Detect PrestaShop ps_facetedsearch PHP Object Injection Leading to Unauthenticated RCE (CVE-2026-54159) in Microsoft Sentinel
CVE-2026-54159 is a critical (CVSS 10.0) PHP Object Injection vulnerability (CWE-74) in the PrestaShop ps_facetedsearch module (versions >=3.0.0, <4.0.4). The module caches faceted-search filter state using unsafe PHP deserialization of user-controllable input, allowing an unauthenticated attacker to submit a crafted serialized payload that instantiates gadget-chain objects, ultimately leading to arbitrary PHP code execution on the storefront web server. Exploitation requires no authentication and no user interaction, and a public PoC exists (GHSA-m5f5-28qr-9g9r).
MITRE ATT&CK
- Tactic
- Initial Access Execution Persistence
KQL Detection Query
let SuspiciousMarkers = dynamic(["O:8:\"","O:9:\"","O:10:\"","php_ext","phar://","__wakeup","__destruct","unserialize"]);
W3CIISLog
| where cs_uri_stem has "module/ps_facetedsearch" or cs_uri_query has "ps_facetedsearch"
| where cs_method == "POST"
| extend DecodedQuery = url_decode(cs_uri_query)
| where DecodedQuery has_any (SuspiciousMarkers) or cs_bytes > 20000
| project TimeGenerated, cIP, csUserAgent=cs_User_Agent, cs_uri_stem, DecodedQuery, sc_status
| sort by TimeGenerated descDetects HTTP POST requests to the PrestaShop ps_facetedsearch module endpoint containing PHP serialized-object markers (e.g. O:8:"classname") or phar:// wrapper strings indicative of PHP Object Injection exploitation attempts against CVE-2026-54159.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate faceted search filter submissions with unusually large but benign query strings
- Automated QA/load-testing traffic against the storefront search endpoint
- Third-party integrations that pass base64-like tokens resembling serialized markers
Other platforms for CVE-2026-54159
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate PHP Object Injection payload submission to ps_facetedsearch endpoint
Expected signal: Web server access log entry showing a POST to /module/ps_facetedsearch/ajax with a request body/query containing 'O:20:"PsFacetedSearchTest"' and 'phar://'.
- Test 2Simulate webshell drop artifact following simulated RCE
Expected signal: File creation event (via FIM/EDR/auditd) for a new .php file under the ps_facetedsearch cache directory, along with corresponding access log entries for the preceding exploitation request.
- Test 3Simulate malicious serialized payload with __destruct gadget marker
Expected signal: Proxy/web log entry capturing the POST request with URL-decoded body containing '__destruct' and '__wakeup' strings targeting the ps_facetedsearch endpoint.
Unlock Pro Content
Get the full detection package for CVE-2026-54159 including response playbook, investigation guide, and atomic red team tests.