PHP 8.5.7 SOAP RCE - Fake HashTable Heap Spray via php or php-fpm Process

Ethan Andrews@eandrews

•updated Jun 28, 2026•1•0•2

Detects anomalous behavior associated with the PHP 8.5.7 SOAP remote code execution (RCE) vulnerability. The detection monitors for PHP/PHP-FPM processes spawning suspicious child processes (e.g., shell, python, powershell), the creation of specific exploitation marker files (e.g., php857_rce, rpoc.php), and suspicious command-line patterns indicative of payload execution or command-based exploitation techniques.