Arch Linux ASA-202610-1: Critical Unauthenticated PHP Code Execution — Patching, Detection, and Hardening Guide | Security Arsenal

The Arch Linux security team has published advisory ASA-202610-1, flagging the php package before version 8.5.12-1 as vulnerable to arbitrary code execution. Because PHP is the interpreter behind an enormous share of public-facing web infrastructure — CMS platforms, APIs, admin portals, and internal tooling — a remotely triggerable code execution flaw in the runtime itself sits at the top of the defender's priority list. If you run PHP on Arch Linux (servers, containers, appliances, or developer workstations exposed to untrusted input), treat this as an emergency change.

Introduction

Per the advisory, PHP packages prior to 8.5.12-1 on Arch Linux are affected. The critical qualifier in the advisory title is unauthenticated: an attacker does not need valid credentials, a valid session, or prior access to trigger code execution. Any HTTP request reaching a vulnerable PHP interpreter — via Apache/mod_php, Nginx + PHP-FPM, or a standalone php-cgi/php-cli wrapper — is a potential execution vector, depending on how the flaw is exercised through request handling.

Why this matters operationally:

Blast radius is the web tier. Compromise of the PHP process means code execution in the context of the web service account (http, www-data, or a dedicated pool user) — which typically can read application configs, database credentials, and uploaded content, and is a standard pivot point for lateral movement.
Arch is a rolling-release distribution. Many organizations run Arch in containers, build pipelines, and edge services where patching cadence is inconsistent. A rolling-release model also means some hosts may have pulled the vulnerable build recently and silently.
Unauthenticated RCE in an interpreter is scanner bait. Historically, interpreter-level RCEs are weaponized within days of disclosure and folded into mass-scanning botnets and initial-access tooling.

Do not wait for a working public exploit to justify the patch window. Patch now, then hunt.

Technical Analysis

Affected products and versions

Item	Detail
Distribution	Arch Linux (rolling release)
Package	`php` (and derived runtime usage: `php-fpm`, `php-cgi`, `php-apache`, `php-cli` wrappers)
Vulnerable versions	All versions before 8.5.12-1
Fixed version	8.5.12-1
Advisory	ASA-202610-1
Impact	Arbitrary code execution, unauthenticated, network-reachable

No CVE identifier is published in the advisory summary at time of writing; track the upstream PHP security releases page and the Arch security tracker for the CVE mapping as it lands. Do not let the absence of a CVE number delay remediation — the distribution advisory is authoritative for your patching decision.

How the exposure works (defender's view)

An interpreter-level code execution flaw means attacker-controlled input reaching the PHP engine can be turned into native command/code execution. From a detection standpoint, the exploitation requirements matter more than the bug class:

Reachability: The target must expose a PHP endpoint to the attacker — any vhost, route, or script processed by the vulnerable interpreter counts, including /index.php, forgotten admin panels, staging vhosts, and API gateways that proxy to PHP-FPM.
Execution context: Successful exploitation executes as the web service user. On Arch that is typically http for the stock package, or per-pool users defined in /etc/php/php-fpm.d/*.conf.
Post-exploitation shape: Once the interpreter is coerced into running attacker code, the most common next observable is the PHP process (or its parent web server) spawning child processes — /bin/sh, bash, curl/wget to pull second-stage payloads, python/perl reverse shells, or direct writes to web-accessible directories (webshells in uploads/, /tmp, or the docroot).

That post-exploitation shape is your detection surface. You may not reliably see the exploit request itself, but a PHP-FPM worker spawning /bin/sh -c curl ... is loud, high-fidelity telemetry.

Exploitation status

At publication, the Arch advisory confirms the vulnerability class and affected versions; no in-the-wild exploitation or CISA KEV listing is noted in the summary. Treat unauthenticated interpreter RCE as pre-weaponization: assume scanning and exploit development are underway and compress your patch SLA accordingly. Verify your exposure now: any host answering HTTP/S with a vulnerable PHP build is in scope.

Detection & Response

The detections below target the highest-fidelity behaviors: web service accounts spawning shells or download tooling, webshell-style file drops in web roots, and vulnerable package versions still installed.

YAML

---
title: PHP-FPM or Web Server Spawning Shell or Download Tool
id: 3f9a1c47-2b8e-4d51-9c36-7e0a5f2b91d4
status: experimental
description: Detects PHP-FPM workers, Apache, or Nginx spawning command interpreters or file-download utilities — a hallmark of PHP remote code execution post-exploitation consistent with ASA-202610-1 abuse.
references:
  - https://linuxsecurity.com/advisories/archlinux/archlinux-202610-1-php-code-execution
  - https://attack.mitre.org/techniques/T1059/004/
  - https://attack.mitre.org/techniques/T1105/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1059.004
  - attack.command_and_control
  - attack.t1105
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/php-fpm'
      - '/php-fpm8.5'
      - '/httpd'
      - '/apache2'
      - '/nginx'
      - '/php-cgi'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/zsh'
      - '/curl'
      - '/wget'
      - '/python'
      - '/python3'
      - '/perl'
      - '/nc'
      - '/ncat'
      - '/socat'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate PHP applications invoking shell_exec/exec for media processing, backups, or git operations
  - Health-check scripts executed by PHP-FPM pool users
level: high
---
title: Webshell or Payload Dropped in Web-Accessible Directory by PHP Process
id: 8c2e5b13-4a7f-49d2-b861-3d6f9c0e52a7
status: experimental
description: Detects PHP-related processes writing executable scripts into web roots, upload directories, or /tmp — consistent with webshell deployment following exploitation of the PHP code execution flaw in ASA-202610-1.
references:
  - https://linuxsecurity.com/advisories/archlinux/archlinux-202610-1-php-code-execution
  - https://attack.mitre.org/techniques/T1505/003/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.persistence
  - attack.t1505.003
logsource:
  category: file_event
  product: linux
detection:
  selection_path:
    TargetFilename|contains:
      - '/srv/http/'
      - '/var/www/'
      - '/usr/share/webapps/'
      - '/uploads/'
      - '/tmp/'
      - '/dev/shm/'
  selection_ext:
    TargetFilename|endswith:
      - '.php'
      - '.phtml'
      - '.phar'
      - '.sh'
  selection_image:
    Image|endswith:
      - '/php-fpm'
      - '/php-cgi'
      - '/httpd'
      - '/apache2'
  condition: selection_path and selection_ext and selection_image
falsepositives:
  - Application deployments and CI/CD writes to docroots
  - CMS media/upload handling writing legitimate PHP templates
level: high
---
title: Outbound Connection from PHP-FPM Worker to Uncommon Destination
id: 5d1b8e62-7c3a-4f95-a2d4-9b6e1c8f03d9
status: experimental
description: Detects PHP-FPM or CGI processes initiating outbound network connections, which may indicate second-stage payload retrieval or reverse shell establishment after code execution via ASA-202610-1.
references:
  - https://linuxsecurity.com/advisories/archlinux/archlinux-202610-1-php-code-execution
  - https://attack.mitre.org/techniques/T1071/001/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.command_and_control
  - attack.t1071.001
logsource:
  category: network_connection
  product: linux
detection:
  selection:
    Image|endswith:
      - '/php-fpm'
      - '/php-cgi'
      - '/php'
    Initiated: 'true'
  filter_common:
    DestinationPort:
      - 443
      - 80
  condition: selection and not filter_common
falsepositives:
  - PHP applications making legitimate API calls on non-standard ports
level: medium

KQL — Microsoft Sentinel / Defender

// Hunt: PHP/web-server processes spawning shells or downloaders (Linux Syslog/CEF into Sentinel)
// Covers post-exploitation behavior for ASA-202610-1 (unauthenticated PHP RCE)
let lookback = 7d;
let web_parents = dynamic(["php-fpm", "php-cgi", "httpd", "apache2", "nginx"]);
let suspicious_children = dynamic(["sh", "bash", "dash", "zsh", "curl", "wget", "nc", "ncat", "socat", "perl"]);
Syslog
| where TimeGenerated > ago(lookback)
| where Facility == "user" or SyslogMessage has_any (web_parents)
| where SyslogMessage has_any (suspicious_children)
| extend ParentProc = extract(@"php-fpm|php-cgi|httpd|apache2|nginx", 0, SyslogMessage)
| where isnotempty(ParentProc)
| project TimeGenerated, Computer, ProcessName, SyslogMessage
| order by TimeGenerated desc;
// Companion hunt: outbound connections from PHP processes via CEF firewall/flow logs
CommonSecurityLog
| where TimeGenerated > ago(lookback)
| where DeviceAction in ("allowed", "permit", "accept")
| where DestinationPort !in (80, 443, 53)
| where SourceHostName has_any ("web", "php", "www") or Message has "php-fpm"
| summarize ConnectionCount = count(), Destinations = make_set(DestinationAddress) by SourceAddress, DestinationPort, bin(TimeGenerated, 1h)
| where ConnectionCount > 20
| order by ConnectionCount desc

VQL — Velociraptor

-- Artifact: Linux.Hunt.PHPExploitChildren (ASA-202610-1 post-exploitation hunt)
-- Enumerate PHP processes and their children, plus suspicious files in web roots.

-- 1) Running PHP processes and their command lines
SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Name =~ 'php|httpd|apache|nginx'

-- 2) Children spawned by web/PHP parents (shells, downloaders, interpreters)
LET web_pids = SELECT Pid FROM pslist()
               WHERE Name =~ 'php-fpm|php-cgi|httpd|apache2|nginx'
SELECT Pid, Ppid, Name, CommandLine, Username, CreateTime
FROM pslist()
WHERE Ppid in (SELECT Pid FROM web_pids)
  AND Name =~ 'sh|bash|dash|curl|wget|nc|ncat|socat|python|perl'

-- 3) Recently written script files in web roots and temp dirs (webshell triage)
SELECT FullPath, Size, Mtime, Ctime
FROM glob(globs=['/srv/http/**/*.php', '/var/www/**/*.php',
                 '/tmp/*.php', '/tmp/*.sh', '/dev/shm/*'])
WHERE Mtime > now() - 604800
ORDER BY Mtime DESC

Bash / Shell

#!/bin/bash
# ASA-202610-1 remediation & verification — Arch Linux PHP unauthenticated RCE
# Run as root on each Arch host/container image build.

set -euo pipefail

echo "[1] Current PHP package version:"
pacman -Q php 2>/dev/null || echo "php package not installed"

echo "[2] Syncing package databases and upgrading php to >= 8.5.12-1:"
pacman -Syu --noconfirm php

echo "[3] Verifying installed version meets the fixed baseline:"
INSTALLED=$(pacman -Q php | awk '{print $2}')
echo "Installed: $INSTALLED"
if vercmp "$INSTALLED" "8.5.12-1" < 0; then
  echo "FAIL: php $INSTALLED is still vulnerable (< 8.5.12-1). Investigate mirror sync."
  exit 1
fi
echo "PASS: php $INSTALLED >= 8.5.12-1"

echo "[4] Restarting services that hold the interpreter in memory:"
systemctl restart php-fpm 2>/dev/null || true
systemctl restart httpd 2>/dev/null || true   # Apache/mod_php
systemctl restart nginx 2>/dev/null || true   # if proxying to FPM, FPM restart is the critical one

echo "[5] Checking for long-lived PHP processes still running the old build:"
for pid in $(pgrep -f 'php-fpm|php-cgi'); do
  exe=$(readlink -f /proc/$pid/exe 2>/dev/null || true)
  echo "PID $pid -> $exe (deleted binaries indicate un-restarted old build)"
done
ls -l /proc/$(pgrep -f 'php-fpm' | head -1)/exe 2>/dev/null | grep -q '(deleted)' && \
  echo "WARNING: running interpreter is a deleted (pre-patch) binary — restart required" || true

echo "[6] Exposure sweep — listening web services on this host:"
ss -tlnp | grep -E ':(80|443|9000)\b' || echo "No web listeners found"

echo "[7] Triage: recently modified scripts in web roots (potential webshells):"
find /srv/http /var/www /usr/share/webapps -type f \( -name '*.php' -o -name '*.phtml' \) \
  -mtime -7 -printf '%T+ %p\n' 2>/dev/null | sort -r | head -50

echo "[8] Hardening check — disable dangerous functions in php.ini if not already:"
grep -E '^disable_functions' /etc/php/php.ini || \
  echo "RECOMMEND: disable_functions = exec,passthru,shell_exec,system,proc_open,popen"

Remediation

Patch immediately. Upgrade the php package to 8.5.12-1 or later on every Arch host, container base image, and build pipeline runner: pacman -Syu php. Verify with pacman -Q php and confirm the version string is at or above 8.5.12-1. Also check related packages (php-fpm is part of the base php package on Arch; confirm php-apache, php-cgi, and php-gd-style extensions are rebuilt against the fixed runtime where applicable).
Restart interpreter-bearing services. A package upgrade does not patch a running process. Restart php-fpm, Apache (mod_php), and any long-running php-cli daemons (queue workers, Laravel Horizon, cron-spawned daemons). Confirm no process maps a (deleted) php binary afterward.
Rebuild containers and images. Any Docker/OCI image based on archlinux or archlinux:base with PHP installed must be rebuilt and redeployed — patching a running container is not durable. Scan registries for stale images.
Reduce the attack surface while patching. If an immediate upgrade is impossible, temporarily restrict HTTP access to PHP endpoints at the WAF/reverse proxy (allowlist source IPs for admin panels, block direct access to upload directories, disable execution in uploads/ via php_admin_flag engine off or nginx location blocks), and set disable_functions = exec,passthru,shell_exec,system,proc_open,popen plus open_basedir scoping in php.ini. These are mitigation layers, not fixes.
Hunt before and after patching. Assume a vulnerable, internet-facing host may already be compromised: check web roots and /tmp//dev/shm for recently dropped scripts, review access logs for anomalous request patterns (unexpected POST bodies, requests to rarely-hit endpoints), and audit the web service account's process history and outbound connections.
Track the upstream mapping. Monitor the Arch security tracker (ASA-202610-1) and PHP.net security releases for the CVE assignment and any CISA KEV addition; if it lands in KEV, apply the associated federal remediation deadline to your SLA even if you are not a FCEB agency.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub

Arch Linux ASA-202610-1: Critical Unauthenticated PHP Code Execution — Patching, Detection, and Hardening Guide