Exploit discussion active in current signal (1 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
ILIAS before versions 9.22, 10.10, and 11.3 contains an unauthenticated PHP object injection vulnerability that allows unauthenticated attackers to execute arbitrary code by injecting serialized objects through the LTI authentication endpoint and triggering deserialization via the Shibboleth back-channel logout endpoint. Attackers can write arbitrary serialized objects into session storage, then exploit an available POP gadget through the logout endpoint's unrestricted deserialization to write attacker-controlled PHP content to a web-accessible path and achieve remote code execution as the web server user.
Priority
MEDIUM
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-08-27 | 1 | Disclosure1 |
| 2026-09-11 | 3 | Disclosure1Exploit1PoC1 |
| 2026-09-12 | 1 | PoC1 |
[remote] CVE-2026-80428 Unauthenticated PHP Object Injection via Shibboleth - ILIAS < 9.22, 10.0 < 10.10, 11.0 < 11.3 - RCE https://dlvr.it/TVR2Cl
Post summary
The tweet discloses CVE-2026-80428, an unauthenticated PHP Object Injection in Shibboleth affecting ILIAS versions that can lead to RCE, without mentioning patches, exploits, or active exploitation.
🔴 CVE-2026-80428: ILIAS'ta kritik, kimlik doğrulama gerektirmeyen PHP Object Injection açığı 26 Ağustos'ta yayınlandı. Geçtiğimiz günlerde ise public exploit/PoC yayınlandı. Açık, belirli koşullarda saldırganların uzaktan kod çalıştırmasına (RCE) olanak sağlayabiliyor. Etkilenen sürümler: ILIAS < 9.22, 10.0–10.9 ve 11.0–11.2. ILIAS'ı 9.22, 10.10 veya 11.3 ve üzeri sürümlere güncelleyin. Güncelleme mümkün değilse Shibboleth entegrasyonunu ve ilgili logout endpoint'lerini geçici olarak erişim kısıtlamasıyla koruyun.
Post summary
CVE‑2026‑80428, a critical PHP Object Injection that allows remote code execution in ILIAS, was disclosed on Aug 26 and a public PoC was released. Patching to newer ILIAS versions is recommended, with a temporary workaround using Shibboleth integration if upgrade is not possible.
CVE-2026-80428: Unauthenticated PHP object injection in ILIAS LMS chains two auth-exempt endpoints into RCE as the web server user, affecting ILIAS < 9.22, 10.0 < 10.10, and 11.0 < 11.3. - CVE-2026-80428 is a two-stage chain. Stage 1 POSTs to ltiauth.php, which writes attacker-controlled session data to the session table. A "\w+|" marker in the parameter value breaks the custom session parser, causing raw serialized PHP to land in ilSession as if it were a legitimate value. Stage 2 POSTs a SOAP LogoutNotification to shib_logout.php, which deserializes every live session row with no class allowlist, triggering the payload. - The gadget is GuzzleHttp\Cookie\FileCookieJar, bundled in ILIAS's own vendor tree. __destruct() calls file_put_contents() with an attacker-supplied path and JSON-embedded PHP, dropping a webshell to the docroot. No authentication is required at any step. - Forensic artifacts to hunt: unexpected .php files in the ILIAS public docroot (random-hex names like util_a1b2c3.php), POST requests to /ltiauth.php and /shib_logout.php in web server logs, SOAP body content in POST payloads to shib_logout.php, and new session rows with serialized object strings in the ilSession database table. - A working public exploit was published 2026-08-31 by DigiProSec. v9 and v10 are confirmed exploitable; v11 has a code path issue that prevents exploitation as packaged, but patch regardless. Fixed in 9.22, 10.10, and 11.3. #DFIR_Radar
Post summary
CVE-2026-80428 is a two‑stage PHP object injection that leads to RCE as web‑server user, a public exploit has been released, and fixes are shipped in 9.22, 10.10, and 11.3.
🔒 #CyberSecurity CVE-2026-80428: ILIAS LMS Unauthenticated PHP Object Injection via Shibboleth —… "A public proof-of-concept exploit has been released for CVE-2026-80428, a critical…" 🔗 https://securityarsenal.com/blog/cve-2026-80428-ilias-lms-unauthenticated-php-object-injection-via-shibboleth-detection-and-remediation-guide #CyberSecurity #ThreatIntel #critical #zeroday #cve
Post summary
A public proof‑of‑concept exploit for CVE‑2026‑80428, a critical unauthenticated PHP object injection in ILIAS LMS, has been released, but no active exploitation or patch info is disclosed.
CVE-2026-80428 ILIAS deserialises stored session data for an unauthenticated caller. The Shibboleth back-channel endpoint at components/ILIAS/AuthShibboleth/resources/shib_logout.ph… https://www.cve.org/CVERecord?id=CVE-2026-80428
Post summary
The post identifies CVE-2026-80428 as an unauthenticated deserialization flaw in ILIAS via a Shibboleth endpoint, but provides no proof of concept, exploitation code, or mitigation details.