https://detectionflow.com/blog/ Notes on detection engineering, detection-as-code, and measuring what your security tooling actually catches. en Thu, 22 Oct 2026 00:00:00 +0000 https://detectionflow.com/blog/php2shell-detection-engineering-strategy/ https://detectionflow.com/blog/php2shell-detection-engineering-strategy/ Thu, 22 Oct 2026 00:00:00 +0000 How to detect PHP2Shell (CVE-2026-109618, CVE-2026-109619) exploitation using web server error logs, auditd and Sysmon for Linux.