1name: crowdsecurity/vpatch-CVE-2026-46725
2description: 'Detects PHP object injection in the TYPO3 ceselector extension via a serialized PHP object passed in the T3_ceselector_ cookie.'
3rules:
4    - zones:
5        - COOKIES
6      variables:
7        - '/t3_ceselector_.*/'
8      transform:
9        - urldecode
10        - lowercase
11      match:
12        type: regex
13        value: '[oc]:\d+:'
14
15labels:
16  type: exploit
17  service: http
18  confidence: 3
19  spoofable: 0
20  behavior: 'http:exploit'
21  label: 'TYPO3 ceselector - RCE'
22  classification:
23    - cve.CVE-2026-46725
24    - attack.T1059
25    - cwe.CWE-502