CVE-2026-77647: 
Linux Debian Analyse et atténuation des vulnérabilités

CVE-2026-77647 is a critical unauthenticated remote code execution (RCE) vulnerability in SPIP, an open-source web publishing framework. It affects all SPIP versions before 4.4.20 and was disclosed on August 20–21, 2026, with confirmed exploitation in the wild during August 2026. The vulnerability stems from incorrect identification of <?php blocks combined with PHP's var_export() function mishandling inputs containing a < character. It carries a CVSS v3.1 base score of 9.8 (Critical) (GitHub Advisory, ENISA EUVD).

The root cause is classified as CWE-94 (Improper Control of Generation of Code / Code Injection). SPIP's template engine incorrectly identifies <?php blocks in user-supplied input, and PHP's var_export() function mishandles certain edge cases — specifically when a < character is present — allowing attacker-controlled data to be interpreted and executed as PHP code. Because no authentication or user interaction is required and the attack is conducted entirely over the network with low complexity, the attack surface is extremely broad. No specific public PoC code has been identified at the time of disclosure, but the vulnerability was confirmed exploited in the wild prior to the patch release (GitHub Advisory, ENISA EUVD).

Successful exploitation allows an unauthenticated remote attacker to execute arbitrary code on the SPIP server with the privileges of the web server process, resulting in full compromise of confidentiality, integrity, and availability. An attacker could exfiltrate sensitive data (including database credentials, user data, and site content), modify or destroy website content, install persistent backdoors or web shells, and use the compromised server as a pivot point for lateral movement within the hosting environment (ENISA EUVD, GitHub Advisory).

The vulnerability was confirmed exploited in the wild in August 2026, prior to or concurrent with public disclosure (GitHub Advisory). No public proof-of-concept exploit code has been identified as of the disclosure date, and the EPSS score is currently 0.0, though this is likely to change given active exploitation (ENISA EUVD). No specific threat actor attribution or CISA KEV catalog listing has been reported at this time. The zero-authentication requirement and network-accessible attack vector make this vulnerability highly attractive for opportunistic mass exploitation.

1. Reconnaissance: Identify internet-facing SPIP installations running versions prior to 4.4.20 using search engines (Shodan, Censys) or web crawlers looking for SPIP-specific fingerprints (e.g., /spip.php, meta generator tags, or /ecrire/ admin paths).
2. Craft malicious payload: Construct an HTTP request containing input that includes a < character in a context processed by SPIP's template engine, designed to bypass the incorrect <?php block identification logic and cause var_export() to mishandle the input.
3. Trigger code injection: Submit the crafted payload to a vulnerable SPIP endpoint (e.g., a public-facing page or form that processes template variables) without any authentication credentials.
4. Achieve arbitrary code execution: The malicious input is incorrectly parsed and passed to var_export(), which outputs PHP-executable code that is subsequently evaluated by the server, resulting in execution of attacker-controlled commands.
5. Establish persistence: Deploy a web shell or reverse shell to maintain access, exfiltrate data, or pivot to other systems on the network (GitHub Advisory, ENISA EUVD).

• Network: Unusual HTTP POST or GET requests to SPIP public endpoints containing < characters or PHP-like syntax in parameter values; unexpected outbound connections from the web server to external IPs.
• File System: Newly created or modified PHP files in the SPIP installation directory (e.g., web shells with names like shell.php, cmd.php, or random strings); unexpected files in /tmp/ or writable web directories.
• Logs: Web server access logs showing requests with anomalous payloads containing <?, var_export, or < characters in query strings or POST bodies; PHP error logs referencing unexpected code evaluation.
• Process: Unusual child processes spawned by the web server process (e.g., bash, sh, curl, wget, python) executing system commands; unexpected cron jobs or scheduled tasks added under the web server user account.

The primary remediation is to upgrade SPIP to version 4.4.20 or later, which addresses the incorrect PHP block identification and var_export() mishandling (GitHub Advisory, SPIP Blog). Debian users should apply the security update announced via the Debian Security Announce mailing list (Debian Advisory). As an interim measure where immediate patching is not possible, consider restricting public access to SPIP instances, enabling a web application firewall (WAF) with rules to block requests containing PHP-like syntax in user input, and monitoring for anomalous server behavior.

The vulnerability received coverage from security news outlets including The Hacker Wire, which published a dedicated article on the unauthenticated RCE (The Hacker Wire). Social media discussion was noted on Mastodon and Bluesky shortly after disclosure. The SPIP project issued a critical security update announcement on their official blog (SPIP Blog). Given the critical CVSS score and confirmed in-the-wild exploitation, the vulnerability attracted prompt attention from the security community and vulnerability tracking platforms.