# Ruleset Update Summary - 2026/10/22 - v11317 **URL:** \ **Category:** Ruleset Updates\ **Created:** [October 22, 2026, 8:34pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2026-10-22-v11317/3487 "2026-10-22T20:34:36Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![rulesbot](https://avatars.discourse-cdn.com/v4/letter/r/13edae/32.png) [@rulesbot](https://community.emergingthreats.net/u/rulesbot)\ **Post date:** [October 22, 2026, 8:34pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2026-10-22-v11317/3487/1 "2026-10-22T20:34:36Z")
## Summary: 16 new OPEN, 20 new PRO (16 + 4) Thanks @byrne\_emmy12099, @fr0s7\_ * * * ## Added rules: ### Open: - 2072546 - ET MALWARE NetSupport RAT CnC Domain in DNS Lookup (sendcarierpacket .com) (malware.rules) - 2072547 - ET MALWARE NetSupport RAT CnC Domain in TLS SNI (sendcarierpacket .com) (malware.rules) - 2072548 - ET EXPLOIT PHP php2shell Handler-mismatch Session Injection (CVE-2026-109619) (exploit.rules) - 2072549 - ET EXPLOIT PHP php2shell Multipart Header Amplification OOM (CVE-2026-109618) (exploit.rules) - 2072550 - ET EXPLOIT PHP php2shell Nested Empty File Control OOM (CVE-2026-109618) (exploit.rules) - 2072551 - ET EXPLOIT PHP php2shell Chunked Multipart Request without Content-Length (CVE-2026-109618) (exploit.rules) - 2072552 - ET EXPLOIT PHP php2shell Binary URL-Encoded POST for $\_POST Corruption (CVE-2026-109618) (exploit.rules) - 2072553 - ET EXPLOIT PHP php2shell Multipart Request without Content-Length (CVE-2026-109618) (exploit.rules) - 2072554 - ET EXPLOIT PHP php2shell Code Injection in Filename (CVE-2026-109619) (exploit.rules) - 2072555 - ET HUNTING PHP Generic Upload Progress Session Manipulation (hunting.rules) - 2072556 - ET EXPLOIT PHP php2shell Excessive Multipart Part Count (CVE-2026-109618) (exploit.rules) - 2072557 - ET EXPLOIT PHP php2shell Excessive Empty Multipart File Controls (CVE-2026-109618) (exploit.rules) - 2072558 - ET WEB\_SPECIFIC\_APPS D-Link apply.cgi?formSystemCheck ipv4\_ping Parameter Command Injection Attempt (CVE-2026-95675) (web\_specific\_apps.rules) - 2072559 - ET WEB\_SPECIFIC\_APPS D-Link DHMAPI SetTimeSettings NTPServer Parameter Command Injection Attempt (CVE-2026-93958) (web\_specific\_apps.rules) - 2072560 - ET MALWARE NetSupport RAT CnC Domain in DNS Lookup (transunionbiba .lat) (malware.rules) - 2072561 - ET MALWARE NetSupport RAT CnC Domain in TLS SNI (transunionbiba .lat) (malware.rules) ### Pro: - 2868899 - ETPRO MALWARE NetSupport RAT CnC Host Exfil (malware.rules) - 2868900 - ETPRO MALWARE Malicious Win32/NetSupport Rat CnC Checkin (malware.rules) - 2868901 - ETPRO WEB\_SPECIFIC\_APPS VMware Aria Operations for Networks Authenticated Code Injection via exportPDF (CVE-2023-20889) (web\_specific\_apps.rules) - 2868902 - ETPRO EXPLOIT Apache HTTP Server mod\_proxy HTTP Request Smuggling (CVE-2023-25690) (exploit.rules)