Drupal Critical RCE Patches Released — Detection, Hardening, and Remediation Guide for Defenders

---
title: Web Server Process Spawning Shell or Reconnaissance Tools
description: Detects Apache, nginx, or PHP-FPM worker processes spawning shells, network utilities, or reconnaissance commands — a hallmark of successful CMS RCE exploitation such as the critical Drupal flaws. Web server workers should essentially never spawn interactive shells or download tools.
references:
  - https://attack.mitre.org/techniques/T1190/
  - https://attack.mitre.org/techniques/T1059/
  - https://www.bleepingcomputer.com/news/security/drupal-patches-critical-rce-flaws-warns-exploits-may-emerge-soon/
author: Security Arsenal
date: 2026/01/15
status: experimental
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/apache2'
      - '/httpd'
      - '/php-fpm'
      - '/nginx'
      - '/php-cgi'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/curl'
      - '/wget'
      - '/nc'
      - '/ncat'
      - '/python'
      - '/python3'
      - '/perl'
      - '/id'
      - '/whoami'
  condition: selection_parent and selection_child
falsepositives:
  - Drupal cron or Drush maintenance tasks executed through the web context (rare; tune by parent process path)
  - Legitimate backup or cache-purge plugins invoking system utilities
level: high
---
title: Executable PHP File Created in Drupal Writable Directories
description: Detects creation of PHP files in Drupal upload and files directories, consistent with web shell deployment following exploitation of a Drupal RCE. The sites/default/files tree should never legitimately contain newly written PHP files.
references:
  - https://attack.mitre.org/techniques/T1505/003/
  - https://www.bleepingcomputer.com/news/security/drupal-patches-critical-rce-flaws-warns-exploits-may-emerge-soon/
author: Security Arsenal
date: 2026/01/15
status: experimental
logsource:
  category: file_event
  product: linux
detection:
  selection_path:
    TargetFilename|contains:
      - '/sites/default/files/'
      - '/files/php/'
      - '/tmp/'
      - '/var/tmp/'
  selection_ext:
    TargetFilename|endswith:
      - '.php'
      - '.phtml'
      - '.phar'
      - '.php5'
      - '.inc'
  condition: selection_path and selection_ext
falsepositives:
  - Deployment pipelines writing compiled templates — filter by CI/CD service account and deployment windows
level: high
---
title: Suspicious Serialized Payload in Drupal Form or AJAX Request
description: Detects HTTP requests to Drupal form, AJAX, or admin endpoints containing PHP serialized object markers, indicative of object injection or deserialization exploitation attempts against Drupal core.
references:
  - https://attack.mitre.org/techniques/T1190/
  - https://www.bleepingcomputer.com/news/security/drupal-patches-critical-rce-flaws-warns-exploits-may-emerge-soon/
author: Security Arsenal
date: 2026/01/15
status: experimental
logsource:
  category: webserver
detection:
  selection_uri:
    cs-uri|contains:
      - '/?q=system/ajax'
      - '/system/ajax'
      - '/ajax/'
      - '/user/password'
  selection_payload:
    cs-body|contains:
      - 'O:'
      - 'a:2:{'
      - 'form_build_id='
  condition: selection_uri and selection_payload
falsepositives:
  - Legitimate Drupal AJAX form submissions — baseline normal form_build_id traffic before enabling alerting; treat serialized-object markers (O:<int>) as high-fidelity
level: medium

// Hunt 1: Web server workers spawning shells or download tools (post-RCE behavior)
Syslog
| where TimeGenerated > ago(14d)
| where Facility =~ 'auth' or Facility =~ 'daemon' or SyslogMessage has_any ('apache2', 'php-fpm', 'httpd')
| extend Parsed = SyslogMessage
| where Parsed has_any ('/bin/sh', '/bin/bash', 'curl ', 'wget ', 'whoami', 'id;', 'nc -')
| where Parsed has_any ('apache', 'php-fpm', 'www-data')
| project TimeGenerated, Computer, ProcessName, SyslogMessage
| order by TimeGenerated desc;

// Hunt 2: Network connections from web server processes to rare external destinations
DeviceNetworkEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName in~ ('apache2', 'httpd', 'php-fpm', 'php-cgi', 'nginx')
| where RemotePort in (80, 443, 4444, 5555, 8080, 8443)
| where not(RemoteIP startswith '10.' or RemoteIP startswith '192.168.' or RemoteIP startswith '172.')
| summarize ConnectionCount = count(), DistinctDestinations = dcount(RemoteIP), Destinations = make_set(RemoteIP) by DeviceName, InitiatingProcessFileName
| where ConnectionCount > 50
| order by DistinctDestinations desc;

// Hunt 3: PHP files written to Drupal files directories (web shell staging)
CommonSecurityLog
| where TimeGenerated > ago(14d)
| where Message has_all ('sites/default/files', '.php')
| project TimeGenerated, SourceHostName, Message
| order by TimeGenerated desc

-- Hunt: Drupal post-exploitation sweep — web shells in files dirs and web-tier child processes
-- Targets artifacts consistent with exploitation of the critical Drupal RCE flaws
LET webroots <= SELECT FullPath FROM glob(globs=['/var/www/**/sites/default/files/*.php', '/var/www/**/sites/*/files/*.php', '/srv/www/**/sites/default/files/*.php'])
SELECT FullPath,
       Mtime,
       Ctime,
       Size,
       Mode
FROM webroots
WHERE Mtime > now() - (14 * 24 * 60 * 60)
ORDER BY Mtime DESC

-- Enumerate suspicious children of web server / PHP-FPM processes
SELECT Pid, PPid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Username =~ 'www-data|apache|nginx'
  AND CommandLine =~ '(?i)(/bin/(ba)?sh|curl|wget|nc |ncat|python|perl|whoami|base64)'

#!/bin/bash
# Drupal critical RCE — verification and triage script
# Run as root or with sudo on each Drupal web host

WEBROOT="/var/www/html"   # adjust to your Drupal document root
REPORT="/tmp/drupal_triage_$(date +%Y%m%d_%H%M).txt"

echo "=== Drupal RCE Triage Report: $(hostname) — $(date) ===" | tee "$REPORT"

# 1) Report installed Drupal core version (requires drush on PATH)
echo -e "\n[+] Drupal core version:" | tee -a "$REPORT"
if command -v drush &>/dev/null; then
  (cd "$WEBROOT" && sudo -u www-data drush status --field=drupal-version 2>/dev/null) | tee -a "$REPORT"
else
  grep -m1 "const VERSION" "$WEBROOT/core/lib/Drupal.php" 2>/dev/null | tee -a "$REPORT"
fi

# 2) PHP files in writable upload directories — prime web shell indicator
echo -e "\n[+] PHP files found under files/ directories (should be NONE):" | tee -a "$REPORT"
find "$WEBROOT" -path '*/files/*' \( -name '*.php' -o -name '*.phtml' -o -name '*.phar' -o -name '*.inc' \) -mtime -30 -ls 2>/dev/null | tee -a "$REPORT"

# 3) Recently modified files across the webroot (last 14 days)
echo -e "\n[+] Files modified in webroot within last 14 days:" | tee -a "$REPORT"
find "$WEBROOT" -type f -name '*.php' -mtime -14 2>/dev/null | tee -a "$REPORT"

# 4) PHP files containing classic web shell primitives
echo -e "\n[+] Files containing dangerous function combinations:" | tee -a "$REPORT"
grep -rlE "(eval\s*\(|base64_decode\s*\(|shell_exec\s*\(|passthru\s*\(|assert\s*\()" "$WEBROOT" --include='*.php' 2>/dev/null | head -50 | tee -a "$REPORT"

# 5) Check .htaccess protections exist for files directories
echo -e "\n[+] Verifying .htaccess PHP execution blocks in files dirs:" | tee -a "$REPORT"
for d in $(find "$WEBROOT" -type d -name 'files' 2>/dev/null); do
  if grep -qi 'SetHandler Drupal_Security_Do_Not_Remove' "$d/.htaccess" 2>/dev/null; then
    echo "OK: $d/.htaccess blocks PHP execution" | tee -a "$REPORT"
  else
    echo "WARNING: $d/.htaccess missing or weakened — PHP may execute here!" | tee -a "$REPORT"
  fi
done

# 6) List web server child processes running right now
echo -e "\n[+] Current child processes of web server workers:" | tee -a "$REPORT"
ps --ppid $(pgrep -d, -f 'apache2|httpd|php-fpm' 2>/dev/null) -o pid,ppid,user,cmd 2>/dev/null | tee -a "$REPORT"

echo -e "\n=== Triage complete. Investigate any findings BEFORE patching; preserve evidence if compromise is suspected. ===" | tee -a "$REPORT"