Mirasvit Full Page Cache Warmer deserialization flaw exploited
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
CVE-2026-45247 in Mirasvit Full Page Cache Warmer allows remote code execution via unsafe deserialization and is actively exploited in the wild.
CISA has added CVE-2026-45247 to its Known Exploited Vulnerabilities catalog, confirming active exploitation in the field. The vulnerability is a deserialization of untrusted data flaw in Mirasvit Full Page Cache Warmer, a product commonly deployed in web environments. Deserialization attacks of this type are a well-established attack vector that allows attackers to achieve arbitrary code execution on affected systems.
Federal Civilian Executive Branch agencies are required by Binding Operational Directive 22-01 to remediate this vulnerability by the specified due date. CISA recommends all organizations, not just federal agencies, prioritize patching this vulnerability as part of their vulnerability management program. The catalog listing confirms this is not a theoretical risk but an active threat with documented exploitation.
Mentioned in this report
Detection guidance
Web Server or PHP Process Spawning Shell With Recon or Download-and-Execute Commands
Detects a PHP or web server process on Linux spawning a shell that runs recon, download-and-execute or reverse-shell commands. This is a typical post-exploitation sign after deserialization RCE in a PHP e-commerce extension. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Web Server or PHP Process Spawning Shell With Recon or Download-and-Execute
Commands
description: Detects php-fpm, php, Apache or nginx worker processes on Linux spawning
a shell that runs recon, payload download or reverse-shell commands. Generalises
post-exploitation after deserialization RCE in PHP web applications (e.g. Magento
extensions such as Mirasvit Full Page Cache Warmer, CVE-2026-45247), not a specific
payload.
tags:
- attack.initial-access
- attack.t1190
- attack.execution
- attack.t1202
logsource:
category: process_creation
product: linux
detection:
selection_parent:
ParentImage|endswith:
- /php-fpm
- /php-fpm7
- /php-fpm8
- /php
- /php7
- /php8
- /apache2
- /httpd
- /nginx
selection_shell:
Image|endswith:
- /sh
- /bash
- /dash
selection_cmd:
CommandLine|contains:
- whoami
- uname -a
- /etc/passwd
- curl
- wget
- base64 -d
- /dev/tcp/
- nc -e
- bash -i
- chmod +x
- python -c
- perl -e
condition: selection_parent and selection_shell and selection_cmd
falsepositives:
- Web applications or admin plugins that legitimately shell out to curl or wget for
health checks or cache warming
- Deployment scripts triggered through PHP that download packages
level: medium
id: 43227488-37d3-5639-b575-dfe177d00935
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/alerts/2026/06/03/cisa-adds-one-known-exploited-vulnerability-catalog
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/alerts/2026/06/03/cisa-adds-one-known-exploited-vulnerability-catalog
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs