alert tcp $EXTERNAL_NET any -> $HOME_NET 5555 (msg:"VEDAS CVE-2026-105192 LMCache - Unauthenticated ZeroMQ msgpack pickle deserialization RCE attempt"; flow:established,to_server; dsize:>30; content:"|80|"; fast_pattern; pcre:"/(?:c(?:os|nt|posix)\x0asystem\x0a|csubprocess\x0a(?:Popen|run|call|check_output)|c(?:__builtin__|builtins)\x0a(?:eval|exec|__import__)|\x8c[\x02-\x0c](?:os|nt|posix|subprocess|builtins|platform|pty)\x8c[\x02-\x14][A-Za-z_]+\x93)/"; classtype:attempted-admin; reference:cve,CVE-2026-105192; reference:url,https://www.exploit.observer/?keyword=CVE-2026-105192&match=exact; reference:url,https://subdomain.center/?engine=ammonites&keyword=lmcache&match=exact; sid:1090003; rev:1;)