php2shell.rules

# php2shell CVE-2026-109618 / CVE-2026-109619 RCE in PHP
alert http any any -> any any (msg:"CORELIGHT EXPLOIT php2shell CVE-2026-109618 / CVE-2026-109619 Potential RCE in PHP longjmp() memory handling - PHP_SESSION_UPLOAD_PROGRESS in HTTP POST Body"; flow:established,to_server; http.method; content:"POST"; http.request_body; content:"PHP_SESSION_UPLOAD_PROGRESS"; fast_pattern; reference:cve,2026-109618; reference:cve,2026-109619; reference:url,corelight.com/blog/php2shell-detection-before-disclosure; reference:url,github.com/corelight/php2shell-detect; reference:url,php2shell.com; classtype:misc-activity; sid:3000650; rev:1; metadata:created_at 2026_10_16, mitre_tactic_id TA0001, mitre_technique_id T1190, deployment Perimeter, deployment Internal;)
alert http any any -> any any (msg:"CORELIGHT EXPLOIT php2shell CVE-2026-109618 / CVE-2026-109619 Potential RCE in PHP longjmp() memory handling - PHP advertises a potentially affected version in HTTP response header"; flow:established,to_client; http.response_header; content:"PHP/"; nocase; fast_pattern; pcre:"/^(?:X-Powered-By|Server):(?:[ \t]*|[^\r\n]*[ \t,\x3b(])PHP\/(?!(?:8\.2\.(?:3[5-9]|[4-9][0-9]|[1-9][0-9]{2,3})|8\.3\.(?:3[6-9]|[4-9][0-9]|[1-9][0-9]{2,3})|8\.4\.(?:2[7-9]|[3-9][0-9]|[1-9][0-9]{2,3})|8\.5\.(?:1[2-9]|[2-9][0-9]|[1-9][0-9]{2,3})))(?:5\.(?:[4-9]|[1-9][0-9]{1,2})|(?:[6-9]|[1-9][0-9])\.(?:0|[1-9][0-9]{0,2}))\.(?:0|[1-9][0-9]{0,3})(?:[-+][a-z0-9.+~_-]+)?(?:[ \t,\x3b)]|$)/i"; threshold: type limit, track by_src, count 1, seconds 3600; reference:cve,2026-109618; reference:cve,2026-109619; reference:url,corelight.com/blog/php2shell-detection-before-disclosure; reference:url,github.com/corelight/php2shell-detect; reference:url,php2shell.com; classtype:misc-activity; sid:3000651; rev:3; metadata:created_at 2026_10_16, mitre_tactic_id TA0043, mitre_technique_id T1592.002, deployment Perimeter, deployment Internal;)
alert http any any -> any any (msg:"CORELIGHT EXPLOIT php2shell CVE-2026-109618 / CVE-2026-109619 Potential RCE in PHP longjmp() memory handling - PHP phpinfo content advertises a potentially affected version"; flow:established,to_client; http.response_body; content:"PHP Version"; nocase; fast_pattern; pcre:"/<h1(?:[ \t\r\n]+[^>]{0,128})?>[ \t\r\n]*PHP Version[ \t]+(?!(?:8\.2\.(?:3[5-9]|[4-9][0-9]|[1-9][0-9]{2,3})|8\.3\.(?:3[6-9]|[4-9][0-9]|[1-9][0-9]{2,3})|8\.4\.(?:2[7-9]|[3-9][0-9]|[1-9][0-9]{2,3})|8\.5\.(?:1[2-9]|[2-9][0-9]|[1-9][0-9]{2,3})))(?:5\.(?:[4-9]|[1-9][0-9]{1,2})|(?:[6-9]|[1-9][0-9])\.(?:0|[1-9][0-9]{0,2}))\.(?:0|[1-9][0-9]{0,3})(?:[-+][a-z0-9.+~_-]+)?[ \t\r\n]*<\/h1>/i"; threshold: type limit, track by_src, count 1, seconds 3600; reference:cve,2026-109618; reference:cve,2026-109619; reference:url,corelight.com/blog/php2shell-detection-before-disclosure; reference:url,github.com/corelight/php2shell-detect; reference:url,php2shell.com; classtype:misc-activity; sid:3000652; rev:3; metadata:created_at 2026_10_16, mitre_tactic_id TA0043, mitre_technique_id T1592.002, deployment Perimeter, deployment Internal;)
alert http any any -> any any (msg:"CORELIGHT EXPLOIT php2shell CVE-2026-109618 / CVE-2026-109619 Potential RCE in PHP longjmp() memory handling - Serialized integer-key collision pattern in HTTP request body"; flow:established,to_server; http.method; content:"POST"; http.request_body; content:"i:4294967296|3b|"; fast_pattern; content:"i:8589934592|3b|"; distance:0; within:48; content:"i:12884901888|3b|"; distance:0; within:48; reference:cve,2026-109618; reference:cve,2026-109619; reference:url,corelight.com/blog/php2shell-detection-before-disclosure; reference:url,github.com/corelight/php2shell-detect; reference:url,php2shell.com; classtype:misc-activity; sid:3000653; rev:1; metadata:created_at 2026_10_22, mitre_tactic_id TA0001, mitre_technique_id T1190, deployment Perimeter, deployment Internal; )