Party
Community detection authors (darkfibr, rjmendez, Lexsah, Blevene)
the rules, and the correction of the leaked PoC's mechanism
Claims this site attributes to this party
| Claim | Who says it | Status | Primary | Sources |
|---|---|---|---|---|
| None of the public proof-of-concept exploits reviewed by VulnCheck has the correct mechanism; a lab reproduction of the leaked PoC's precondition produced a clean 200 The Hacker News says the same of the public code. Fastly: working RCE needs knowledge of the running binary's layout on x86_64. | rjmendez (detection author) citing VulnCheck; Huntress | reported | 1/2 | rjmendez, GitHub Huntress |
Its sources in the vault
- GitHub - darkfibr/php2shell-detect: Defensive detection toolkit for php2shell (CVE-2026-109618/109619, PHP session.upload_progress UAF): UA-independent shape scanner, estate checker, Suricata/Snort rules · GitHub darkfibr (Mike Haddock), GitHub
- GitHub - rjmendez/phpup-2026: IOCs and detection rules for CVE-2026-109618 / CVE-2026-109619 (PHP session.upload_progress UAF) · GitHub rjmendez, GitHub
- GitHub - Lexsah/php2shell-detection: Detection and mitigation rules for CVE-2026-109618 / CVE-2026-109619 (php2shell). Blue-team only. · GitHub Lexsah, GitHub
- PHP2Shell: Detection Opportunities · GitHub Blevene (GitHub gist)