LibreNMS remote code execution vulnerability
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Remote code execution vulnerability in LibreNMS 21.6.x through 26.x requires patching to 26.5.0 or later.
A remote code execution vulnerability has been discovered in LibreNMS affecting versions 21.6.x through 26.x prior to 26.5.0. The vulnerability allows an attacker to execute arbitrary code on affected systems. LibreNMS is a widely-deployed open-source network monitoring and management platform. Organisations running vulnerable versions should apply patches immediately as RCE vulnerabilities in network management tools pose significant risk to infrastructure monitoring and control systems. The vendor has issued security guidance and patches addressing this issue.
Detection guidance
Web Server or PHP Process Spawning Shell With Download or Reverse-Shell Commands
Detects a PHP or web server process (as used by LibreNMS) spawning a shell that runs download, reverse-shell or encoded-payload commands. This is a typical post-exploitation pattern after RCE in a PHP web application. The report gives no exploit specifics, so this rule covers generic RCE follow-on behaviour. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Web Server or PHP Process Spawning Shell With Download or Reverse-Shell Commands
description: Detects PHP-FPM, PHP, Apache, or Nginx parent processes spawning a shell
that runs download-and-execute, reverse-shell, or encoded-payload commands. Typical
post-exploitation behaviour after RCE in a PHP web application such as LibreNMS.
Does not depend on a specific exploit path or payload.
tags:
- attack.initial-access
- attack.t1190
logsource:
category: process_creation
product: linux
detection:
selection_parent:
ParentImage|contains:
- php-fpm
- /apache2
- /httpd
- /nginx
ParentImage|endswith:
- /php
selection_parent_php:
ParentImage|endswith: /php
selection_shell:
Image|endswith:
- /sh
- /bash
- /dash
selection_cmd:
CommandLine|contains:
- curl
- wget
- /dev/tcp/
- nc -e
- bash -i
- base64 -d
- python -c
- perl -e
- mkfifo
condition: (selection_parent or selection_parent_php) and selection_shell and selection_cmd
falsepositives:
- Administrators running LibreNMS custom alert transports or scripts that call curl
or wget through a shell from PHP
- Web application update or installer scripts that download files via a shell
level: medium
id: ba91e352-27b9-5d5a-b55e-f9f2abcae45f
status: experimental
author: Vorant
references:
- https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0732
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0732
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,853 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs