \uc11c\ubc84 &#8220;\uc55e\uc5d0&#8221; \uc788\uc73c\uba70, \uc774\ub7ec\ud55c \uc81c\ud488\uc740 HTTP \ubd84\uc11d\uc744 \uc0ac\uc6a9\ud55c \uc6f9 \uc11c\ubc84 \uc545\uc6a9 \uc8fc\ubcc0\uc5d0 \uc790\uccb4 \ud0d0\uc9c0 \uc138\ud2b8\ub97c \uac16\uac8c \ub429\ub2c8\ub2e4. \uc774\ub7ec\ud55c \uc81c\ud488\uc758 \ud154\ub808\uba54\ud2b8\ub9ac\ub294 \uc0c1\uad00\uad00\uacc4, \uacbd\uace0 \ubc0f \ucd94\uac00 \ubd84\uc11d\uc744 \uc704\ud574 Sumo Logic\uc73c\ub85c \uc218\uc9d1\ub418\uc5b4\uc57c \ud569\ub2c8\ub2e4.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\uc774 \ube14\ub85c\uadf8\uc758 \ud0d0\uc9c0 \uc5d4\uc9c0\ub2c8\uc5b4\ub9c1 \ucd08\uc810\uc740 \ucd08\uae30 \uc545\uc6a9 \ubc0f \uc131\uacf5\uc801\uc778 \uacf5\uaca9\uc73c\ub85c\ubd80\ud130\uc758 \ud6c4\uc18d \ud65c\ub3d9\uacfc \uad00\ub828\ub41c \uc6f9 \uc11c\ubc84\uc758 \ub3d9\uc791 \uad00\ucc30\uc5d0 \uc788\uc2b5\ub2c8\ub2e4. \uc774\ub7ec\ud55c \uad00\ucc30\uc740 \ub2e4\ub978 \ubcf4\uc548 \uc81c\ud488\uc758 \ud154\ub808\uba54\ud2b8\ub9ac\uc640 \uc0c1\uad00\uad00\uacc4\ub97c \uc9c0\uc744 \uc218 \uc788\uc2b5\ub2c8\ub2e4.<\/p>\n\n\n\n<h3 id=\"look-for-spikes-in-web-server-errors\" class=\"wp-block-heading\">\uc6f9 \uc11c\ubc84 \uc624\ub958\uc758 \uae09\uc99d\uc744 \ucc3e\uc73c\uc138\uc694<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">PHP2Shell \ucde8\uc57d\uc810\uc740 PHP \uc624\ub958 \ucc98\ub9ac\uc758 \uacb0\ud568\uc5d0\uc11c \ube44\ub86f\ub418\ubbc0\ub85c \uc545\uc6a9 \uc2dc\ub3c4\ub294 \uc6f9 \uc11c\ubc84\uc758 \uc624\ub958\ub85c \ud45c\uc2dc\ub429\ub2c8\ub2e4. Sumo Logic\uc758 <a href=\"https:\/\/www.sumologic.com\/help\/docs\/search\/search-query-language\/search-operators\/timeslice\/\">timeslice \uac80\uc0c9 \uc5f0\uc0b0\uc790<\/a>\ub97c \uc0ac\uc6a9\ud558\uba74 \uc6f9 \uc11c\ubc84\uc758 \uc624\ub958 \ud65c\ub3d9\uc5d0 \uae09\uc99d\uc774 \uc788\uc5c8\ub294\uc9c0 \uc27d\uac8c \ud3c9\uac00\ud560 \uc218 \uc788\uc2b5\ub2c8\ub2e4.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\uc544\ub798 \uc608\uc81c\uc5d0\uc11c\ub294 \uc2dc\uac04\ub2f9 \uc11c\ubc84 \uce21 \uc624\ub958(500-599 \ubc94\uc704\uc758 HTTP \uc751\ub2f5 \ucf54\ub4dc\ub97c \uc0dd\uc131\ud558\ub294 \uc624\ub958) \uc218\ub97c \uacc4\uc0b0\ud569\ub2c8\ub2e4. \uacb0\uacfc\uc5d0\uc11c \uae09\uc99d\uc744 \uc2dc\uac01\uc801\uc73c\ub85c \uc2a4\uce94\ud560 \uc218 \uc788\uc2b5\ub2c8\ub2e4.<\/p>\n\n\n\n<h5 id=\"example-1-syslog-wrapped-apache-access-logs\" class=\"wp-block-heading\"><strong>\uc608\uc81c 1: (Syslog \ub798\ud551\ub41c) Apache \uc561\uc138\uc2a4 \ub85c\uadf8<\/strong><\/h5>\n\n\n\n<pre class=\"wp-block-code\"><code>(_sourceCategory=linux\/system webserver_system=apache webserver_farm=* OR _sourceCategory=linux\/syslog) httpd-access HTTP (50* OR 51* OR 52* OR 53* OR 54* OR 55* OR 59*)\n| parse \"httpd-access: *\" as mesg nodrop\n| parse regex field=mesg \"^(?&lt;src_ip&gt;\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3})\\s+(?&lt;vhost&gt;\\S+)\" nodrop\n| parse regex field=mesg \"\\\"(?&lt;method&gt;&#091;A-Z]+)\\s(?&lt;uri&gt;\\S+)\\sHTTP\\\/&#091;\\d\\.]+\\\"\\s(?&lt;status_code&gt;\\d+)\\s(?&lt;size&gt;&#091;\\d-]+)\" nodrop\n| where !isNull(status_code) and status_code &gt;= 500 and status_code &lt;= 599\n| timeslice 1h\n| count by _timeslice, _sourceHost\n| sort by _timeslice, _count desc<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<h5 id=\"example-2-sumo-logic-cloud-siem-records\" class=\"wp-block-heading\">\uc608\uc81c 2: Sumo Logic Cloud SIEM \ub808\ucf54\ub4dc<\/h5>\n\n\n\n<p class=\"wp-block-paragraph\">\uc544\ub798 \ucffc\ub9ac\ub294 \ubc30\ud3ec\uc5d0\uc11c web_servers \ub610\ub294 http_servers <a href=\"https:\/\/www.sumologic.com\/help\/docs\/cse\/match-lists-suppressed-lists\/standard-match-lists\/#standard-match-lists\">\ud45c\uc900 \uc77c\uce58 \ubaa9\ub85d<\/a>\uc774 \uc0dd\uc131\ub418\uace0 \ucc44\uc6cc\uc838 \uc788\ub294\uc9c0 \uc5ec\ubd80\uc5d0 \ub530\ub77c \ub2ec\ub77c\uc9d1\ub2c8\ub2e4.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>_index=sec_record*\n| where http_response_statusCode &gt;= 500 and http_response_statusCode &lt;= 599 \n| where jsonArrayContains(listMatches, \"web_servers\") or jsonArrayContains(listMatches, \"http_servers\")\n| timeslice 1h\n| count by _timeslice, dstDevice_ip\n| sort by _timeslice, _count desc<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n<div class=\"e-img \">\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"855\" height=\"683\" src=\"https:\/\/www.sumologic.com\/wp-content\/uploads\/PHP2Shell-img1-Searching-Environment.png\" alt=\"\" class=\"wp-image-81403\" title=\"\" srcset=\"https:\/\/www.sumologic.com\/wp-content\/uploads\/PHP2Shell-img1-Searching-Environment.png 855w, https:\/\/www.sumologic.com\/wp-content\/uploads\/PHP2Shell-img1-Searching-Environment-767x613.png 767w, https:\/\/www.sumologic.com\/wp-content\/uploads\/PHP2Shell-img1-Searching-Environment-300x240.png 300w, https:\/\/www.sumologic.com\/wp-content\/uploads\/PHP2Shell-img1-Searching-Environment-575x459.png 575w\" sizes=\"auto, (max-width: 855px) 100vw, 855px\" \/><\/figure>\n<\/div>\n\n\n<p class=\"wp-block-paragraph\"><em>\uadf8\ub9bc 1: \uc6f9 \uc11c\ubc84 \uc624\ub958 \ud65c\ub3d9 \uae09\uc99d<\/em><\/p>\n\n\n\n<div style=\"height:20px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<h3 id=\"identify-web-server-processes-spawning-a-shell\" class=\"wp-block-heading\">\uc6f9 \uc11c\ubc84 \ud504\ub85c\uc138\uc2a4\uac00 \uc178\uc744 \uc0dd\uc131\ud558\ub294 \uacbd\uc6b0 \uc2dd\ubcc4<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">\uacf5\uaca9\uc790\uac00 PHP2Shell\uc744 \uc131\uacf5\uc801\uc73c\ub85c \uc545\uc6a9\ud558\uba74 \uc6f9 \uc11c\ubc84 \ub610\ub294 PHP \ud504\ub85c\uc138\uc2a4\uc758 \uc790\uc2dd \ud504\ub85c\uc138\uc2a4\ub97c \ud1b5\ud574 \uc545\uc131 \ucf54\ub4dc\ub97c \uc2e4\ud589\ud560 \uc218 \uc788\uc2b5\ub2c8\ub2e4. \uc544\ub798 \ucffc\ub9ac\ub294 Windows \ubc0f Linux \ud658\uacbd \ubaa8\ub450\uc5d0\uc11c \uc804\uccb4 OS \uc178\uc744 \uc2dc\uc791\ud558\ub294 \uc77c\ubc18\uc801\uc778 \uc6f9 \uc11c\ubc84 \ud504\ub85c\uc138\uc2a4\ub97c \uc2dd\ubcc4\ud569\ub2c8\ub2e4.<\/p>\n\n\n\n<h5 id=\"example-1-windows-process-logs\" class=\"wp-block-heading\">\uc608\uc81c 1: Windows \ud504\ub85c\uc138\uc2a4 \ub85c\uadf8<\/h5>\n\n\n\n<pre class=\"wp-block-code\"><code>_sourceCategory =\"windows\/eventlogs\"\n| parse \"&lt;EventID&gt;*&lt;\/EventID&gt;\" as eventId\n| where eventId = \"4688\"\n| parse \"&lt;Data Name='ParentProcessName'&gt;*&lt;\/Data&gt;\" as parentBaseImage nodrop\n| parse \"&lt;Data Name='NewProcessName'&gt;*&lt;\/Data&gt;\" as baseImage nodrop\n| parse \"&lt;Data Name='CommandLine'&gt;*&lt;\/Data&gt;\" as commandLine nodrop\n| parse \"&lt;Data Name='SubjectUserName'&gt;*&lt;\/Data&gt;\" as user_username nodrop\n| parse \"&lt;Data Name='SubjectDomainName'&gt;*&lt;\/Data&gt;\" as user_domain nodrop\n| parse regex \"&lt;Computer&gt;(?&lt;device_hostname&gt;&#091;^&lt;]+)&lt;\/Computer&gt;\" nodrop\n| where parentBaseImage matches \/(?i).*(w3wp\\.exe|httpd\\.exe|nginx\\.exe|php-cgi\\.exe|tomcat\\.exe)$\/\n| where baseImage matches \/(?i).*(cmd\\.exe|powershell\\.exe|bitsadmin\\.exe|pwsh\\.exe|powershell_ise\\.exe)$\/\n| fields device_hostname, user_domain, user_username, parentBaseImage, baseImage, commandLine<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<h5 id=\"example-2-sumo-logic-cloud-siem-records\" class=\"wp-block-heading\">\uc608\uc81c 2: Sumo Logic Cloud SIEM \ub808\ucf54\ub4dc<\/h5>\n\n\n\n<pre class=\"wp-block-code\"><code>_index=sec_record*\n| where parentBaseImage matches \/(?i).*(w3wp\\.exe|httpd\\.exe|nginx\\.exe|php-cgi\\.exe|tomcat\\.exe|\\\/httpd|\\\/nginx|\\\/php-cgi|\\\/tomcat|\\\/apache2|\\\/apache)$\/\n| where baseImage matches \/(?i).*(cmd\\.exe|sh\\.exe|bash\\.exe|powershell\\.exe|bitsadmin\\.exe|pwsh\\.exe|powershell_ise\\.exe|\\\/bash|\\\/sh|\\\/dash|\\\/zsh|\\\/ksh|\\\/csh|\\\/python3?|\\\/perl)$\/\n| fields device_hostname, device_ip, user_username, parentBaseImage, baseImage, commandLine<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n<div class=\"e-img \">\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"320\" src=\"https:\/\/www.sumologic.com\/wp-content\/uploads\/PHP2Shell-img2-Searching-Web-Shell-Activity-1024x320.png\" alt=\"\" class=\"wp-image-81410\" title=\"\" srcset=\"https:\/\/www.sumologic.com\/wp-content\/uploads\/PHP2Shell-img2-Searching-Web-Shell-Activity-1024x320.png 1024w, https:\/\/www.sumologic.com\/wp-content\/uploads\/PHP2Shell-img2-Searching-Web-Shell-Activity-300x94.png 300w, https:\/\/www.sumologic.com\/wp-content\/uploads\/PHP2Shell-img2-Searching-Web-Shell-Activity-767x240.png 767w, https:\/\/www.sumologic.com\/wp-content\/uploads\/PHP2Shell-img2-Searching-Web-Shell-Activity-572x179.png 572w, https:\/\/www.sumologic.com\/wp-content\/uploads\/PHP2Shell-img2-Searching-Web-Shell-Activity.png 1439w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n<\/div>\n\n\n<p class=\"wp-block-paragraph\"><em>\uadf8\ub9bc 2: nginx\uc5d0\uc11c \uc2dc\uc791\ub41c \uc178 \ucc3e\uae30<\/em><\/p>\n\n\n\n<div style=\"height:20px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<h3 id=\"look-for-web-server-processes-executing-common-web-shell-commands\" class=\"wp-block-heading\">\uc6f9 \uc11c\ubc84 \ud504\ub85c\uc138\uc2a4\uac00 \uc77c\ubc18\uc801\uc778 \uc6f9 \uc178 \uba85\ub839\uc744 \uc2e4\ud589\ud558\ub294 \uacbd\uc6b0 \ucc3e\uae30<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">\uc6f9 \uc11c\ubc84\ub294 \uc804\uccb4 OS \uc178\uc744 \ud1b5\ud558\uc9c0 \uc54a\uace0 \uc178 \uba85\ub839\uc744 \uc9c1\uc811 \uc2e4\ud589\ud560 \uc218\ub3c4 \uc788\uc2b5\ub2c8\ub2e4. \uc544\ub798 \ucffc\ub9ac\ub294 \uc6f9 \uc11c\ubc84 \ud504\ub85c\uc138\uc2a4\uc758 \uc790\uc2dd \ud504\ub85c\uc138\uc2a4\ub85c \uc2e4\ud589\ub418\ub294 \uc77c\ubc18\uc801\uc778 \uac80\uc0c9, \uc790\uaca9 \uc99d\uba85 \uc218\uc9d1 \ubc0f \uc720\ucd9c \uba85\ub839\uc744 \uc2dd\ubcc4\ud569\ub2c8\ub2e4.<\/p>\n\n\n\n<h5 id=\"example-1-windows-process-logs\" class=\"wp-block-heading\"><strong>\uc608\uc81c 1: Windows \ud504\ub85c\uc138\uc2a4 \ub85c\uadf8<\/strong><\/h5>\n\n\n\n<pre class=\"wp-block-code\"><code>_sourceCategory =\"windows\/eventlogs\"\n| parse \"&lt;EventID&gt;*&lt;\/EventID&gt;\" as eventId\n| where eventId = \"4688\"\n| parse \"&lt;Data Name='ParentProcessName'&gt;*&lt;\/Data&gt;\" as parentBaseImage nodrop\n| parse \"&lt;Data Name='NewProcessName'&gt;*&lt;\/Data&gt;\" as baseImage nodrop\n| parse \"&lt;Data Name='CommandLine'&gt;*&lt;\/Data&gt;\" as commandLine nodrop\n| parse \"&lt;Data Name='SubjectUserName'&gt;*&lt;\/Data&gt;\" as user_username nodrop\n| parse \"&lt;Data Name='SubjectDomainName'&gt;*&lt;\/Data&gt;\" as user_domain nodrop\n| parse regex \"&lt;Computer&gt;(?&lt;device_hostname&gt;&#091;^&lt;]+)&lt;\/Computer&gt;\" nodrop\n| where parentBaseImage matches \/(?i).*(w3wp\\.exe|httpd\\.exe|nginx\\.exe|php-cgi\\.exe|tomcat\\.exe|apache).*\/\n| where commandLine matches \/(?i).*(whoami|net user |ping |systeminfo |netstat |arp -a|ipconfig |ifconfig |curl |wget ).*\/\n| fields device_hostname, user_domain, user_username, parentBaseImage, baseImage, commandLine<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<h5 id=\"example-2-sumo-logic-cloud-siem-records\" class=\"wp-block-heading\">\uc608\uc81c 2: Sumo Logic Cloud SIEM \ub808\ucf54\ub4dc<\/h5>\n\n\n\n<pre class=\"wp-block-code\"><code>_index=sec_record*\n| where parentBaseImage matches \/(?i).*(w3wp\\.exe|httpd\\.exe|nginx\\.exe|php-cgi\\.exe|tomcat\\.exe|apache|\\\/httpd|\\\/nginx|\\\/php-cgi|\\\/tomcat|\\\/apache2).*\/\n| where commandLine matches \/(?i).*(whoami|net user |ping |systeminfo |netstat |arp -a|ipconfig |ifconfig |curl |wget |id |uname |cat \\\/etc\\\/passwd|nc -).*\/\n| fields device_hostname, device_ip, user_username, parentBaseImage, commandLine<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n<div class=\"e-img \">\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"308\" src=\"https:\/\/www.sumologic.com\/wp-content\/uploads\/PHP2Shell-img3-Searching-Web-Shell-Activity-ex2-1024x308.png\" alt=\"\" class=\"wp-image-81417\" title=\"\" srcset=\"https:\/\/www.sumologic.com\/wp-content\/uploads\/PHP2Shell-img3-Searching-Web-Shell-Activity-ex2-1024x308.png 1024w, https:\/\/www.sumologic.com\/wp-content\/uploads\/PHP2Shell-img3-Searching-Web-Shell-Activity-ex2-300x90.png 300w, https:\/\/www.sumologic.com\/wp-content\/uploads\/PHP2Shell-img3-Searching-Web-Shell-Activity-ex2-765x230.png 765w, https:\/\/www.sumologic.com\/wp-content\/uploads\/PHP2Shell-img3-Searching-Web-Shell-Activity-ex2-572x172.png 572w, https:\/\/www.sumologic.com\/wp-content\/uploads\/PHP2Shell-img3-Searching-Web-Shell-Activity-ex2.png 1441w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n<\/div>\n\n\n<p class=\"wp-block-paragraph\"><em>\uadf8\ub9bc 3: Internet Information Server\uc758 \uc790\uc2dd \ud504\ub85c\uc138\uc2a4\ub85c \uc2e4\ud589\ub418\ub294 \uc6d0\uaca9 wget \uba85\ub839<\/em><\/p>\n\n\n\n<div style=\"height:20px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<h2 id=\"sumo-logic-cloud-siem-detections\" class=\"wp-block-heading\">Sumo Logic Cloud SIEM \ud0d0\uc9c0<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Sumo Logic Cloud SIEM\uc5d0\ub294 \uc6f9 \uc178 \ud65c\ub3d9\uc744 \ud0d0\uc9c0\ud558\uace0 PHP2Shell\uc5d0 \uc758\ud574 \uc131\uacf5\uc801\uc73c\ub85c \uc545\uc6a9\ub41c \uc6f9 \uc11c\ubc84\ub97c \uc2dd\ubcc4\ud558\ub294 \ub370 \ub3c4\uc6c0\uc774 \ub418\ub294 \uc5ec\ub7ec \uae30\ubcf8 \uc81c\uacf5 \uaddc\uce59\uc774 \uc788\uc2b5\ub2c8\ub2e4. \uaddc\uce59\uc758 \ud0d0\uc9c0 \uc774\ub860\uc740 \uc704\uc5d0\uc11c \uc124\uba85\ud55c \ucffc\ub9ac\uc640 \ub3d9\uc77c\ud569\ub2c8\ub2e4. \uc989, \uc6f9 \uc11c\ubc84 \ud504\ub85c\uc138\uc2a4\uc758 \ube44\uc815\uc0c1\uc801\uc778 \uc790\uc2dd \ud504\ub85c\uc138\uc2a4\uc640 \uc6f9 \uc11c\ubc84\uc758 \uc624\ub958\uc728 \uae09\uc99d\uc785\ub2c8\ub2e4.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\ub2e4\uc74c \ud0d0\uc9c0\ub97c \ud1b5\ud574 \uc7a0\uc7ac\uc801 \uce68\ud574\ub97c \uc870\uc0ac\ud560 \uc218 \uc788\uc2b5\ub2c8\ub2e4.<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><thead><tr><th>Cloud SIEM \uaddc\uce59 ID<\/th><th>\uaddc\uce59 \uc774\ub984<\/th><\/tr><\/thead><tbody><tr><td>MATCH-S00164<\/td><td>\uc6f9 \uc11c\ubc84\uc5d0\uc11c \uc0dd\uc131\ub41c \uc758\uc2ec\uc2a4\ub7ec\uc6b4 \uc178<\/td><\/tr><tr><td>MATCH-S00174<\/td><td>\uc77c\ubc18\uc801\uc778 \uc6f9 \uc178 \uba85\ub839\uc744 \uc2e4\ud589\ud558\ub294 \uc6f9 \uc11c\ube44\uc2a4<\/td><\/tr><tr><td>MATCH-S00539<\/td><td>\uc758\uc2ec\uc2a4\ub7ec\uc6b4 \ud504\ub85c\uc138\uc2a4\ub97c \uc2e4\ud589\ud558\ub294 \uc6f9 \uc11c\ubc84*<\/td><\/tr><tr><td>OUTLIER-S00036 (\uc2e0\uaddc)<\/td><td>\uc18c\uc2a4 IP\uc758 HTTP \uc11c\ubc84 \uc624\ub958 \uae09\uc99d<\/td><\/tr><tr><td>OUTLIER-S00037 (\uc2e0\uaddc)<\/td><td>\ub300\uc0c1 IP\uc758 HTTP \uc11c\ubc84 \uc624\ub958 \uae09\uc99d<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\uc55e\uc11c \uc5b8\uae09\ud588\ub4ef\uc774 CHAIN \uaddc\uce59\uc744 \uc0dd\uc131\ud558\uc5ec \uc131\uacf5\uc801\uc778 PHP2Shell \uc545\uc6a9\uc5d0 \ub300\ud55c \ub354 \ub192\uc740 \ucda9\uc2e4\ub3c4\uc758 \ud0d0\uc9c0\ub97c \uad6c\ucd95\ud560 \uc218 \uc788\uc2b5\ub2c8\ub2e4. CHAIN \uaddc\uce59\uc740 \uc5d4\ud2f0\ud2f0\uc5d0 \ub300\ud55c PHP2Shell\uc758 \uc5e3\uc9c0 \ub514\ubc14\uc774\uc2a4 \uad00\ucc30(\uc608: WAF \uc54c\ub9bc)\uc744 \uc704\uc758 \ud45c\uc5d0 \uc788\ub294 \uc6f9 \uc178 \ud0d0\uc9c0 \ub85c\uc9c1\uacfc \uc5f0\uad00\uc2dc\ud0b5\ub2c8\ub2e4.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\uc774\ub7ec\ud55c \uaddc\uce59\uc744 \uc0ac\uc6a9\ud558\ub824\uba74 <a href=\"https:\/\/www.sumologic.com\/help\/docs\/cse\/match-lists-suppressed-lists\/standard-match-lists\/#standard-match-lists\">\ud45c\uc900 \ub9e4\uce58 \ub9ac\uc2a4\ud2b8<\/a>\ub97c \uc0dd\uc131\ud558\uace0 \ucc44\uc6cc\uc57c \ud569\ub2c8\ub2e4. MATCH-S00539\ub294 &#8220;web_servers&#8221; \ub9e4\uce58 \ub9ac\uc2a4\ud2b8\ub97c \uc0ac\uc6a9\ud558\uc5ec \uc6f9 \uc11c\ubc84\uc758 \ud504\ub85c\uc138\uc2a4 \uc2e4\ud589\uc73c\ub85c \ud0d0\uc9c0 \ubc94\uc704\ub97c \uc81c\ud55c\ud569\ub2c8\ub2e4.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">OUTLIER-S00036 \ubc0f OUTLIER-S00037\uc740 \uc11c\ubc84 \uce21 \uc624\ub958\ub97c \ucd94\uc801\ud558\uae30 \uc704\ud574 &#8220;web_servers&#8221; \ub610\ub294 &#8220;http_servers&#8221; \ub9e4\uce58 \ub9ac\uc2a4\ud2b8\uac00 \ud544\uc694\ud569\ub2c8\ub2e4. <a href=\"https:\/\/help.sumologic.com\/docs\/cse\/match-lists-suppressed-lists\/create-match-list\/\" target=\"_blank\" rel=\"noopener\">\ub9e4\uce58 \ub9ac\uc2a4\ud2b8\ub97c \uc0dd\uc131\ud558\uace0 \ucc44\uc6b0\ub294 \ubc29\ubc95<\/a>\uc744 \uc54c\uc544\ubcf4\uc138\uc694.<\/p>\n\n\n\n<h2 id=\"recommendations-to-fix-and-mitigate-php2shell\" class=\"wp-block-heading\">PHP2Shell \uc218\uc815 \ubc0f \uc644\ud654 \uad8c\uc7a5 \uc0ac\ud56d<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">PHP \uadf8\ub8f9\uc758 \uc9c0\uce68\uc740 \uba85\ud655\ud569\ub2c8\ub2e4. \uc9c0\uae08 \uc5c5\ub370\uc774\ud2b8\ud558\uc138\uc694.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">&#8220;\uc704\ud5d8\uc5d0 \ucc98\ud55c \ub300\uc0c1: \uc6f9 \uc694\uccad\uc744 \uc81c\uacf5\ud558\ub294 \ubaa8\ub4e0 PHP \uc124\uce58(PHP-FPM, mod_php\uac00 \ud3ec\ud568\ub41c Apache, php-cgi, FrankenPHP \ubc0f LiteSpeed \ud3ec\ud568). \ud2b9\ud788 mod_php\uc758 \uc704\ud5d8\uc774 \uac00\uc7a5 \ub192\uc73c\uba70, \uc778\uc99d\ub418\uc9c0 \uc54a\uc740 \uc694\uccad\uc774 \uc560\ud50c\ub9ac\ucf00\uc774\uc158 \ucf54\ub4dc\uac00 \uc2e4\ud589\ub418\uae30 \uc804\uc5d0 \uacf5\uaca9\uc744 \ud2b8\ub9ac\uac70\ud560 \uc218 \uc788\ub294 \uc545\uc6a9\uc774 \uc785\uc99d\ub418\uc5c8\uc2b5\ub2c8\ub2e4.&#8221; PHP \uadf8\ub8f9\uc758 \uc804\uccb4 \uacf5\uc9c0\uc0ac\ud56d\uc744 <a href=\"https:\/\/www.php.net\/archive\/2026.php#2026-10-21-5\" target=\"_blank\" rel=\"noopener\">\uc5ec\uae30<\/a>\uc5d0\uc11c \uc77d\uc5b4\ubcf4\uc138\uc694.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/www.crowdstrike.com\/en-us\/blog\/crowdstrike-protects-customers-from-php-rce-zero-days\/\" target=\"_blank\" rel=\"noopener\">\ucee4\ubba4\ub2c8\ud2f0 \ubd84\uc11d\uc5d0 \ub530\ub974\uba74 \uc131\uacf5\uc801\uc778 \uc545\uc6a9\uc73c\ub85c \uacf5\uaca9\uc790\ub294 \uc6f9 \uc11c\ubc84 \uc0ac\uc6a9\uc790 \ucee8\ud14d\uc2a4\ud2b8\uc5d0\uc11c \uba85\ub839 \uc2e4\ud589 \uad8c\ud55c\uc744 \uc5bb\uc744 \uc218 \uc788\uc2b5\ub2c8\ub2e4<\/a>. \uc774\ub97c \ud1b5\ud574 \uc6f9 \uc178\uc744 \ubc30\ud3ec\ud558\uace0, \uad6c\uc131 \ud30c\uc77c\uc5d0\uc11c API \ubc0f \ub370\uc774\ud130\ubca0\uc774\uc2a4 \uc790\uaca9 \uc99d\uba85\uc744 \uc218\uc9d1\ud558\uba70, \ub0b4\ubd80 \ub124\ud2b8\uc6cc\ud06c\ub85c \uc774\ub3d9\ud560 \uc218 \uc788\uc2b5\ub2c8\ub2e4.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\uc989\uc2dc \uc5c5\ub370\uc774\ud2b8\ud558\ub294 \uac83\uc774 \uad8c\uc7a5\ub429\ub2c8\ub2e4. \uc544\uc9c1 \uc5c5\ub370\uc774\ud2b8\ud560 \uc218 \uc5c6\ub2e4\uba74 \uc704\uc758 \uac80\uc0c9 \ubc0f \ud0d0\uc9c0\ub97c \uc0ac\uc6a9\ud558\uc5ec \uc601\ud5a5\uc744 \ubc1b\ub294 \uc11c\ubc84\uc5d0\uc11c \uc131\uacf5\uc801\uc778 \uc545\uc6a9\uc744 \ub098\ud0c0\ub0b4\ub294 \uc545\uc6a9 \ud6c4 \ud65c\ub3d9\uc744 \ubaa8\ub2c8\ud130\ub9c1\ud558\uc138\uc694.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\uc544\uc9c1 Cloud SIEM\uc744 \uc0ac\uc6a9\ud558\uc9c0 \uc54a\uace0 \uc788\uc73c\uba70 \uc774\ub7ec\ud55c \uc704\ud611\uc744 \ud0d0\uc9c0\ud558\uace0 \ub300\uc751\ud558\ub294 \ub370 \uc5b4\ub5bb\uac8c \ub3c4\uc6c0\uc774 \ub420 \uc218 \uc788\ub294\uc9c0 \uc54c\uace0 \uc2f6\ub2e4\uba74 <a href=\"http:\/\/www.sumologic.com\/ko\/request-demo\">\ub370\ubaa8\ub97c \uc608\uc57d\ud558\uc5ec \uc790\uc138\ud788 \uc54c\uc544\ubcf4\uc138\uc694<\/a>.<\/p>\n\n\n\n<h2 id=\"references-and-further-resources\" class=\"wp-block-heading\">\ucc38\uace0 \uc790\ub8cc \ubc0f \ucd94\uac00 \ub9ac\uc18c\uc2a4<\/h2>\n\n\n\n<h4 id=\"nist-vulnerability-information\" class=\"wp-block-heading\">NIST \ucde8\uc57d\uc810 \uc815\ubcf4<\/h4>\n\n\n\n<ol class=\"wp-block-list\">\n<li><a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/cve-2026-109618\" target=\"_blank\" rel=\"noopener\">https:\/\/nvd.nist.gov\/vuln\/detail\/cve-2026-109618<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/cve-2026-109619\" target=\"_blank\" rel=\"noopener\">https:\/\/nvd.nist.gov\/vuln\/detail\/cve-2026-109619<\/a><\/li>\n<\/ol>\n\n\n\n<h4 id=\"php-s-guidance\" class=\"wp-block-heading\">PHP\uc758 \uc9c0\uce68<\/h4>\n\n\n\n<ol start=\"3\" class=\"wp-block-list\">\n<li><a href=\"https:\/\/www.php.net\/archive\/2026.php#2026-10-20-1\" target=\"_blank\" rel=\"noopener\">https:\/\/www.php.net\/archive\/2026.php#2026-10-20-1<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/www.php.net\/archive\/2026.php#2026-10-21-5\" target=\"_blank\" rel=\"noopener\">https:\/\/www.php.net\/archive\/2026.php#2026-10-21-5<\/a><\/li>\n<\/ol>\n\n\n\n<h4 id=\"cybersecurity-community-resources-and-reports\" class=\"wp-block-heading\">\uc0ac\uc774\ubc84 \ubcf4\uc548 \ucee4\ubba4\ub2c8\ud2f0 \ub9ac\uc18c\uc2a4 \ubc0f \ubcf4\uace0\uc11c<\/h4>\n\n\n\n<ol start=\"5\" class=\"wp-block-list\">\n<li><a href=\"https:\/\/calif.io\/php2shell\/\" target=\"_blank\" rel=\"noopener\">https:\/\/calif.io\/php2shell\/<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/www.wiz.io\/blog\/php2shell-php-rce\" target=\"_blank\" rel=\"noopener\">https:\/\/www.wiz.io\/blog\/php2shell-php-rce<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/www.huntress.com\/blog\/php2shell-leaked-critical-php-vulnerabilities\" target=\"_blank\" rel=\"noopener\">https:\/\/www.huntress.com\/blog\/php2shell-leaked-critical-php-vulnerabilities<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/www.crowdstrike.com\/en-us\/blog\/crowdstrike-protects-customers-from-php-rce-zero-days\/\" target=\"_blank\" rel=\"noopener\">https:\/\/www.crowdstrike.com\/en-us\/blog\/crowdstrike-protects-customers-from-php-rce-zero-days\/<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/thehackernews.com\/2026\/10\/someone-tried-to-exploit-php2shell-4.html\" target=\"_blank\" rel=\"noopener\">https:\/\/thehackernews.com\/2026\/10\/someone-tried-to-exploit-php2shell-4.html<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/openai.com\/index\/coordinated-disclosure-of-critical-vulnerabilities\/\" target=\"_blank\" rel=\"noopener\">https:\/\/openai.com\/index\/coordinated-disclosure-of-critical-vulnerabilities\/<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/aws.amazon.com\/blogs\/security\/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot\/\" target=\"_blank\" rel=\"noopener\">https:\/\/aws.amazon.com\/blogs\/security\/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot\/<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/blog.checkpoint.com\/security\/php2shell-what-we-know-about-the-leaked-critical-php-vulnerabilities-cve-2026-109618-cve-2026-109619\/\" target=\"_blank\" rel=\"noopener\">https:\/\/blog.checkpoint.com\/security\/php2shell-what-we-know-about-the-leaked-critical-php-vulnerabilities-cve-2026-109618-cve-2026-109619\/<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/blog.cloudflare.com\/php-vulnerabilities-waf-protection\" target=\"_blank\" rel=\"noopener\">https:\/\/blog.cloudflare.com\/php-vulnerabilities-waf-protection<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/research.jfrog.com\/post\/php2shell-all-you-need-to-know-about-cve-2026-109618-and-cve-2026-109619\/\" target=\"_blank\" rel=\"noopener\">https:\/\/research.jfrog.com\/post\/php2shell-all-you-need-to-know-about-cve-2026-109618-and-cve-2026-109619\/<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/www.reuters.com\/technology\/what-is-php-why-did-it-take-government-websites-offline-2026-10-21\/\" target=\"_blank\" rel=\"noopener\">https:\/\/www.reuters.com\/technology\/what-is-php-why-did-it-take-government-websites-offline-2026-10-21\/<\/a><\/li>\n<\/ol>\n<\/div>\n<\/div>\n<\/div>\n<\/div><\/section>\n","protected":false},"excerpt":{"rendered":"","protected":false},"author":345,"featured_media":81430,"template":"","meta":{"_acf_changed":false,"show_custom_date":false,"custom_date":"","featured":false,"featured_image":0,"learn_more_label":"","image_alt_text":"","learn_more_type":"","show_popup":false,"learn_more_link_file":0,"event_date":false,"event_start_date":"","event_end_date":"","place_holder_image_url":"","post_reading_time":"3","notification_enabled":false,"notification_text":"","notification_logo":"","notification_expiration_time":0,"is_enable_transparent_header":false,"selected_taxonomy_terms":{"blog-category":[320,325],"blog-tag":[],"translation_priority":[221]},"selected_primary_terms":[],"learn_more_link":[],"featured_page_list":[],"notification_enabled_post_list":[],"_gspb_post_css":"","_relevanssi_hide_post":"","_relevanssi_hide_content":"","_relevanssi_pin_for_all":"","_relevanssi_pin_keywords":"","_relevanssi_unpin_keywords":"","_relevanssi_related_keywords":"","_relevanssi_related_include_ids":"","_relevanssi_related_exclude_ids":"","_relevanssi_related_no_append":"","_relevanssi_related_not_related":"","_relevanssi_related_posts":"80880,80896,81992","_relevanssi_noindex_reason":"","inline_featured_image":false,"footnotes":""},"blog-category":[320,325],"blog-tag":[],"class_list":["post-81983","blog","type-blog","status-publish","has-post-thumbnail","hentry","blog-category-secops-security","blog-category-cloud-siem"],"acf":[],"permalink_manager":null,"_links":{"self":[{"href":"https:\/\/www.sumologic.com\/ko\/wp-json\/wp\/v2\/blog\/81983","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.sumologic.com\/ko\/wp-json\/wp\/v2\/blog"}],"about":[{"href":"https:\/\/www.sumologic.com\/ko\/wp-json\/wp\/v2\/types\/blog"}],"author":[{"embeddable":true,"href":"https:\/\/www.sumologic.com\/ko\/wp-json\/wp\/v2\/users\/345"}],"version-history":[{"count":2,"href":"https:\/\/www.sumologic.com\/ko\/wp-json\/wp\/v2\/blog\/81983\/revisions"}],"predecessor-version":[{"id":81985,"href":"https:\/\/www.sumologic.com\/ko\/wp-json\/wp\/v2\/blog\/81983\/revisions\/81985"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.sumologic.com\/ko\/wp-json\/wp\/v2\/media\/81430"}],"wp:attachment":[{"href":"https:\/\/www.sumologic.com\/ko\/wp-json\/wp\/v2\/media?parent=81983"}],"wp:term":[{"taxonomy":"blog-category","embeddable":true,"href":"https:\/\/www.sumologic.com\/ko\/wp-json\/wp\/v2\/blog-category?post=81983"},{"taxonomy":"blog-tag","embeddable":true,"href":"https:\/\/www.sumologic.com\/ko\/wp-json\/wp\/v2\/blog-tag?post=81983"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}