# SPIP CMS RCE flaw actively exploited

Published: 2026-08-21 · Severity: elevated
Canonical: https://vorant.io/reports/75b10f31-9752-5527-8dae-7fabf145a7cd/spip-cms-rce-flaw-actively-exploited

> CERT-FR warns of an actively exploited remote code execution vulnerability in SPIP CMS versions before 4.4.21.

CERT-FR has issued an advisory regarding a remote code execution vulnerability affecting the SPIP content management system in versions prior to 4.4.21. The vendor has confirmed the flaw is being actively exploited in the wild, allowing attackers to execute arbitrary code on affected systems remotely. No CVE identifier or technical exploitation details were provided in the advisory itself, but a vendor security bulletin published on 20 August 2026 accompanies the release of the patched version.

Organizations running SPIP should prioritize upgrading to version 4.4.21 or later immediately, given confirmed active exploitation. Defenders should review web server and application logs for anomalous requests to SPIP installations and monitor for signs of post-exploitation activity such as unexpected file writes or outbound connections from web servers hosting SPIP.

## Detection guidance (public sample)

### Web Server Process Spawning Command Shell (Possible SPIP RCE Post-Exploitation)

ATT&CK: T1190

Detects a web server or PHP-FPM process spawning a shell/interpreter child process, a classic signature of successful RCE exploitation against a web application such as SPIP. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Web Server Process Spawning Command Shell (Possible SPIP RCE Post-Exploitation)
description: Detects Apache, Nginx or PHP-FPM worker processes spawning shell or scripting
  interpreters. This is a common post-exploitation indicator following successful
  remote code execution against a PHP-based CMS such as SPIP, which the vendor confirmed
  is being actively exploited (versions prior to 4.4.21).
tags:
- attack.initial-access
- attack.t1190
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    ParentImage|endswith:
    - /apache2
    - /httpd
    - /nginx
    - /php-fpm
    - /php-fpm7
    - /php-fpm8
    Image|endswith:
    - /sh
    - /bash
    - /dash
    - /python
    - /python3
    - /perl
    - /curl
    - /wget
    - /nc
    - /ncat
  filter_healthchecks:
    CommandLine|contains:
    - logrotate
    - healthcheck
    - service --status-all
  condition: selection and not filter_healthchecks
falsepositives:
- Legitimate server administration scripts invoked through cron or configuration management
  tools that share the same parent process
- PHP application code intentionally shelling out to system utilities (e.g. image
  conversion, backup scripts)
level: high
id: 4464f00f-ac36-507b-a71c-68d6228998f0
status: experimental
author: Vorant
```

### Web Server Process Initiating Outbound Network Connection

ATT&CK: T1190

Detects a web server or PHP-FPM process establishing an outbound connection to a non-standard port, consistent with C2 callback or data exfiltration after exploiting a web application vulnerability like the SPIP RCE. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Web Server Process Initiating Outbound Network Connection
description: Detects Apache, Nginx or PHP-FPM processes making outbound network connections
  to ports other than standard web/proxy ports. Web server processes normally only
  accept inbound connections; outbound connections from these processes can indicate
  successful RCE exploitation (e.g. active exploitation of SPIP CMS prior to 4.4.21)
  followed by C2 communication or data exfiltration.
tags:
- attack.command-and-control
- attack.t1190
logsource:
  category: network_connection
  product: linux
detection:
  selection:
    Image|endswith:
    - /apache2
    - /httpd
    - /nginx
    - /php-fpm
    - /php-fpm7
    - /php-fpm8
    Initiated: true
  filter_common_ports:
    DestinationPort:
    - 80
    - 443
    - 8080
    - 8443
  condition: selection and not filter_common_ports
falsepositives:
- Web application legitimately calling external APIs or webhooks over non-standard
  ports
- Health-check or monitoring agents embedded in the web server process tree
level: medium
id: fbe409b9-170d-5808-9ca3-1139dbe64c0f
status: experimental
author: Vorant
```

### PHP Process Writing New PHP File to Web-Accessible Directory

ATT&CK: T1190

Detects a PHP interpreter or PHP-FPM worker writing a new .php/.phtml file, a common webshell-drop behavior seen after exploiting an RCE flaw in a PHP-based CMS such as SPIP. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: PHP Process Writing New PHP File to Web-Accessible Directory
description: Detects PHP-FPM/PHP-CGI processes creating new executable script files
  (.php, .phtml) at runtime, a behavior consistent with webshell drop following exploitation
  of a CMS remote code execution vulnerability such as the actively exploited SPIP
  flaw (versions prior to 4.4.21).
tags:
- attack.persistence
- attack.t1190
logsource:
  category: file_event
  product: linux
detection:
  selection:
    Image|endswith:
    - /php-fpm
    - /php-fpm7
    - /php-fpm8
    - /php-cgi
    - /php
    TargetFilename|endswith:
    - .php
    - .phtml
    - .php5
  filter_deployment:
    TargetFilename|contains:
    - /vendor/
    - /composer/
    - /.git/
  condition: selection and not filter_deployment
falsepositives:
- Legitimate CMS plugin installation or update workflows that write PHP files at runtime
- CI/CD or deployment tooling that pushes application code through the PHP process
  itself
level: high
id: 516b1d76-7ade-58f6-abe9-3a0800c06ff5
status: experimental
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1063

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/75b10f31-9752-5527-8dae-7fabf145a7cd/spip-cms-rce-flaw-actively-exploited.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup