WordPress object cache poisoning via forged serialized WP_Post entries (wp2shell)

Emiliano Mema@Nosalva

•updated Jul 22, 2026•2•0•7

This rule detects potentially unauthorized content injection within Redis or Memcached application logs. It monitors for specific keywords indicating WordPress post data ('WP_Post') being processed by these caching services, which is often an indicator of object injection or application-level exploitation attempts aimed at manipulating application data.