alert http any any -> any any (msg:"ATTACK [PTsecurity] Roundcube RCE (CVE-2025-49113)"; flow:established, to_server; http.uri; content:"_uploadid="; nocase; content:"_from="; nocase; content:"O|3a|16|3a|"; nocase; distance:0; content:"Crypt_GPG_Engine"; nocase; distance:0; content:"_gpgconf"; nocase; distance:0; reference:cve, 2025-49113; reference:url, fearsoff.org/research/roundcube; reference:url, rules.ptsecurity.com; classtype:attempted-admin; sid:10014002; rev:1;)