PHP2Shell (CVE-2026-109618) 60-Second Runtime Lockdown + Exporting Virtualised Entra ID / Intune Grids to CSV

If your team manages PHP-FPM / Nginx / Apache workloads alongside Microsoft 365 / Entra ID, two operational headaches are dominating incident and audit queues right now:

1. Emergency runtime containment for PHP2Shell (CVE-2026-109618 / CVE-2026-115560)—especially when an attacker uses an RCE foothold to relay outbound phishing through local sendmail / SMTP and instantly tank your domain's SPF / DMARC (550 5.7.26) reputation.
2. Extracting complete audit evidence from virtualised Microsoft Entra ID & Intune ARIA grids (role="grid"), which unmount off-screen rows as you scroll and break standard table exporters during UK Cyber Essentials v3.3 ("Danzell") and EU NIS2 Article 21 audits.

Here is the exact practitioner runbook we use at FaultyPacket to lock down both in under 15 minutes.

Part 1: 4-Layer PHP2Shell (CVE-2026-109618 / 115560) Runtime Containment

Patching PHP binaries across legacy or vendor-locked estates takes days. You can sever the exploit primitive (proc_open, shell_exec, pcntl_exec, and outbound shell callbacks) in 60 seconds at the pool and systemd layers:

1. Lock Down Your php-fpm Pool (www.conf)

Use php_admin_value (which cannot be overridden by .user.ini or ini_set() at runtime):

; /etc/php/8.3/fpm/pool.d/www.conf
php_admin_value[disable_functions] = exec,passthru,shell_exec,system,proc_open,popen,pcntl_exec,pcntl_fork,dl,mail
php_admin_value[open_basedir] = /var/www/app:/tmp
php_admin_flag[allow_url_fopen] = off
php_admin_flag[allow_url_include] = off
php_admin_flag[expose_php] = off

2. Block CGI Path-Info & .php Execution in Upload Directories (Nginx)

location ~* ^/(uploads|storage|media|tmp|cache)/.*\.(php|phtml|phar|inc)$ {
    deny all;
    return 403;
}

3. Prevent Compromised Web Nodes from Spoofing Your Domain (550 5.7.26)

When a web server is compromised, attackers immediately abuse local MTA relays or unauthenticated SMTP to send phishing under your apex domain.

• Ensure your root SPF record stays strictly <= 10 DNS mechanism lookups and ends in hardfail (-all), and delegate web/transactional senders to isolated subdomains.
• Enforce DMARC (p=quarantine or p=reject) plus MTA-STS (mode: enforce) so you receive immediate TLS-RPT / RUA telemetry if an unauthorised IP attempts to send mail as your domain.

👉 Test your live domain's SPF lookup depth, DMARC policy, and MTA-STS posture right in your browser (100% client-side DoH):
FaultyPacket Live PHP2Shell & Email Security Guide

Part 2: Exporting Virtualised Entra ID & Intune ARIA Grids (role="grid") to Clean CSV

If you have ever tried to export Conditional Access policies, Sign-In Logs, or Intune Device Compliance tables for an auditor, you know that modern React/FluentUI portals virtualise the DOM—only ~25 rows exist in HTML at any moment.

Instead of manually screenshotting pages:

1. Capture role="row" elements via a MutationObserver keyed by data-row-key / aria-rowindex while scrolling the virtualised container.
2. Normalise multi-line cell badges and strip CSV Formula Injection (DDE prefixes =, +, -, @) before writing RFC 4180 UTF-8 BOM CSVs for Excel.

We built a 100% free, zero-telemetry Chrome MV3 extension (storage + activeTab only) that handles virtualised ARIA grid capture and instant CSV export automatically:

• Entra ID & Intune ARIA Grid CSV Exporter Guide & Free Download

Need Done-For-You 24h Async Remediation or Audit-Ready Fix Packs?

• Free Interactive Browser Scanners & Extensions: https://faultypacket.co.uk
• Done-For-You 24h Async Remediation on Fiverr (@faultypacket): https://www.fiverr.com/faultypacket (PHP2Shell + SPF/DMARC Hardening, 24h DMARC/MTA-STS Fix, UK Cyber Essentials v3.3 "Danzell" Gap Audit, and EU NIS2/DORA Supplier Posture Audits).