Skip to content

Security Sense

AI Threat Intelligence

  • About
  • Blog
  • Privacy Policy

Tag: webshell

CVE-2026-46300: Linux Kernel Privilege Escalation via Shared Fragment Handling

Posted on November 3, 2026 by Kyle

Overview

CVE-2026-46300 is a high-severity vulnerability in the Linux kernel affecting how shared fragments are handled during socket buffer coalescing. This flaw can lead to unintended modification of page-cache-backed data, specifically allowing ESP input processing to decrypt shared fragments in place. When chained with other vulnerabilities, this can enable privilege escalation, the implantation of PHP webshells, and arbitrary command execution as root, posing a significant threat to Linux-based systems, including IoT devices.

Technical Analysis

The vulnerability stems from a missing initialization of a variable within the skb_try_coalesce() function. When skb_try_coalesce() transfers paged fragments from one socket buffer (@from) to another (@to), it fails to preserve the SKBFL_SHARED_FRAG marker if @from had it set. This breaks an invariant relied upon by later in-place writers, particularly ESP input processing. Consequently, ESP input checks skb_has_shared_frag() and, if the marker is missing, incorrectly determines that an uncloned nonlinear skb can skip skb_cow_data(), leading to in-place decryption over page-cache backed fragments.

This unintended modification of page-cache-backed data can be leveraged for privilege escalation. The NVD record explicitly states that this vulnerability can be chained with CVE-2026-109618 and CVE-2026-109619 to implant PHP webshells and execute commands as root.

  • CVSS 3.1 Score: 7.8 (High)
  • CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  • Weaknesses: CWE-787 (Out-of-bounds Write), CWE-456 (Missing Initialization of a Variable), CWE-123 (Write-what-where Condition)
  • Affected Versions:
    • Linux kernel versions >= 3.9 and <= 5.10.257
    • Linux kernel versions >= 5.11 and < 5.15.208
    • Linux kernel versions >= 5.16 and < 6.1.174
    • Linux kernel versions >= 6.2 and < 6.6.141
    • Linux kernel versions >= 6.7 and < 6.12.91
    • Linux kernel versions >= 6.13 and < 6.18.33
    • Linux kernel versions >= 6.19 and < 7.0.10
    • Linux kernel version 7.1

Detection

Direct detection of the kernel vulnerability exploitation itself can be challenging from user-space logs. However, the post-exploitation activities described (webshells, root command execution) provide clear detection opportunities.

  • Suspicious File Writes: Monitor web server directories (/var/www/, /srv/www/, /usr/share/nginx/html/, etc.) for the creation or modification of .php files by unusual processes or with suspicious content (e.g., base64 encoded strings, eval() functions). Utilize auditd logs for PATH events related to file creation/modification.
  • Privileged Process Execution: Look for sh, bash, php, python, or perl being executed with root privileges (UID 0) by unexpected parent processes or in unusual contexts. This is particularly relevant if the parent process is a network service or a process that should not typically spawn shells. Monitor auditd logs for SYSCALL events related to execve.
  • Network Activity: Monitor for unusual outbound connections from compromised systems, especially those indicative of botnet activity (e.g., DDoS attacks, C2 communications) if linked to malware families like KATARU or Mirai.

Sigma Detection Rules

⚠️ AI-generated detection rules. These are experimental starting points. Review field names, EventIDs, and logic against your environment’s schema before deploying. Tune to reduce false positives.

Linux Webshell Creation in Web Directories

title: Linux Webshell Creation in Web Directories
id: 752a1b3e-f1c3-4d0a-b8e7-2c9f0e1d4a3b
status: experimental
description: Detects the creation or modification of .php files in common web server directories, indicative of webshell deployment after exploitation.
logsource:
  product: linux
  service: auditd
detection:
  selection:
    type: 'PATH'
    name|endswith:
      - '.php'
      - '.phtml'
      - '.phar'
    # Common web server root directories
    directory|contains:
      - '/var/www/'
      - '/srv/www/'
      - '/usr/share/nginx/html/'
      - '/var/www/html/'
      - '/var/www/htdocs/'
  condition: selection
level: high

Linux Suspicious Root Command Execution

title: Linux Suspicious Root Command Execution
id: 9e0c3f1a-5b6d-4e7c-8a2b-1d0f2e3c4b5a
status: experimental
description: Detects execution of common shell or scripting interpreters with root privileges, which could indicate successful privilege escalation.
logsource:
  product: linux
  service: auditd
detection:
  selection:
    type: 'SYSCALL'
    a0|contains:
      - '/bin/sh'
      - '/bin/bash'
      - '/usr/bin/php'
      - '/usr/bin/python'
      - '/usr/bin/perl'
    uid: '0' # Root user
  condition: selection
level: high

Mitigations

  1. Apply Kernel Patches: Immediately update Linux kernel to a version that includes the fix for CVE-2026-46300. Refer to the provided kernel Git references for specific patch details.
  2. Regular System Updates: Ensure all Linux-based systems, including IoT devices, are kept up-to-date with the latest security patches from their respective distributions.
  3. Principle of Least Privilege: Restrict user and process privileges to the absolute minimum required to perform their functions.
  4. Network Segmentation: Isolate critical systems and IoT devices on separate network segments to limit lateral movement in case of compromise.
  5. Web Server Hardening: Implement strong web server security configurations, including disabling unnecessary PHP functions, restricting write access to web directories, and using Web Application Firewalls (WAFs).

References

  • https://nvd.nist.gov/vuln/detail/CVE-2026-46300
  • https://git.kernel.org/stable/c/2f2b16022a2e10ca7bccfb98db5ed2ec0f72641c
  • https://git.kernel.org/stable/c/3599e6b3cc1ada96883d496a50a210d3afbb6987
  • https://git.kernel.org/stable/c/3884358a9286b17f389a72b1426fc4547c23c111
  • https://git.kernel.org/stable/c/3bd9e113d50034db99d7ef69fd8e5242d15e414a
  • https://git.kernel.org/stable/c/760e1addc27ba1a7beb4a0a7e8b3e9ec49e7a34e
  • https://git.kernel.org/stable/c/78bf6b6bb19541d19fbda6242e7cfe2c682763c0
  • https://git.kernel.org/stable/c/9d3e5fd19fe1063bf607219e8562fbd567b8e8d5
  • https://git.kernel.org/stable/c/f84eca5817390257cef78013d0112481c503b4a3
  • https://www.nozominetworks.com/blog/kataru-iot-malware-adopts-public-lpe-exploits
  • https://ltna.com.au/cyber

Indicators of Compromise

Type Value Description
SHA256 13382c16e2401b07451577b46e634b8031ec254d98b876e59692b5fa22abc1d4 KATARU ARM32 payload hash (via https://www.nozominetworks.com/blog/kataru-iot-malware-adopts-public-lpe-exploits)
SHA256 6fbae3505ae0d638b820165c572d548ce92dda71e82dc47e8efe13f30617f35f KATARU ARM32 payload hash (via https://www.nozominetworks.com/blog/kataru-iot-malware-adopts-public-lpe-exploits)
SHA256 9d7cd4948a1fcbaeadc425752fce9a933bd6fc41eeede030dffd7b99b3bc51d5 KATARU AMD64 payload hash (via https://www.nozominetworks.com/blog/kataru-iot-malware-adopts-public-lpe-exploits)
SHA256 9d87e6615c810907443ebd5e915f3b35099c3b5c6b6c684637138a7f8ec9cebc KATARU ARM32 payload hash (via https://www.nozominetworks.com/blog/kataru-iot-malware-adopts-public-lpe-exploits)
SHA256 cc76bc218627279ecb4d0ce74ad2651e9db9e3e843e35d6569576e056e3a9218 KATARU loader hash (via https://www.nozominetworks.com/blog/kataru-iot-malware-adopts-public-lpe-exploits)
IP Address 160.191.242.92 KATARU Telnet brute force and C2 IP (via https://www.nozominetworks.com/blog/kataru-iot-malware-adopts-public-lpe-exploits)
Domain bins.sh Domain for fetching per-architecture payloads (via https://www.nozominetworks.com/blog/kataru-iot-malware-adopts-public-lpe-exploits)

MITRE ATT&CK

  • T1068 — Exploitation for Privilege Escalation
  • T1505.003 — Web Shell
  • T1059 — Command and Scripting Interpreter
  • T1110.001 — Password Guessing
  • T1498.001 — Direct Network Flood
  • T1053.003 — Cron
  • T1082 — System Information Discovery
  • T1499.002 — Service Exhaustion Flood
  • T1106 — Native API
  • T1016 — System Network Configuration Discovery
  • T1059.004 — Unix Shell
  • T1562.001 — Disable or Modify Tools
  • T1027 — Obfuscated Files or Information
  • T1573.002 — Asymmetric Cryptography
  • T1095 — Non-Application Layer Protocol
  • T1037.004 — RC Scripts
  • T1543.002 — Systemd Service
  • T1105 — Ingress Tool Transfer
🤖 AI Attribution
Generated by gemini-2.5-flash ·
2,776 input / 2,315 output tokens ·
Reviewed and approved by a human analyst before publication
Posted in vulnerabilityTagged high, iot, kataru, kernel, linux, mirai, privilege-escalation, vulnerability, webshellLeave a comment

CVE-2026-109619: PHP Stale Internal Request-State RCE Vulnerability

Posted on November 3, 2026 by Kyle

Overview

CVE-2026-109619 is a high-severity vulnerability in PHP that enables unauthenticated remote code execution. The flaw stems from stale internal request-state, allowing attackers to manipulate freed memory. This vulnerability affects a wide range of PHP versions and products, including critical network devices, and is being actively exploited by threat actors, including state-sponsored groups and ransomware operators, often in conjunction with PHP2Shell exploitation.

Technical Analysis

  • Vulnerability: CVE-2026-109619 is a stale internal request-state vulnerability in PHP.
  • Mechanism: PHP contains various global state variables that temporarily point to request memory. In certain scenarios, this global state may not be correctly reset or may be repopulated after being reset, leading to it referring to freed request memory. Subsequent requests can then read or branch on this stale state before it is fully initialized.
  • Impact: Multiple strategies can trigger this condition, leading to unauthenticated remote code execution (RCE).
  • CVSS v3.1: 8.1 (HIGH) – CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H.
  • Weaknesses: CWE-416 (Use After Free), CWE-755 (Improper Handling of Exceptional Conditions), CWE-824 (Access of Uninitialized Pointer), CWE-1325 (Unchecked Return Value to NULL Pointer Dereference).
  • Affected Versions:
    • PHP php versions >= 5.4.0 < 8.2.35
    • PHP php versions >= 8.3.0 < 8.3.36
    • PHP php versions >= 8.4.0 < 8.4.27
    • PHP php versions >= 8.5.0 < 8.5.12
    • Siemens ruggedcom_ape1808_firmware
    • Palo Alto Networks pan-os versions >= 10.2.0 < 10.2.7
    • Palo Alto Networks pan-os version 10.2.7
    • Palo Alto Networks pan-os version 10.2.8
    • Palo Alto Networks pan-os version 10.2.9
    • Palo Alto Networks pan-os version 10.2.10
  • Attack Vector: Network-based (AV:N), unauthenticated (PR:N), requiring no user interaction (UI:N). The attack complexity is high (AC:H).

Detection

  • Monitor web server access logs for unusual requests to PHP files, especially those with suspicious parameters, encoded commands, or patterns indicative of PHP2Shell exploitation. Look for unexpected HTTP methods or large POST bodies to unusual endpoints.
  • Detect unexpected process spawns originating from web server processes (e.g., php-fpm.exe, httpd.exe, nginx.exe, apache2, php-fpm) or their child processes. Look for cmd.exe, powershell.exe, sh, bash, python, perl, nc, wget, curl, or other command-line utilities.
  • Monitor for the creation of suspicious files (e.g., .php, .txt, .log files containing web shell code) in web-accessible directories (/var/www/html, htdocs, wwwroot). Look for files containing common web shell keywords like eval(, system(, passthru(, shell_exec(, base64_decode(, $_GET[, $_POST[, or PHP2Shell specific strings.
  • Analyze network flow logs for outbound connections initiated by web server processes to unusual or external IP addresses/domains, indicative of C2 communication or data exfiltration.
  • Review PHP error logs for unexpected errors or warnings that might indicate exploitation attempts or memory corruption.

Sigma Detection Rules

⚠️ AI-generated detection rules. These are experimental starting points. Review field names, EventIDs, and logic against your environment’s schema before deploying. Tune to reduce false positives.

Web Server Process Spawning Suspicious Shell

title: Web Server Process Spawning Suspicious Shell
id: 90c7e2b1-d3f4-4a8e-a2c3-f0e2b1d3f4a8
status: experimental
description: Detects suspicious process creation by common web server processes, indicative of RCE exploitation of CVE-2026-109619.
logsource:
  product: windows
  service: sysmon
detection:
  selection_parent:
    ParentImage|endswith:
      - '\\httpd.exe'
      - '\\nginx.exe'
      - '\\php-fpm.exe'
  selection_child:
    Image|endswith:
      - '\\cmd.exe'
      - '\\powershell.exe'
      - '\\sh.exe'
      - '\\bash.exe'
      - '\\python.exe'
      - '\\perl.exe'
      - '\\nc.exe'
      - '\\wget.exe'
      - '\\curl.exe'
  condition: all of selection_*
level: critical

Suspicious PHP File Creation in Web Root

title: Suspicious PHP File Creation in Web Root
id: 4f1c7e2b-d3f4-4a8e-a2c3-f0e2b1d3f4a8
status: experimental
description: Detects creation of new PHP files in web-accessible directories by web server processes, potentially indicating webshell deployment (e.g., PHP2Shell) after CVE-2026-109619 exploitation.
logsource:
  product: windows
  service: sysmon
detection:
  selection:
    EventID: 11
    Image|endswith:
      - '\\httpd.exe'
      - '\\nginx.exe'
      - '\\php-fpm.exe'
    TargetFilename|endswith:
      - '.php'
      - '.phtml'
      - '.php5'
    TargetFilename|contains:
      - '\\inetpub\\wwwroot\\'
      - '\\Apache24\\htdocs\\'
      - '\\nginx\\html\\'
      - '\\www\\html\\'
  condition: selection
level: high

Web Access Log – Generic PHP RCE Attempt

title: Web Access Log - Generic PHP RCE Attempt
id: 7e2b1d3f-4a8e-a2c3-f0e2b1d3f4a8
status: experimental
description: Detects common patterns in web access logs indicative of PHP RCE attempts, potentially targeting CVE-2026-109619. This rule may produce false positives and requires tuning.
logsource:
  category: webserver
  service: apache
detection:
  selection:
    cs-uri-query|contains:
      - 'cmd='
      - 'exec='
      - 'system='
      - 'passthru='
      - 'shell_exec='
      - 'eval='
      - 'base64_decode='
      - 'id%20'
      - 'whoami%20'
      - 'cat%20/etc/passwd'
      - 'wget%20'
      - 'curl%20'
    cs-uri-stem|endswith:
      - '.php'
      - '.phtml'
      - '.php5'
  condition: selection
level: medium

Mitigations

  1. Patch PHP: Upgrade PHP installations to the latest patched versions: 8.2.35, 8.3.36, 8.4.27, 8.5.12, or newer, as soon as possible.
  2. Patch Affected Products: Apply vendor-specific patches for Siemens ruggedcom_ape1808_firmware and Palo Alto Networks pan-os to versions that address CVE-2026-109619.
  3. Implement Web Application Firewall (WAF): Deploy and configure a WAF to detect and block exploitation attempts targeting PHP vulnerabilities, including known PHP2Shell patterns and generic RCE payloads.
  4. Least Privilege: Ensure PHP processes and web servers run with the minimum necessary privileges to limit the impact of successful exploitation.
  5. Network Segmentation: Isolate web servers running PHP applications from critical internal networks to contain potential breaches.
  6. Regular Audits: Conduct regular security audits and penetration tests of PHP applications and underlying infrastructure to identify and remediate vulnerabilities.

References

  • https://nvd.nist.gov/vuln/detail/CVE-2026-109619
  • https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp
  • http://www.openwall.com/lists/oss-security/2026/10/21/16
  • https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-glocal-php-infrastructure/
  • https://hunt.io/blog/php2shell-cve-2026-109618-109619-open-directories
  • https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/
  • https://www.vulncheck.com/blog/php2shell-vulnerabilities
  • https://socradar.io/blog/inc-gentlemen-ransomware-ai-infrastructure

Indicators of Compromise

Type Value Description
SHA256 0c5486f06620e26e316f4b33f318b0d646d5e1133789331aa2fed012360d1486 PHP2Shell second-stage ELF x86-64 binary hash (via https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-glocal-php-infrastructure/)
SHA256 1485e14e0f62bc94664eec341cabd275dad7d30b1d496c40ec340c9a0d9f0ba8 Hash of follow-up POST request body (via https://www.vulncheck.com/blog/php2shell-vulnerabilities)
SHA256 150ae88f0999032e2a6113501d6082f54a3ed98d02427b21a96e773a27d7bf16 Hash of uploaded file part ‘a’ (via https://www.vulncheck.com/blog/php2shell-vulnerabilities)
SHA256 27d926a6708d6769d97d065e7a5a860ab496eab272c03d1cebc55ec71b954fa2 Hash of uploaded file part ‘b’ (via https://www.vulncheck.com/blog/php2shell-vulnerabilities)
SHA256 40caf199ca1ebe056a74427f8e9db06c66899e33ae09c0ec2769ec70bf6dd8e7 Hash of uploaded file part ‘a’ (via https://www.vulncheck.com/blog/php2shell-vulnerabilities)
SHA256 43898a0a53bbd25d31ad9f5018ed3182be98a66109b22c9cab545a9fc447992a PHP2Shell scanner/OOM-tool HTTP request body hash (via https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-glocal-php-infrastructure/)
SHA256 7bc41ed79a9ae909927a9e40701736460a8cb70fca16ce1510e58677aca764b6 PHP2Shell scanner/OOM-tool HTTP request body hash (via https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-glocal-php-infrastructure/)
IP Address 103.114.163.188 PHP2Shell-associated anonymisation network IP (via https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-glocal-php-infrastructure/)
IP Address 103.216.220.92 PHP2Shell-associated anonymisation network IP (via https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-glocal-php-infrastructure/)
IP Address 109.71.252.97 PHP2Shell scanner/exploitation IP (via https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-glocal-php-infrastructure/)
IP Address 134.209.159.64 PHP2Shell-associated anonymisation network IP (via https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-glocal-php-infrastructure/)
IP Address 221.14.159.134 Exploitation attempt IP for CVE-2026-109618 (via https://www.vulncheck.com/blog/php2shell-vulnerabilities)
IP Address 31.223.184.166 PHP2Shell-associated anonymisation network IP (via https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-glocal-php-infrastructure/)
IP Address 37.19.200.5 PHP2Shell-associated anonymisation network IP (via https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-glocal-php-infrastructure/)
IP Address 45.198.224.169 PHP2Shell scanner/exploitation IP (via https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-glocal-php-infrastructure/)
IP Address 85.11.167.243 PHP2Shell scanner/exploitation IP (via https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-glocal-php-infrastructure/)
IP Address 91.90.123.25 Verification IP for CVE-2026-109618 (via https://www.vulncheck.com/blog/php2shell-vulnerabilities)
IP Address 92.118.112.100 PHP2Shell second-stage payload staging host IP (via https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-glocal-php-infrastructure/)
IP Address 95.217.98.37 PHP2Shell-associated anonymisation network IP (via https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-glocal-php-infrastructure/)
URL https://fedi.katze.sh/@elise/117478655339557825 Fediverse post discussing a different PHP vulnerability (via http://www.openwall.com/lists/oss-security/2026/10/21/17)
URL https://fedi.katze.sh/@elise/117479383739450605 Fediverse post reporting incomplete PHP fix (via http://www.openwall.com/lists/oss-security/2026/10/21/17)

MITRE ATT&CK

  • T1190 — Exploit Public-Facing Application
  • T1059.004 — Unix Shell
  • T1059.003 — Windows Command Shell
  • T1505.003 — Web Shell
  • T1590.005 — IP Addresses
  • T1053.003 — Cron
  • T1005 — Data from Local System
  • T1608.001 — Upload Malware
  • T1595.002 — Vulnerability Scanning
  • T1583.004 — Server
  • T1098.004 — SSH Authorized Keys
  • T1552.001 — Credentials In Files
  • T1041 — Exfiltration Over C2 Channel
  • T1210 — Exploitation of Remote Services
  • T1486 — Data Encrypted for Impact
  • T1496 — Resource Hijacking
  • T1105 — Ingress Tool Transfer
  • T1588.005 — Exploits
  • T1592 — Gather Victim Host Information
  • T1133 — External Remote Services
  • T1071.004 — DNS
  • T1036.005 — Match Legitimate Resource Name or Location
  • T1499.004 — Application or System Exploitation
  • T1071 — Application Layer Protocol
  • T1036 — Masquerading
  • T1595 — Active Scanning
  • T1090.002 — External Proxy
  • T1090 — Proxy
  • T1059 — Command and Scripting Interpreter
  • T1078 — Valid Accounts
  • T1573 — Encrypted Channel
  • T1592.002 — Software
  • T1203 — Exploitation for Client Execution
  • T1499 — Endpoint Denial of Service
  • T1059.006 — Python
  • T1071.001 — Web Protocols
  • T1046 — Network Service Discovery
  • T1082 — System Information Discovery
  • T1583.003 — Virtual Private Server
  • T1102 — Web Service
  • T1562.001 — Disable or Modify Tools
  • T1070.004 — File Deletion
  • T1021 — Remote Services
  • T1083 — File and Directory Discovery
  • T1136 — Create Account
  • T1018 — Remote System Discovery
  • T1003.003 — NTDS
  • T1021.001 — Remote Desktop Protocol
  • T1567.002 — Exfiltration to Cloud Storage
  • T1587.001 — Malware
  • T1489 — Service Stop
  • T1087.002 — Domain Account
  • T1053.005 — Scheduled Task
  • T1219 — Remote Access Tools
  • T1558.003 — Kerberoasting
  • T1583.001 — Domains
  • T1135 — Network Share Discovery
  • T1059.001 — PowerShell
  • T1588.002 — Tool
  • T1490 — Inhibit System Recovery
  • T1110 — Brute Force
  • T1204.002 — Malicious File
  • T1114.001 — Local Email Collection
  • T1572 — Protocol Tunneling
  • T1021.002 — SMB/Windows Admin Shares
  • T1072 — Software Deployment Tools
  • T1566.001 — Spearphishing Attachment
  • T1070.006 — Timestomp
  • T1074.001 — Local Data Staging
  • T1555.003 — Credentials from Web Browsers
  • T1056.002 — GUI Input Capture
  • T1003.006 — DCSync
  • T1057 — Process Discovery
  • T1591 — Gather Victim Org Information
  • T1056.001 — Keylogging
  • T1555 — Credentials from Password Stores
  • T1132.001 — Standard Encoding
  • T1566.002 — Spearphishing Link
  • T1573.001 — Symmetric Cryptography
  • T1218.011 — Rundll32
  • T1497.001 — System Checks
  • T1539 — Steal Web Session Cookie
  • T1027 — Obfuscated Files or Information
  • T1102.002 — Bidirectional Communication
  • T1140 — Deobfuscate/Decode Files or Information
  • T1055.012 — Process Hollowing
  • T1110.001 — Password Guessing
  • T1087.001 — Local Account
  • T1021.004 — SSH
  • T1040 — Network Sniffing
  • T1567 — Exfiltration Over Web Service
  • T1552 — Unsecured Credentials
  • T1552.004 — Private Keys
  • T1087 — Account Discovery
  • T1087.004 — Cloud Account
🤖 AI Attribution
Generated by gemini-2.5-flash ·
2,763 input / 2,653 output tokens ·
Reviewed and approved by a human analyst before publication
Posted in vulnerabilityTagged high, php, rce, vulnerability, web, webshellLeave a comment

CVE-2026-109618: PHP Memory Corruption Leads to Unauthenticated RCE

Posted on November 3, 2026 by Kyle

Overview

This report details CVE-2026-109618, a critical memory corruption vulnerability in PHP that enables unauthenticated remote code execution. The flaw stems from improper handling of out-of-memory errors, leaving request memory in an uninitialized state. Active exploitation has been observed, with threat actors leveraging this vulnerability to deploy various malware families and establish persistence.

Technical Analysis

The vulnerability, CVE-2026-109618, is an out-of-memory (OOM) corruption flaw in PHP. It occurs because PHP uses longjmp() to exit the current context during OOM errors, but some contexts fail to properly account for this, leaving request memory uninitialized. Subsequent request cleanup procedures can then read or branch on this uninitialized memory, leading to remote code execution (RCE). The vulnerability is unauthenticated and can be triggered consistently via multiple OOM strategies.

  • CVSS 3.1 Score: 9.8 (CRITICAL) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
  • Weaknesses: CWE-416 (Use-After-Free), CWE-755 (Improper Handling of Exceptional Conditions), CWE-824 (Access of Uninitialized Pointer), CWE-1325 (Uninitialized Memory in PHP).
  • Affected PHP versions:
    • php >= 7.3.0 < 8.2.35
    • php >= 8.3.0 < 8.3.36
    • php >= 8.4.0 < 8.4.27
    • php >= 8.5.0 < 8.5.12
  • Affected products also include:
    • siemens ruggedcom_ape1808_firmware
    • paloaltonetworks pan-os >= 10.2.0 < 10.2.7
    • paloaltonetworks pan-os 10.2.7
    • paloaltonetworks pan-os 10.2.8
    • paloaltonetworks pan-os 10.2.9
    • paloaltonetworks pan-os 10.2.10

Detection

  • Monitor web server access logs for unusual request patterns, especially those that might trigger OOM conditions or attempt to execute arbitrary commands. Look for abnormally long or malformed requests.
  • Monitor for unexpected child processes spawned by web server processes (e.g., httpd.exe, nginx.exe, php-fpm.exe, php.exe). Look for cmd.exe, powershell.exe, sh, bash, python.exe, or other scripting interpreters.
  • Look for suspicious file writes in web-accessible directories, such as .php files with obfuscated content or known webshell signatures, originating from web server processes.
  • Analyze system logs for php process crashes or abnormal memory usage spikes followed by suspicious process activity.
  • Hunt for network connections initiated by the web server process to unusual external IP addresses or domains, indicative of C2 communication or data exfiltration.

Sigma Detection Rules

⚠️ AI-generated detection rules. These are experimental starting points. Review field names, EventIDs, and logic against your environment’s schema before deploying. Tune to reduce false positives.

Windows Web Server Spawning Shell

title: Windows Web Server Spawning Shell
id: 9a3e2f1a-b1c7-4d8e-a0b1-c74d8ea0b1c7
status: experimental
description: Detects suspicious shell process creation by common Windows web server processes, indicative of RCE.
logsource:
  product: windows
  service: sysmon
detection:
  selection:
    ParentImage|endswith:
      - '\inetinfo.exe'
      - '\httpd.exe'
      - '\nginx.exe'
      - '\php-cgi.exe'
      - '\php-fpm.exe'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
  condition: selection
level: high

Linux Web Server Spawning Shell

title: Linux Web Server Spawning Shell
id: 8b2d1e0a-a0b1-4c7d-8e9f-a0b1c74d8e9f
status: experimental
description: Detects suspicious shell process creation by common Linux web server processes, indicative of RCE.
logsource:
  product: linux
  service: auditd
detection:
  selection:
    ParentProcessName:
      - 'apache2'
      - 'httpd'
      - 'nginx'
      - 'php-fpm'
      - 'php-cgi'
    ProcessName:
      - 'sh'
      - 'bash'
      - 'dash'
      - 'zsh'
      - 'python'
      - 'perl'
      - 'php'
  condition: selection
level: high

PHP Process Outbound Network Connection

title: PHP Process Outbound Network Connection
id: 7c1f0d9a-9f8e-4b6c-7d5a-9f8e4b6c7d5a
status: experimental
description: Detects outbound network connections initiated by PHP processes to non-standard ports or external IPs, potentially indicating C2 or data exfiltration after RCE.
logsource:
  product: windows
  service: sysmon
detection:
  selection:
    EventID: 3
    Image|endswith:
      - '\php.exe'
      - '\php-cgi.exe'
      - '\php-fpm.exe'
    DestinationPort|!in:
      - 80
      - 443
    DestinationIp|!in:
      - '127.0.0.1'
      - '::1'
      - '10.0.0.0/8'
      - '172.16.0.0/12'
      - '192.168.0.0/16'
  condition: selection
level: medium

Mitigations

  1. Patch PHP installations immediately. Upgrade to the latest patched versions: PHP 8.2.35, PHP 8.3.36, PHP 8.4.27, PHP 8.5.12, or newer.
  2. Apply available patches for affected products such as Siemens RUGGEDCOM APE1808 firmware and Palo Alto Networks PAN-OS.
  3. Implement a Web Application Firewall (WAF) to detect and block malicious request patterns targeting PHP vulnerabilities.
  4. Restrict outbound network connectivity from web servers to only necessary services and destinations.
  5. Employ Endpoint Detection and Response (EDR) solutions to monitor for suspicious process creation and file modifications on web servers.

References

  • https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w
  • http://www.openwall.com/lists/oss-security/2026/10/21/6
  • http://www.openwall.com/lists/oss-security/2026/10/23/5
  • https://cert-portal.siemens.com/productcert/html/ssa-566512.html
  • https://www.wiz.io/blog/php2shell-php-rce
  • https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-glocal-php-infrastructure/
  • https://hunt.io/blog/php2shell-cve-2026-109618-109619-open-directories
  • https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/
  • https://www.vulncheck.com/blog/php2shell-vulnerabilities
  • https://socradar.io/blog/inc-gentlemen-ransomware-ai-infrastructure
  • https://www.huntress.com/blog/amazon-clickfix-finger
  • https://unit42.paloaltonetworks.com/ai-assisted-cybercrime-analysis/
  • https://www.security.nl/posting/959207/Amerikaanse+overheid+waarschuwt+voor+misbruik+van+PHP2Shell-lekken?channel=rss

Indicators of Compromise

Type Value Description
SHA256 0c5486f06620e26e316f4b33f318b0d646d5e1133789331aa2fed012360d1486 PHP2Shell second-stage ELF x86-64 binary hash (via https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-glocal-php-infrastructure/)
SHA256 1485e14e0f62bc94664eec341cabd275dad7d30b1d496c40ec340c9a0d9f0ba8 Hash of follow-up POST request body (via https://www.vulncheck.com/blog/php2shell-vulnerabilities)
SHA256 150ae88f0999032e2a6113501d6082f54a3ed98d02427b21a96e773a27d7bf16 Hash of uploaded file part ‘a’ (via https://www.vulncheck.com/blog/php2shell-vulnerabilities)
SHA256 27d926a6708d6769d97d065e7a5a860ab496eab272c03d1cebc55ec71b954fa2 Hash of uploaded file part ‘b’ (via https://www.vulncheck.com/blog/php2shell-vulnerabilities)
SHA256 40caf199ca1ebe056a74427f8e9db06c66899e33ae09c0ec2769ec70bf6dd8e7 Hash of uploaded file part ‘a’ (via https://www.vulncheck.com/blog/php2shell-vulnerabilities)
SHA256 43898a0a53bbd25d31ad9f5018ed3182be98a66109b22c9cab545a9fc447992a PHP2Shell scanner/OOM-tool HTTP request body hash (via https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-glocal-php-infrastructure/)
SHA256 7bc41ed79a9ae909927a9e40701736460a8cb70fca16ce1510e58677aca764b6 PHP2Shell scanner/OOM-tool HTTP request body hash (via https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-glocal-php-infrastructure/)
IP Address 103.114.163.188 PHP2Shell-associated anonymisation network IP (via https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-glocal-php-infrastructure/)
IP Address 103.216.220.92 PHP2Shell-associated anonymisation network IP (via https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-glocal-php-infrastructure/)
IP Address 109.71.252.97 PHP2Shell scanner/exploitation IP (via https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-glocal-php-infrastructure/)
IP Address 130.12.180.51 RedTail · confidence 75% · first seen 2026-10-23
IP Address 134.199.154.64 Mirai · confidence 75% · first seen 2026-10-22
IP Address 134.209.159.64 PHP2Shell-associated anonymisation network IP (via https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-glocal-php-infrastructure/)
IP Address 217.60.102.5 RedTail · confidence 100% · first seen 2026-10-23
IP Address 221.14.159.134 Exploitation attempt IP for CVE-2026-109618 (via https://www.vulncheck.com/blog/php2shell-vulnerabilities)
IP Address 31.223.184.166 PHP2Shell-associated anonymisation network IP (via https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-glocal-php-infrastructure/)
IP Address 37.19.200.5 PHP2Shell-associated anonymisation network IP (via https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-glocal-php-infrastructure/)
IP Address 45.198.224.169 PHP2Shell scanner/exploitation IP (via https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-glocal-php-infrastructure/)
IP Address 85.11.167.243 PHP2Shell scanner/exploitation IP (via https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-glocal-php-infrastructure/)
IP Address 91.90.123.25 Verification IP for CVE-2026-109618 (via https://www.vulncheck.com/blog/php2shell-vulnerabilities)
IP Address 92.118.112.100 PHP2Shell second-stage payload staging host IP (via https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-glocal-php-infrastructure/)
IP Address 95.217.98.37 PHP2Shell-associated anonymisation network IP (via https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-glocal-php-infrastructure/)
Domain p.2137gang.net RedTail · confidence 100% · first seen 2026-10-23
Domain p.2137gang.pl RedTail · confidence 100% · first seen 2026-10-23
Domain p.2137gang.shop RedTail · confidence 100% · first seen 2026-10-23
Domain p.2137gang.st RedTail · confidence 100% · first seen 2026-10-23
Domain p.2137gang.store RedTail · confidence 100% · first seen 2026-10-23
Domain proxies.identities.network RedTail · confidence 100% · first seen 2026-10-23
Domain proxy.identities.network RedTail · confidence 100% · first seen 2026-10-23
Domain proxy.insanecppdev.com RedTail · confidence 100% · first seen 2026-10-23
Domain proxy.insanitycpp.cx RedTail · confidence 100% · first seen 2026-10-23
Domain thunder.godofthunder.st Mirai · confidence 90% · first seen 2026-10-22
URL http://92.118.112.100/nfs Mirai · confidence 100% · first seen 2026-10-22
URL http://92.118.112.100/s Mirai · confidence 100% · first seen 2026-10-22
URL http://hackattackkaboom.botlesscucks.st/x86_64 Mirai · confidence 100% · first seen 2026-10-22
URL https://217.60.102.5/sh RedTail · confidence 100% · first seen 2026-10-23
URL https://217.60.103.56/sh RedTail · confidence 100% · first seen 2026-10-23

MITRE ATT&CK

  • T1190 — Exploit Public-Facing Application
  • T1059.004 — Unix Shell
  • T1059.003 — Windows Command Shell
  • T1059.006 — Python
  • T1059.001 — PowerShell
  • T1505.003 — Web Shell
  • T1590.005 — IP Addresses
  • T1053.003 — Cron
  • T1005 — Data from Local System
  • T1608.001 — Upload Malware
  • T1595.002 — Vulnerability Scanning
  • T1583.004 — Server
  • T1098.004 — SSH Authorized Keys
  • T1552.001 — Credentials In Files
  • T1041 — Exfiltration Over C2 Channel
  • T1210 — Exploitation of Remote Services
  • T1486 — Data Encrypted for Impact
  • T1496 — Resource Hijacking
  • T1105 — Ingress Tool Transfer
  • T1588.005 — Exploits
  • T1592 — Gather Victim Host Information
  • T1133 — External Remote Services
  • T1071.004 — DNS
  • T1036.005 — Match Legitimate Resource Name or Location
  • T1499.004 — Application or System Exploitation
  • T1071 — Application Layer Protocol
  • T1036 — Masquerading
  • T1595 — Active Scanning
  • T1090.002 — External Proxy
  • T1090 — Proxy
  • T1059 — Command and Scripting Interpreter
  • T1078 — Valid Accounts
  • T1573 — Encrypted Channel
  • T1592.002 — Software
  • T1203 — Exploitation for Client Execution
  • T1499 — Endpoint Denial of Service
  • T1071.001 — Web Protocols
  • T1046 — Network Service Discovery
  • T1082 — System Information Discovery
  • T1583.003 — Virtual Private Server
  • T1102 — Web Service
  • T1562.001 — Disable or Modify Tools
  • T1070.004 — File Deletion
  • T1021 — Remote Services
  • T1083 — File and Directory Discovery
  • T1136 — Create Account
  • T1018 — Remote System Discovery
  • T1003.003 — NTDS
  • T1021.001 — Remote Desktop Protocol
  • T1567.002 — Exfiltration to Cloud Storage
  • T1587.001 — Malware
  • T1489 — Service Stop
  • T1087.002 — Domain Account
  • T1053.005 — Scheduled Task
  • T1219 — Remote Access Tools
  • T1558.003 — Kerberoasting
  • T1583.001 — Domains
  • T1135 — Network Share Discovery
  • T1588.002 — Tool
  • T1490 — Inhibit System Recovery
  • T1110 — Brute Force
  • T1204.002 — Malicious File
  • T1114.001 — Local Email Collection
  • T1572 — Protocol Tunneling
  • T1021.002 — SMB/Windows Admin Shares
  • T1072 — Software Deployment Tools
  • T1566.001 — Spearphishing Attachment
  • T1070.006 — Timestomp
  • T1074.001 — Local Data Staging
  • T1555.003 — Credentials from Web Browsers
  • T1056.002 — GUI Input Capture
  • T1003.006 — DCSync
  • T1057 — Process Discovery
  • T1591 — Gather Victim Org Information
  • T1056.001 — Keylogging
  • T1555 — Credentials from Password Stores
  • T1132.001 — Standard Encoding
  • T1566.002 — Spearphishing Link
  • T1573.001 — Symmetric Cryptography
  • T1218.011 — Rundll32
  • T1497.001 — System Checks
  • T1539 — Steal Web Session Cookie
  • T1027 — Obfuscated Files or Information
  • T1102.002 — Bidirectional Communication
  • T1140 — Deobfuscate/Decode Files or Information
  • T1055.012 — Process Hollowing
  • T1110.001 — Password Guessing
  • T1087.001 — Local Account
  • T1021.004 — SSH
  • T1040 — Network Sniffing
  • T1567 — Exfiltration Over Web Service
  • T1552 — Unsecured Credentials
  • T1552.004 — Private Keys
  • T1087 — Account Discovery
  • T1087.004 — Cloud Account
🤖 AI Attribution
Generated by gemini-2.5-flash ·
2,689 input / 2,444 output tokens ·
Reviewed and approved by a human analyst before publication
Posted in vulnerabilityTagged critical, dprk, memory-corruption, php, ransomware, rce, vulnerability, web-application, webshellLeave a comment

CVE-2026-102764: Critical BeyondTrust Remote Support Authentication Bypass

Posted on October 17, 2026 by Kyle

Overview

CVE-2026-102764 is a critical authentication bypass vulnerability affecting BeyondTrust Remote Support appliances. This flaw allows a remote, unauthenticated attacker to perform arbitrary file operations on the vulnerable appliance. It has been added to CISA’s Known Exploited Vulnerabilities Catalog, indicating active exploitation by sophisticated threat actors, including those linked to ARMORY CASTLE.

Technical Analysis

The vulnerability (CWE-290, Improper Neutralization of Special Elements used in an Authentication Bypass) resides within internal components of BeyondTrust Remote Support. These components fail to adequately validate the origin of received messages, enabling an attacker to spoof legitimate communications. Under specific conditions, this spoofing allows an unauthenticated remote attacker to execute file operations on the appliance, potentially leading to arbitrary code execution, privilege escalation to root, and the deployment of backdoors or webshells.

  • CVE ID: CVE-2026-102764
  • CVSS 3.1 Score: 9.8 (CRITICAL)
  • CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  • Affected Products: BeyondTrust Remote Support versions up to and including 26.2.3.
  • Attack Vector: Network (AV:N), requiring low attack complexity (AC:L) with no privileges (PR:N) or user interaction (UI:N).
  • Impact: High confidentiality, integrity, and availability impact (C:H/I:H/A:H).
  • Observed Exploitation: Actively exploited in the wild by threat actors, including ARMORY CASTLE, to achieve root access and deploy malware such as SAWFLY and BARECLAW.

Detection

Detection efforts should focus on anomalous activity originating from or targeting BeyondTrust Remote Support appliances, particularly suspicious file operations or process execution.

  • Network Logs: Monitor for unusual network traffic patterns to/from BeyondTrust appliances, especially unexpected connections or data transfers post-exploitation.
  • Appliance Logs: Review system logs on BeyondTrust appliances for:
    • Unusual process creation by the BeyondTrust service (e.g., sh, bash, python, perl, cmd.exe, powershell.exe spawned by the main BeyondTrust process).
    • Suspicious file modifications or creations in web root directories (e.g., /var/www/html, /opt/beyondtrust/web/) indicative of webshell deployment.
    • Changes to system configuration files or new user accounts being created.
    • Attempts to modify or delete log files.
  • Endpoint Detection and Response (EDR): On systems interacting with or hosting the BeyondTrust appliance, look for:
    • Execution of known malware families like SAWFLY or BARECLAW.
    • Unusual outbound connections from the appliance to external C2 infrastructure.
    • Privilege escalation attempts or suspicious persistence mechanisms being established.

Sigma Detection Rules

⚠️ AI-generated detection rules. These are experimental starting points. Review field names, EventIDs, and logic against your environment’s schema before deploying. Tune to reduce false positives.

BeyondTrust Remote Support – Suspicious Process Creation

title: BeyondTrust Remote Support - Suspicious Process Creation
id: 9a3b2c1d-4e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects suspicious process creation by the BeyondTrust Remote Support service, indicative of post-exploitation activity after CVE-2026-102764 exploitation. This could include shell execution or other arbitrary commands.
logsource:
  product: linux
  service: auditd
detection:
  selection:
    type: 'EXECVE'
    a0|contains: ['sh', 'bash', 'python', 'perl', 'php', 'nc', 'wget', 'curl']
    # Adjust 'comm' or 'exe' based on the actual BeyondTrust service process name on the appliance
    # Example: comm: 'beyondtrust_service' or exe|endswith: '/opt/beyondtrust/bin/service'
    # For broader detection, you might omit the parent process if logs are limited.
  condition: selection
level: high

BeyondTrust Remote Support – Suspicious File Write in Web Root

title: BeyondTrust Remote Support - Suspicious File Write in Web Root
id: 1b2c3d4e-5f6a-7b8c-9d0e-1f2a3b4c5d6e
status: experimental
description: Detects suspicious file writes in common web root directories on a BeyondTrust appliance, potentially indicating webshell deployment after CVE-2026-102764 exploitation.
logsource:
  product: linux
  service: auditd
detection:
  selection:
    type: 'SYSCALL'
    syscall: 'openat'
    a1: 'O_WRONLY|O_CREAT'
    # Common web root paths for appliances. Adjust based on actual BeyondTrust appliance structure.
    name|startswith: ['/var/www/', '/opt/beyondtrust/web/', '/usr/share/nginx/html/', '/usr/local/apache2/htdocs/']
    # Look for common webshell extensions or suspicious file names
    name|endswith: ['.php', '.jsp', '.asp', '.aspx', '.pl', '.py', '.sh', '.cgi', '.txt', '.log']
    # Exclude known legitimate writes if causing FPs
  condition: selection
level: high

Mitigations

Prioritize immediate patching and implement compensating controls to limit potential impact.

  1. Patch Immediately: Upgrade BeyondTrust Remote Support to a patched version beyond 26.2.3 as soon as possible. Refer to the vendor advisory for specific patch versions.
  2. Network Segmentation: Isolate BeyondTrust Remote Support appliances on a dedicated network segment with strict ingress/egress filtering to limit exposure and contain potential breaches.
  3. Principle of Least Privilege: Ensure that the BeyondTrust appliance and associated services operate with the minimum necessary privileges.
  4. Monitor Appliance Logs: Implement robust logging and continuous monitoring of BeyondTrust appliance system and application logs for suspicious activity.
  5. Web Application Firewall (WAF): Deploy a WAF in front of the BeyondTrust appliance to detect and block suspicious web requests, although this vulnerability may bypass some WAF rules due to its internal component nature.

References

  • https://www.beyondtrust.com/blog/entry/bt26-05
  • https://beyondtrustcorp.service-now.com/csm?id=csm_kb_article&sysparm_article=KB0024066
  • https://nvd.nist.gov/vuln/detail/CVE-2026-102764
  • https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-102764
  • https://cloud.google.com/blog/topics/threat-intelligence/armory-castle-exploits-beyondtrust
  • https://ltna.com.au/cyber
  • https://socprime.com/blog/cve-2026-10264-beyondtrust-zero-day-exploited/
  • https://ppl-ai-file-upload.s3.amazonaws.com/web/direct-files/attachments/11146061/e3a50834-c553-4e4c-b521-58d936951de5/Chinese-Hackers-Exploit-BeyondTrust-Zero-Day-to-Gain-Root-Access-and-Deploy-Backdoors.pdf

Indicators of Compromise

Type Value Description
SHA256 1f19b9a27d79c11bda00a1e8faf74a7fdd683d38ccef1b60df2fd0307e3aa462 SHA-256 hash of the BARECLAW binary (via https://socprime.com/blog/cve-2026-102764-beyondtrust-zero-day-exploited/)
SHA256 dc14e215269a93fdbc4c1a80b984c23faf7af0911c6dbb85309796a6f2ae95fb SHA-256 hash of the SAWFLY webshell (via https://socprime.com/blog/cve-2026-102764-beyondtrust-zero-day-exploited/)
info ARMORY CASTLE Threat actor group observed exploiting CVE-2026-102764.
info BARECLAW Associated malware family observed in post-exploitation activities.
info SAWFLY Associated malware family observed in post-exploitation activities.
info backdoor Generic term for persistent access mechanisms deployed post-exploitation.
info webshell Common post-exploitation artifact deployed after successful exploitation.

MITRE ATT&CK

  • T1190 — Exploit Public-Facing Application
  • T1068 — Exploitation for Privilege Escalation
  • T1505.003 — Web Shell
  • T1083 — File and Directory Discovery
  • T1003 — OS Credential Dumping
  • T1133 — External Remote Services
  • T1548.003 — Sudo and Sudo Caching
  • T1021.004 — SSH
  • T1005 — Data from Local System
  • T1572 — Protocol Tunneling
  • T1136.001 — Local Account
  • T1070.001 — Clear Windows Event Logs
  • T1548.001 — Setuid and Setgid
  • T1552.001 — Credentials In Files
  • T1041 — Exfiltration Over C2 Channel
  • T1090.003 — Multi-hop Proxy
  • T1562.001 — Disable or Modify Tools
  • T1070.004 — File Deletion
  • T1543.002 — Systemd Service
  • T1090.001 — Internal Proxy
  • T1078.003 — Local Accounts
🤖 AI Attribution
Generated by gemini-2.5-flash ·
2,394 input / 2,344 output tokens ·
Reviewed and approved by a human analyst before publication
Posted in vulnerabilityTagged armory castle, authentication bypass, bareclaw, beyondtrust, critical, cve-2026-102764, privilege escalation, remote support, sawfly, vulnerability, webshell, zero-day exploitationLeave a comment

CVE-2026-105133: AhsayCBS Improper Authentication Vulnerability Exploited

Posted on October 17, 2026 by Kyle

Overview

CVE-2026-105133 is an improper authentication vulnerability in Ahsay AhsayCBS versions up to 10.3.2. This flaw allows remote attackers to bypass authentication via manipulation of a specific API parameter. The vulnerability is actively exploited in the wild, often chained with CVE-2026-105134, leading to post-exploitation activities such as webshell deployment and cryptominer installation.

Technical Analysis

  • Vulnerability: Improper Authentication (CWE-287).
  • Affected Software: Ahsay AhsayCBS up to version 10.3.2.
  • Affected Component: API component, specifically the checkSysPwd function within com/ahsay/obs/api/ApiStructsAction.java.
  • Attack Vector: Remote attackers can manipulate the random argument during API calls to bypass authentication.
  • CVSS 3.1 Score: 7.3 (HIGH) – CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. This indicates a network-based attack, low attack complexity, no privileges required, no user interaction, and low impact on confidentiality, integrity, and availability.
  • Exploitation: The exploit is public and actively used. It can be chained with CVE-2026-105134 for further compromise.
  • Observed Post-Exploitation: Deployment of webshells and XMRig cryptominer.

Detection

  • Monitor web server access logs for suspicious requests to the /obs/api/ApiStructsAction.java endpoint, particularly those manipulating the random parameter or exhibiting unusual authentication patterns (e.g., failed authentication followed by immediate success without valid credentials).
  • Look for unexpected file creations or modifications in web root directories, indicative of webshell deployment (e.g., .jsp, .php, .aspx files).
  • Monitor for new, unauthorized processes, especially those related to cryptomining (e.g., xmrig.exe, miner.exe) or unusual command-line executions originating from the AhsayCBS process.
  • Detect outbound network connections from AhsayCBS servers to known cryptomining pools or unusual C2 infrastructure.
  • Monitor for sustained high CPU utilization on AhsayCBS servers, which could indicate cryptomining activity.

Sigma Detection Rules

⚠️ AI-generated detection rules. These are experimental starting points. Review field names, EventIDs, and logic against your environment’s schema before deploying. Tune to reduce false positives.

AhsayCBS API Improper Authentication Attempt

title: AhsayCBS API Improper Authentication Attempt
id: 902b7194-c71b-4d2a-a22a-1c3906a1a123
status: experimental
description: Detects suspicious access patterns to the AhsayCBS API endpoint related to CVE-2026-105133.
logsource:
  category: webserver
detection:
  selection:
    cs-uri-stem|contains: '/obs/api/ApiStructsAction.java'
  condition: selection
level: medium

AhsayCBS Webshell Deployment in Web Root

title: AhsayCBS Webshell Deployment in Web Root
id: 7e7f8e1d-c3d9-4b1a-8b0c-0a1b2c3d4e5f
status: experimental
description: Detects creation of suspicious files (potential webshells) in the AhsayCBS web application directory.
logsource:
  product: windows
  service: sysmon
detection:
  selection:
    EventID: 11
    TargetFilename|contains|all:
      - '\AhsayCBS\webapps\obs\'
    TargetFilename|endswith:
      - '.jsp'
      - '.aspx'
      - '.php'
  condition: selection
level: high

XMRig Cryptominer Process Execution

title: XMRig Cryptominer Process Execution
id: 1a2b3c4d-5e6f-7a8b-9c0d-e1f2a3b4c5d6
status: experimental
description: Detects common process names or command-line arguments associated with XMRig cryptominer activity.
logsource:
  product: windows
  service: sysmon
detection:
  selection_image:
    EventID: 1
    Image|contains:
      - 'xmrig'
      - 'miner'
  selection_cmdline:
    EventID: 1
    CommandLine|contains|all:
      - '--donate-level'
      - '-o'
  condition: 1 of selection_*
level: critical

Mitigations

  1. Upgrade Ahsay AhsayCBS to version 10.3.4 or later immediately.
  2. Implement network segmentation to restrict access to AhsayCBS servers from untrusted networks.
  3. Deploy a Web Application Firewall (WAF) to detect and block suspicious API requests and webshell uploads.
  4. Regularly audit AhsayCBS server logs for signs of compromise, including unauthorized file changes and process execution.
  5. Ensure endpoint detection and response (EDR) solutions are deployed and configured to detect cryptomining activity and suspicious process behavior.

References

  • https://nvd.nist.gov/vuln/detail/CVE-2026-105133
  • https://vuldb.com/cve/CVE-2026-105133
  • https://vuldb.com/submit/942688
  • https://vuldb.com/vuln/413350
  • https://vuldb.com/vuln/413350/cti
  • https://www.ahsay.com/en/support/help-centre/release-notes/cbs/v10.3.4
  • https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-105133
  • https://www.huntress.com/blog/ahsaycbs-flaws-exploit
  • https://ltna.com.au/cyber

Indicators of Compromise

Type Value Description
SHA256 05f69ae6b2b89c1c4dcf836bff032232f11bf0109f2b498e2345045d06139034 Modified NSSM utility (msedge.exe) (via https://www.huntress.com/blog/ahsaycbs-flaws-exploit)
SHA256 481728a7c9c4c02be07051d9c1958d902ea6397ebb8952ab83944818e3d25d21 Powershell script (Taskgmr.ps1) (via https://www.huntress.com/blog/ahsaycbs-flaws-exploit)
SHA256 4dcb0202fe8b2d4d7b183764e38184cd6ed50132786cc7e7d1f7f4bce1dd6f3d XMRig miner (edge.exe) (via https://www.huntress.com/blog/ahsaycbs-flaws-exploit)
IP Address 51.195.127.124 XMR cryptomining pool IP address (via https://www.huntress.com/blog/ahsaycbs-flaws-exploit)
Domain imagefiles-backup.oss-ap-southeast-7.aliyuncs.com Payload hosting domain (Alibaba Cloud Object Storage) (via https://www.huntress.com/blog/ahsaycbs-flaws-exploit)
Domain xmr.kryptex.network XMR cryptomining pool domain (via https://www.huntress.com/blog/ahsaycbs-flaws-exploit)
URL http://imagefiles-backup.oss-ap-southeast-7.aliyuncs.com Payload hosting server for various files (Taskgmr.ps1, msedge.exe, edge.exe, config.json, WinRing0x64.sys) (via https://www.huntress.com/blog/ahsaycbs-flaws-exploit)

MITRE ATT&CK

  • T1190 — Exploit Public-Facing Application
  • T1078 — Valid Accounts
  • T1505.003 — Web Shell
  • T1496 — Resource Hijacking
  • T1036.005 — Match Legitimate Resource Name or Location
  • T1564 — Hide Artifacts
  • T1543.003 — Windows Service
  • T1608.001 — Upload Malware
  • T1036.004 — Masquerade Task or Service
  • T1057 — Process Discovery
  • T1059.001 — PowerShell
  • T1571 — Non-Standard Port
  • T1059.003 — Windows Command Shell
  • T1071.001 — Web Protocols
  • T1105 — Ingress Tool Transfer
  • T1569.002 — Service Execution
  • T1124 — System Time Discovery
🤖 AI Attribution
Generated by gemini-2.5-flash ·
2,120 input / 1,803 output tokens ·
Reviewed and approved by a human analyst before publication
Posted in vulnerabilityTagged ahsaycbs, cryptomining, high, improper authentication, known_exploited, vulnerability, webshell, xmrigLeave a comment

CVE-2026-105134: AhsayCBS Command Injection Vulnerability Actively Exploited

Posted on October 17, 2026 by Kyle

Overview

CVE-2026-105134 is a critical command injection vulnerability impacting Ahsay AhsayCBS backup software, specifically within its Replication Receiver component. This flaw enables unauthenticated remote attackers to execute arbitrary operating system commands by manipulating the random parameter in the /rps/api/json/UpdateReceivers.do endpoint. The vulnerability is actively exploited, with observed attacks deploying webshells and XMRig cryptominers.

Technical Analysis

This vulnerability exists in Ahsay AhsayCBS versions up to 10.3.2. The flaw is located in the /rps/api/json/UpdateReceivers.do endpoint of the Replication Receiver component. A remote attacker can achieve OS command injection by manipulating the random argument within requests to this endpoint. The vulnerability has a CVSS 3.1 score of 10.0 (CRITICAL) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, indicating network-exploitable, low complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

  • Affected Component: Replication Receiver
  • Affected Endpoint: /rps/api/json/UpdateReceivers.do
  • Vulnerable Parameter: random
  • Affected Versions: Ahsay AhsayCBS up to 10.3.2
  • Attack Vector: Remote, unauthenticated command injection via HTTP/HTTPS requests.
  • Weaknesses: CWE-77 (Improper Neutralization of Special Elements used in a Command (‘Command Injection’)), CWE-78 (Improper Neutralization of Special Elements used in an OS Command (‘OS Command Injection’))
  • Chaining: This vulnerability can be chained with CVE-2026-105133 for potentially broader impact.
  • Post-Exploitation: Observed post-exploitation activities include the deployment of webshells and XMRig cryptominers.

Detection

Defenders can identify exploitation attempts and post-exploitation activity through various log sources and behavioral indicators:

  • Web Server Logs: Monitor access logs for requests to /rps/api/json/UpdateReceivers.do where the random parameter in the query string or POST body contains suspicious characters indicative of command injection (e.g., &, |, ;, $(, `).
  • Process Creation Logs (Windows/Linux): Look for unusual child processes spawned by the AhsayCBS service process (e.g., AhsayCBS.exe, java.exe, or similar) that include cmd.exe, powershell.exe, sh, bash, python.exe, or other scripting interpreters.
  • File System Monitoring: Detect the creation of suspicious files in web root directories (e.g., .jsp, .php, .asp, .aspx files that are not part of the legitimate application) or the presence of known cryptominer executables like xmrig.exe.
  • Network Activity: Monitor for outbound connections from the AhsayCBS server to unusual IP addresses or domains, especially those associated with cryptomining pools or C2 infrastructure.
  • Resource Utilization: Look for sudden spikes in CPU usage on the AhsayCBS server, which could indicate cryptomining activity.

Sigma Detection Rules

⚠️ AI-generated detection rules. These are experimental starting points. Review field names, EventIDs, and logic against your environment’s schema before deploying. Tune to reduce false positives.

AhsayCBS CVE-2026-105134 Exploitation Attempt

title: AhsayCBS CVE-2026-105134 Exploitation Attempt
id: 7e2f1b3c-d4a5-4e6f-8b0c-9a1d2e3f4a5b
status: experimental
description: Detects attempts to exploit CVE-2026-105134 in AhsayCBS by looking for suspicious requests to the vulnerable endpoint with command injection patterns.
logsource:
  category: webserver
detection:
  selection_uri:
    cs-uri-stem|endswith: '/rps/api/json/UpdateReceivers.do'
  selection_injection_patterns:
    cs-uri-query|contains:
      - '&'
      - '|'
      - ';'
      - '`'
      - '$('
      - '||'
      - '&&'
  condition: selection_uri and selection_injection_patterns
level: high

AhsayCBS Service Spawning Suspicious Processes

title: AhsayCBS Service Spawning Suspicious Processes
id: 8c9d0e1f-a2b3-4c5d-6e7f-0a1b2c3d4e5f
status: experimental
description: Detects post-exploitation activity where the AhsayCBS service process spawns common command interpreters, indicative of command injection success.
logsource:
  product: windows
  service: sysmon
detection:
  selection_parent:
    ParentImage|endswith:
      - '\AhsayCBS.exe'
      - '\java.exe' # Common for Java-based services
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\sh.exe'
      - '\bash.exe'
      - '\python.exe'
  condition: selection_parent and selection_child
level: critical

XMRig Cryptominer Execution

title: XMRig Cryptominer Execution
id: 9d0e1f2a-b3c4-5d6e-7f8a-9b0c1d2e3f4a
status: experimental
description: Detects the execution of XMRig cryptominer, often deployed after successful exploitation of vulnerabilities like CVE-2026-105134.
logsource:
  product: windows
  service: sysmon
detection:
  selection:
    Image|endswith:
      - '\xmrig.exe'
      - '\xmrig-proxy.exe'
    CommandLine|contains:
      - '--donate-level'
      - '-o pool.supportxmr.com'
      - '-u wallet_address'
  condition: selection
level: high

Mitigations

  1. Patch Immediately: Upgrade Ahsay AhsayCBS to version 10.3.4 or later. This is the primary and most effective mitigation.
  2. Network Segmentation: Isolate AhsayCBS servers on a dedicated network segment with strict egress filtering to limit outbound connections and prevent lateral movement in case of compromise.
  3. Principle of Least Privilege: Ensure the AhsayCBS service runs with the minimum necessary privileges to perform its functions.
  4. Application Whitelisting: Implement application whitelisting to prevent the execution of unauthorized executables (e.g., xmrig.exe, unknown scripting interpreters) on the server.
  5. Regular Backups: Maintain regular, off-site, and immutable backups of critical data to facilitate recovery in the event of a successful attack.

References

  • https://nvd.nist.gov/vuln/detail/CVE-2026-105134
  • https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-105134
  • https://vuldb.com/cve/CVE-2026-105134
  • https://vuldb.com/submit/942743
  • https://vuldb.com/vuln/413351
  • https://vuldb.com/vuln/413351/cti
  • https://www.ahsay.com/en/support/help-centre/release-notes/cbs/v10.3.4
  • https://www.huntress.com/blog/ahsaycbs-flaws-exploit
  • https://ltna.com.au/cyber

Indicators of Compromise

Type Value Description
SHA256 05f69ae6b2b89c1c4dcf836bff032232f11bf0109f2b498e2345045d06139034 Modified NSSM utility (msedge.exe) (via https://www.huntress.com/blog/ahsaycbs-flaws-exploit)
SHA256 481728a7c9c4c02be07051d9c1958d902ea6397ebb8952ab83944818e3d25d21 Powershell script (Taskgmr.ps1) (via https://www.huntress.com/blog/ahsaycbs-flaws-exploit)
SHA256 4dcb0202fe8b2d4d7b183764e38184cd6ed50132786cc7e7d1f7f4bce1dd6f3d XMRig miner (edge.exe) (via https://www.huntress.com/blog/ahsaycbs-flaws-exploit)
IP Address 51.195.127.124 XMR cryptomining pool IP address (via https://www.huntress.com/blog/ahsaycbs-flaws-exploit)
Domain imagefiles-backup.oss-ap-southeast-7.aliyuncs.com Payload hosting domain (Alibaba Cloud Object Storage) (via https://www.huntress.com/blog/ahsaycbs-flaws-exploit)
Domain xmr.kryptex.network XMR cryptomining pool domain (via https://www.huntress.com/blog/ahsaycbs-flaws-exploit)
URL http://imagefiles-backup.oss-ap-southeast-7.aliyuncs.com Payload hosting server for various files (Taskgmr.ps1, msedge.exe, edge.exe, config.json, WinRing0x64.sys) (via https://www.huntress.com/blog/ahsaycbs-flaws-exploit)

MITRE ATT&CK

  • T1059 — Command and Scripting Interpreter
  • T1505.003 — Web Shell
  • T1496 — Resource Hijacking
  • T1036.005 — Match Legitimate Resource Name or Location
  • T1564 — Hide Artifacts
  • T1543.003 — Windows Service
  • T1608.001 — Upload Malware
  • T1190 — Exploit Public-Facing Application
  • T1036.004 — Masquerade Task or Service
  • T1057 — Process Discovery
  • T1059.001 — PowerShell
  • T1571 — Non-Standard Port
  • T1059.003 — Windows Command Shell
  • T1071.001 — Web Protocols
  • T1105 — Ingress Tool Transfer
  • T1569.002 — Service Execution
  • T1124 — System Time Discovery
🤖 AI Attribution
Generated by gemini-2.5-flash ·
2,137 input / 2,181 output tokens ·
Reviewed and approved by a human analyst before publication
Posted in vulnerabilityTagged ahsaycbs, command-injection, critical, cryptomining, known_cve, vulnerability, webshell, xmrigLeave a comment

WordPress Core SQL Injection (CVE-2026-60137) Chained for RCE

Posted on July 25, 2026 - September 27, 2026 by Kyle

Overview

CVE-2026-60137 is a SQL injection vulnerability affecting WordPress Core. While rated Medium severity on its own, it is critical because it can be chained with CVE-2026-63030 to enable unauthenticated remote code execution (RCE). This vulnerability is actively exploited, making immediate patching crucial for all WordPress administrators.

Technical Analysis

The vulnerability resides in the WP_Query component of WordPress Core, specifically in how it handles the author__not_in parameter. WordPress versions 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 do not properly sanitize untrusted input passed to this parameter by a plugin or theme. This allows an attacker to inject arbitrary SQL queries.

  • Vulnerability Type: SQL Injection (CWE-89)
  • Affected Versions:
    • WordPress >= 6.8, < 6.8.6
    • WordPress >= 6.9, < 6.9.5
    • WordPress >= 7.0, < 7.0.2
  • Prerequisites: A plugin or theme must pass untrusted input to the author__not_in parameter of WP_Query.
  • Attack Vector: Network (CVSS:3.1/AV:N)
  • Impact: High confidentiality impact (CVSS:3.1/C:H), no integrity or availability impact on its own. When chained with CVE-2026-63030, it leads to RCE.
  • CVSS 3.1 Score: 5.9 (MEDIUM)

Detection

  • Web Server Logs: Monitor web server access logs (e.g., Apache, Nginx, IIS) for requests containing author__not_in= in the URI or POST body, especially when combined with common SQL injection payloads such as UNION SELECT, ' OR 1=1--, SLEEP(), or LOAD_FILE(). Look for unusual HTTP status codes or response sizes following such requests.
  • Process Monitoring: On web servers, monitor for the web server process (e.g., httpd.exe, nginx.exe, php-fpm.exe, w3wp.exe) spawning unusual child processes, particularly command shells (cmd.exe, powershell.exe, sh, bash) or scripting interpreters, which could indicate successful RCE.
  • File Integrity Monitoring (FIM): Implement FIM on WordPress installation directories. Alert on the creation or modification of new .php files in web-accessible directories (wp-content, wp-includes, plugin/theme directories), as this could indicate a webshell drop.
  • Network Traffic Analysis: Look for outbound connections initiated by the web server process to unusual or known malicious IP addresses/domains, which might indicate command-and-control (C2) communication or data exfiltration post-exploitation.

Sigma Detection Rules

⚠️ AI-generated detection rules. These are experimental starting points. Review field names, EventIDs, and logic against your environment’s schema before deploying. Tune to reduce false positives.

WordPress Core SQL Injection CVE-2026-60137 Attempt

title: WordPress Core SQL Injection CVE-2026-60137 Attempt
id: 9029a1b8-20d0-482a-97a6-407133f93282
status: experimental
description: Detects attempts to exploit CVE-2026-60137, a SQL injection vulnerability in WordPress Core's WP_Query author__not_in parameter.
logsource:
  category: webserver
detection:
  selection_uri:
    - cs-uri-query|contains: 'author__not_in='
    - c-uri|contains: 'author__not_in='
  selection_sqli_patterns:
    - cs-uri-query|contains:
        - ' UNION SELECT '
        - ' OR 1=1-- '
        - ' AND 1=1-- '
        - ' SLEEP('
        - ' WAITFOR DELAY '
        - ' LOAD_FILE('
        - ' CONCAT('
    - c-uri|contains:
        - ' UNION SELECT '
        - ' OR 1=1-- '
        - ' AND 1=1-- '
        - ' SLEEP('
        - ' WAITFOR DELAY '
        - ' LOAD_FILE('
        - ' CONCAT('
  condition: selection_uri and selection_sqli_patterns
level: high

Web Server Process Spawning Suspicious Shell (Windows)

title: Web Server Process Spawning Suspicious Shell (Windows)
id: 4b27f67d-93d3-4a11-a81d-66f688820c7a
status: experimental
description: Detects a web server process spawning a command shell, indicative of successful remote code execution, potentially via CVE-2026-60137 chaining.
logsource:
  product: windows
  service: sysmon
detection:
  selection_parent:
    ParentImage|endswith:
      - '\php-fpm.exe'
      - '\httpd.exe'
      - '\nginx.exe'
      - '\w3wp.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
  condition: selection_parent and selection_child
level: critical

Web Server Process Creating Suspicious PHP File (Windows)

title: Web Server Process Creating Suspicious PHP File (Windows)
id: 7e7f8e1a-5b0c-4d3e-8f9a-2c1d0e6f7b8c
status: experimental
description: Detects a web server process creating a new PHP file in a web-accessible directory, which could indicate a webshell drop after successful exploitation.
logsource:
  product: windows
  service: sysmon
  definition: 'Requires Sysmon EventID 11 (FileCreate) to be enabled.'
detection:
  selection_process:
    Image|endswith:
      - '\php-fpm.exe'
      - '\httpd.exe'
      - '\nginx.exe'
      - '\w3wp.exe'
  selection_file:
    TargetFilename|endswith: '.php'
    TargetFilename|contains:
      - '\wp-content\uploads\'
      - '\wp-content\plugins\'
      - '\wp-content\themes\'
      - '\html\'
      - '\www\'
  condition: selection_process and selection_file
level: high

Mitigations

  1. Patch Immediately: Update all affected WordPress installations to the latest patched versions: 6.8.6, 6.9.5, 7.0.2, or newer. This is the most critical step to prevent exploitation.
  2. Web Application Firewall (WAF): Deploy and configure a WAF to detect and block common SQL injection patterns, specifically targeting the author__not_in parameter in WordPress requests. Ensure rules are updated to cover known exploitation patterns for this CVE.
  3. Review Plugins and Themes: Audit all third-party and custom WordPress plugins and themes. Prioritize those that interact with WP_Query or user-supplied input for author__not_in to ensure proper input sanitization and validation are in place.
  4. Principle of Least Privilege: Ensure the web server process and its associated PHP processes run with the minimum necessary privileges to limit the impact of successful exploitation.

References

  • https://nvd.nist.gov/vuln/detail/CVE-2026-60137
  • https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-fpp7-x2x2-2mjf
  • https://wordpress.org/news/2026/07/wordpress-7-0-2-release/
  • https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-60137
  • https://www.wiz.io/blog/wp2shell-cve-2026-63030-cve-2026-60137

Indicators of Compromise

No public IOCs available at time of writing.

MITRE ATT&CK

  • T1190 — Exploit Public-Facing Application
  • T1505.003 — Web Shell
  • T1140 — Deobfuscate/Decode Files or Information
  • T1087 — Account Discovery
  • T1059 — Command and Scripting Interpreter
  • T1083 — File and Directory Discovery
  • T1552.001 — Credentials In Files
  • T1059.004 — Unix Shell
  • T1078 — Valid Accounts
  • T1068 — Exploitation for Privilege Escalation
  • T1027 — Obfuscated Files or Information
  • T1027.002 — Software Packing
  • T1071.001 — Web Protocols
  • T1136 — Create Account
  • T1018 — Remote System Discovery
  • T1046 — Network Service Discovery
🤖 AI Attribution
Generated by gemini-2.5-flash ·
2,343 input / 2,291 output tokens ·
Reviewed and approved by a human analyst before publication
Posted in vulnerabilityTagged actively exploited, cve-2026-60137, cve-2026-63030, medium, pre-authentication, rce, sql injection, vulnerability, webshell, wordpressLeave a comment

CVE-2026-63030: WordPress REST API RCE via Chained SQL Injection

Posted on July 25, 2026 - September 27, 2026 by Kyle

Overview

CVE-2026-63030 is a critical vulnerability affecting WordPress Core, specifically its REST API batch endpoint. This flaw, when combined with a separate SQL Injection vulnerability (CVE-2026-60137), enables unauthenticated attackers to execute arbitrary code on vulnerable WordPress installations. Given its CVSS score of 9.8 and confirmed active exploitation, immediate patching is essential for all affected WordPress sites.

Technical Analysis

  • Vulnerability Type: Interpretation Conflict (CWE-436) leading to SQL Injection and Remote Code Execution.
  • Affected Versions:
    • WordPress versions 6.9.x before 6.9.5
    • WordPress versions 7.0.x before 7.0.2
  • Attack Vector: Network (AV:N), Low Attack Complexity (AC:L), No Privileges Required (PR:N), No User Interaction (UI:N). CVSS 3.1 Base Score: 9.8 (CRITICAL).
  • Mechanism: The vulnerability chain involves two distinct issues:
    1. CVE-2026-63030: A REST API batch endpoint route confusion issue. This allows an attacker to manipulate how the batch endpoint processes requests.
    2. CVE-2026-60137: An author__not_in WP_Query SQL Injection. This SQLi can be triggered through the confused batch endpoint.
  • Exploitation: An unauthenticated attacker can leverage the route confusion to inject malicious SQL queries via the author__not_in parameter. This SQL injection can then be escalated to achieve Remote Code Execution, potentially leading to webshell deployment or direct command execution. Tools like CMSmap have been linked to exploitation attempts.

Detection

  • Web Server Logs: Monitor web server access logs for unusual requests to WordPress REST API batch endpoints, specifically wp-json/batch/v1/ or similar paths, containing suspicious parameters (e.g., author__not_in) or large, malformed POST bodies.
  • Process Creation: Look for unexpected child processes spawned by the web server process (e.g., httpd, nginx, w3wp.exe, php-cgi.exe). Specifically, monitor for cmd.exe, powershell.exe, sh, or bash being executed.
  • File System Monitoring: Detect creation of suspicious files (e.g., .php, .asp, .jsp files) in WordPress web root directories, particularly wp-content/uploads/ or wp-includes/, by the web server process. These could indicate webshell deployment.
  • Database Logs: If available, monitor database logs for unusual or malformed SQL queries, especially those targeting user or option tables, originating from the WordPress application.

Sigma Detection Rules

⚠️ AI-generated detection rules. These are experimental starting points. Review field names, EventIDs, and logic against your environment’s schema before deploying. Tune to reduce false positives.

WordPress REST API Batch Endpoint Suspicious Request

title: WordPress REST API Batch Endpoint Suspicious Request
id: 9283e01a-f1c2-4a7b-a1c3-2d4e5f6g7h8i
status: experimental
description: Detects suspicious requests to the WordPress REST API batch endpoint, potentially indicating exploitation attempts for CVE-2026-63030 chained with CVE-2026-60137.
logsource:
  category: webserver
detection:
  selection:
    cs-uri-stem|contains: '/wp-json/batch/v1/'
    cs-method: ['POST', 'PUT']
    c-uri|contains: 'author__not_in'
  condition: selection
level: high

Web Server Spawning Shell Process

title: Web Server Spawning Shell Process
id: a1b2c3d4-e5f6-7890-1234-567890abcdef
status: experimental
description: Detects a web server process spawning a shell interpreter, indicative of successful Remote Code Execution (RCE).
logsource:
  product: windows
  service: sysmon
detection:
  selection:
    ParentImage|endswith: 
      - '\w3wp.exe'
      - '\httpd.exe'
      - '\nginx.exe'
      - '\php-cgi.exe'
      - '\apache.exe'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\sh.exe'
      - '\bash.exe'
      - '\pwsh.exe'
  condition: selection
level: critical

Web Server Creating Suspicious File in WordPress Directories

title: Web Server Creating Suspicious File in WordPress Directories
id: f0e9d8c7-b6a5-4321-fedc-ba9876543210
status: experimental
description: Detects a web server process creating suspicious files (e.g., webshells) in common WordPress upload or include directories, a common post-exploitation activity.
logsource:
  product: windows
  service: sysmon
detection:
  selection:
    EventID: 11
    ParentImage|endswith:
      - '\w3wp.exe'
      - '\httpd.exe'
      - '\nginx.exe'
      - '\php-cgi.exe'
      - '\apache.exe'
    TargetFilename|contains:
      - '\wp-content\uploads\'
      - '\wp-includes\'
    TargetFilename|endswith:
      - '.php'
      - '.php5'
      - '.phtml'
      - '.asp'
      - '.aspx'
      - '.jsp'
      - '.jspx'
  condition: selection
level: high

Mitigations

  1. Patch Immediately: Upgrade WordPress to version 6.9.5 or 7.0.2, or later, as soon as possible. These versions contain the necessary fixes for both CVE-2026-63030 and CVE-2026-60137.
  2. Restrict REST API Access: If feasible and not critical for site functionality, consider limiting access to the WordPress REST API endpoint (/wp-json/) at the web server or WAF level, especially for unauthenticated users.
  3. Implement Web Application Firewall (WAF): Deploy and configure a WAF to detect and block known SQL injection patterns and suspicious requests targeting WordPress REST API endpoints.
  4. Principle of Least Privilege: Ensure the web server process runs with the minimum necessary privileges to limit the impact of successful exploitation.
  5. Regular Backups: Maintain regular, tested backups of WordPress sites and databases to facilitate recovery in case of compromise.

References

  • https://nvd.nist.gov/vuln/detail/CVE-2026-63030
  • https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-ff9f-jf42-662q
  • https://wordpress.org/news/2026/07/wordpress-7-0-2-release/
  • https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-63030
  • https://www.wiz.io/blog/wp2shell-cve-2026-63030-cve-2026-60137

Indicators of Compromise

No public IOCs available at time of writing.

MITRE ATT&CK

  • T1190 — Exploit Public-Facing Application
  • T1505.003 — Web Shell
  • T1059.003 — Windows Command Shell
  • T1059.004 — Unix Shell
  • T1140 — Deobfuscate/Decode Files or Information
  • T1087 — Account Discovery
  • T1059 — Command and Scripting Interpreter
  • T1083 — File and Directory Discovery
  • T1552.001 — Credentials In Files
  • T1078 — Valid Accounts
  • T1068 — Exploitation for Privilege Escalation
  • T1027 — Obfuscated Files or Information
  • T1027.002 — Software Packing
  • T1071.001 — Web Protocols
  • T1136 — Create Account
  • T1018 — Remote System Discovery
  • T1046 — Network Service Discovery
🤖 AI Attribution
Generated by gemini-2.5-flash ·
2,319 input / 2,116 output tokens ·
Reviewed and approved by a human analyst before publication
Posted in vulnerabilityTagged batch api exploitation, cmsmap, critical, cve-2026-60137, cve-2026-63030, pre-authentication, rce, sql injection, vulnerability, webshell, wordpressLeave a comment
Proudly powered by WordPress | Theme: micro, developed by DevriX.