PHP2Shell (CVE-2026-109618, CVE-2026-109619) is unauthenticated remote code execution in PHP core, and the default configuration is exposed. Parsing happens before your application runs, so route-scoped WAF rules never see it. Patch to 8.5.12, 8.4.27, 8.3.36 or 8.2.35. Then hunt. Attacks were reported before the patch shipped, so run these four Graylog searches across your full retention period, not just from today. https://graylog.org/post/detecting-php2shell-cves-with-graylog/