SPIP CMS RCE flaw actively exploited
CERT-FR warns of an actively exploited remote code execution vulnerability in SPIP CMS versions before 4.4.21.
CERT-FR has issued an advisory regarding a remote code execution vulnerability affecting the SPIP content management system in versions prior to 4.4.21. The vendor has confirmed the flaw is being actively exploited in the wild, allowing attackers to execute arbitrary code on affected systems remotely. No CVE identifier or technical exploitation details were provided in the advisory itself, but a vendor security bulletin published on 20 August 2026 accompanies the release of the patched version.
Organizations running SPIP should prioritize upgrading to version 4.4.21 or later immediately, given confirmed active exploitation. Defenders should review web server and application logs for anomalous requests to SPIP installations and monitor for signs of post-exploitation activity such as unexpected file writes or outbound connections from web servers hosting SPIP.
Detection guidance
Web Server Process Spawning Command Shell (Possible SPIP RCE Post-Exploitation)
Detects a web server or PHP-FPM process spawning a shell/interpreter child process, a classic signature of successful RCE exploitation against a web application such as SPIP. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Web Server Process Spawning Command Shell (Possible SPIP RCE Post-Exploitation)
description: Detects Apache, Nginx or PHP-FPM worker processes spawning shell or scripting
interpreters. This is a common post-exploitation indicator following successful
remote code execution against a PHP-based CMS such as SPIP, which the vendor confirmed
is being actively exploited (versions prior to 4.4.21).
tags:
- attack.initial-access
- attack.t1190
logsource:
category: process_creation
product: linux
detection:
selection:
ParentImage|endswith:
- /apache2
- /httpd
- /nginx
- /php-fpm
- /php-fpm7
- /php-fpm8
Image|endswith:
- /sh
- /bash
- /dash
- /python
- /python3
- /perl
- /curl
- /wget
- /nc
- /ncat
filter_healthchecks:
CommandLine|contains:
- logrotate
- healthcheck
- service --status-all
condition: selection and not filter_healthchecks
falsepositives:
- Legitimate server administration scripts invoked through cron or configuration management
tools that share the same parent process
- PHP application code intentionally shelling out to system utilities (e.g. image
conversion, backup scripts)
level: high
id: 4464f00f-ac36-507b-a71c-68d6228998f0
status: experimental
author: Vorant
Web Server Process Initiating Outbound Network Connection
Detects a web server or PHP-FPM process establishing an outbound connection to a non-standard port, consistent with C2 callback or data exfiltration after exploiting a web application vulnerability like the SPIP RCE. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Web Server Process Initiating Outbound Network Connection
description: Detects Apache, Nginx or PHP-FPM processes making outbound network connections
to ports other than standard web/proxy ports. Web server processes normally only
accept inbound connections; outbound connections from these processes can indicate
successful RCE exploitation (e.g. active exploitation of SPIP CMS prior to 4.4.21)
followed by C2 communication or data exfiltration.
tags:
- attack.command-and-control
- attack.t1190
logsource:
category: network_connection
product: linux
detection:
selection:
Image|endswith:
- /apache2
- /httpd
- /nginx
- /php-fpm
- /php-fpm7
- /php-fpm8
Initiated: true
filter_common_ports:
DestinationPort:
- 80
- 443
- 8080
- 8443
condition: selection and not filter_common_ports
falsepositives:
- Web application legitimately calling external APIs or webhooks over non-standard
ports
- Health-check or monitoring agents embedded in the web server process tree
level: medium
id: fbe409b9-170d-5808-9ca3-1139dbe64c0f
status: experimental
author: Vorant
PHP Process Writing New PHP File to Web-Accessible Directory
Detects a PHP interpreter or PHP-FPM worker writing a new .php/.phtml file, a common webshell-drop behavior seen after exploiting an RCE flaw in a PHP-based CMS such as SPIP. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: PHP Process Writing New PHP File to Web-Accessible Directory
description: Detects PHP-FPM/PHP-CGI processes creating new executable script files
(.php, .phtml) at runtime, a behavior consistent with webshell drop following exploitation
of a CMS remote code execution vulnerability such as the actively exploited SPIP
flaw (versions prior to 4.4.21).
tags:
- attack.persistence
- attack.t1190
logsource:
category: file_event
product: linux
detection:
selection:
Image|endswith:
- /php-fpm
- /php-fpm7
- /php-fpm8
- /php-cgi
- /php
TargetFilename|endswith:
- .php
- .phtml
- .php5
filter_deployment:
TargetFilename|contains:
- /vendor/
- /composer/
- /.git/
condition: selection and not filter_deployment
falsepositives:
- Legitimate CMS plugin installation or update workflows that write PHP files at runtime
- CI/CD or deployment tooling that pushes application code through the PHP process
itself
level: high
id: 516b1d76-7ade-58f6-abe9-3a0800c06ff5
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1063
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free