Apache

Mentions · 7d1
Mentions · 30d2
All mentions9
First seenSep 2, 2026
Last mentioned3d ago

Timeline

9 articles · newest first

Cloudflare opens PHP CTF for php2shell WAF bypasses

HackerOne participants must get code execution on PHP 8.5.11, read a resetting flag, and privately report a distinct bypass.

Cloudflare Blogupdated Oct 28, 00:00 UTC · 3d agofirst Oct 27, 13:00 UTC · 3d agoTools 30 sourcesCVE-2026-109618 CVE-2026-1096192 · 1 read

PHP patches unauthenticated RCE flaws dubbed PHP2Shell

Fixes are in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35; a public exploit hits before application code runs.

Help Net Securityupdated Oct 21, 14:07 UTC · 9d agofirst Oct 21, 13:51 UTC · 9d agoVulnerability 5 sourcesCVE-2026-109618 CVE-2026-1096191

The Truth about GET and HTTP Standards, (Tue, Sep 22nd)

SANS research tests Apache, NGINX, and Python server responses to non-standard HTTP GET requests with a body, finding inconsistent handling.

SANS Internet Storm CenterSep 22, 14:48 UTC · Sep 22, 2026Research2 · 2 reads

PoisonedRefresh: A Fileless Linux Rootkit That Injects PHP Web Shells Into F5 BIG-IP APM Server Memory

Sophos details PoisonedRefresh, a fileless Linux rootkit that injects a memory-resident PHP web shell into F5 BIG-IP APM after exploitation of CVE-2025-53521.

Security AffairsSep 9, 08:50 UTC · Sep 9, 2026MalwareExploitedCVE-2025-535212 · 1 read

F5 BIG-IP APM Malware Injects a PHP Web Shell Into Memory, Evading Disk Scans

Sophos found F5 BIG-IP APM malware that injects a PHP web shell into Apache's memory, evading disk scans, linked to exploited CVE-2025-53521.

The Hacker NewsSep 9, 07:36 UTC · Sep 9, 2026MalwareExploitedCVE-2025-535217 · 5 reads

Hackers breach F5 BIG-IP APM devices to deploy Linux rootkit

Sophos analyzed a Linux rootkit on F5 BIG-IP APM devices that injects a fileless PHP web shell, likely after CVE-2025-53521 exploitation.

BleepingComputerSep 8, 20:08 UTC · Sep 8, 2026MalwareExploitedCVE-2025-53521

Gambling Goblin Turns Brazilian Government Sites Into SEO Weapons

Check Point links Chinese-speaking cluster Gambling Goblin to SEO-fraud compromises of Brazilian government sites via malicious Apache modules since mid-2025.

Infosecurity MagazineSep 2, 14:00 UTC · Sep 2, 2026Threat actor2 · 1 read

Malicious Apache Modules Hijack Brazilian Government Site Traffic to Push Betting Pages

Check Point links Gambling Goblin, a Chinese-speaking cluster, to malicious Apache modules hijacking Brazilian government servers to promote betting sites.

The Hacker NewsSep 2, 13:44 UTC · Sep 2, 2026Threat actorExploited1 · 1 read

Gaming the system: how a Chinese-speaking actor turned Brazilian government sites into an SEO weapon

Check Point identifies Chinese-speaking group Gambling Goblin hijacking Brazilian government domains via malicious Apache modules for SEO-manipulated gambling phishing.

Check Point ResearchSep 2, 10:16 UTC · Sep 2, 2026Threat actor2

Related CVEs

by mentions

CVE-2025-535212%9.3
Stack-Based Buffer Overflow in F5 BIG-IP APM Enables Unauthenticated RCE
published Oct 15, 2025F5 BIG-IP (BIG-IP Access Policy Manager / APM)KEV
CVE-2026-109619100%9.2
Use-after-free RCE in PHP via stale request globals
published 9d agophpKEVPoC ×15
CVE-2026-109618100%9.2
OOM longjmp memory flaw enabling RCE in PHP
published 9d agophpKEVPoC ×25

Appears with

ESETvendor · 4
Earth Berberokathreat actor · 3
Gambling Goblinthreat actor · 3
Sophosvendor · 3
AlphaAgentmalware · 3
F5vendor · 3
DownPromalware · 3
oRATmalware · 3
PoisonedRefreshmalware · 3
Check Pointvendor · 2
BIG-IP APMproduct · 2
Trend Microvendor · 2
Shadowserver Foundationorganization · 2
libphpproduct · 2
PHPproduct · 2
Cloudflarevendor · 2

Entities are extracted by the model from each article. First seen Sep 2, 2026, last mentioned 3d ago. Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.