PHP 8.5.7 StreamBucket SOAP RCE — php-fpm/php Spawning Unexpected Child Process

Ibrahim Saud@tektrix

•updated Jun 30, 2026•2•0•5

Detects anomalous child process execution from PHP web handler processes (e.g., php-fpm, php-cgi) indicative of exploitation of the StreamBucket SOAP RCE vulnerability. The rule identifies spawning of common shell tools or access to sensitive process memory files (/proc/self/maps or /proc/self/mem) associated with ASLR defeat techniques used in this exploit chain.