vLLM Process Spawning Shell (CVE-2026-22778 RCE)
Detects unexpected shell or command interpreter processes spawned as children of the vLLM or Python worker processes. This behavior strongly indicates a successful Remote Code Execution (RCE) payload, such as a system() call, resulting from the CVE-2026-22778 JPEG2000 heap overflow exploit.
Microsoft Sentinel (KQL)
