Brandon Levene
@blove0 followers0 downloads23 copies0 likes122 views
6 detections
Filters
Last updated
All Time
Detection languages
4
2
Categories
4
3
2
2
1
Platforms
5
2
2
Products / Services
4
2
2
1
MITRE Techniques
5
5
CVEs
5
2
IDS Classtypes
2
IDS Protocols
2
Detects a malformed PHPSESSID Set-Cookie header indicative of CVE-2026-109618, which may result in stale session ID memory disclosure in PHP applications.
Detects HTTP POST requests containing multipart/form-data with PHP_SESSION_UPLOAD_PROGRESS, which is associated with CVE-2026-109618 and CVE-2026-109619 exploitation attempts, tracked via a detection filter.
Detects PHP error log entries indicating a session object decode failure, which may indicate exploitation attempts of CVE-2026-109618 and CVE-2026-109619. Note - the logsource product php / service error is not defined by SigmaHQ. Map it with a processing pipeline to wherever PHP error lines land in your stack (PHP error_log file, nginx or Apache error log, PHP-FPM log, or syslog/journal).
Detects a PHP-FPM child process crashing with signal 11 (SIGSEGV) as logged by the FPM master, which may indicate exploitation attempts following an arm-shaped request. Correlate with the arm fatal error by timestamp and source. Note - the logsource product linux / service php-fpm is not defined by SigmaHQ. Map it with a processing pipeline to the PHP-FPM master log (for example /var/log/php8.x-fpm.log on Debian/Ubuntu, /var/log/php-fpm/error.log on RHEL-family, container stderr for official php-fpm images, or the php-fpm systemd journal unit).
Detects PHP fatal out-of-memory errors reported in Unknown on line 0, indicating a memory exhaustion bailout before request initialization (pre-RINIT), associated with CVE-2026-109618 and CVE-2026-109619 exploitation attempts. Note - the logsource product php / service error is not defined by SigmaHQ. Map it with a processing pipeline to wherever PHP error lines land in your stack (PHP error_log file, nginx or Apache error log, PHP-FPM log, or syslog/journal). If log_errors is Off, or FPM runs with fastcgi.logging Off and catch_workers_output no, the line is never written.
Detects PHP out-of-memory fatal errors (Allowed memory size exhausted) on hosts where memory_limit=-1 has been configured as mitigation. On these hosts, memory is unlimited, so this error indicates potential configuration tampering or an attack.