Quick.CMS PHP deserialization flaw patched
OpenSolution Quick.CMS transmitted serialized data over plaintext HTTP, letting attackers tamper with payloads to trigger PHP object injection and remote code execution.
Sourcecert.pl — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CERT Polska coordinated disclosure of CVE-2026-11860, a vulnerability in OpenSolution Quick.CMS in which serialized data used by the admin panel is sent over unencrypted HTTP without integrity or authenticity checks. An on-path attacker able to intercept or manipulate this traffic can tamper with the serialized payload and inject malicious PHP objects, since the application deserializes the data without validation or class restrictions.
Exploitation relies on abusing PHP magic methods such as __wakeup() and __destruct(), combined with gadget chains present in the application, to achieve arbitrary code execution on the server. The attack is triggered automatically whenever an administrator accesses the admin panel over the vulnerable HTTP channel, making it a practical man-in-the-middle style attack rather than requiring direct interaction from the victim beyond normal admin usage.
OpenSolution addressed the issue in Quick.CMS version 6.8, released 14 May 2026, by restricting the affected communication to HTTPS. Deployments that have not applied this patch, or that continue to serve the admin panel over HTTP, remain exposed. No in-the-wild exploitation has been reported; this is a coordinated disclosure with a vendor patch already available.
Mentioned in this report
Detection guidance
PHP Object Injection Payload in HTTP Request to CMS Admin Panel
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects serialized PHP object markers (e.g. O:8:"ClassName") in HTTP request parameters targeting an admin panel, indicative of PHP deserialization / object injection exploitation such as CVE-2026-11860. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: PHP Object Injection Payload in HTTP Request to CMS Admin Panel
description: Detects PHP serialized object injection markers (O:<len>:"ClassName")
in the query string or body of requests to admin panel endpoints, consistent with
exploitation of insecure PHP deserialization such as CVE-2026-11860 in Quick.CMS.
Generalises on the PHP serialization object marker pattern rather than a specific
gadget chain or payload.
tags:
- attack.initial-access
- attack.t1190
logsource:
category: webserver
detection:
selection:
cs-uri-query|re: O:[0-9]+:"[A-Za-z0-9_\\]+"
admin_path:
cs-uri-stem|contains:
- /admin
- admin.php
- /panel
condition: selection and admin_path
falsepositives:
- Legitimate application features that intentionally pass serialized PHP objects to
admin endpoints (rare, should be validated against app behaviour)
- Security scanners/pentest tools testing for PHP object injection
level: high
id: 23048c0f-3629-59bd-823f-50182635a443
status: experimental
author: Vorant
Web Server Process Spawning Shell After Possible Deserialization Exploit
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects a PHP/web-server process (php-fpm, php-cgi, apache2, httpd) spawning a command interpreter, consistent with successful remote code execution via a PHP object injection / deserialization gadget chain. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Web Server Process Spawning Shell After Possible Deserialization Exploit
description: Detects php-fpm/php-cgi/apache/httpd processes spawning shell or script
interpreters, which is atypical for normal web application operation and consistent
with code execution achieved through a PHP deserialization gadget chain (e.g. CVE-2026-11860
style exploitation of Quick.CMS admin panel).
tags:
- attack.execution
- attack.t1190
logsource:
category: process_creation
product: linux
detection:
selection:
ParentImage|endswith:
- /php-fpm
- /php-cgi
- /apache2
- /httpd
Image|endswith:
- /sh
- /bash
- /dash
- /perl
- /python
- /python3
filter_common_admin:
CommandLine|contains:
- logrotate
- cron
condition: selection and not filter_common_admin
falsepositives:
- CMS or web application plugins that legitimately shell out for image processing,
backups, or scheduled maintenance tasks
- Custom admin scripts invoked by the CMS via PHP exec()/shell_exec() for legitimate
operational purposes
level: medium
id: 9d52bb1e-66a1-5fb6-999a-81be4206f8ad
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2026/06/CVE-2026-11860
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs