CVE-2026-22778 vLLM Worker Spawning Unexpected Child Process (RCE)
Detects the spawning of unexpected child processes such as shell interpreters, download tools, or package managers from vLLM Python serving processes. This activity could indicate a successful exploitation of a vulnerability like CVE-2026-22778, leading to remote code execution through a function pointer overwrite.
Microsoft Sentinel (KQL)
