ET EXPLOIT PHP php2shell Chunked Multipart Request without Content-Length (CVE-2026-109618)

7.0.3 5.0SID: 2072551Rev: 1Enabled3 views

Fileemerging-exploit.rules

CreatedOctober 22, 2026

UpdatedOctober 22, 2026

Classificationmisc-attack

alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT PHP php2shell Chunked Multipart Request without Content-Length (CVE-2026-109618)"; reference:url,github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w; reference:cve,2026-109618; classtype:misc-attack; sid:2072551; rev:1; metadata:affected_product PHP, attack_target Web_Server, tls_state TLSDecrypt, created_at 2026_10_22, cve CVE_2026_109618, deployment Perimeter, deployment Internal, performance_impact Low, confidence Low, signature_severity Major, updated_at 2026_10_22, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1189, mitre_technique_name Drive_by_Compromise;)

Detection details are hidden.

References

url	github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w
cve	2026-109618

Metadata

affected productPHP

attack targetWeb_Server

tls stateTLSDecrypt

created at2026_10_22

cve

CVE-2026-109618

deploymentInternal

performance impactLow

confidenceLow

signature severityMajor

updated at2026_10_22

mitre tactic idTA0001

mitre tactic nameInitial_Access

mitre technique idT1189

mitre technique nameDrive_by_Compromise

Comments (0)

Please sign in to leave a comment.

No comments yet. Be the first to comment!