# Community detection authors (darkfibr, rjmendez, Lexsah, Blevene): what they say

> Research: collected from outside sources and what this site derives from them; every fact links to a saved copy of its source.

Community detection authors (darkfibr, rjmendez, Lexsah, Blevene): the rules, and the correction of the leaked PoC's mechanism; the claims this site attributes to them and their sources.

Party

# Community detection authors (darkfibr, rjmendez, Lexsah, Blevene)

the rules, and the correction of the leaked PoC's mechanism

## Claims this site attributes to this party

| Claim | Who says it | Status | [Fact-check](https://php.oct.2026.newsroom.sgit.ai/factcheck/) | Primary | Sources |
|---|---|---|---|---|---|
| None of the public proof-of-concept exploits reviewed by VulnCheck has the correct mechanism; a lab reproduction of the leaked PoC's precondition produced a clean 200The Hacker News says the same of the public code. Fastly: working RCE needs knowledge of the running binary's layout on x86_64. [fact timeline →](../../facts/pocs-wrong/index.html) | rjmendez (detection author) citing VulnCheck; Huntress | reported | **A1** Weak signal●○○○○○ status overstated | 1/2 | [rjmendez, GitHub](../../sources/github-rjmendez-phpup-2026/index.html) [Huntress](../../sources/huntress-php2shell-rapid-response/index.html) |

## Its sources in the vault
- [GitHub - darkfibr/php2shell-detect: Defensive detection toolkit for php2shell (CVE-2026-109618/109619, PHP session.upload_progress UAF): UA-independent shape scanner, estate checker, Suricata/Snort rules · GitHub](../../sources/github-darkfibr-php2shell-detect/index.html) darkfibr (Mike Haddock), GitHub
- [GitHub - rjmendez/phpup-2026: IOCs and detection rules for CVE-2026-109618 / CVE-2026-109619 (PHP session.upload_progress UAF) · GitHub](../../sources/github-rjmendez-phpup-2026/index.html) rjmendez, GitHub
- [GitHub - Lexsah/php2shell-detection: Detection and mitigation rules for CVE-2026-109618 / CVE-2026-109619 (php2shell). Blue-team only. · GitHub](../../sources/github-lexsah-php2shell-detection/index.html) Lexsah, GitHub
- [PHP2Shell: Detection Opportunities · GitHub](../../sources/gist-blevene-detection-guide/index.html) Blevene (GitHub gist)

[Every party →](../index.html)


---
site v0.22.26 · data as of 2026-10-25T14:40Z · vault commit 94352a55fbaa · https://refs.php.oct.2026.newsroom.sgit.ai/actors/detectors/index.html