Fedora 43 DokuWiki Object Injection RCE: Detection and Remediation Guide (Advisory 2026-046b69d591)

---
title: Web Server Process Spawning Shell or Command Interpreter (Linux)
id: 3f7a2b91-4c5e-4d8a-b6f2-9a1c3e5d7f90
status: experimental
description: Detects httpd, nginx, or php-fpm spawning a shell or command interpreter, consistent with post-exploitation of a web application RCE such as the DokuWiki object injection flaw (Fedora advisory 2026-046b69d591).
references:
  - https://linuxsecurity.com/advisories/fedora/fedora-43-dokuwiki-2026-046b69d591
  - https://github.com/dokuwiki/dokuwiki/issues/4752
  - https://attack.mitre.org/techniques/T1059/004/
author: Security Arsenal
date: 2026/02/12
tags:
  - attack.execution
  - attack.t1059.004
  - attack.t1190
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/httpd'
      - '/nginx'
      - '/php-fpm'
      - '/php-fpm8.3'
      - '/php-cgi'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/zsh'
      - '/curl'
      - '/wget'
      - '/python'
      - '/python3'
      - '/perl'
      - '/nc'
      - '/ncat'
      - '/base64'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate wiki plugins invoking system utilities (e.g., PDF renderers, mailers) - tune per environment baseline
level: high
---
title: Web Shell Written to DokuWiki Data Directory
id: 8c1e4d62-7b3a-4f95-a2c8-1e6b9d0f4a27
status: experimental
description: Detects PHP files created in DokuWiki data or media directories, which should contain content files rather than executable code - a strong indicator of web shell deployment following RCE exploitation.
references:
  - https://linuxsecurity.com/advisories/fedora/fedora-43-dokuwiki-2026-046b69d591
  - https://attack.mitre.org/techniques/T1505/003/
author: Security Arsenal
date: 2026/02/12
tags:
  - attack.persistence
  - attack.t1505.003
logsource:
  category: file_event
  product: linux
detection:
  selection_path:
    TargetFilename|contains:
      - '/dokuwiki/data/'
      - '/dokuwiki/lib/plugins/'
      - '/var/lib/dokuwiki/data/'
  selection_ext:
    TargetFilename|endswith:
      - '.php'
      - '.phtml'
      - '.phar'
  condition: selection_path and selection_ext
falsepositives:
  - Plugin installation or updates by an administrator through the DokuWiki extension manager
level: high
---
title: PHP unserialize Gadget Chain Artifact in Web Access Log
id: 5b9f0e73-2a6d-4c81-b3e4-7d2a8c1f6e39
status: experimental
description: Detects serialized PHP object payloads (O: and a: serialized structure markers) in web server access log URIs, a hallmark of PHP object injection probing and exploitation attempts against applications like DokuWiki.
references:
  - https://linuxsecurity.com/advisories/fedora/fedora-43-dokuwiki-2026-046b69d591
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/02/12
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: webserver
detection:
  selection:
    c-uri|contains:
      - 'O%3A'
      - '%3AO%3A'
      - 'O:+'
      - 'a%3A2%3A%7B'
      - '__wakeup'
      - '__destruct'
  condition: selection
falsepositives:
  - Rare; serialized data in URLs is not typical of legitimate DokuWiki traffic
level: high

// Hunt 1: Serialized PHP object injection patterns in web requests (Syslog/CEF ingestion of httpd/nginx logs)
Syslog
| where TimeGenerated > ago(7d)
| where ProcessName has_any ("httpd", "apache2", "nginx")
| where SyslogMessage has_any ("O%3A", "%3AO%3A", "O:+", "a%3A2%3A%7B", "__wakeup", "__destruct", "unserialize")
| extend RequestUri = extract(@'"(?:GET|POST|PUT)\s+([^\s]+)', 1, SyslogMessage)
| where isnotempty(RequestUri)
| summarize RequestCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by RequestUri, SourceIP = Computer, HostIP
| order by RequestCount desc;

// Hunt 2: Web server or PHP-FPM spawning shells/interpreters (Defender for Endpoint on Linux)
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName has_any ("httpd", "nginx", "php-fpm", "php-cgi")
| where FileName has_any ("sh", "bash", "dash", "curl", "wget", "python", "python3", "perl", "nc", "ncat", "base64")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, AccountName, InitiatingProcessCommandLine
| order by TimeGenerated desc;

// Hunt 3: Outbound connections from the web server process to unusual destinations
DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName has_any ("httpd", "nginx", "php-fpm")
| where RemoteIPType == "Public"
| summarize ConnectionCount = count(), RemoteIPs = make_set(RemoteIP, 20) by DeviceName, InitiatingProcessFileName, RemotePort
| where ConnectionCount > 50 or array_length(RemoteIPs) > 10
| order by ConnectionCount desc

-- DokuWiki post-exploitation hunt: web shells in data dirs and suspicious child processes
-- Fedora advisory 2026-046b69d591 (object injection RCE)

-- Part A: PHP files inside DokuWiki data/media directories (should be content-only)
LET shell_files = SELECT FullPath, Size, Mtime, Ctime
FROM glob(globs=['/var/www/html/dokuwiki/data/**/*.php',
                 '/var/www/html/dokuwiki/lib/plugins/**/*.php',
                 '/var/lib/dokuwiki/data/**/*.php',
                 '/usr/share/dokuwiki/data/**/*.php'])
WHERE Mtime > now() - 1209600

-- Part B: Shells/interpreters parented to web server processes
LET suspicious_procs = SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ 'sh |bash|curl |wget |python|nc |ncat|base64'
  AND Username =~ 'apache|nginx|www-data'

SELECT * FROM shell_files
UNION ALL
SELECT * FROM suspicious_procs

#!/usr/bin/env bash
# DokuWiki object injection remediation & verification - Fedora 43
# Advisory: 2026-046b69d591 | Upstream: dokuwiki/dokuwiki#4752
set -euo pipefail

echo "=== [1] Checking installed DokuWiki package ==="
if rpm -q dokuwiki &>/dev/null; then
    rpm -q dokuwiki
    echo "--> Package found. Applying patched update from Fedora advisory 2026-046b69d591..."
    sudo dnf update -y --advisory=FEDORA-2026-046b69d591 dokuwiki || \
      sudo dnf update -y dokuwiki
    echo "--> Post-update version:"
    rpm -q dokuwiki
else
    echo "--> No RPM-managed DokuWiki found. Checking for manual/source installs..."
    sudo find /var/www /srv/www /usr/share -maxdepth 3 -iname "doku.php" 2>/dev/null || true
    echo "--> If a source install exists, pull the fixed upstream commit referenced in"
    echo "    https://github.com/dokuwiki/dokuwiki/issues/4752 and redeploy."
fi

echo "=== [2] Auditing for object injection probing in access logs (last 30 days) ==="
for log in /var/log/httpd/access_log* /var/log/nginx/access.log*; do
    [ -f "$log" ] || continue
    hits=$(zgrep -hE 'O%3A|O:|a%3A[0-9]+%3A%7B|__wakeup|__destruct' "$log" 2>/dev/null | wc -l || true)
    [ "$hits" -gt 0 ] && echo "!! $log: $hits suspicious serialized-payload requests - INVESTIGATE"
done

echo "=== [3] Hunting for web shells in DokuWiki writable directories ==="
sudo find /var/lib/dokuwiki/data /usr/share/dokuwiki/data /var/www/html/dokuwiki/data \
    -type f \( -name '*.php' -o -name '*.phtml' -o -name '*.phar' \) \
    -mtime -30 -ls 2>/dev/null || echo "--> No recent PHP files in data directories."

echo "=== [4] Checking for web-server-spawned shells (current state) ==="
sudo ps -eo pid,ppid,user,comm,args | awk '$3=="apache"||$3=="nginx"||$3=="www-data"' | \
    grep -E 'bash|sh |curl|wget|python|perl|nc ' || echo "--> No suspicious web-server children."

echo "=== [5] Hardening: block PHP execution in DokuWiki data directory ==="
echo "    Apache (add to .htaccess or vhost for the data/ path):"
echo "      <Directory /var/lib/dokuwiki/data>"
echo "        php_flag engine off"
echo "        Require all denied"
echo "      </Directory>"
echo "    Nginx:"
echo "      location ~ /dokuwiki/data/.*\.php { deny all; }"

echo "=== Done. If steps 2-4 produced findings, isolate the host and begin IR. ==="