VORANT. Threat Intelligence Research Create a free account

Quick.CMS deserialization flaw enables RCE

Published Vorant ratingroutine vulnerability

Vorant's rating weighs the evidence in the report: confirmed exploitation, victims claimed, CVSS and EPSS, and how many sources agree. It rates the report, not your assets.

OpenSolution Quick.CMS suffers from insecure deserialization over HTTP, allowing attackers to inject malicious payloads that execute when administrators access the admin panel.

Sourcecert.pl — open the original

What to check

Applies to
The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
Exploitation
No exploitation in the wild and no public exploit is recorded for the CVEs named.

CERT Polska coordinated disclosure of CVE-2026-11860, a critical vulnerability in OpenSolution Quick.CMS that allows remote code execution through insecure deserialization. The software deserializes user-controlled data received over plaintext HTTP without integrity or authenticity checks, enabling attackers to inject malicious serialized objects during transmission.

The vulnerability leverages PHP magic methods such as __wakeup() and __destruct() through gadget chains to achieve arbitrary code execution. Exploitation occurs automatically when an administrator accesses the admin panel, requiring no additional user interaction beyond normal administrative activities.

The vendor released a patch for version 6.8 on May 14, 2026, that mitigates the issue by restricting communication to HTTPS. Organizations running unpatched Quick.CMS deployments remain vulnerable to this attack vector. The vulnerability was responsibly reported by researcher Arkadiusz Marta.

Mentioned in this report

Vulnerabilities CVE-2026-11860

Related reporting

Detection guidance

Quick.CMS Deserialization Payload in HTTP Request

ATT&CK T1190 · status experimental · needs webserver logs · generated from the report, not run against telemetry

A behavioural hunt for the technique in general, not a signature for the CVEs this report names.

Detects HTTP requests to Quick.CMS admin endpoints containing PHP serialized-object markers indicative of a deserialization exploit attempt (CVE-2026-11860). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Quick.CMS Deserialization Payload in HTTP Request
id: 6873a575-08a8-5194-bc5c-915dc083f605
status: experimental
description: Detects HTTP requests containing PHP serialization gadget markers (e.g.
  O:8:, __wakeup, __destruct) sent to a web application, consistent with exploitation
  of insecure deserialization such as CVE-2026-11860 in Quick.CMS.
references:
- CERT Polska CVE-2026-11860 advisory
author: Vorant
tags:
- attack.t1190
logsource:
  category: webserver
detection:
  selection:
    cs-uri-query|contains:
    - 'O:8:'
    - 'O:4:'
    - __wakeup
    - __destruct
  filter:
    cs-uri-query|contains:
    - unsubscribe
  condition: selection and not filter
falsepositives:
- Security scanners or automated vulnerability assessment tools probing for the same
  pattern
- Legitimate applications that pass serialized PHP objects as query parameters (rare)
level: high

Web Server Process Spawning Shell After Possible RCE

ATT&CK T1190 · status experimental · needs windows process_creation logs · generated from the report, not run against telemetry

A behavioural hunt for the technique in general, not a signature for the CVEs this report names.

Detects a PHP/web-server worker process spawning a command interpreter, a common post-exploitation indicator following successful exploitation of a web application deserialization flaw. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Web Server Process Spawning Shell After Possible RCE
id: 368ad1e3-6ae3-5e35-8501-12c3169db985
status: experimental
description: Detects a PHP interpreter or web server worker process (e.g. php-cgi,
  php, httpd, apache2, nginx) spawning a shell or scripting interpreter, which is
  a common indicator of remote code execution following exploitation of a public-facing
  application such as Quick.CMS via CVE-2026-11860.
references:
- CERT Polska CVE-2026-11860 advisory
author: Vorant
tags:
- attack.t1190
- attack.t1203
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
    - \php-cgi.exe
    - \php.exe
    - \httpd.exe
    - \apache.exe
    - \nginx.exe
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \wscript.exe
    - \cscript.exe
  condition: selection
falsepositives:
- Custom PHP applications that legitimately shell out to system utilities for maintenance
  tasks
- Web hosting control panels that invoke shell scripts from PHP for administrative
  automation
level: high

New PHP File Written by Web Server Process (Possible Webshell Drop)

ATT&CK T1190 · status experimental · needs windows file_event logs · generated from the report, not run against telemetry

A behavioural hunt for the technique in general, not a signature for the CVEs this report names.

Detects a web server or PHP interpreter process writing a new .php file into a web-accessible directory, consistent with webshell deployment following exploitation of a deserialization vulnerability like CVE-2026-11860. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: New PHP File Written by Web Server Process (Possible Webshell Drop)
id: 344aff04-2230-56ea-b0fc-350fa785ff5c
status: experimental
description: Detects creation of a new .php file by a web server or PHP process, which
  may indicate a webshell dropped after successful exploitation of a deserialization
  vulnerability such as CVE-2026-11860 in Quick.CMS. Intended to be tuned to the site's
  actual webroot path.
references:
- CERT Polska CVE-2026-11860 advisory
author: Vorant
tags:
- attack.t1190
logsource:
  category: file_event
  product: windows
detection:
  selection:
    Image|contains:
    - php-cgi.exe
    - php.exe
    - httpd.exe
    - apache.exe
    - nginx.exe
    TargetFilename|endswith: .php
  filter:
    TargetFilename|contains:
    - \cache\
    - \tmp\
  condition: selection and not filter
falsepositives:
- Legitimate CMS plugin installation or update processes writing new PHP files
- Content management workflows where administrators upload PHP templates through the
  admin panel
level: medium

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://cert.pl/en/posts/2026/06/CVE-2026-11860

Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.

What this brief leaves out

This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.

It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.

A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.

Create a free account   What it costs