MyBB Limited ACP Privilege Escalation to Full Admin — PoC Script Execution

Ibrahim Saud@tektrix

•updated Jun 29, 2026•1•0•1

Detects execution of specific scripts or suspicious child processes indicative of a MyBB 'limited_acp_to_admin' exploit attempt. This rule looks for known script names related to the PoC and suspicious process lineage where a PHP web server process spawns command shells or scripting interpreters commonly used in post-exploitation activities.