CVE-2026-56290: Joomlack Page Builder RCE — Emergency Detection and Remediation

---
title: Potential Web Shell Creation via Web Server Process - Joomlack
id: 8a1b2c3d-4e5f-6789-0abc-def123456789
status: experimental
description: Detects web server processes creating suspicious files (e.g., .php, .jsp) in web directories, indicative of file upload exploits like CVE-2026-56290.
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
author: Security Arsenal
date: 2026/07/08
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  product: linux
  category: file_event
detection:
  selection:
    Image|endswith:
      - '/apache2'
      - '/httpd'
      - '/nginx'
    TargetFilename|contains:
      - '/var/www/html'
      - '/public_html'
      - '/joomla'
    TargetFilename|endswith:
      - '.php'
      - '.php5'
      - '.phtml'
  condition: selection
falsepositives:
  - Legitimate application updates or plugin installations via CMS admin interfaces
level: high
---
title: Web Server Spawning Shell Process - Webshell Execution
id: 9b2c3d4e-5f6a-7890-1bcd-ef234567890a
status: experimental
description: Detects web server processes spawning shell processes, a strong indicator of successful web shell execution often seen after CVE-2026-56290 exploitation.
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
author: Security Arsenal
date: 2026/07/08
tags:
  - attack.execution
  - attack.t1059.004
logsource:
  product: linux
  category: process_creation
detection:
  selection:
    ParentImage|endswith:
      - '/apache2'
      - '/httpd'
      - '/nginx'
    Image|endswith:
      - '/bash'
      - '/sh'
      - '/zsh'
      - '/perl'
      - '/python'
  condition: selection
falsepositives:
  - Authorized administrative shell scripts executed via web interface
level: critical

// Hunt for Joomlack Page Builder exploit patterns in Web Logs (CommonSecurityLog/Syslog)
// Look for POST requests to the vulnerable component endpoint followed by shell access
let StartDate = ago(7d);
CommonSecurityLog
| where TimeGenerated >= StartDate
| where DeviceProduct in ("Apache", "Linux", "nginx")
// Joomlack exploit often targets specific upload paths, adjust based on vendor advisory
| where RequestURL contains "joomlack" 
| where RequestMethod =~ "POST"
| extend FileExt = extract(@'\.([a-zA-Z0-9]+)$', 1, RequestURL)
| where FileExt in ("php", "jsp", "sh")
| project TimeGenerated, SourceIP, DestinationIP, RequestURL, RequestMethod, DeviceAction
| top 100 by TimeGenerated desc


// Hunt for web shell execution via Process Creation (Linux EDR)
DeviceProcessEvents
| where Timestamp > ago(3d)
| where InitiatingProcessFileName in ("apache2", "httpd", "nginx", "php-fpm")
| where FileName in ("sh", "bash", "perl", "python", "php")
| project Timestamp, DeviceName, AccountName, InitiatingProcessCommandLine, ProcessCommandLine, FileName
| order by Timestamp desc

// Hunt for recently modified PHP files in web roots (Potential Webshells)
SELECT FullPath, Size, Mtime, Mode
FROM glob(globs='/**/public_html/**/*.php')
WHERE Mtime > now() - 24h
   AND NOT FullPath =~ 'cache'
   AND NOT FullPath =~ 'vendor'
   AND NOT FullPath =~ 'tmp'

// Hunt for suspicious process parent-child relationships
SELECT Pid, Ppid, Name, Exe, CommandLine, Username
FROM pslist()
WHERE Pid IN (
   SELECT Pid FROM pslist() WHERE Name =~ '(apache|httpd|nginx)'
)
AND Name =~ '(sh|bash|perl|python|php)'

#!/bin/bash
# Emergency Triage and Hardening for CVE-2026-56290
# Run as root or with sudo privileges

echo "[*] Starting CVE-2026-56290 Triage and Remediation..."

# 1. Identify Joomlack Page Builder installations
echo "[+] Scanning for Joomlack Page Builder installations..."
WEB_ROOTS=("/var/www/html" "/home/*/public_html")

FOUND=0
for path in "${WEB_ROOTS[@]}"; do
  if find "$path" -type f -name "*.xml" -exec grep -l "Joomlack" {} \; 2>/dev/null; then
    FOUND=1
  fi
done

if [ $FOUND -eq 0 ]; then
  echo "[-] Joomlack Page Builder not found in standard locations."
else
  echo "[!] Joomlack Page Builder FOUND."
  echo "[!] ACTION REQUIRED: Apply the latest vendor patch immediately."
  echo "[!] If patch unavailable, disable the plugin by renaming the directory."
  echo "    Example: mv /path/to/components/com_joomlack /path/to/components/com_joomlack.DISABLED"
fi

# 2. Scan for recently uploaded web shells (last 48 hours)
echo "[+] Scanning for recently modified PHP/Script files (last 48h)..."
find /var/www/html -type f \( -name "*.php" -o -name "*.jsp" -o -name "*.sh" \) -mtime -2 -ls 2>/dev/null

# 3. Check for active web shell processes
echo "[+] Checking for active shells spawned by web servers..."
ps aux | grep -E '(apache|httpd|nginx)' | grep -E '(bash|sh|perl|python)' | grep -v grep

echo "[*] Triage complete. Review findings and apply vendor patches per CISA BOD 26-04."