Detects the first observed PHP fatal error on a web server within the configured history window. The rule creates a first-seen state keyed by host.id and raises when a host with no prior matching event in the history window reports a PHP fatal error, indicating a previously unseen condition rather than definitive malicious activity. It targets web-server error logs from Apache, Nginx, and Apache Tomcat (indices logs-apache.error-*, logs-nginx.error-*, logs-apache_tomcat.*) and matches events where the message contains PHP and Fatal and error. Implemented as a new_terms rule, it uses a short ingested window (from: now-9m) to trigger on first occurrences and a history window (history_window_start: now-7d) to establish first-seen state over the prior days. The rule maps to MITRE ATT&CK technique T1190 (Exploit Public-Facing Application) under Initial Access, signaling potential exploitation paths that terminate PHP processing. It includes investigation guidance and explicit false positive considerations, emphasizing that many legitimate factors (new deployments, defects, QA activity) can produce a first-seen fatal error. Investigation steps cover reviewing the full error text, identifying affected host and PHP context, correlating with access logs, checking endpoint telemetry for crashes or unusual activity, and comparing against deployment and configuration changes. Remediation guidance suggests patching or rolling back affected components, isolating suspicious hosts, rotating secrets, and expanding review to related hosts to detect broader patterns. The rule has risk_score 47 and severity set to medium, and is intended to facilitate triage and investigation rather than automatic attribution of malicious behavior.