CVE-2026-37552: MixPHP Framework RCE Vulnerability

CVE-2026-37552 Overview

CVE-2026-37552 is an unsafe deserialization vulnerability affecting MixPHP Framework versions 2.x through 2.2.17. The flaw resides in the sync-invoke TCP server implemented in Server.php. The server accepts data from a TCP socket, passes it directly to Opis\Closure\unserialize(), and then executes the resulting closure through call_user_func(). The TCP connection performs no authentication or signature verification. Any local actor with access to the bound loopback port can send a crafted serialized PHP closure and achieve arbitrary code execution on the host. The weakness is classified under [CWE-502: Deserialization of Untrusted Data].

Critical Impact
A local attacker who can reach the 127.0.0.1 sync-invoke port can execute arbitrary PHP code in the context of the MixPHP process, leading to full compromise of confidentiality, integrity, and availability.

Affected Products

MixPHP Framework 2.x
MixPHP Framework versions up to and including 2.2.17
Applications embedding the mix-php/mix sync-invoke TCP server component

Discovery Timeline

2026-05-01 - CVE-2026-37552 published to NVD
2026-05-07 - Last updated in NVD database

Technical Details for CVE-2026-37552

Vulnerability Analysis

The vulnerability lives in the MixPHP sync-invoke server, specifically at line 87 of Server.php. The server reads bytes from a connected TCP client and feeds them straight into Opis\Closure\unserialize(). The deserialized object — expected to be a PHP closure — is then invoked using call_user_func(). Because PHP deserialization can instantiate arbitrary classes and trigger magic methods such as __wakeup and __destruct, an attacker controls program state at multiple points before code execution. The use of Opis\Closure extends the attack surface to serialized closures, allowing the attacker to ship an entire callable that executes on the server. The reachable endpoint is bound to 127.0.0.1, restricting the attack to local context but not to privileged users.

Root Cause

The root cause is the absence of authentication, integrity verification, and input validation on data received over the TCP socket. The server treats untrusted bytes as a trusted closure payload. No HMAC, no shared secret, and no schema check sits between the network read and the deserializer.

Attack Vector

An attacker requires local access to the host running the MixPHP sync-invoke service. Local access can be obtained through a low-privileged shell account, a co-tenanted web application running on the same host, or a separate vulnerability that yields localhost network reach. The attacker opens a TCP connection to the loopback port, transmits a serialized payload containing an Opis\Closure object whose body executes attacker-chosen PHP, and the server invokes it. The result is arbitrary code execution under the user account running the MixPHP process.

For technical details on the affected code path, see the MixPHP Server.php source and the proof-of-concept gist.

Detection Methods for CVE-2026-37552

Indicators of Compromise

Unexpected child processes spawned by the PHP process hosting the MixPHP sync-invoke server, particularly shells, curl, wget, or compilers.
Outbound network connections originating from the MixPHP worker process to unfamiliar destinations.
New or modified PHP files within the application directory immediately after sync-invoke traffic.
TCP connections to 127.0.0.1 on the sync-invoke port from processes that are not the documented MixPHP client.

Detection Strategies

Inventory hosts running mix-php/mix at versions 2.x through 2.2.17 using software composition analysis on composer.lock and vendor directories.
Hunt for process lineage where the PHP interpreter running MixPHP forks shell or scripting interpreters.
Inspect packet captures or eBPF traces on loopback for serialized PHP markers such as O: and C: patterns destined for the sync-invoke port.
Audit application logs for malformed or oversized sync-invoke requests preceding suspicious activity.

Monitoring Recommendations

Monitor loopback listeners and alert on new processes binding ports historically associated with MixPHP sync-invoke.
Track file integrity on PHP source directories and writable cache paths used by the framework.
Forward PHP error logs and process telemetry to a centralized analytics pipeline for correlation.

How to Mitigate CVE-2026-37552

Immediate Actions Required

Identify all hosts running MixPHP 2.x through 2.2.17 and confirm whether the sync-invoke TCP server is enabled.
Restrict access to the loopback sync-invoke port using host-based firewall rules and process isolation.
Run the MixPHP process under a dedicated low-privilege user to limit the impact of code execution.
Audit local accounts and co-tenanted services that can reach 127.0.0.1 on the affected port.

Patch Information

No fixed version is referenced in the published advisory data. Consult the mix-php/mix GitHub project for the latest releases and apply any vendor patch that adds authentication, signature verification, or replaces Opis\Closure\unserialize() with a safe transport for inter-process invocation.

Workarounds

Disable the sync-invoke TCP server if the feature is not required by the application.
Replace the closure-based RPC with a non-deserializing transport such as JSON-RPC over an authenticated Unix domain socket.
Wrap incoming sync-invoke payloads with an HMAC verified before any call to Opis\Closure\unserialize().
Apply Linux namespace or container isolation so that untrusted local users cannot reach the loopback port of the MixPHP process.

bash

# Example: block non-root local access to the MixPHP sync-invoke port using iptables owner matching
sudo iptables -A INPUT -i lo -p tcp --dport 9503 -m owner ! --uid-owner mixphp -j DROP