CVE-2026-85097: Critical Bricksforge WordPress Plugin Flaw (CVSS 10.0) Under Active Exploitation — Detection and Remediation Guide

---
title: PHP File Written to WordPress Uploads Directory
id: 1c9a4f27-8b3e-4d5a-9f12-7e6c0a1b2d34
status: experimental
description: Detects creation of PHP files in WordPress uploads directories, a hallmark of webshell deployment via arbitrary file upload flaws such as CVE-2026-85097 (Bricksforge).
references:
  - https://thehackernews.com/2026/10/attackers-exploit-cvss-100-bricksforge.html
  - https://attack.mitre.org/techniques/T1505/003/
author: Security Arsenal
date: 2026/10/09
tags:
  - attack.persistence
  - attack.t1505.003
logsource:
  product: linux
  service: auditd
detection:
  selection_path:
    - '/wp-content/uploads/'
  selection_ext:
    - '.php'
    - '.phtml'
    - '.phar'
    - '.php5'
    - '.php7'
  condition: selection_path and selection_ext
falsepositives:
  - Rare legitimate plugin operations that cache compiled templates in uploads (verify against known plugin behavior)
level: critical
---
title: Web Server Process Spawning Shell or Command Tools
id: 4e7d2b91-6f38-4c1a-b824-9d3f5e6a7c08
status: experimental
description: Detects PHP-FPM, Apache, or Nginx worker processes spawning interactive shells or command execution tools, consistent with post-exploitation activity following webshell deployment via CVE-2026-85097.
references:
  - https://thehackernews.com/2026/10/attackers-exploit-cvss-100-bricksforge.html
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/10/09
tags:
  - attack.execution
  - attack.t1059.004
  - attack.t1505.003
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/php-fpm'
      - '/php-fpm8.1'
      - '/php-fpm8.2'
      - '/php-fpm8.3'
      - '/apache2'
      - '/httpd'
      - '/nginx'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/zsh'
      - '/curl'
      - '/wget'
      - '/nc'
      - '/ncat'
      - '/python'
      - '/python3'
      - '/perl'
      - '/base64'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate WordPress plugins invoking system commands (image processing, backups) — baseline your environment and allowlist known plugin wrappers
level: high
---
title: Suspicious Unauthenticated Requests to Bricksforge Plugin Endpoints
id: 8a2c6e14-3d91-4b7f-a653-1f9e2c5b8d46
status: experimental
description: Detects inbound HTTP requests directly targeting Bricksforge plugin paths or WordPress AJAX handlers with upload-like parameters, indicative of exploitation attempts against CVE-2026-85097.
references:
  - https://thehackernews.com/2026/10/attackers-exploit-cvss-100-bricksforge.html
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/10/09
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: webserver
detection:
  selection_uri:
    cs-uri|contains:
      - '/wp-content/plugins/bricksforge/'
      - 'admin-ajax.php'
      - '/wp-json/bricksforge'
  selection_method:
    cs-method: 'POST'
  filter_known:
    cs-referer|contains:
      - '/wp-admin/'
  condition: selection_uri and selection_method and not filter_known
falsepositives:
  - Legitimate front-end AJAX actions from the plugin; tune by correlating with file creation events and uploaded content-type headers
level: high

// Hunt for webshell placement and web server command execution following
// CVE-2026-85097 exploitation. Assumes Syslog/CEF ingestion from web hosts
// and/or Defender for Endpoint on Linux servers into Sentinel.

// 1) PHP files created under WordPress uploads directories (Syslog file events / auditd)
Syslog
| where TimeGenerated > ago(14d)
| where SyslogMessage has_all ("wp-content/uploads", ".php")
| project TimeGenerated, Computer, ProcessName, SyslogMessage
| order by TimeGenerated desc;

// 2) Web server processes spawning shells or downloaders (Defender for Endpoint on Linux)
DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName in~ ("php-fpm", "apache2", "httpd", "nginx", "php-fpm8.2", "php-fpm8.3")
| where FileName in~ ("sh", "bash", "dash", "curl", "wget", "nc", "ncat", "python3", "perl", "base64")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, AccountName
| order by TimeGenerated desc;

// 3) Inbound POST requests to Bricksforge plugin paths (WAF/IIS/nginx logs via CEF)
CommonSecurityLog
| where TimeGenerated > ago(14d)
| where RequestMethod == "POST"
| where RequestURL has_any ("bricksforge", "admin-ajax.php")
| summarize RequestCount = count(), DistinctSources = dcount(SourceIP) by RequestURL, DestinationHostName, bin(TimeGenerated, 1h)
| where RequestCount > 50
| order by RequestCount desc

-- Hunt for webshells and post-exploitation artifacts on WordPress hosts
-- suspected of CVE-2026-85097 compromise.

-- 1) Recently created PHP files in uploads directories (last 30 days)
SELECT FullPath, Size, Mtime, Ctime
FROM glob(globs='/var/www/**/wp-content/uploads/**/*.php')
WHERE Mtime > now() - (30 * 24 * 3600)
ORDER BY Mtime DESC

-- 2) Web server user processes running shells or network tools
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Username =~ 'www-data|apache|nginx'
  AND CommandLine =~ 'bash|/bin/sh|curl |wget |nc |python|perl |base64'

-- 3) Established outbound connections from web server processes (C2 or payload fetch)
SELECT Pid, Name, Status, Family, LocalAddr, LocalPort, RemoteAddr, RemotePort
FROM netstat()
WHERE Status =~ 'ESTAB'
  AND Name =~ 'php-fpm|apache2|httpd|nginx|bash|sh$|curl|wget'
  AND RemoteAddr !~ '^(10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.|127\.)'

#!/bin/bash
# CVE-2026-85097 — Bricksforge verify/harden script for Linux WordPress hosts
# Run as root or with sudo on each affected host.

WP_ROOT="/var/www/html"   # adjust per site; loop if multi-site hosting

# 1) Check Bricksforge version and deactivate if unpatched
sudo -u www-data wp plugin list --path="$WP_ROOT" --format=table | grep -i bricksforge
# If the installed version predates the patched release from the Patchstack advisory:
# sudo -u www-data wp plugin update bricksforge --path="$WP_ROOT"
# Emergency only, if no patch is available:
# sudo -u www-data wp plugin deactivate bricksforge --path="$WP_ROOT"

# 2) Hunt for PHP files dropped into uploads (webshell indicator)
find "$WP_ROOT/wp-content/uploads" -type f \( -name "*.php" -o -name "*.phtml" -o -name "*.phar" \) \
  -mtime -30 -printf '%T@ %Tc %p\n' | sort -nr

# 3) Grep access logs for suspicious POSTs to plugin endpoints
grep -hE 'POST .*(bricksforge|admin-ajax\.php)' /var/log/nginx/access.log* /var/log/apache2/access.log* 2>/dev/null \
  | awk '{print $1}' | sort | uniq -c | sort -nr | head -20

# 4) Harden: deny PHP execution in uploads (nginx)
cat > /etc/nginx/conf.d/wp-uploads-hardening.conf <<'EOF'
location ~* /wp-content/uploads/.*\.php$ {
    deny all;
    return 403;
}
EOF
nginx -t && systemctl reload nginx

# 4-alt) Harden for Apache: drop this into wp-content/uploads/.htaccess
cat > "$WP_ROOT/wp-content/uploads/.htaccess" <<'EOF'
<FilesMatch "\.(php|phtml|phar|php5|php7)$">
    Require all denied
</FilesMatch>
EOF

# 5) Audit admin users and recently modified core files
sudo -u www-data wp user list --role=administrator --path="$WP_ROOT"
find "$WP_ROOT" -maxdepth 2 -name "*.php" -mtime -14 -printf '%Tc %p\n' | sort -r | head -40