We will have useful detections for #PHP2Shell in our post and in MISP shortly. We're doing rigorous validation to make sure we don't provide nonsense.