@ifin@infosec.exchange My corporate pen tester ran the exploit against clones of servers and purple team analyzed the telemetry and here are the IOCs we've settled on: IOCs - User-Agent: Mozilla/5.0 (php2shell-test/1.0.0) and /2.0.0 - multipart field PHP_SESSION_UPLOAD_PROGRESS = "pwn" - PHPSESSID sent as a form field with a single NUL byte (that's the leak-A trigger, never seen in legit traffic) - a multi-MB "big" field in the body (7-24MB, the OOM primer) - 1000+ fields f0000/f0001/... (trips max_input_vars) - response Set-Cookie: PHPSESSID= longer than ~32 chars (up to 512 URL-encoded bytes = the ASLR heap leak itself) - if it lands: id>/tmp/, uid=33, FIRE_OK We have found no evidence of compromise with these (other than the pen test) so we have no evidence of exploitation in the wild, but posting nonetheless in case there is something other's can use. #php2shell