PHP 8.5.7 StreamBucket SOAP Deserialization RCE - CVE exploit chain

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•5

This rule detects post-exploitation activity related to the exploitation of PHP StreamBucket SOAP deserialization vulnerabilities. It monitors for child process execution from PHP web server processes (e.g., php-fpm, php.exe), the creation of specific proof-of-concept (PoC) marker files, and the presence of identified exploit script filenames on disk.