CVE-2026-55200 libssh2 RCE: PoC harness execution or post-exploit child spawn

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•0

This rule monitors for the presence of known exploit harness binaries associated with CVE-2026-55200 on disk or in command lines, and identifies post-exploitation activity where common network utilities (curl, git, php) execute unsigned or suspicious child processes, which often indicates lateral movement or payload staging.