import "hash"

rule bulwark_https_bulwarkblack_com_php2shell_patch_php_runtime_cve_2026_109618_109619
{
    meta:
        author = "Bulwark Black LLC"
        source = "https://bulwarkblack.com/php2shell-patch-php-runtime-cve-2026-109618-109619/"
        description = "Auto-extracted indicators. Verify before use; not a behavioral detection rule."
        generated = "2026-10-21T15:36:16Z"
        tlp = "TLP:CLEAR"
        indicator_count = "19"
    strings:
        $s0 = "calif.io" ascii wide nocase  // Domains
        $s1 = "rpms.remirepo.net" ascii wide nocase  // Domains
    condition:
        any of ($s*) or
        hash.md5(0, filesize) == "00c10e6cc4da4bd08722adeebcd95984" or
        hash.md5(0, filesize) == "07f0b6ddaabf40b1b2042dade8d613fa" or
        hash.md5(0, filesize) == "1389aa259617437392ce149c48143645" or
        hash.md5(0, filesize) == "19373a83abb840e18ab3ce5a7975ce1b" or
        hash.md5(0, filesize) == "217005865f0145f392300bac212afcc9" or
        hash.md5(0, filesize) == "3556683d512a47f2937899c524b1a4c6" or
        hash.md5(0, filesize) == "38efdb17ea594501bb55a1d71867b12e" or
        hash.md5(0, filesize) == "4148ae686fdb4d01be673fab9d9c073d" or
        hash.md5(0, filesize) == "48ddf592361e4fdb97a8a85982dab691" or
        hash.md5(0, filesize) == "4e315666e8e344cdb64119a3b5ccf32f" or
        hash.md5(0, filesize) == "771c654ae1154d4daa72f4e1545d163c" or
        hash.md5(0, filesize) == "77454fe2d30c4220b5701f6fdfb893ba" or
        hash.md5(0, filesize) == "afffe22785674c80a31875c848d2242a" or
        hash.md5(0, filesize) == "c1d409ad838f47f59446f21cc438d5dd" or
        hash.md5(0, filesize) == "da07c85852e34625bb478496302ede46" or
        hash.md5(0, filesize) == "efb7b8c949ac4650a09736fc376e9aee" or
        hash.md5(0, filesize) == "f9a45927414245e3a64bb12d0a0c2f64"
}