CVE-2026-115560: PHP Critical RCE Mitigation and Detection Guide

Introduction

The PHP Group has published urgent mitigation advice for CVE-2026-115560, a critical code execution vulnerability impacting the PHP interpreter. While the vulnerability carries a 'Critical' rating due to the potential for remote code execution (RCE), the vendor's advisory clarifies that specific, limited security conditions must be met for the flaw to be exploitable.

For defenders, this creates a complex triage scenario: the vulnerability is severe enough to warrant immediate attention, but the preconditions mean not all assets are equally exposed. In this guide, we break down the attack mechanics, identify exactly which configurations are at risk, and provide actionable detection and remediation strategies.

Technical Analysis

Affected Products and Configurations

The vulnerability resides in the core PHP engine, affecting multiple active release branches. According to the PHP Group, the flaw is a type confusion or memory corruption bug (specifics depend on the exact patch diff, but RCE classification implies memory safety issues) that can be triggered under specific request handling conditions.

Affected Versions:

• PHP 8.1.x prior to 8.1.35
• PHP 8.2.x prior to 8.2.23
• PHP 8.3.x prior to 8.3.12
• PHP 8.4.x prior to 8.4.1

The "Limited Security Issue" Context: The PHP advisory notes that exploitation requires a non-default configuration where user input is passed directly to specific vulnerable functions without proper sanitization, or where a specific SAPI (Server API) configuration is active. Most standard LAMP/LEMP stacks using PHP-FPM with default php.ini settings are likely not directly exploitable via standard HTTP requests. However, custom applications or legacy scripts that disable certain security checks or handle raw input streams are at high risk.

Exploitation Mechanics

From a defender's perspective, the attack chain would likely involve:

1. Delivery: An attacker sends a specially crafted HTTP request containing malicious payloads (likely in POST data or specific headers) to a PHP script that processes this input.
2. Trigger: The vulnerable PHP function processes the input, leading to memory corruption or type confusion.
3. Execution: The attacker achieves arbitrary code execution within the context of the PHP process (typically the web server user, e.g., www-data or apache).

Exploitation Status

As of the publication date (April 2026), there is no confirmed widespread in-the-wild exploitation, nor has this CVE been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. However, given the prevalence of PHP in the enterprise (powering a significant portion of the web), public proof-of-concept (PoC) code is expected to surface rapidly. Threat actors frequently weaponize PHP RCEs for web shell deployment and ransomware staging.

Detection & Response

Detecting exploitation of CVE-2026-115560 requires monitoring for abnormal child processes spawned by the web server or PHP-FPM master processes, as well as unexpected network connections originating from the web tier.

SIGMA Rules

---
title: PHP Web Server Spawning Suspicious Shell
id: 8f1c2e3a-4b5c-4d6e-9f0a-1b2c3d4e5f6g
status: experimental
description: Detects web server or PHP processes spawning shell commands, indicative of RCE exploitation via CVE-2026-115560.
references:
  - https://www.infosecurity-magazine.com/news/php-publishes-mitigation-advice/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1059.004
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/php-fpm'
      - '/httpd'
      - '/apache2'
      - '/nginx'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/zsh'
      - '/ksh'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate system administration scripts executed via cron or maintenance pages.
  - CMS plugins that invoke system commands (rare, usually risky behavior).
level: high
---
title: PHP Process Initiating Outbound Network Connection
id: 2b3c4d5e-6f7g-8h9i-0j1k-2l3m4n5o6p7q
status: experimental
description: Detects PHP or web server processes initiating unexpected outbound network connections, potentially indicating C2 communication or data exfiltration.
references:
  - https://www.infosecurity-magazine.com/news/php-publishes-mitigation-advice/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.command_and_control
  - attack.t1071.001
logsource:
  category: network_connection
  product: linux
detection:
  selection:
    Image|endswith:
      - '/php'
      - '/php-fpm'
      - '/httpd'
      - '/apache2'
      - '/nginx'
    DestinationPort:
      - 4444
      - 5555
      - 8080
      - 6667
      - 53
  condition: selection
falsepositives:
  - Legitimate API calls to external services on non-standard ports.
  - DNS resolution (port 53) from the server itself (usually handled by systemd-resolved, not PHP directly).
level: medium

KQL (Microsoft Sentinel / Defender)

This query hunts for Linux audit logs (ingested via Syslog or AMA) where a web server process spawns a shell. It assumes you are collecting SYSCALL or EXECVE events via Auditd or similar.

// Hunt for web server processes spawning shells (CVE-2026-115560 exploitation attempt)
Syslog
| where Facility == "user" or SyslogMessage contains "EXECVE"
| where SyslogMessage contains "php-fpm" or SyslogMessage contains "apache2" or SyslogMessage contains "httpd"
| where SyslogMessage has_any ("/bin/sh", "/bin/bash", "/bin/dash")
| project TimeGenerated, HostIP, ProcessName, SyslogMessage
| order by TimeGenerated desc

Velociraptor VQL

Use this artifact to hunt across your Linux fleet for suspicious parent-child process relationships involving PHP and shells.

-- Hunt for suspicious child processes spawned by PHP/Web Servers
SELECT Pid, Ppid, Name, Exe, Cmdline, Username, CreateTime
FROM pslist()
WHERE (Ppid IN (SELECT Pid FROM pslist() WHERE Name =~ 'php|httpd|apache|nginx'))
AND (Name =~ 'sh|bash|dash|zsh')

Remediation Script

Use this Bash script to inventory your PHP versions and apply patches on Debian/Ubuntu and RHEL/CentOS systems. This script checks the installed version and updates to the latest available patched release.

#!/bin/bash

# CVE-2026-115560 Remediation Script
# Checks PHP version and updates if necessary

echo "[+] Checking PHP version..."
PHP_VERSION=$(php -v | head -n 1 | awk '{print $2}')
echo "Current PHP Version: $PHP_VERSION"

# Define vulnerable version ranges (simplified logic)
# 8.1.x < 8.1.35, 8.2.x < 8.2.23, 8.3.x < 8.3.12, 8.4.x < 8.4.1
VULNERABLE=false

# Simple check for demonstration - refine regex for production use
if [[ "$PHP_VERSION" == 8.1.* ]] || [[ "$PHP_VERSION" == 8.2.* ]] || [[ "$PHP_VERSION" == 8.3.* ]] || [[ "$PHP_VERSION" == 8.4.* ]]; then
    echo "[!] Potentially vulnerable version detected."
    VULNERABLE=true
fi

if [ "$VULNERABLE" = true ]; then
    echo "[+] Attempting to update PHP..."
    
    # Detect OS
    if [ -f /etc/debian_version ]; then
        # Debian/Ubuntu
        apt-get update
        apt-get install -y php-cli php-fpm php-common
    elif [ -f /etc/redhat-release ]; then
        # RHEL/CentOS/Alma/Rocky
        dnf update -y php php-cli php-fpm php-common
    else
        echo "[-] Unsupported OS. Please update manually."
        exit 1
    fi
    
    echo "[+] Update complete. Restarting services..."
    systemctl restart php*-fpm 2>/dev/null
    systemctl restart apache2 2>/dev/null || systemctl restart httpd 2>/dev/null
    echo "[+] Services restarted."
else
    echo "[+] PHP version appears to be safe or not managed by this script."
fi

# Verification
echo "[+] Verifying new version..."
php -v

Remediation

The PHP Group has released patched versions for all supported branches. Immediate action is required for systems running custom applications or exposed to untrusted input.

1. Patch Immediately Upgrade to the following minimum versions:

• PHP 8.1: Upgrade to 8.1.35 or later.
• PHP 8.2: Upgrade to 8.2.23 or later.
• PHP 8.3: Upgrade to 8.3.12 or later.
• PHP 8.4: Upgrade to 8.4.1 or later.

2. Review Configurations Since the vendor indicates "limited security issue conditions," review your php.ini and application code for:

• Disabled Functions: Ensure disable_functions includes dangerous functions like exec, system, shell_exec, passthru, and proc_open if not strictly required by the application.
• Input Handling: Audit code that processes raw HTTP input or unserializes user data. Ensure strict type checking and input validation.

3. Web Application Firewall (WAF) Deploy WAF rules to block common RCE payloads. Look for patterns associated with PHP object injection, command injection, or memory corruption triggers in POST bodies and URL parameters. While a WAF is not a substitute for patching, it provides a virtual patch while you test updates.

4. Isolation Ensure your PHP-FPM or Apache/Nginx workers run with the least privilege necessary. Use distinct users for different vhosts or applications to contain the blast radius if one site is compromised.

Official Advisory: Refer to the PHP Group Official Security Advisories and the Infosecurity Magazine report for the full technical details.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub