PHP 8.5.7 StreamBucket SOAP RCE (CVE-2026-55199) exploitation indicators

Ibrahim Saud@tektrix

•updated Jun 29, 2026•1•0•1

This rule detects potential exploitation of the PHP StreamBucket SOAP RCE vulnerability (CVE-2026-55199). It monitors for characteristic post-exploitation behaviors, including the spawning of unexpected shell or system utility processes, access to sensitive memory mapping files (/proc/self/maps or /proc/self/mem) for ASLR defeat, creation of specific RCE marker files (e.g., /tmp/php857_rce_*.txt), and anomalous outbound network connections following SOAP request activity.