Detect PrestaShop ps_facetedsearch PHP Object Injection Leading to Unauthenticated RCE (CVE-2026-54159) in Microsoft Sentinel
CVE-2026-54159 is a critical (CVSS 10.0) PHP Object Injection vulnerability (CWE-74) in the PrestaShop ps_facetedsearch module (versions >=3.0.0, <4.0.4). The module caches faceted-search filter state using unsafe PHP deserialization of user-controllable input, allowing an unauthenticated attacker to submit a crafted serialized payload that instantiates gadget-chain objects, ultimately leading to arbitrary PHP code execution on the storefront web server. Exploitation requires no authentication and no user interaction, and a public PoC exists (GHSA-m5f5-28qr-9g9r).
MITRE ATT&CK
- Tactic
- Initial Access Execution Persistence
KQL Detection Query
let SuspiciousMarkers = dynamic(["O:8:\"","O:9:\"","O:10:\"","php_ext","phar://","__wakeup","__destruct","unserialize"]);
W3CIISLog
| where cs_uri_stem has "module/ps_facetedsearch" or cs_uri_query has "ps_facetedsearch"
| where cs_method == "POST"
| extend DecodedQuery = url_decode(cs_uri_query)
| where DecodedQuery has_any (SuspiciousMarkers) or cs_bytes > 20000
| project TimeGenerated, cIP, csUserAgent=cs_User_Agent, cs_uri_stem, DecodedQuery, sc_status
| sort by TimeGenerated descDetects HTTP POST requests to the PrestaShop ps_facetedsearch module endpoint containing PHP serialized-object markers (e.g. O:8:"classname") or phar:// wrapper strings indicative of PHP Object Injection exploitation attempts against CVE-2026-54159.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate faceted search filter submissions with unusually large but benign query strings
- Automated QA/load-testing traffic against the storefront search endpoint
- Third-party integrations that pass base64-like tokens resembling serialized markers
Other platforms for CVE-2026-54159
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate PHP Object Injection payload submission to ps_facetedsearch endpoint
Expected signal: Web server access log entry showing a POST to /module/ps_facetedsearch/ajax with a request body/query containing 'O:20:"PsFacetedSearchTest"' and 'phar://'.
- Test 2Simulate webshell drop artifact following simulated RCE
Expected signal: File creation event (via FIM/EDR/auditd) for a new .php file under the ps_facetedsearch cache directory, along with corresponding access log entries for the preceding exploitation request.
- Test 3Simulate malicious serialized payload with __destruct gadget marker
Expected signal: Proxy/web log entry capturing the POST request with URL-decoded body containing '__destruct' and '__wakeup' strings targeting the ps_facetedsearch endpoint.
Response Playbook
Triage
- Confirm the store is running ps_facetedsearch module version >=3.0.0 and <4.0.4 by checking the module's config.xml or PrestaShop back-office module list.
- Search web server access logs for POST/GET requests to endpoints containing 'ps_facetedsearch' with query strings matching PHP serialization markers (O:N:"classname") or phar:// wrapper usage.
- Check for unexpected PHP files, webshells, or modified core/module files under the PrestaShop install directory (especially /modules/ps_facetedsearch/ and /cache/) created or modified near the time of suspicious requests.
- Review PHP error logs for unserialize() warnings, 'Class not found' errors, or __wakeup/__destruct exceptions correlating with the suspicious requests.
- Inspect outbound network connections from the web server process (php-fpm/apache) for unexpected callbacks consistent with RCE gadget chain execution.
Containment
- Immediately update ps_facetedsearch to version 4.0.4 or later, or disable/uninstall the module from the PrestaShop back office until patched.
- Deploy a WAF/reverse-proxy rule blocking requests to ps_facetedsearch endpoints containing PHP serialization markers ('O:', 'phar://', '__wakeup', '__destruct') as a stop-gap while patching.
- Isolate the affected web server/host from sensitive internal networks if evidence of successful RCE or webshell drop is found, and rotate any credentials stored in configuration files accessible by the web process.
- Restore any modified or unauthorized files from known-good backups and re-validate file integrity across the PrestaShop install.
Evidence Collection
- Preserve full web server access and error logs covering the suspected exploitation window, including raw (undecoded) query strings.
- Capture a forensic copy of the /modules/ps_facetedsearch/ directory, PrestaShop cache directory, and any newly created/modified files with timestamps and hashes.
- Collect PHP-FPM/Apache process lists and any suspicious child processes spawned by the web server at the time of the alert.
- Export database records related to module cache tables (e.g. ps_layered_* tables) that may contain the malicious serialized payload.
Escalation Criteria
- !Escalate to incident response if evidence of successful code execution is found (webshell files, unexpected outbound connections, new admin accounts, or scheduled tasks).
- !Escalate if the affected store processes payment card data or PII, given the unauthenticated RCE nature of CVE-2026-54159 and potential PCI-DSS/breach notification implications.
- !Escalate if multiple source IPs are observed probing the same endpoint, suggesting mass scanning/exploitation campaign activity rather than a single opportunistic attempt.
- !Escalate if the module cannot be immediately patched or disabled due to business dependency, requiring compensating controls and executive risk acceptance.
Investigation Guide
Related Techniques
Forensic Artifacts
- >
Web server access/error logs showing POST requests to ps_facetedsearch module URIs with serialized PHP object payloads - >
Newly created or modified PHP files under /modules/ps_facetedsearch/ or /cache/ directories with anomalous timestamps - >
PHP-FPM/Apache worker process command lines or child processes inconsistent with normal PrestaShop operation - >
Database rows in ps_layered_filter/ps_layered_* cache tables containing suspicious serialized blob data
Tuning Guidance
Baseline normal ps_facetedsearch traffic volume and typical query parameter shapes for the specific store before enabling blocking actions, since legitimate filter selections can produce long, complex query strings. Tune out known internal vulnerability scanners and CDN/WAF health-check IPs. If the store uses URL-rewritten friendly URLs, ensure log parsing decodes rewritten paths so 'ps_facetedsearch' module identifiers are still captured; consider correlating with PHP error logs (unserialize failures) to reduce false positives from benign encoded strings that superficially resemble serialization markers.
Hunting Queries
Broader retrospective hunt across historical web logs for any request to ps_facetedsearch containing PHP serialized object syntax, to identify prior undetected exploitation attempts against CVE-2026-54159.
W3CIISLog
| where cs_uri_stem has "ps_facetedsearch"
| extend DecodedQuery = url_decode(cs_uri_query)
| where DecodedQuery matches regex @'O:\d+:"[A-Za-z0-9_\\]+"'
| summarize count(), make_set(cIP) by cs_uri_stem, bin(TimeGenerated, 1h)index=web (uri_path="*ps_facetedsearch*")
| eval decoded=urldecode(uri_query)
| regex decoded="O:\d+:\"[A-Za-z0-9_\\\\]+\""
| stats count by src_ip, uri_path, _timeAtomic Red Team Tests
Sends a crafted HTTP POST request containing a PHP serialized object marker to the ps_facetedsearch module endpoint in a lab PrestaShop instance to validate detection of CVE-2026-54159 exploitation attempts.
Command
curl -s -X POST 'http://LAB_TARGET/module/ps_facetedsearch/ajax' -d 'action=filter&data=O:20:"PsFacetedSearchTest":1:{s:4:"file";s:10:"phar://evil";}' -H 'Content-Type: application/x-www-form-urlencoded'Cleanup
No persistent changes made; clear web server access logs of test entries if log hygiene is required in the lab environment.Expected Telemetry
Web server access log entry showing a POST to /module/ps_facetedsearch/ajax with a request body/query containing 'O:20:"PsFacetedSearchTest"' and 'phar://'.
Expected Detection
KQL and SPL detections match on the O:N:"classname" serialization marker and phar:// string within the request to the ps_facetedsearch endpoint.
Creates a benign test file mimicking a webshell drop location under the ps_facetedsearch module directory to validate file-integrity and artifact-based detection logic in a lab PrestaShop deployment.
Command
echo '<?php /* atomic-test marker */ ?>' > /var/www/html/modules/ps_facetedsearch/cache/test_shell.php && stat /var/www/html/modules/ps_facetedsearch/cache/test_shell.phpCleanup
rm -f /var/www/html/modules/ps_facetedsearch/cache/test_shell.phpExpected Telemetry
File creation event (via FIM/EDR/auditd) for a new .php file under the ps_facetedsearch cache directory, along with corresponding access log entries for the preceding exploitation request.
Expected Detection
File integrity monitoring or EDR file-creation rule flags an unexpected PHP file write within the module's cache directory shortly after a suspicious ps_facetedsearch request.
Submits an HTTP request containing __destruct and __wakeup magic method markers within a serialized payload string to the ps_facetedsearch endpoint to validate detection of gadget-chain trigger indicators.
Command
Invoke-WebRequest -Uri 'http://LAB_TARGET/module/ps_facetedsearch/ajax' -Method POST -Body 'action=filter&data=O:15:%22TestGadget%22:2:%7Bs:9:%22__destruct%22;s:4:%22exec%22;s:8:%22__wakeup%22;s:4:%22true%22;%7D' -ContentType 'application/x-www-form-urlencoded'Cleanup
No persistent state changes; no cleanup required beyond clearing test log entries in the lab environment.Expected Telemetry
Proxy/web log entry capturing the POST request with URL-decoded body containing '__destruct' and '__wakeup' strings targeting the ps_facetedsearch endpoint.
Expected Detection
Elastic EQL, QRadar AQL, and Chronicle YARA-L rules match on the __wakeup/__destruct magic-method markers combined with the ps_facetedsearch URL path.