Ghostscript Spawned By Web/PHP Process Via Imagick Delegate (CVE-2026-65640) - Linux - STRICT
SIGMA detection rule by Adama ASSIONGBON (SOC & CTI Consultant), https://linkedin.com/in/adama-assiongbon-9029893a · Unknown
Detects the Ghostscript binary (gs) spawned as a child of a web server or PHP runtime process on Linux, consistent with ImageMagick's delegate mechanism processing a file that Imagick identified as PostScript content, the trigger condition for CVE-2026-65640. The attacker does not control which binary gets invoked, that is determined by the server's ImageMagick delegates.xml configuration, typically hardcoded to "gs", so this signal is not evadable by renaming an attacker-controlled implant the way a dropped webshell can be. Confirmation signal on a different surface than the web-layer rule, independent of whether the log pipeline captures the upload request body. SOC L1 should verify the source, affected host, user, process or request fields, timing, and related activity.
Detecte le binaire Ghostscript (gs) lance en tant qu'enfant d'un processus serveur web ou runtime PHP sous Linux, cohérent avec le mecanisme de delegation d'ImageMagick traitant un fichier qu'Imagick a identifie comme du contenu PostScript, la condition declenchante de CVE-2026-65640. L'attaquant ne controle pas quel binaire est invoque, cela depend de la configuration delegates.xml d'ImageMagick sur le serveur, generalement fixee sur "gs" : ce signal n'est donc pas evasible en renommant un implant controle par l'attaquant, contrairement a un webshell depose. Signal de confirmation sur une couche differente de la regle web, utile que le pipeline de logs capture ou non le corps de la requete d'upload. Le SOC L1 doit vérifier la source, l’hôte affecté, l’utilisateur, les champs de processus ou de requête, la chronologie et les activités associées.
title: Ghostscript Spawned By Web/PHP Process Via Imagick Delegate (CVE-2026-65640) - Linux - STRICT
id: 37dbb2fa-b95a-4322-bcc0-3c14fbc3e412
status: experimental
description: |
Detects the Ghostscript binary (gs) spawned as a child of a web server or PHP runtime process on Linux, consistent with ImageMagick's delegate mechanism processing a file that Imagick identified as PostScript content, the trigger condition for CVE-2026-65640. The attacker does not control which binary gets invoked, that is determined by the server's ImageMagick delegates.xml configuration, typically hardcoded to "gs", so this signal is not evadable by renaming an attacker-controlled implant the way a dropped webshell can be. Confirmation signal on a different surface than the web-layer rule, independent of whether the log pipeline captures the upload request body. SOC L1 should verify the source, affected host, user, process or request fields, timing, and related activity.
Detecte le binaire Ghostscript (gs) lance en tant qu'enfant d'un processus serveur web ou runtime PHP sous Linux, cohérent avec le mecanisme de delegation d'ImageMagick traitant un fichier qu'Imagick a identifie comme du contenu PostScript, la condition declenchante de CVE-2026-65640. L'attaquant ne controle pas quel binaire est invoque, cela depend de la configuration delegates.xml d'ImageMagick sur le serveur, generalement fixee sur "gs" : ce signal n'est donc pas evasible en renommant un implant controle par l'attaquant, contrairement a un webshell depose. Signal de confirmation sur une couche differente de la regle web, utile que le pipeline de logs capture ou non le corps de la requete d'upload. Le SOC L1 doit vérifier la source, l’hôte affecté, l’utilisateur, les champs de processus ou de requête, la chronologie et les activités associées.
references:
- https://www.cve.org/CVERecord?id=CVE-2026-65640
- https://nvd.nist.gov/vuln/detail/CVE-2026-65640
- https://wordpress.org/news/2026/08/wordpress-7-0-4-release/
- https://www.securityweek.com/wordpress-7-0-4-patches-remote-code-execution-vulnerability/
- https://cybersecuritynews.com/wordpress-imagick-rce-vulnerability/
author: Adama ASSIONGBON (SOC & CTI Consultant), https://linkedin.com/in/adama-assiongbon-9029893a
date: 2026-08-14
related:
- id: ef153a8d-c9d6-472c-b9c3-78e9ef3cff12
type: derived
- id: 4bc5899c-59fa-4d9d-b32a-6447436078e7
type: derived
- id: 94b4dcf3-8f11-4c2d-8132-40743026958a
type: derived
tags:
- attack.execution
- attack.t1190
- cve.2026-65640
logsource:
product: linux
category: process_creation
definition: >
Linux process creation telemetry from auditd, Sysmon for Linux or EDR. Required fields:
Image, ParentImage, ParentCommandLine, CommandLine, User.
detection:
selection_web_parent:
ParentImage|endswith:
- '/apache2'
- '/apache2-prefork'
- '/apache2-worker'
- '/httpd'
- '/httpd.worker'
- '/httpd.event'
- '/nginx'
- '/php'
- '/php-cgi'
- '/lsphp'
selection_php_fpm_parent_image:
ParentImage|contains:
- '/php-fpm'
- '/php7.'
- '/php8.'
- '/php-cgi'
- '/lsphp'
selection_php_fpm_parent_cmd:
ParentCommandLine|contains:
- 'php-fpm'
- 'php-cgi'
- 'lsphp'
- 'pool www'
selection_ghostscript_child:
Image|endswith:
- '/gs'
- '/gsc'
- '/gsx'
condition: >
(selection_web_parent or selection_php_fpm_parent_image or selection_php_fpm_parent_cmd) and
selection_ghostscript_child
fields:
- Computer
- User
- Image
- CommandLine
- ParentImage
- ParentCommandLine
- CurrentDirectory
- ProcessId
- ParentProcessId
falsepositives:
- Sites that intentionally use Imagick with the Ghostscript delegate to process legitimate EPS, PDF or PostScript uploads (print-ready design workflows, PDF thumbnail generation plugins). This cannot be distinguished from exploitation by command line alone, since the delegate invocation uses the same configured command template regardless of whether the input content is malicious or benign; if this workflow is expected in the environment, scope or suppress this rule at the SIEM level for the specific hosts running it rather than adding an ineffective content-based filter, or consider disabling the Ghostscript delegate if the feature is not actually needed
- Manual administrative use of Ghostscript from a web-triggered maintenance script (rare, validate against known baselines)
level: critical