alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT PHP php2shell Chunked Multipart Request without Content-Length (CVE-2026-109618)"; flow:established,to_server; http.content_type; content:"multipart/form-data|3b|"; http.header; content:"transfer-encoding: chunked"; fast_pattern; nocase; http.header_names; content:!"content-length|0d 0a|"; nocase; http.method; content:"POST"; reference:url,github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w; reference:cve,2026-109618; classtype:misc-attack; sid:2072551; rev:1; metadata:affected_product PHP, attack_target Web_Server, tls_state TLSDecrypt, created_at 2026_10_22, cve CVE_2026_109618, deployment Perimeter, deployment Internal, performance_impact Low, confidence Low, signature_severity Major, updated_at 2026_10_22, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1189, mitre_technique_name Drive_by_Compromise; target:dest_ip;)