PHP 8.5.7 StreamBucket SOAP RCE — unexpected child process from php-fpm or php

Ibrahim Saud@tektrix

•updated Jun 29, 2026•1•0•3

Detects remote code execution (RCE) attempts targeting PHP 8.5.7 StreamBucket SOAP vulnerability. The rule monitors for suspicious child process creation originating from web server processes (php-fpm, php, apache, httpd) including shells, scripting engines (python, perl, ruby), or network utilities (nc, curl, wget).