Canonical has released Ubuntu Security Notice USN-9055-1, addressing a serious vulnerability in the php-pecl-http extension — the PECL HTTP module that provides HTTP request/response handling for PHP applications. According to the advisory, this vulnerability could allow a remote, unauthenticated attacker to crash the extension (denial of service) or execute arbitrary code on affected systems simply by sending specially crafted network traffic.
This is the kind of vulnerability that should be at the top of every patch queue this week. PHP remains one of the most widely deployed server-side languages on the internet, and any RCE in a commonly loaded extension like pecl_http presents a direct path to full server compromise. If your organization runs PHP applications on Ubuntu that rely on this extension — whether for internal APIs, customer-facing web services, or microservice communication — you are in scope.
Technical Analysis
Affected Products and Platforms
The vulnerability affects the php-pecl-http package across multiple Ubuntu Long-Term Support (LTS) releases. This package provides the pecl_http PHP extension, which exposes HTTP client and server functionality through PHP. Organizations running any of the following with php-pecl-http installed are affected:
- Ubuntu 16.04 LTS (including ESM)
- Ubuntu 18.04 LTS (including ESM)
- Ubuntu 20.04 LTS
- Ubuntu 22.04 LTS
- Ubuntu 24.04 LTS
The pecl_http extension is frequently loaded by applications that need to make outbound HTTP requests, process webhooks, proxy API calls, or handle multipart form data parsing. It is not a default PHP extension — it must be explicitly installed — but it is common in modern PHP frameworks and microservice architectures.
Vulnerability Details
The Ubuntu advisory describes the vulnerability with the following language: "pecl_http could be made to crash or run programs if it received specially crafted network traffic." This indicates a memory corruption or input validation flaw in how the extension parses or handles incoming network data. In practical terms, an attacker who can send malicious HTTP traffic to a PHP application using the pecl_http extension may be able to:
- Crash the PHP process, resulting in denial of service against the web application.
- Execute arbitrary code with the privileges of the PHP interpreter (typically
www-data,nginx, orapacheuser on Ubuntu systems).
The vulnerability is triggered by network traffic — no authentication, no user interaction, and no valid credentials are required. This makes it a pre-authentication remote code execution vector, the most dangerous class of web application vulnerability.
Because no specific CVE identifier was disclosed in the advisory summary at the time of writing, defenders should monitor the official Ubuntu advisory and Canonical's security tracker for CVE assignment and CVSS scoring updates.
Exploitation Status
At the time of this writing, there is no confirmed public proof-of-concept exploit, no known active exploitation in the wild, and this vulnerability has not been added to CISA's Known Exploited Vulnerabilities (KEV) catalog. However, given the nature of the flaw — pre-authentication RCE triggered by network traffic — the window between patch release and active exploitation attempts is typically short. History has shown that PHP extension vulnerabilities attract rapid attention from threat actors scanning for exposed instances.
Why This Matters
PHP powers an enormous share of the web. When a vulnerability in a PHP extension allows unauthenticated remote code execution, the attack surface is massive. The pecl_http extension is not obscure — it is used in frameworks and applications that handle HTTP request parsing, REST API clients, webhook receivers, and proxy functionality. An attacker who gains code execution through this vector can pivot to lateral movement, deploy web shells, exfiltrate data, or use the compromised server as a staging point for further attacks.
Detection & Response
Given that this vulnerability is triggered by specially crafted network traffic targeting PHP processes, detection should focus on three key areas: (1) identifying systems with the vulnerable package installed, (2) detecting anomalous behavior from PHP processes that may indicate successful exploitation, and (3) monitoring for post-exploitation activity such as web shell deployment or unexpected process spawning.
SIGMA Rules
The following rules target observable behaviors associated with exploitation of this vulnerability — specifically, PHP processes spawning unexpected child processes (a common indicator of successful RCE) and web server processes writing executable files to web-accessible directories.
---
title: PHP Process Spawning Unexpected Child Process
id: 8f2a1b3c-4d5e-6f7a-8b9c-0d1e2f3a4b5c
status: experimental
description: Detects PHP interpreter or PHP-FPM worker processes spawning command shells or other unexpected child processes, which may indicate successful remote code execution through a PHP extension vulnerability such as the pecl_http flaw addressed in USN-9055-1.
references:
- https://linuxsecurity.com/advisories/ubuntu/ubuntu-9055-1-pecl-http
- https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/04/05
tags:
- attack.execution
- attack.t1059
- attack.initial_access
- attack.t1190
logsource:
category: process_creation
product: linux
detection:
selection_parent:
ParentImage|endswith:
- '/php'
- '/php-fpm'
- '/php7.4'
- '/php8.0'
- '/php8.1'
- '/php8.2'
- '/php8.3'
- '/php-cgi'
- '/php-cli'
selection_child:
Image|endswith:
- '/bash'
- '/sh'
- '/dash'
- '/zsh'
- '/python'
- '/python2'
- '/python3'
- '/perl'
- '/curl'
- '/wget'
- '/nc'
- '/ncat'
- '/netcat'
- '/nmap'
- '/base64'
- '/id'
- '/whoami'
- '/uname'
- '/cat'
- '/chmod'
- '/chown'
condition: selection_parent and selection_child
falsepositives:
- PHP applications that legitimately invoke system commands for image processing, PDF generation, or email sending
- Composer or artisan commands that shell out during deployment
level: high
---
title: Web Server Writing Executable to Web Directory
id: 2c3d4e5f-6a7b-8c9d-0e1f-2a3b4c5d6e7f
status: experimental
description: Detects PHP or web server processes writing executable files (.php, .sh, .elf) to web-accessible directories, which may indicate web shell deployment following exploitation of a PHP extension vulnerability.
references:
- https://linuxsecurity.com/advisories/ubuntu/ubuntu-9055-1-pecl-http
- https://attack.mitre.org/techniques/T1505/003/
author: Security Arsenal
date: 2026/04/05
tags:
- attack.persistence
- attack.t1505.003
- attack.defense_evasion
logsource:
category: file_event
product: linux
detection:
selection_path:
TargetFilename|contains:
- '/var/www/'
- '/srv/www/'
- '/usr/share/nginx/'
- '/opt/lampp/htdocs/'
- '/home/*/public_html/'
selection_ext:
TargetFilename|endswith:
- '.php'
- '.phtml'
- '.sh'
- '.elf'
selection_proc:
Image|endswith:
- '/php'
- '/php-fpm'
- '/apache2'
- '/nginx'
condition: selection_path and selection_ext and selection_proc
falsepositives:
- Legitimate PHP application deployments via CI/CD pipelines
- CMS auto-update mechanisms (WordPress, Drupal)
level: high
---
title: PHP Process Making Unusual Outbound Network Connection
id: 5d6e7f8a-9b0c-1d2e-3f4a-5b6c7d8e9f0a
status: experimental
description: Detects PHP interpreter processes establishing outbound network connections to unusual ports or external IP addresses, potentially indicating command-and-control communication or data exfiltration following exploitation.
references:
- https://linuxsecurity.com/advisories/ubuntu/ubuntu-9055-1-pecl-http
- https://attack.mitre.org/techniques/T1071/
author: Security Arsenal
date: 2026/04/05
tags:
- attack.command_and_control
- attack.t1071
- attack.exfiltration
logsource:
category: network_connection
product: linux
detection:
selection:
Image|endswith:
- '/php'
- '/php-fpm'
- '/php-cgi'
DestinationPort:
- 4444
- 5555
- 6666
- 7777
- 8888
- 9999
- 1234
- 31337
Initiated: 'true'
condition: selection
falsepositives:
- PHP applications connecting to microservices on non-standard ports
- Development and testing environments
level: medium
KQL — Microsoft Sentinel / Defender
For organizations ingesting Linux syslog and process events into Microsoft Sentinel (via the Azure Monitor Agent, Syslog connector, or Defender for Endpoint for Linux), the following hunt queries can help identify systems with the vulnerable package and detect post-exploitation behavior.
// Hunt 1: Identify PHP processes spawning unexpected child processes (potential RCE)
// Requires Linux process creation events via Syslog/auditd or Defender for Endpoint
DeviceProcessEvents
| where TimeGenerated > ago(24h)
| where InitiatingProcessFileName in~ ("php", "php-fpm", "php7.4", "php8.0", "php8.1", "php8.2", "php8.3", "php-cgi", "php-cli")
| where FileName in~ ("bash", "sh", "dash", "zsh", "python", "python2", "python3", "perl", "curl", "wget", "nc", "ncat", "netcat", "base64", "id", "whoami", "uname")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, AccountName, RemoteIP
| order by TimeGenerated desc
// Hunt 2: Detect web server processes writing PHP/shell files to web directories
DeviceFileEvents
| where TimeGenerated > ago(24h)
| where InitiatingProcessFileName in~ ("php", "php-fpm", "apache2", "nginx")
| where FolderPath has_any ("/var/www/", "/srv/www/", "/usr/share/nginx/", "/opt/lampp/htdocs/")
| where FileName endswith_any (".php", ".phtml", ".sh", ".elf")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, FolderPath, FileName, SHA256
| order by TimeGenerated desc
// Hunt 3: Identify systems with php-pecl-http installed via dpkg audit (Syslog ingestion)
Syslog
| where TimeGenerated > ago(7d)
| where SyslogMessage has "php-pecl-http"
| where SyslogMessage has_any ("install", "upgrade", "remove", "purge")
| project TimeGenerated, Computer, SyslogMessage
| order by TimeGenerated desc
Velociraptor VQL
For organizations running Velociraptor for endpoint visibility, the following VQL artifact can be deployed as a hunt to identify systems with the vulnerable php-pecl-http package installed and enumerate associated PHP configuration.
-- Artifact: Hunt for php-pecl-http installation and version across Linux endpoints
-- Purpose: Identify all systems running the vulnerable pecl_http PHP extension
-- to prioritize patching per USN-9055-1
SELECT * FROM foreach(
row={
SELECT * FROM glob(globs='/usr/bin/dpkg')
},
query={
SELECT * FROM execve(
argv=['dpkg', '-l', 'php-pecl-http'],
length=100000
)
}
)
-- Additional: Check if pecl_http is loaded in PHP configuration
SELECT * FROM foreach(
row={
SELECT FullPath FROM glob(globs='/etc/php/*/cli/conf.d/*http*.ini')
},
query={
SELECT FullPath, read_file(filename=FullPath, length=4096) AS ConfigContent
FROM scope()
}
)
-- Additional: Enumerate PHP-FPM pool configurations to understand service exposure
SELECT * FROM glob(
globs='/etc/php/*/fpm/pool.d/*.conf',
accessor='file'
)
Remediation Script
The following Bash script automates identification, verification, and remediation of the vulnerable php-pecl-http package across Ubuntu systems. It checks whether the package is installed, whether the system is running a vulnerable version, and applies the security update.
#!/bin/bash
#===============================================================================
# USN-9055-1 Remediation Script — php-pecl-http Vulnerability
# Security Arsenal | Vulnerability Management
#
# This script checks if php-pecl-http is installed, determines if the system
# is vulnerable, applies the security update, and verifies the patch.
#
# Usage: sudo bash remediate_usn_9055_1.sh
#===============================================================================
set -euo pipefail
echo "[$(date '+%Y-%m-%d %H:%M:%S')] Starting USN-9055-1 remediation check..."
# --- Step 1: Check if php-pecl-http is installed ---
echo ""
echo "[STEP 1] Checking if php-pecl-http is installed..."
if dpkg -l php-pecl-http 2>/dev/null | grep -q '^ii'; then
INSTALLED_VERSION=$(dpkg -l php-pecl-http 2>/dev/null | grep '^ii' | awk '{print $3}')
echo " [!] php-pecl-http IS INSTALLED — Version: ${INSTALLED_VERSION}"
echo " [!] This system requires patching."
else
echo " [+] php-pecl-http is NOT installed on this system."
echo " [+] No action required."
exit 0
fi
# --- Step 2: Identify Ubuntu release ---
echo ""
echo "[STEP 2] Identifying Ubuntu release..."
if [ -f /etc/os-release ]; then
. /etc/os-release
echo " [*] OS: ${PRETTY_NAME}"
echo " [*] Codename: ${VERSION_CODENAME}"
else
echo " [-] Unable to determine OS version. Exiting."
exit 1
fi
# --- Step 3: Check if pecl_http extension is loaded ---
echo ""
echo "[STEP 3] Checking if pecl_http extension is actively loaded..."
PHP_BIN=$(command -v php 2>/dev/null || echo "")
if [ -n "${PHP_BIN}" ]; then
if ${PHP_BIN} -m 2>/dev/null | grep -qi "http"; then
echo " [!] pecl_http extension IS LOADED in PHP"
echo " [!] Active exploitation surface confirmed"
else
echo " [*] pecl_http extension is installed but not currently loaded in CLI SAPI"
echo " [*] Check FPM/Apache SAPI separately if applicable"
fi
else
echo " [*] PHP CLI not found in PATH — checking php-fpm directly"
fi
# Check php-fpm pools
if [ -d "/etc/php" ]; then
for PHP_VER_DIR in /etc/php/*/fpm/pool.d/; do
if [ -d "${PHP_VER_DIR}" ]; then
PHP_VER=$(echo "${PHP_VER_DIR}" | grep -oP '\d+\.\d+')
echo " [*] Found PHP ${PHP_VER} FPM configuration"
fi
done
fi
# --- Step 4: Apply the security update ---
echo ""
echo "[STEP 4] Applying security update for php-pecl-http..."
echo " [*] Running apt update..."
apt-get update -qq
echo " [*] Upgrading php-pecl-http..."
apt-get install --only-upgrade -y php-pecl-http
# --- Step 5: Verify the patch was applied ---
echo ""
echo "[STEP 5] Verifying patch installation..."
NEW_VERSION=$(dpkg -l php-pecl-http 2>/dev/null | grep '^ii' | awk '{print $3}')
echo " [*] Installed version after update: ${NEW_VERSION}"
# --- Step 6: Restart PHP services ---
echo ""
echo "[STEP 6] Restarting PHP-FPM and web server services to load patched extension..."
for PHP_VER_DIR in /etc/php/*/fpm/; do
if [ -d "${PHP_VER_DIR}" ]; then
PHP_VER=$(echo "${PHP_VER_DIR}" | grep -oP '\d+\.\d+' | head -1)
echo " [*] Restarting php${PHP_VER}-fpm..."
systemctl restart "php${PHP_VER}-fpm" 2>/dev/null || echo " [-] Failed to restart php${PHP_VER}-fpm"
fi
done
if systemctl is-active --quiet apache2; then
echo " [*] Restarting Apache..."
systemctl restart apache2
fi
if systemctl is-active --quiet nginx; then
echo " [*] Restarting Nginx..."
systemctl restart nginx
fi
# --- Step 7: Post-patch verification ---
echo ""
echo "[STEP 7] Post-patch verification..."
if [ -n "${PHP_BIN}" ]; then
echo " [*] PHP version: $(${PHP_BIN} -v 2>/dev/null | head -1)"
if ${PHP_BIN} -m 2>/dev/null | grep -qi "http"; then
echo " [*] pecl_http extension still loaded (patched version)"
${PHP_BIN} -r 'echo " [*] pecl_http version: " . phpversion("http") . "\n";' 2>/dev/null || true
fi
fi
echo ""
echo "[$(date '+%Y-%m-%d %H:%M:%S')] USN-9055-1 remediation complete."
echo ""
echo "==================================================================="
echo " REMEDIATION SUMMARY"
echo "==================================================================="
echo " Package: php-pecl-http"
eecho " Pre-patch: ${INSTALLED_VERSION}"
echo " Post-patch: ${NEW_VERSION}"
echo " Advisory: https://linuxsecurity.com/advisories/ubuntu/ubuntu-9055-1-pecl-http"
echo "==================================================================="
Remediation
Immediate Actions (Within 24 Hours)
-
Identify all affected systems. Run
dpkg -l php-pecl-httpacross your Ubuntu fleet. Any system with this package installed is potentially vulnerable. Use configuration management tools (Ansible, Puppet, Chef) or the Bash script above to automate this at scale. -
Apply the security update immediately. Canonical has released patched versions through the standard Ubuntu security repositories. Run:
sudo apt update && sudo apt install --only-upgrade php-pecl-http- Restart all PHP-FPM pools and web server services to load the patched extension.
-
Verify the patch. Confirm the updated package version using
dpkg -l php-pecl-httpand cross-reference against the fixed versions listed in the Ubuntu advisory. Ensure the pecl_http extension loads correctly after the update.
Short-Term Hardening (Within 1 Week)
-
Audit extension necessity. If
php-pecl-httpis installed but not actively used by your application, remove it entirely:sudo apt remove --purge php-pecl-http. Every installed PHP extension expands your attack surface. -
Restrict network access. Ensure PHP-FPM sockets and web server listeners are not directly exposed to the internet where possible. Use reverse proxies, WAFs, and network segmentation to limit the traffic that reaches PHP processes.
-
Deploy detection rules. Implement the Sigma rules and KQL queries provided above in your SIEM/SOAR pipeline. Alert on PHP processes spawning shells, writing to web directories, or making unusual outbound connections.
Long-Term Improvements
-
Implement automated patch management. PHP extension vulnerabilities like this one are discovered regularly. Organizations should have automated patching pipelines that can apply security updates to non-critical systems within hours and to critical systems within days.
-
Adopt a WAF with virtual patching. A web application firewall configured with rules to detect and block malformed HTTP requests targeting PHP endpoints can provide a compensating control while patches are staged and deployed.
-
Inventory PHP extensions. Maintain a software bill of materials (SBOM) for all PHP deployments. Know which extensions are installed, which are loaded, and which applications depend on them. This inventory is critical for rapid response when the next PHP extension vulnerability drops.
-
Monitor for CVE assignment. Subscribe to the Ubuntu Security Notices feed and monitor CISA KEV for updates. Once a CVE is assigned and a CVSS score is published, update your risk register and patch SLAs accordingly.
Related Resources
Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.