CVE-2026-45247 CrowdStrike LogScale · LogScale

Detect Mirasvit Full Page Cache Warmer Deserialization RCE (CVE-2026-45247) in CrowdStrike LogScale

Detects exploitation of CVE-2026-45247, a deserialization of untrusted data vulnerability in the Mirasvit Full Page Cache Warmer Magento extension. Successful exploitation allows remote attackers to execute arbitrary code by sending crafted serialized PHP objects to vulnerable endpoints. This CVE is listed in CISA KEV, indicating active exploitation in the wild.

MITRE ATT&CK

Tactic
Initial Access Execution Persistence

LogScale Detection Query

CrowdStrike LogScale (LogScale)
cql 
#event_simpleName=NetworkReceiveAccept OR #event_simpleName=HttpRequest
| CommandLine = /cache-warmer|cachewarmer|mirasvit.*warmer/i
  OR RequestUrl = /cache-warmer|cachewarmer|mirasvit.*warmer/i
| HttpMethod IN ["POST", "PUT"]
| eval suspicious = case(
    match(RequestBody, "O:[0-9]+:") OR match(RequestBody, "rO0") OR match(RequestBody, "YTo"), "serialized_payload",
    BytesSent > 5000, "large_payload",
    true(), "standard"
  )
| where suspicious != "standard"
| groupby([RemoteAddressIP4, ComputerName, RequestUrl, HttpMethod, suspicious], function=count(aid, as=request_count))
| sort(request_count, order=desc)
| search request_count >= 1
critical severity medium confidence

CrowdStrike Falcon query detecting HTTP POST/PUT requests to Mirasvit cache warmer paths on monitored endpoints, filtered for PHP serialization markers or anomalously large payloads indicative of CVE-2026-45247 exploitation.

Data Sources

Falcon sensor network eventsHTTP request telemetryProcess telemetry

Required Tables

HttpRequestNetworkReceiveAcceptProcessRollup2

False Positives & Tuning

  • Authorized cache warming automation running on Magento servers
  • Internal Magento queue workers sending POST requests to warm cache entries
  • Red team or penetration testing activity against Magento environments
  • Third-party Magento plugins that proxy requests through cache warmer endpoints

Other platforms for CVE-2026-45247

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) All platforms (combined) →

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Simulate Deserialization Probe to Cache Warmer Endpoint

    Expected signal: POST request to /mirasvit/cachewarmer/collect visible in web access logs with payload containing 'O:8:' serialization marker; HTTP response code logged

  2. Test 2PHP Deserialization Gadget Chain Simulation (Lab)

    Expected signal: PHP CLI process spawned with command-line containing unserialize() — visible in auditd execve records or CrowdStrike process telemetry

  3. Test 3Web Shell Drop Simulation Following Deserialization RCE

    Expected signal: File creation event in /var/www/html/pub/ for a .php file by the web server user (www-data or nginx); auditd CREATE record or Falcon sensor file event

Last updated: 2026-06-19 Research depth: standard
References (3)

Response Playbook

Triage

  1. Identify the source IP(s) sending POST/PUT requests to cache warmer endpoints and cross-reference with known good IPs (internal crawlers, CDN egress ranges, authorized scanners)
  2. Examine the full HTTP request body if available — look for PHP serialized object markers (O:, C:, rO0ABJ) or base64-encoded blobs that could encapsulate serialized payloads
  3. Check web server and PHP error logs on the Magento host for deserialization errors, fatal exceptions, or unexpected object instantiation messages coinciding with the suspicious request timestamps
  4. Determine the installed version of Mirasvit Full Page Cache Warmer and compare against any vendor-published patched versions from the changelog reference
  5. Review Magento's var/log/system.log and var/log/debug.log for anomalous PHP class instantiation or file write operations following the suspicious requests

Containment

  1. Immediately block the offending source IP(s) at the WAF, load balancer, or perimeter firewall and enable rate limiting on all cache warmer URL paths for non-internal sources
  2. If exploitation is confirmed, take the affected Magento application offline or into maintenance mode to prevent further abuse while patching; notify stakeholders of the service impact
  3. Revoke and rotate any Magento admin credentials, API tokens, or integration keys that may have been accessible from the compromised web context

Evidence Collection

  1. Capture and preserve the full HTTP request (headers, body, and response) from the exploit attempt — export from WAF, IDS, or web server access and error logs with timestamps intact
  2. On the Magento host, acquire a memory snapshot if possible, and collect /tmp, /var/www (or Magento root), PHP session files, and any newly created or modified files within the past 24 hours using find with -newer flag against a reference file

Escalation Criteria

  • !Escalate immediately if any web shell, unexpected PHP file, or new cron entry is discovered on the Magento host following the suspicious requests — this indicates successful code execution
  • !Escalate if outbound connections from the Magento server to external IPs are observed after the exploit attempt, indicating potential C2 channel establishment or data exfiltration

Investigation Guide

Related Techniques

[object Object][object Object][object Object]

Forensic Artifacts

  • >Web server access logs showing POST/PUT to /cache-warmer or Mirasvit module paths with large bodies or serialization markers
  • >PHP error logs in var/log/ with unserialize() exceptions or class-not-found errors referencing unexpected namespaces
  • >Newly created or modified PHP files in the Magento root, pub/, or var/ directories (use find /var/www -name '*.php' -newer /var/www/index.php)
  • >Unexpected outbound network connections from the PHP-FPM or web server process visible in netstat or ss output
  • >Bash history or auditd logs showing PHP CLI invocations with eval, base64_decode, or shell execution functions from the web server user account

Tuning Guidance

Reduce false positives by first building a baseline of known legitimate cache warmer traffic — identify authorized internal crawler IPs, CDN origin IPs, and scheduled cron job source addresses, then add them to an allowlist exclusion in the query. Increase confidence by adding correlation with PHP process spawn events or file system write events on the Magento host following the HTTP request. If the organization has patched or does not use Mirasvit Full Page Cache Warmer, this detection can be retired or scoped to asset inventory for the affected product only.

Hunting Queries

Broad hunt for any elevated access patterns to Mirasvit cache warmer endpoints over the past 7 days, surfacing IP addresses or hosts with unusual request volumes that may indicate reconnaissance or ongoing exploitation attempts

Hunting — KQL
kql 
W3CIISLog
| where TimeGenerated >= ago(7d)
| where csUriStem has_any ('/cache-warmer/', '/mirasvit/', '/cachewarmer/')
| summarize RequestCount = count(), UniqueIPs = dcount(csClientIP), Methods = make_set(csMethod), Statuses = make_set(scStatus) by csHost, csUriStem, bin(TimeGenerated, 1h)
| where RequestCount > 5 or UniqueIPs > 3
| order by RequestCount desc
Hunting — SPL
spl 
index=web sourcetype IN (iis, apache_access, nginx_access)
(uri_path="*/cache-warmer*" OR uri_path="*/cachewarmer*" OR uri_path="*/mirasvit*")
| timechart span=1h count by src_ip
| where count > 5

Atomic Red Team Tests

Test 1 Simulate Deserialization Probe to Cache Warmer Endpoint
linux

Sends a POST request with a PHP serialized object payload to the Mirasvit cache warmer endpoint to simulate an initial exploitation probe and generate web log telemetry.

Command

bash 
curl -s -X POST 'http://TARGET_MAGENTO_HOST/mirasvit/cachewarmer/collect' -H 'Content-Type: application/x-www-form-urlencoded' -H 'User-Agent: Mozilla/5.0' --data 'data=O:8:"stdClass":1:{s:4:"test";s:4:"data";}' -o /dev/null -w '%{http_code}'

Cleanup

bash 
No cleanup required — this is a network-only probe that generates log entries only

Expected Telemetry

POST request to /mirasvit/cachewarmer/collect visible in web access logs with payload containing 'O:8:' serialization marker; HTTP response code logged

Expected Detection

SPL and KQL queries should fire on the URI path match combined with the serialized object pattern in the request body or query string

Test 2 PHP Deserialization Gadget Chain Simulation (Lab)
linux

Executes a local PHP script that mimics the server-side deserialization of a malicious payload, verifying that PHP process telemetry is generated for detection rule validation.

Command

bash 
php -r '$payload = "O:8:\"stdClass\":1:{s:4:\"exec\";s:2:\"id\"}"; $obj = @unserialize($payload); echo "Deserialization attempted";'

Cleanup

bash 
No files created; lab environment only

Expected Telemetry

PHP CLI process spawned with command-line containing unserialize() — visible in auditd execve records or CrowdStrike process telemetry

Expected Detection

Elastic EQL sequence rule correlates HTTP request event with subsequent PHP process execution containing eval or exec patterns

Test 3 Web Shell Drop Simulation Following Deserialization RCE
linux

Simulates the post-exploitation step of a successful deserialization attack by writing a PHP web shell to the Magento pub/ directory, testing file integrity monitoring and detection coverage for persistence.

Command

bash 
echo '<?php if(isset($_GET["cmd"])){ system($_GET["cmd"]); } ?>' > /var/www/html/pub/health_check_tmp.php && echo 'Web shell written to pub/ - verify detection fired' && sleep 5 && rm -f /var/www/html/pub/health_check_tmp.php

Cleanup

bash 
rm -f /var/www/html/pub/health_check_tmp.php

Expected Telemetry

File creation event in /var/www/html/pub/ for a .php file by the web server user (www-data or nginx); auditd CREATE record or Falcon sensor file event

Expected Detection

File integrity monitoring alert for new PHP file in Magento public directory; CrowdStrike CQL or Elastic EQL rules for web shell creation patterns should trigger

Related Detections

Tactic Hubs

TA0001Initial AccessTA0002ExecutionTA0003Persistence

Related Techniques

T1190Exploit Public-Facing ApplicationT1059.004Unix ShellT1505.003Web Shell

Same Tactic: Initial Access

Popular Detections