PHP 8.5.7 StreamBucket SOAP Deserialization RCE (CVE-2026-20253)

Ibrahim Saud@tektrix

•updated Jun 29, 2026•1•0•6

Detects malicious activity associated with the exploitation of StreamBucket PHP vulnerabilities. The rule monitors for unexpected child processes spawned by PHP/web server processes, the creation of specific exploitation artifact files in /tmp, unauthorized reading of /proc/self memory files by PHP, and inbound SOAP-related HTTP requests.