Detecting PHP2Shell: a detection engineering strategy
How to detect PHP2Shell (CVE-2026-109618, CVE-2026-109619) exploitation using web server error logs, auditd and Sysmon for Linux.
The DetectionFlow blog
Notes on detection engineering, detection-as-code, and measuring what your security tooling actually catches.