ET EXPLOIT PHP php2shell Binary URL-Encoded POST for $_POST Corruption (CVE-2026-109618)

7.0.3 5.0SID: 2072552Rev: 1Disabled20 views

Fileemerging-exploit.rules

CreatedOctober 22, 2026

UpdatedOctober 22, 2026

Classificationmisc-attack

alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT PHP php2shell Binary URL-Encoded POST for $_POST Corruption (CVE-2026-109618)"; flow:established,to_server; http.content_type; content:"application/x-www-form-urlencoded"; fast_pattern; http.request_body; pcre:"/^\x3d[^&]*?[\x00-\x1f\x7f-\xff]+[^&]*?\x26/s"; http.method; content:"POST"; reference:url,github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w; reference:cve,2026-109618; classtype:misc-attack; sid:2072552; rev:1; metadata:affected_product PHP, attack_target Web_Server, tls_state TLSDecrypt, created_at 2026_10_22, cve CVE_2026_109618, deployment Perimeter, deployment Internal, performance_impact Significant, confidence Low, signature_severity Major, updated_at 2026_10_22; target:dest_ip;)

References

url	github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w
cve	2026-109618

Metadata

affected productPHP

attack targetWeb_Server

tls stateTLSDecrypt

created at2026_10_22

cve

CVE-2026-109618

deploymentInternal

performance impactSignificant

confidenceLow

signature severityMajor

updated at2026_10_22

Comments (0)

Please sign in to leave a comment.

No comments yet. Be the first to comment!