Quick.CMS PHP deserialization flaw patched
OpenSolution Quick.CMS transmitted serialized data over plaintext HTTP, letting attackers tamper with payloads to trigger PHP object injection and remote code execution.
CERT Polska coordinated disclosure of CVE-2026-11860, a vulnerability in OpenSolution Quick.CMS in which serialized data used by the admin panel is sent over unencrypted HTTP without integrity or authenticity checks. An on-path attacker able to intercept or manipulate this traffic can tamper with the serialized payload and inject malicious PHP objects, since the application deserializes the data without validation or class restrictions.
Exploitation relies on abusing PHP magic methods such as __wakeup() and __destruct(), combined with gadget chains present in the application, to achieve arbitrary code execution on the server. The attack is triggered automatically whenever an administrator accesses the admin panel over the vulnerable HTTP channel, making it a practical man-in-the-middle style attack rather than requiring direct interaction from the victim beyond normal admin usage.
OpenSolution addressed the issue in Quick.CMS version 6.8, released 14 May 2026, by restricting the affected communication to HTTPS. Deployments that have not applied this patch, or that continue to serve the admin panel over HTTP, remain exposed. No in-the-wild exploitation has been reported; this is a coordinated disclosure with a vendor patch already available.
Mentioned in this report
Detection guidance
PHP Object Injection Payload in HTTP Request to CMS Admin Panel
Detects serialized PHP object markers (e.g. O:8:"ClassName") in HTTP request parameters targeting an admin panel, indicative of PHP deserialization / object injection exploitation such as CVE-2026-11860. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: PHP Object Injection Payload in HTTP Request to CMS Admin Panel
description: Detects PHP serialized object injection markers (O:<len>:"ClassName")
in the query string or body of requests to admin panel endpoints, consistent with
exploitation of insecure PHP deserialization such as CVE-2026-11860 in Quick.CMS.
Generalises on the PHP serialization object marker pattern rather than a specific
gadget chain or payload.
tags:
- attack.initial_access
- attack.t1190
logsource:
category: webserver
detection:
selection:
cs-uri-query|re: O:[0-9]+:"[A-Za-z0-9_\\]+"
admin_path:
cs-uri-stem|contains:
- /admin
- admin.php
- /panel
condition: selection and admin_path
falsepositives:
- Legitimate application features that intentionally pass serialized PHP objects to
admin endpoints (rare, should be validated against app behaviour)
- Security scanners/pentest tools testing for PHP object injection
level: high
id: 23048c0f-3629-59bd-823f-50182635a443
status: experimental
author: Vorant
Web Server Process Spawning Shell After Possible Deserialization Exploit
Detects a PHP/web-server process (php-fpm, php-cgi, apache2, httpd) spawning a command interpreter, consistent with successful remote code execution via a PHP object injection / deserialization gadget chain. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Web Server Process Spawning Shell After Possible Deserialization Exploit
description: Detects php-fpm/php-cgi/apache/httpd processes spawning shell or script
interpreters, which is atypical for normal web application operation and consistent
with code execution achieved through a PHP deserialization gadget chain (e.g. CVE-2026-11860
style exploitation of Quick.CMS admin panel).
tags:
- attack.execution
- attack.t1190
logsource:
category: process_creation
product: linux
detection:
selection:
ParentImage|endswith:
- /php-fpm
- /php-cgi
- /apache2
- /httpd
Image|endswith:
- /sh
- /bash
- /dash
- /perl
- /python
- /python3
filter_common_admin:
CommandLine|contains:
- logrotate
- cron
condition: selection and not filter_common_admin
falsepositives:
- CMS or web application plugins that legitimately shell out for image processing,
backups, or scheduled maintenance tasks
- Custom admin scripts invoked by the CMS via PHP exec()/shell_exec() for legitimate
operational purposes
level: medium
id: 9d52bb1e-66a1-5fb6-999a-81be4206f8ad
status: experimental
author: Vorant
CMS Admin Panel Traffic Transmitted over Unencrypted HTTP
Detects administrative panel traffic sent over plaintext HTTP rather than HTTPS, the exposure condition that allows on-path tampering with serialized data as described in CVE-2026-11860. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: CMS Admin Panel Traffic Transmitted over Unencrypted HTTP
description: Detects HTTP (non-TLS) requests to CMS administrative panel paths. Unencrypted
admin panel traffic carrying serialized data is the precondition exploited in on-path
(MitM) attacks such as CVE-2026-11860, where an attacker tampers with serialized
PHP objects in transit. Intended as an exposure/hunting rule to flag deployments
still serving admin functionality over plaintext HTTP.
tags:
- attack.collection
- attack.t1557
logsource:
category: network_connection
product: windows
detection:
selection:
DestinationPort: 80
admin_path:
- DestinationHostname|exists: true
http_admin:
Application|contains:
- admin
condition: selection and http_admin
falsepositives:
- Internal management networks that intentionally rely on plaintext HTTP for legacy
admin interfaces behind trusted network segmentation
- Load balancers or reverse proxies terminating TLS upstream, making backend traffic
appear as plaintext HTTP
level: low
id: 6451d6f6-adbe-5443-b174-e0c997ad0e57
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2026/06/CVE-2026-11860
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free