Active Exploits Target Critical SPIP CMS RCE (CVE-2026-77647)

Executive Summary

A critical vulnerability in the SPIP content management system (CMS), identified as CVE-2026-77647, is under active exploitation in the wild. This flaw carries a CVSS score of 9.8, reflecting its severity. It allows a remote, unauthenticated attacker to execute arbitrary code on the server, leading to a complete system compromise. The SPIP development team has released a security update and urges all administrators of SPIP-based websites to upgrade immediately to prevent takeover of their servers.

Vulnerability Details

The vulnerability is an unauthenticated Remote Code Execution (RCE) flaw. It stems from a combination of two issues within the CMS's code:

1. Incorrect Code Block Identification: The application fails to correctly identify and handle <?php code blocks within certain inputs.
2. Input Mishandling: The var_export PHP function improperly handles inputs that contain a < character, which can be manipulated by an attacker.

An attacker can craft a special network request that leverages these two weaknesses. The crafted input bypasses security filters, allowing the attacker to inject and execute arbitrary PHP code on the server. No authentication or prior access is required to exploit this vulnerability, making any vulnerable, internet-facing SPIP installation a potential target.

Affected Systems

All versions of the SPIP CMS prior to the patched version 4.4.20 are affected.

Exploitation Status

This is not a theoretical threat. Exploitation attempts were observed in the wild in August 2026. Threat actors are actively scanning the internet for vulnerable SPIP instances and attempting to exploit this flaw. The ease of exploitation and the high potential impact make this a very attractive target for attackers.

Impact Assessment

A successful exploitation of CVE-2026-77647 results in a full compromise of the web server. An attacker can achieve complete control, allowing them to:

• Steal sensitive data from the website's database.
• Deface the website or replace its content.
• Use the compromised server as a pivot point to attack other systems on the internal network.
• Use the server's resources for malicious activities, such as hosting malware, sending spam, or participating in DDoS attacks.

Given that SPIP is a popular CMS, particularly in French-speaking regions, the potential number of affected websites is significant.

Cyber Observables — Hunting Hints

Security teams can hunt for signs of exploitation attempts in web server logs:

Detection Methods

• Version Check: The most straightforward detection method is to check the SPIP version. If it is less than 4.4.20, the site is vulnerable.
• Web Application Firewall (WAF): A properly configured WAF may be able to detect and block generic code injection attempts, but a specific rule for this CVE would be more effective. Look for WAF logs that show blocked requests with PHP code in parameters.
• File Integrity Monitoring (FIM): Use FIM to monitor the web root directory for the creation of new or modified files, which could indicate the presence of a web shell dropped by an attacker.

Remediation Steps

• Upgrade Immediately: The only effective remediation is to upgrade your SPIP installation to version 4.4.20 or newer. This can be done via a direct download or by using the spip_loader tool (version 7.0.0 or later).
• No Workarounds: There are no official workarounds. Disabling specific functions is not a reliable mitigation. Upgrading is mandatory.
• Post-Patch Actions: After patching, it is crucial to review the server for signs of compromise. Check for unknown files, suspicious user accounts, or unexpected running processes. If a compromise is suspected, restore from a known-good backup and change all credentials.