Quick.CMS deserialization flaw enables RCE
OpenSolution Quick.CMS suffers from insecure deserialization over HTTP, allowing attackers to inject malicious payloads that execute when administrators access the admin panel.
CERT Polska coordinated disclosure of CVE-2026-11860, a critical vulnerability in OpenSolution Quick.CMS that allows remote code execution through insecure deserialization. The software deserializes user-controlled data received over plaintext HTTP without integrity or authenticity checks, enabling attackers to inject malicious serialized objects during transmission.
The vulnerability leverages PHP magic methods such as __wakeup() and __destruct() through gadget chains to achieve arbitrary code execution. Exploitation occurs automatically when an administrator accesses the admin panel, requiring no additional user interaction beyond normal administrative activities.
The vendor released a patch for version 6.8 on May 14, 2026, that mitigates the issue by restricting communication to HTTPS. Organizations running unpatched Quick.CMS deployments remain vulnerable to this attack vector. The vulnerability was responsibly reported by researcher Arkadiusz Marta.
Mentioned in this report
Detection guidance
Quick.CMS Deserialization Payload in HTTP Request
Detects HTTP requests to Quick.CMS admin endpoints containing PHP serialized-object markers indicative of a deserialization exploit attempt (CVE-2026-11860). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Quick.CMS Deserialization Payload in HTTP Request
id: 6873a575-08a8-5194-bc5c-915dc083f605
status: experimental
description: Detects HTTP requests containing PHP serialization gadget markers (e.g.
O:8:, __wakeup, __destruct) sent to a web application, consistent with exploitation
of insecure deserialization such as CVE-2026-11860 in Quick.CMS.
references:
- CERT Polska CVE-2026-11860 advisory
author: Vorant
tags:
- attack.t1190
logsource:
category: webserver
product: apache
detection:
selection:
cs-uri-query|contains:
- 'O:8:'
- 'O:4:'
- __wakeup
- __destruct
filter:
cs-uri-query|contains:
- unsubscribe
condition: selection and not filter
falsepositives:
- Security scanners or automated vulnerability assessment tools probing for the same
pattern
- Legitimate applications that pass serialized PHP objects as query parameters (rare)
level: high
Web Server Process Spawning Shell After Possible RCE
Detects a PHP/web-server worker process spawning a command interpreter, a common post-exploitation indicator following successful exploitation of a web application deserialization flaw. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Web Server Process Spawning Shell After Possible RCE
id: 368ad1e3-6ae3-5e35-8501-12c3169db985
status: experimental
description: Detects a PHP interpreter or web server worker process (e.g. php-cgi,
php, httpd, apache2, nginx) spawning a shell or scripting interpreter, which is
a common indicator of remote code execution following exploitation of a public-facing
application such as Quick.CMS via CVE-2026-11860.
references:
- CERT Polska CVE-2026-11860 advisory
author: Vorant
tags:
- attack.t1190
- attack.t1203
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith:
- \php-cgi.exe
- \php.exe
- \httpd.exe
- \apache.exe
- \nginx.exe
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \wscript.exe
- \cscript.exe
condition: selection
falsepositives:
- Custom PHP applications that legitimately shell out to system utilities for maintenance
tasks
- Web hosting control panels that invoke shell scripts from PHP for administrative
automation
level: high
New PHP File Written by Web Server Process (Possible Webshell Drop)
Detects a web server or PHP interpreter process writing a new .php file into a web-accessible directory, consistent with webshell deployment following exploitation of a deserialization vulnerability like CVE-2026-11860. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: New PHP File Written by Web Server Process (Possible Webshell Drop)
id: 344aff04-2230-56ea-b0fc-350fa785ff5c
status: experimental
description: Detects creation of a new .php file by a web server or PHP process, which
may indicate a webshell dropped after successful exploitation of a deserialization
vulnerability such as CVE-2026-11860 in Quick.CMS. Intended to be tuned to the site's
actual webroot path.
references:
- CERT Polska CVE-2026-11860 advisory
author: Vorant
tags:
- attack.t1190
logsource:
category: file_event
product: windows
detection:
selection:
Image|contains:
- php-cgi.exe
- php.exe
- httpd.exe
- apache.exe
- nginx.exe
TargetFilename|endswith: .php
filter:
TargetFilename|contains:
- \cache\
- \tmp\
condition: selection and not filter
falsepositives:
- Legitimate CMS plugin installation or update processes writing new PHP files
- Content management workflows where administrators upload PHP templates through the
admin panel
level: medium
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2026/06/CVE-2026-11860
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free