ImageMagick Ghostscript delegate hijack — gs child process spawn

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•5

Detects anomalous child process execution spawned by ImageMagick binaries. This pattern aligns with exploitation of ImageMagick vulnerabilities where Ghostscript delegates are hijacked via search order manipulation (PATH or working directory) to achieve arbitrary code execution.