# Community detection authors (darkfibr, rjmendez, Lexsah, Blevene): what they say

Community detection authors (darkfibr, rjmendez, Lexsah, Blevene): the rules, and the correction of the leaked PoC's mechanism; the claims this site attributes to them and their sources.

Party

# Community detection authors (darkfibr, rjmendez, Lexsah, Blevene)

the rules, and the correction of the leaked PoC's mechanism

## Claims this site attributes to this party

| Claim | Who says it | Status | Primary | Sources |
|---|---|---|---|---|
| None of the public proof-of-concept exploits reviewed by VulnCheck has the correct mechanism; a lab reproduction of the leaked PoC's precondition produced a clean 200The Hacker News says the same of the public code. Fastly: working RCE needs knowledge of the running binary's layout on x86_64. | rjmendez (detection author) citing VulnCheck; Huntress | reported | 1/2 | [rjmendez, GitHub](../../sources/github-rjmendez-phpup-2026/index.html) [Huntress](../../sources/huntress-php2shell-rapid-response/index.html) |

## Its sources in the vault
- [GitHub - darkfibr/php2shell-detect: Defensive detection toolkit for php2shell (CVE-2026-109618/109619, PHP session.upload_progress UAF): UA-independent shape scanner, estate checker, Suricata/Snort rules · GitHub](../../sources/github-darkfibr-php2shell-detect/index.html) darkfibr (Mike Haddock), GitHub
- [GitHub - rjmendez/phpup-2026: IOCs and detection rules for CVE-2026-109618 / CVE-2026-109619 (PHP session.upload_progress UAF) · GitHub](../../sources/github-rjmendez-phpup-2026/index.html) rjmendez, GitHub
- [GitHub - Lexsah/php2shell-detection: Detection and mitigation rules for CVE-2026-109618 / CVE-2026-109619 (php2shell). Blue-team only. · GitHub](../../sources/github-lexsah-php2shell-detection/index.html) Lexsah, GitHub
- [PHP2Shell: Detection Opportunities · GitHub](../../sources/gist-blevene-detection-guide/index.html) Blevene (GitHub gist)

[Every party →](../index.html)


---
site v0.2.5 · data as of 2026-10-22T11:34Z · vault commit 200d08971937 · https://php.oct.2026.newsroom.sgit.ai/actors/detectors/index.html