VORANT. Threat Intelligence Research Create a free account

SPIP CMS RCE flaw actively exploited

Published Vorant ratingelevated vulnerability

Vorant's rating weighs the evidence in the report: confirmed exploitation, victims claimed, CVSS and EPSS, and how many sources agree. It rates the report, not your assets.

CERT-FR warns of an actively exploited remote code execution vulnerability in SPIP CMS versions before 4.4.21.

Sourcecert.ssi.gouv.fr — open the original

What to check

Applies to
Whether this concerns you is not assessed; the names the report mentions are listed below.

CERT-FR has issued an advisory regarding a remote code execution vulnerability affecting the SPIP content management system in versions prior to 4.4.21. The vendor has confirmed the flaw is being actively exploited in the wild, allowing attackers to execute arbitrary code on affected systems remotely. No CVE identifier or technical exploitation details were provided in the advisory itself, but a vendor security bulletin published on 20 August 2026 accompanies the release of the patched version.

Organizations running SPIP should prioritize upgrading to version 4.4.21 or later immediately, given confirmed active exploitation. Defenders should review web server and application logs for anomalous requests to SPIP installations and monitor for signs of post-exploitation activity such as unexpected file writes or outbound connections from web servers hosting SPIP.

Related reporting

Detection guidance

Web Server Process Spawning Command Shell (Possible SPIP RCE Post-Exploitation)

ATT&CK T1190 · status experimental · needs linux process_creation logs · generated from the report, not run against telemetry

A behavioural hunt for the technique in general.

Detects a web server or PHP-FPM process spawning a shell/interpreter child process, a classic signature of successful RCE exploitation against a web application such as SPIP. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Web Server Process Spawning Command Shell (Possible SPIP RCE Post-Exploitation)
description: Detects Apache, Nginx or PHP-FPM worker processes spawning shell or scripting
  interpreters. This is a common post-exploitation indicator following successful
  remote code execution against a PHP-based CMS such as SPIP, which the vendor confirmed
  is being actively exploited (versions prior to 4.4.21).
tags:
- attack.initial-access
- attack.t1190
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    ParentImage|endswith:
    - /apache2
    - /httpd
    - /nginx
    - /php-fpm
    - /php-fpm7
    - /php-fpm8
    Image|endswith:
    - /sh
    - /bash
    - /dash
    - /python
    - /python3
    - /perl
    - /curl
    - /wget
    - /nc
    - /ncat
  filter_healthchecks:
    CommandLine|contains:
    - logrotate
    - healthcheck
    - service --status-all
  condition: selection and not filter_healthchecks
falsepositives:
- Legitimate server administration scripts invoked through cron or configuration management
  tools that share the same parent process
- PHP application code intentionally shelling out to system utilities (e.g. image
  conversion, backup scripts)
level: high
id: 4464f00f-ac36-507b-a71c-68d6228998f0
status: experimental
author: Vorant

Web Server Process Initiating Outbound Network Connection

ATT&CK T1190 · status experimental · needs linux network_connection logs · generated from the report, not run against telemetry

A behavioural hunt for the technique in general.

Detects a web server or PHP-FPM process establishing an outbound connection to a non-standard port, consistent with C2 callback or data exfiltration after exploiting a web application vulnerability like the SPIP RCE. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Web Server Process Initiating Outbound Network Connection
description: Detects Apache, Nginx or PHP-FPM processes making outbound network connections
  to ports other than standard web/proxy ports. Web server processes normally only
  accept inbound connections; outbound connections from these processes can indicate
  successful RCE exploitation (e.g. active exploitation of SPIP CMS prior to 4.4.21)
  followed by C2 communication or data exfiltration.
tags:
- attack.command-and-control
- attack.t1190
logsource:
  category: network_connection
  product: linux
detection:
  selection:
    Image|endswith:
    - /apache2
    - /httpd
    - /nginx
    - /php-fpm
    - /php-fpm7
    - /php-fpm8
    Initiated: true
  filter_common_ports:
    DestinationPort:
    - 80
    - 443
    - 8080
    - 8443
  condition: selection and not filter_common_ports
falsepositives:
- Web application legitimately calling external APIs or webhooks over non-standard
  ports
- Health-check or monitoring agents embedded in the web server process tree
level: medium
id: fbe409b9-170d-5808-9ca3-1139dbe64c0f
status: experimental
author: Vorant

PHP Process Writing New PHP File to Web-Accessible Directory

ATT&CK T1190 · status experimental · needs linux file_event logs · generated from the report, not run against telemetry

A behavioural hunt for the technique in general.

Detects a PHP interpreter or PHP-FPM worker writing a new .php/.phtml file, a common webshell-drop behavior seen after exploiting an RCE flaw in a PHP-based CMS such as SPIP. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: PHP Process Writing New PHP File to Web-Accessible Directory
description: Detects PHP-FPM/PHP-CGI processes creating new executable script files
  (.php, .phtml) at runtime, a behavior consistent with webshell drop following exploitation
  of a CMS remote code execution vulnerability such as the actively exploited SPIP
  flaw (versions prior to 4.4.21).
tags:
- attack.persistence
- attack.t1190
logsource:
  category: file_event
  product: linux
detection:
  selection:
    Image|endswith:
    - /php-fpm
    - /php-fpm7
    - /php-fpm8
    - /php-cgi
    - /php
    TargetFilename|endswith:
    - .php
    - .phtml
    - .php5
  filter_deployment:
    TargetFilename|contains:
    - /vendor/
    - /composer/
    - /.git/
  condition: selection and not filter_deployment
falsepositives:
- Legitimate CMS plugin installation or update workflows that write PHP files at runtime
- CI/CD or deployment tooling that pushes application code through the PHP process
  itself
level: high
id: 516b1d76-7ade-58f6-abe9-3a0800c06ff5
status: experimental
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1063

Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.

What this brief leaves out

This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply). The paid plans add the security research and news reporting the free tier leaves out.

It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.

A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.

Create a free account   What it costs