PHP2Shell Exploit Probe POSTs to PHP Endpoints with Scanner User Agents

Suraj A@cytech

•updated yesterday•2•0•11

Detects HTTP POST requests directed at PHP endpoints using scripting-library or vulnerability scanner user agents, which is consistent with PHP2Shell (CVE-2026-109618 / CVE-2026-109619) scanning and exploit probing activity.