# Quick.CMS PHP deserialization flaw patched

Published: 2026-06-15 · Severity: medium
Canonical: https://vorant.io/reports/fcc4d637-247c-5184-a74a-1e287c2c5fdf/quick-cms-php-deserialization-flaw-patched

> OpenSolution Quick.CMS transmitted serialized data over plaintext HTTP, letting attackers tamper with payloads to trigger PHP object injection and remote code execution.

CERT Polska coordinated disclosure of CVE-2026-11860, a vulnerability in OpenSolution Quick.CMS in which serialized data used by the admin panel is sent over unencrypted HTTP without integrity or authenticity checks. An on-path attacker able to intercept or manipulate this traffic can tamper with the serialized payload and inject malicious PHP objects, since the application deserializes the data without validation or class restrictions.

Exploitation relies on abusing PHP magic methods such as __wakeup() and __destruct(), combined with gadget chains present in the application, to achieve arbitrary code execution on the server. The attack is triggered automatically whenever an administrator accesses the admin panel over the vulnerable HTTP channel, making it a practical man-in-the-middle style attack rather than requiring direct interaction from the victim beyond normal admin usage.

OpenSolution addressed the issue in Quick.CMS version 6.8, released 14 May 2026, by restricting the affected communication to HTTPS. Deployments that have not applied this patch, or that continue to serve the admin panel over HTTP, remain exposed. No in-the-wild exploitation has been reported; this is a coordinated disclosure with a vendor patch already available.

## Mentioned in this report

- Vulnerabilities: CVE-2026-11860

## Detection guidance (public sample)

### PHP Object Injection Payload in HTTP Request to CMS Admin Panel

ATT&CK: T1190

Detects serialized PHP object markers (e.g. O:8:"ClassName") in HTTP request parameters targeting an admin panel, indicative of PHP deserialization / object injection exploitation such as CVE-2026-11860. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: PHP Object Injection Payload in HTTP Request to CMS Admin Panel
description: Detects PHP serialized object injection markers (O:<len>:"ClassName")
  in the query string or body of requests to admin panel endpoints, consistent with
  exploitation of insecure PHP deserialization such as CVE-2026-11860 in Quick.CMS.
  Generalises on the PHP serialization object marker pattern rather than a specific
  gadget chain or payload.
tags:
- attack.initial_access
- attack.t1190
logsource:
  category: webserver
detection:
  selection:
    cs-uri-query|re: O:[0-9]+:"[A-Za-z0-9_\\]+"
  admin_path:
    cs-uri-stem|contains:
    - /admin
    - admin.php
    - /panel
  condition: selection and admin_path
falsepositives:
- Legitimate application features that intentionally pass serialized PHP objects to
  admin endpoints (rare, should be validated against app behaviour)
- Security scanners/pentest tools testing for PHP object injection
level: high
id: 23048c0f-3629-59bd-823f-50182635a443
status: experimental
author: Vorant
```

### Web Server Process Spawning Shell After Possible Deserialization Exploit

ATT&CK: T1190

Detects a PHP/web-server process (php-fpm, php-cgi, apache2, httpd) spawning a command interpreter, consistent with successful remote code execution via a PHP object injection / deserialization gadget chain. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Web Server Process Spawning Shell After Possible Deserialization Exploit
description: Detects php-fpm/php-cgi/apache/httpd processes spawning shell or script
  interpreters, which is atypical for normal web application operation and consistent
  with code execution achieved through a PHP deserialization gadget chain (e.g. CVE-2026-11860
  style exploitation of Quick.CMS admin panel).
tags:
- attack.execution
- attack.t1190
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    ParentImage|endswith:
    - /php-fpm
    - /php-cgi
    - /apache2
    - /httpd
    Image|endswith:
    - /sh
    - /bash
    - /dash
    - /perl
    - /python
    - /python3
  filter_common_admin:
    CommandLine|contains:
    - logrotate
    - cron
  condition: selection and not filter_common_admin
falsepositives:
- CMS or web application plugins that legitimately shell out for image processing,
  backups, or scheduled maintenance tasks
- Custom admin scripts invoked by the CMS via PHP exec()/shell_exec() for legitimate
  operational purposes
level: medium
id: 9d52bb1e-66a1-5fb6-999a-81be4206f8ad
status: experimental
author: Vorant
```

### CMS Admin Panel Traffic Transmitted over Unencrypted HTTP

ATT&CK: T1557

Detects administrative panel traffic sent over plaintext HTTP rather than HTTPS, the exposure condition that allows on-path tampering with serialized data as described in CVE-2026-11860. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: CMS Admin Panel Traffic Transmitted over Unencrypted HTTP
description: Detects HTTP (non-TLS) requests to CMS administrative panel paths. Unencrypted
  admin panel traffic carrying serialized data is the precondition exploited in on-path
  (MitM) attacks such as CVE-2026-11860, where an attacker tampers with serialized
  PHP objects in transit. Intended as an exposure/hunting rule to flag deployments
  still serving admin functionality over plaintext HTTP.
tags:
- attack.collection
- attack.t1557
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationPort: 80
  admin_path:
  - DestinationHostname|exists: true
  http_admin:
    Application|contains:
    - admin
  condition: selection and http_admin
falsepositives:
- Internal management networks that intentionally rely on plaintext HTTP for legacy
  admin interfaces behind trusted network segmentation
- Load balancers or reverse proxies terminating TLS upstream, making backend traffic
  appear as plaintext HTTP
level: low
id: 6451d6f6-adbe-5443-b174-e0c997ad0e57
status: experimental
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://cert.pl/en/posts/2026/06/CVE-2026-11860

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/fcc4d637-247c-5184-a74a-1e287c2c5fdf/quick-cms-php-deserialization-flaw-patched.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup