This rule detects a distinctive PHP out-of-memory fatal error indicative of PHP2Shell exploitation attempts. It looks for the combination of a PHP Fatal error, an explicit Allowed memory size message, a bytes exhausted condition, and the phrase Unknown on line 0, which is produced before normal application execution. This pattern is associated with exploitation attempts targeting PHP memory-safety flaws and CVEs CVE-2026-109618 and CVE-2026-109619. The rule flags both unsuccessful and successful attempts but does not by itself confirm remote code execution. It is designed to trigger on web server error logs across Apache, Nginx, and Apache Tomcat, signaling a potential exploit targeting a public-facing PHP application and prompting further investigation and correlation with additional telemetry (web, process, network, and host state). The query is tuned to web-facing logs and uses event.dataset filters (apache.error, nginx.error, apache_tomcat.localhost) and a message pattern requiring PHP Fatal error, Allowed memory size, bytes exhausted, and Unknown on line 0. The rule maps to MITRE ATT&CK technique Exploit Public-Facing Application (T1190) under the Initial Access tactic. It carries a moderate risk score (47) and is labeled with a medium severity, with references to CVEs and relevant advisories. A thorough triage is encouraged to validate authenticity, correlate with corroborating telemetry, and determine if code execution or memory disclosure occurred. The rule includes explicit false-positive caveats and structured guidance for investigation, correlation, remediation, and containment.