Corelight
- Aliases / services
- Corelight / Corelight Inc. / php2shell-detect / corelight.com
- Official website
- https://corelight.com/
Each response applies only to its stated service scope. “Not listed” does not mean unpatched or unaffected.
Response status by service
Listed services and systems
- Response status
- Zeek and Suricata detections published
- Response information checked
- 2026-10-27 Rechecked: 2026-10-27
Network detection and investigation platform.
Corelight released a PHP2Shell Zeek package and Suricata rules for suspicious HTTP requests and related traffic. The Zeek package requires Zeek 7 or newer.
What users should do
Install the package, supply visible HTTP traffic and review notice.log. Encrypted traffic requires decryption or equivalent visibility.
Official service URL
Source URLs
- PHP2Shell response and scopehttps://corelight.com/blog/php2shell-detection-before-disclosure?hs_amp=trueResponse evidence
- Zeek detection packagehttps://github.com/corelight/php2shell-detectService and operation documentation
Related official sources
- PHP2Shell response and scopeOfficial notice
- Zeek detection packageOfficial information directory
Comments