PHP 8.5.7 Stream Bucket SOAP RCE - Unexpected Child Process from PHP Worker

Ethan Andrews@eandrews

•updated Jun 28, 2026•1•0•1

Detects anomalous child process execution from PHP worker processes (php-fpm, php-cgi, php.exe) that may indicate exploitation of a PHP 8.5.7 stream bucket Use-After-Free (UAF) vulnerability. Attackers can leverage crafted SOAP requests to achieve remote code execution, resulting in the PHP worker spawning command shells (e.g., sh, bash, cmd.exe) or other interpreters (e.g., python, curl) to execute malicious payloads.