Hackers Exploit Critical Craft CMS Flaws; Hundreds of Servers Likely Compromised

The base Component class in yiisoft/yii2 2.0.48 (CWE-470, unsafe reflection) has a flaw in the __set() magic method: it does not validate that an assigned value is a valid Behavior class name or configuration, allowing attackers to instantiate arbitrary classes. An attacker triggers it by sending attacker-controlled data that the application passes into Component property assignment, supplying chosen class names whose constructors receive parameters and whose setter methods are invoked. Depending on the dependencies installed in the application, this can lead to execution of arbitrary code, retrieval of sensitive information, or unauthorized access; the flaw is network-exploitable with no privileges or user interaction required (CVSS 3.1: 9.1 critical). Any PHP application or CMS built on the Yii 2 framework running the affected version is exposed. A public proof-of-concept is available via huntr, the issue is not yet in CISA KEV, and EPSS assigns an 80.2% probability of exploitation within 30 days (100th percentile); related headlines report exploitation of flaws in Craft CMS, a Yii-based application, indicating the ecosystem is actively targeted.

Do: Upgrade yiisoft/yii2 to a release newer than 2.0.48 (the flaw was addressed in 2.0.49) and rebuild/deploy dependent applications. Audit application code for user-controlled input that flows into Component property assignment or __set(), and validate/whitelist class names there. Operators of Yii-based products such as Craft CMS should verify their framework version and apply vendor-supplied updates promptly, given the high EPSS score.

Yii 2 versions before 2.0.52 mishandle the attaching of behaviors defined with an __class array key, reintroducing the flaw fixed for CVE-2024-4990, an unauthenticated remote code execution issue (CWE-424, improper protection of alternate path). The defect is triggered remotely without authentication when a vulnerable application attaches behaviors this way, giving an attacker high-impact code execution (CVSS 9.8). Any application built on a vulnerable Yii 2 release is affected, most prominently Craft CMS sites, which were the target of an observed in-the-wild campaign between February and April 2025. Exploitation is confirmed: the flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2025-05-02, carries an 84.6% EPSS probability of exploitation within 30 days, and a public SensePost writeup documents the active Craft CMS exploitation campaign. The top headline reports that hundreds of servers were likely compromised in that campaign.

Do: Upgrade Yii 2 to version 2.0.52 or later; Craft CMS operators should immediately update Craft CMS to its patched release that bundles fixed Yii, and confirm the resolved framework version on the system. Because the campaign ran from February through April 2025, review web/application logs and hosted files for indicators from the SensePost writeup, treating any unpatched internet-facing Yii 2 or Craft CMS host as likely compromised. Federal agencies must apply the KEV required action (vendor mitigations or BOD 22-01 guidance) by the CISA deadline.

Craft CMS contains a code injection vulnerability (CWE-94) that allows a remote attacker to execute arbitrary code on affected servers. CISA's listing does not specify the exact attack path or authentication requirements, but the flaw is remotely triggerable and grants arbitrary code execution, which typically means full compromise of the web server and a foothold for follow-on activity such as ransomware (ransomware use is not yet confirmed). Any organization running a Craft CMS instance is in scope, including internet-facing content sites and deployments where the Craft admin panel is reachable from the internet. The vulnerability was added to CISA's Known Exploited Vulnerabilities catalog on 2026-03-20, confirming exploitation in the wild, and EPSS assigns a 99.8% probability of exploitation within 30 days (100th percentile), although no public proof-of-concept is known. No CVSS score has been published yet, so defenders should treat the flaw as urgent given the KEV listing and near-certain EPSS likelihood.

Do: Apply the patched Craft CMS release per the vendor's security advisory referenced in CISA's KEV entry (specific fixed version numbers are not provided in the source data), prioritizing internet-exposed instances, and U.S. federal agencies should follow BOD 22-01 requirements for KEV-listed flaws. Until patched, restrict network access to the Craft CMS control panel/admin interface and review web and application logs for signs of code injection or unexpected process execution, since exploitation in the wild is confirmed while ransomware use remains unknown. Given the 99.8% EPSS score and KEV listing, treat discovery and patching of all Craft CMS instances, including headless deployments, as an urgent, time-boxed task.

Qualitia Active! mail 6 (BuildInfo 6.60.05008561 and earlier) contains a stack-based buffer overflow (CWE-121) that is triggered when the webmail server processes a single specially crafted network request, with no authentication or user interaction required. A remote unauthenticated attacker who sends such a request can execute arbitrary code on the server or crash the service, causing a denial-of-service condition. With a CVSS 3.1 score of 9.8 (AV:N/AC:L/PR:N/UI:N, high impact on confidentiality, integrity, and availability), any internet-exposed deployment is at critical risk; the product is a webmail platform widely deployed by Japanese enterprises, universities, and government organizations. CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2025-04-28, confirming exploitation in the wild, though no public proof-of-concept is known and ransomware use has not been reported. Organizations running affected builds should treat their webmail servers as likely targets and patch per vendor guidance immediately.

Do: Upgrade Active! mail 6 to a BuildInfo later than 6.60.05008561, following Qualitia's advisory (JPCERT is the assigning CNA, so its alert should be used as the authoritative update reference). Until patched, restrict internet access to the webmail interface via IP allow-listing or VPN and review server logs for exploitation attempts, since in-the-wild exploitation is confirmed. US federal agencies must apply the required mitigations per vendor instructions and BOD 22-01 timelines, or discontinue use of the product if mitigations are unavailable.