Spectrum Security

Spectrum Threat Graph (PHP2Shell coverage assessment)

Response status

Detection examples and coverage assessment

Response information checked

2026-10-28

Current re-audit: Official response verified · Research date: 2026-10-28

Detection and telemetry coverage management.

The PHP2Shell article maps 11 procedures to 59 detection candidates and explicitly says they were not lab-tested. Threat Graph maps coverage and gaps across an organization's SIEM and EDR.

Scope: Detection assessment and rule assistance; not proof that all 59 candidates work or that customer PHP is patched.

What users should do

Validate detection examples in your environment and check telemetry and results; patch and restart PHP separately.

Official service URL

• https://www.spectrum.security/

Source URLs

1. PHP2Shell response and scopehttps://www.spectrum.security/blog/11-detections-for-catching-php2shellResponse evidence
2. Threat Graph workflowhttps://www.spectrum.security/blog/threat-graph-turn-threats-into-coverageService and operation documentation
3. https://www.spectrum.security/resourceshttps://www.spectrum.security/resourcesService and operation documentation