CVE-2026-124079: rConfig Unauthenticated RCE via Laravel Horizon Deserialization — Detection and Remediation Guide

---
title: rConfig Laravel Horizon RCE - Web Server Process Spawning Shell
id: 9f3e1a82-5b7c-4d9e-a2f1-8c3d6e5b7a90
status: experimental
description: Detects suspicious child processes spawned by web server or PHP processes, consistent with post-exploitation activity from CVE-2026-124079.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-124079
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/02/10
tags:
  - attack.execution
  - attack.t1059.004
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/php'
      - '/php-fpm'
      - '/nginx'
      - '/apache2'
      - '/httpd'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/zsh'
      - '/python'
      - '/python3'
      - '/perl'
      - '/nc'
      - '/ncat'
      - '/netcat'
      - '/curl'
      - '/wget'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate web application functionality that shells out to system commands
  - Administrative scripts run via cron or manual execution
level: high
---
title: rConfig Redis Unauthenticated Access Attempt
id: 7b2c4d8e-1f6a-4e3b-9c5d-2a8e7f9b1c3d
status: experimental
description: Detects Redis connections from non-localhost sources, which may indicate an attacker attempting to push malicious jobs onto the Laravel Horizon queue.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-124079
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/02/10
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: network_connection
  product: linux
detection:
  selection:
    DestinationPort: 6379
  filter_localhost:
    SourceIp|contains:
      - '127.'
      - '::1'
      - 'localhost'
  condition: selection and not filter_localhost
falsepositives:
  - Legitimate distributed rConfig deployments where Redis is intentionally accessed from application servers
  - Monitoring or health-check systems
level: medium
---
title: rConfig Laravel Horizon Suspicious Job Processing
id: 3e8f1a5c-9d4b-4c2e-8f7a-6b1c9d3e5a7f
status: experimental
description: Detects Laravel Horizon or queue worker processes executing unusual or high-risk commands, consistent with deserialization exploitation.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-124079
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/02/10
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentCommandLine|contains:
      - 'horizon'
      - 'queue:work'
      - 'queue:listen'
  selection_child:
    CommandLine|contains:
      - 'tinker'
      - 'bash'
      - 'sh'
      - 'curl'
      - 'wget'
      - 'nc '
      - 'python'
      - 'base64'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate administrative tasks or maintenance scripts
level: high

// Hunt for web server processes spawning suspicious child processes
let suspicious_children = dynamic(["/bin/sh", "/bin/bash", "/bin/dash", "/usr/bin/python", "/usr/bin/python3", "/usr/bin/perl", "/usr/bin/nc", "/usr/bin/curl", "/usr/bin/wget"]);
let web_parents = dynamic(["php", "php-fpm", "nginx", "apache2", "httpd"]);
Syslog
| where TimeGenerated > ago(7d)
| where ProcessName in~ (web_parents)
| where SyslogMessage has_any (suspicious_children)
| project TimeGenerated, Computer, ProcessName, SyslogMessage, SourceIP
| order by TimeGenerated desc

// Alternative: Hunt for Redis connections from external sources
CommonSecurityLog
| where TimeGenerated > ago(7d)
| where DestinationPort == 6379
| where SourceIP !startswith "127." and SourceIP != "::1"
| where DeviceAction !in ("Allow", "Permit")  // Focus on blocked or suspicious
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Message
| order by TimeGenerated desc

// Hunt for Horizon worker processes executing suspicious commands
SecurityEvent
| where TimeGenerated > ago(7d)
| where EventID == 4688
| where ParentProcessName has_any ("horizon", "queue:work", "queue:listen")
| where NewProcessName has_any ("sh", "bash", "curl", "wget", "nc", "python", "tinker")
| project TimeGenerated, Computer, Account, ParentProcessName, NewProcessName, CommandLine
| order by TimeGenerated desc

-- Hunt for suspicious child processes of web server / PHP processes
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE (Name =~ 'php|nginx|apache|httpd' OR CommandLine =~ 'php|nginx|apache')
  AND (CommandLine =~ '/bin/(sh|bash|dash)|/usr/bin/(python|perl|nc|curl|wget)|nc |bash|sh')

-- Alternative: Check for active Redis connections from non-localhost
SELECT Pid, Name, CommandLine, Exe, Username
FROM netstat()
WHERE Raddr != '127.0.0.1' AND Raddr != '::1' AND Rport == 6379
  AND Status == 'ESTABLISHED'

#!/bin/bash
# CVE-2026-124079 Detection and Mitigation Script for rConfig
# Run as root or with sudo

echo "=== CVE-2026-124079 rConfig Vulnerability Assessment ==="

# Check rConfig version
if [ -d "/var/www/rconfig" ]; then
    RCONFIG_PATH="/var/www/rconfig"
elif [ -d "/opt/rconfig" ]; then
    RCONFIG_PATH="/opt/rconfig"
else
    echo "[!] rConfig installation not found in standard paths."
    exit 1
fi

if [ -f "$RCONFIG_PATH/composer.json" ]; then
    VERSION=$(grep -oP '"version":\s*"\K[^"]+' "$RCONFIG_PATH/composer.json" 2>/dev/null || echo "unknown")
    echo "[*] Detected rConfig version: $VERSION"
    
    # Parse version for comparison
    MAJOR=$(echo $VERSION | cut -d. -f1)
    MINOR=$(echo $VERSION | cut -d. -f2)
    PATCH=$(echo $VERSION | cut -d. -f3)
    
    VULNERABLE=0
    if [ "$MAJOR" -eq 8 ]; then
        if [ "$MINOR" -eq 0 ] && [ "$PATCH" -lt 19 ]; then
            VULNERABLE=1
        elif [ "$MINOR" -eq 2 ] && [ "$PATCH" -lt 19 ]; then
            VULNERABLE=1
        elif [ "$MINOR" -eq 4 ] && [ "$PATCH" -lt 1 ]; then
            VULNERABLE=1
        fi
    fi
    
    if [ $VULNERABLE -eq 1 ]; then
        echo "[!] VULNERABLE: This version is affected by CVE-2026-124079"
    else
        echo "[+] PATCHED: This version appears to be patched or not vulnerable"
    fi
else
    echo "[!] Could not determine rConfig version"
fi

# Check Redis exposure
echo ""
echo "=== Checking Redis Configuration ==="
if command -v redis-cli &> /dev/null; then
    # Check if Redis is listening on all interfaces
    REDIS_BIND=$(netstat -tlnp 2>/dev/null | grep :6379 | grep -oP '(?<=:6379\s).*' | awk '{print $1}' | head -1)
    if [[ "$REDIS_BIND" == "0.0.0.0" || "$REDIS_BIND" == "::" ]]; then
        echo "[!] WARNING: Redis is listening on all interfaces (0.0.0.0)"
        echo "[!] This allows unauthenticated remote access if no password is set"
    else
        echo "[+] Redis appears to be bound to localhost only"
    fi
    
    # Check for Redis authentication
    if redis-cli ping 2>/dev/null | grep -q PONG; then
        echo "[!] WARNING: Redis accepts unauthenticated connections"
    else
        echo "[+] Redis appears to require authentication"
    fi
else
    echo "[!] redis-cli not found. Cannot assess Redis configuration."
fi

# Check Laravel Horizon configuration
echo ""
echo "=== Checking Laravel Horizon Configuration ==="
HORIZON_CONFIG="$RCONFIG_PATH/config/horizon.php"
if [ -f "$HORIZON_CONFIG" ]; then
    if grep -q "'environments'" "$HORIZON_CONFIG"; then
        echo "[*] Horizon configuration found"
    fi
else
    echo "[!] Horizon config not found at expected path"
fi

# Temporary mitigation: Bind Redis to localhost and enable auth
echo ""
echo "=== Applying Temporary Mitigations ==="
echo "[!] The following mitigations will be applied:"
echo "    1. Bind Redis to localhost only"
echo "    2. Enable Redis authentication with a strong password"
echo "    3. Restart Redis and Horizon services"
read -p "Continue? (y/n) " -n 1 -r
echo
if [[ $REPLY =~ ^[Yy]$ ]]; then
    # Backup Redis config
    cp /etc/redis/redis.conf /etc/redis/redis.conf.bak.$(date +%Y%m%d%H%M%S) 2>/dev/null || echo "Could not backup redis.conf"
    
    # Bind to localhost
    sed -i 's/^bind .*/bind 127.0.0.1 ::1/' /etc/redis/redis.conf 2>/dev/null || echo "Could not modify bind directive"
    
    # Generate and set password
    REDIS_PASS=$(openssl rand -base64 32 2>/dev/null || head /dev/urandom | tr -dc A-Za-z0-9 | head -c 32)
    sed -i "s/^# requirepass .*/requirepass $REDIS_PASS/" /etc/redis/redis.conf 2>/dev/null || echo "Could not set requirepass"
    
    echo "[+] Redis password set to: $REDIS_PASS"
    echo "[!] UPDATE your rConfig .env file with: REDIS_PASSWORD=$REDIS_PASS"
    
    # Restart services
    systemctl restart redis 2>/dev/null || service redis restart 2>/dev/null || echo "Could not restart Redis"
    systemctl restart horizon 2>/dev/null || supervisorctl restart all 2>/dev/null || echo "Could not restart Horizon"
    
    echo "[+] Mitigations applied. Update .env and restart rConfig services."
else
    echo "Mitigation skipped."
fi

echo ""
echo "=== Next Steps ==="
echo "1. PATCH IMMEDIATELY: Upgrade to rConfig Core 8.2.19+ or rConfig Pro 8.4.1+"
echo "2. Review firewall rules to ensure Redis (6379/tcp) is not exposed to the network"
echo "3. Implement network segmentation to isolate rConfig servers"
echo "4. Monitor for suspicious processes and Redis connections using provided detection rules"
echo ""
echo "Vendor Advisory: https://www.rconfig.com/ (check for security updates)"