ZD EXPLOIT PHP stream wrapper in HTTP request - LFI or RCE primitive

Ali AlEnezi@site

•updated Sep 15, 2026•1•0•1

This rule monitors incoming HTTP requests for the use of PHP stream wrappers (e.g., php://, data://, expect://, etc.). Such wrappers are often leveraged by adversaries to perform Local File Inclusion (LFI) or to achieve Remote Code Execution (RCE) by manipulating input parameters in vulnerable web applications.