diff --git a/datasets/emerging_threats/php2shell/php2shell.yml b/datasets/emerging_threats/php2shell/php2shell.yml
new file mode 100644
index 00000000..11e62fa8
--- /dev/null
+++ b/datasets/emerging_threats/php2shell/php2shell.yml
@@ -0,0 +1,13 @@
+author: Onur Mustafa Erdogan, Splunk
+id: 8236cff3-dabf-4e3c-b07c-434897abd42b
+date: '2026-10-22'
+description: Generated datasets for php2shell exploitation based on Web Server logs.
+environment: NA
+directory: php2shell
+mitre_technique:
+- T1190
+datasets:
+- name: php2shell_webserver_oom.log
+  path: /datasets/emerging_threats/php2shell/php2shell_webserver_oom.log
+  sourcetype: not_applicable
+  source: not_applicable
diff --git a/datasets/emerging_threats/php2shell/php2shell_webserver_oom.log b/datasets/emerging_threats/php2shell/php2shell_webserver_oom.log
new file mode 100644
index 00000000..2468aa5c
--- /dev/null
+++ b/datasets/emerging_threats/php2shell/php2shell_webserver_oom.log
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:00d41cf4d2a841040230d7a75587257798186ec4a1abde63e3975a7e8d61f89b
+size 715