Found defunct.dat on your site? You've got a problem.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-75650 | Unauthenticated Template Injection RCE in Adobe Commerce and Magento (CVE-2026-75650) | 10.0 | 99% | KEVPoC ×2 | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 45.77.95.4 | hield , which would have prevented all of these cases. IOCs 45.77.95.4 /pub/defunct.dat /errors/defunct.dat /pub/qfile /defunct.da |
From the original article
2 min read at sansec.io
The Sansec Shield WAF detected mass scans for "defunct. dat" and "qfile" files this week. As it turns out, these files contain connection keys that can be used to launch a GSocket reverse shell, effectively handing over the server to anyone with the key.
By Sansec Forensics Team · sansec.io
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.