Search: “web shells”

36 stories in the last 30d

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Exploit / PoC 44 Threat actor 28 Malware 22 Vulnerability 9 Industry 5 AI safety & security 5 Tools 3 Research 3 Advisory 3 Data breach 2 Phishing & fraud 2 Ransomware 2 Model release 1 Policy & legal 1

SeverityAll critical 25 high 63 medium 24 low 2 info 17

Adobe Patches Magento Zero-Day Exploited to Deploy Rust Backdoor and PHP Web Shell

Adobe patches actively exploited Magento zero-day CVE-2026-75650 (CVSS 10.0), abused since Sept 4 to deploy a Rust backdoor and PHP web shells.

Adobe released an emergency hotfix (VULN-39341) for CVE-2026-75650 (CVSS 10.0), dubbed StyleSmuggler by Sansec, which abuses Magento's template system via PHP code injection to trigger unauthenticated remote code execution in Adobe Commerce and Magento Open Source. Exploitation began September 4, 2026, with attackers deploying a Rust-based Linux backdoor and a PHP dropper that writes a web shell; one managed server was compromised 50 minutes after the first report. Previdian honeypots recorded 12 exploitation attempts from two unique IPs in China and Romania since September 7, all unsuccessful. Adobe urges merchants to apply the patch and rotate encryption keys.

The Hacker NewsSep 8, 09:13 UTC · 8d agoExploit / PoC in the wildCVE-2026-75650

Attackers Exploit WooCommerce Wholesale Lead Capture Flaw to Plant PHP Web Shells

Attackers exploit CVE-2026-27540 in WooCommerce Wholesale Lead Capture to upload PHP web shells; Wordfence blocked 100,000+ attempts since June 2026.

Wordfence reports active exploitation of CVE-2026-27540 (CVSS 9.8), an unauthenticated arbitrary file upload in the wwlc_file_upload_handler AJAX action of the WooCommerce Wholesale Lead Capture plugin (versions through 2.0.3.1, 6,000+ installs), enabling remote code execution via uploaded PHP web shells. Over 100,000 exploit attempts were blocked since June 2026, including 99 in the last 24 hours, traced to ten listed IP addresses. Separately, two critical flaws (CVE-2026-78159 and CVE-2026-78006) in The Events Calendar, installed on 600,000+ sites, allow unauthenticated RCE and full site takeover via PHP object injection chains. StellarWP patched the affected plugin versions 6.17.3 and 6.17.4 in releases 6.17.3.1 and 6.17.4.1.

The Hacker Newsupdated 15:00 UTC · 4h agofirst 05:48 UTC · 13h agoExploit / PoC in the wild 6 sources CVE-2026-27540 CVE-2026-78159 CVE-2026-78006

StyleSmuggler: Magento and Adobe Commerce 0-day RCE (CVE-2026-75650) under active attack

Sansec details actively exploited StyleSmuggler 0-day (CVE-2026-75650, CVSS 10.0) unauthenticated RCE in Magento and Adobe Commerce, patched by Adobe hotfix APSB26-146.

Sansec is investigating StyleSmuggler, an actively exploited unauthenticated remote code execution chain in Magento Open Source and Adobe Commerce, now tracked as CVE-2026-75650 with CVSS 10.0. Adobe released hotfix VULN-39341 via APSB26-146 (priority 1) on September 7 for versions 2.4.4 through 2.4.9, but stores were being exploited for roughly three days before the fix existed. The implant is a Rust backdoor that disguises itself as kworker, fc-cache, or chronyd processes and exfiltrates host data in MessagePack records sent as fake NTP replies over UDP port 123. Adobe advises rotating the encryption key and every credential it protected, and Sansec stresses patching does not clean already-compromised stores.

Sansec (Magento / e-commerce security)Sep 5, 00:00 UTC · 11d agoExploit / PoC in the wildCVE-2026-756501

Active exploitation of Cisco Secure Firewall Management Center vulnerabilities

Cisco Talos reports in-the-wild exploitation of critical FMC flaw CVE-2026-20079 by three clusters including a Sandworm-linked APT and Qilin ransomware affiliates.

Cisco Talos is tracking active exploitation of CVE-2026-20079 (CVSS 10.0), an authentication bypass in Cisco Secure Firewall Management Center that lets unauthenticated remote attackers execute scripts and obtain root access, and CVE-2026-20316 (CVSS 5.3), which permits low-privileged logins and can be chained for privilege escalation. Talos identified three post-compromise clusters: UAT-12197 deploying JSP web shells and a JAR command executor for credential theft; UAT-11823, an APT overlapping with Sandworm, deploying a Netcat reverse shell and Cyclops Blink malware; and UAT-11988, assessed as a ransomware operator with TTPs consistent with Qilin affiliates. Hotfixes are available, with a comprehensive hardening release due the week of September 14, 2026.

Cisco TalosSep 9, 16:08 UTC · 7d agoExploit / PoC in the wild 2 sources CVE-2026-20079 CVE-2026-20316

Hackers Exploit FortiGate SSL-VPN Flaw to Breach Thai ISP and Deploy MeshCentral Backdoor

Threat actors exploited FortiOS SSL-VPN flaw CVE-2024-21762 to breach Thai ISP Triple T Broadband, gaining root-level persistence via MeshCentral agents.

Attackers exploited CVE-2024-21762, an out-of-bounds write enabling unauthenticated RCE in FortiOS SSL-VPN, against Triple T Broadband's FortiGate 60F at mail.3bb.co.th, launching a Node.js reverse shell via a ROP payload. Hunt.io uncovered the operation through an exposed staging directory at 92.63.180[.]133:8888 containing 298 files of exploits, credential-harvesting scripts, session cookies, and a device inventory. Post-compromise, the actors deployed MeshCentral agents (device group TH-3BB, C2 www.ayuthayatech.com) running as root, plus a hidden SUID backdoor at /usr/local/bin/.rc, and also targeted an internal Pentaho/Tomcat server with Ghostcat (CVE-2020-1938). A cleanup script removed logs, shell histories, and web shells while deliberately preserving the MeshCentral agent and SUID backdoor.

GBHackersSep 15, 05:20 UTC · 1d agoExploit / PoC in the wild 3 sources CVE-2024-21762 CVE-2020-1938

Attackers Exploit Critical Cisco FMC Flaw to deploy Qilin ransomware

Three threat groups, including Qilin ransomware operators, exploit critical Cisco FMC flaws CVE-2026-20079 and CVE-2026-20316 for root access, credential theft, and ransomware.

Cisco Talos identified three post-compromise clusters exploiting recently patched Cisco Secure Firewall Management Center flaws. UAT-12197 deploys JSP web shells and harvests credentials; UAT-11823 (with Sandworm-overlapping tooling) installs Cyclops Blink for persistence; UAT-11988 (Qilin) uses static credentials, extensive reconnaissance, SOCKS5 proxies, reverse-SSH tunnels, AV killers, and ransomware deployment. CISA added CVE-2026-20079 to the KEV catalog with a September 12, 2026 patch deadline for federal agencies; Cisco urges immediate hotfix application.

Security Affairsupdated Sep 14, 09:27 UTC · 2d agofirst Sep 11, 10:14 UTC · 5d agoExploit / PoC in the wild 11 sources CVE-2026-20079 CVE-2026-203165· 2 reads

Adobe Patches Over 170 Vulnerabilities, Including Commerce Zero-Day

Adobe patched over 170 flaws, including in-the-wild zero-day CVE-2026-75650 (CVSS 10) in Adobe Commerce/Magento enabling unauthenticated RCE and web shell deployments.

Adobe released fixes for more than 170 vulnerabilities across Experience Manager, Acrobat Reader, Photoshop and other products. The Commerce zero-day CVE-2026-75650 (CVSS 10) allows unauthenticated code injection leading to remote code execution and has been exploited since September 4. Sansec reported multiple threat actors deploying backdoors and web shells via the bug, dubbed StyleSmuggler, which triggers injected code through Magento's Payment Transaction Failed Reminder email. Adobe also patched critical Campaign Classic command injection CVE-2026-82004 and two critical ColdFusion RCE flaws (CVE-2026-48273, CVE-2026-75746).

SecurityWeekSep 8, 18:37 UTC · 8d agoExploit / PoC in the wildCVE-2026-75650 CVE-2026-82004 CVE-2026-48273+1 CVEs1

Previously patched Citrix NetScaler flaw exploited in the wild (CVE-2026-8452)

Actively exploited Citrix NetScaler flaw CVE-2026-8452, patched in June, now added to CISA KEV; attackers deploy web shells and run discovery commands.

CISA added CVE-2026-8452, a memory overflow vulnerability in Citrix NetScaler ADC/Gateway, to its Known Exploited Vulnerabilities catalog on August 26, 2026, giving federal agencies until August 29 to remediate. Citrix disclosed and patched the flaw on June 30, 2026 in versions 14.1-72.61, 13.1-63.18, and 13.1-37.272. watchTowr Labs found the flaw can be chained into unauthenticated remote code execution and released a PoC on August 14. Previdian and Defused reported exploitation with web shells named x.php and z.php from at least three unique source IPs.

Help Net SecurityAug 27, 00:00 UTC · 20d agoExploit / PoC in the wildCVE-2026-8452 CVE-2015-3246 CVE-2015-5287+3 CVEs

StyleSmuggler: The Magento Zero-Day Behind New Store Attacks

Sansec reports actively exploited Magento/Adobe Commerce zero-day StyleSmuggler enabling unauthenticated RCE and Rust backdoor installation on fully patched stores since September 4.

Sansec discovered StyleSmuggler, an unpatched zero-day in Magento Open Source and Adobe Commerce, affecting all current versions including 2.4.7, 2.4.8 and 2.4.9, with attacks observed since September 4. The two-stage attack poisons Magento's template system via the styles property and executes the injected PHP during 'Payment Transaction Failed Reminder' email rendering, working even when email delivery fails and when sessions are moved to Redis. Successful compromise installs a lightweight Rust backdoor disguised as fc-cache or chronyd that beacons every 60 seconds with 48-byte UDP packets to NTP port 123 at ntp.timesync.to. A second attacker deployed a PHP web shell in product-image cache directories, hidden behind 404 responses unless a correct X-Cache-Token header is present.

Security AffairsSep 7, 17:49 UTC · 9d agoExploit / PoC in the wild

Week in review: Linux rootkit deployed on F5 BIG-IP APM devices, Cisco FMC bugs exploited

Weekly roundup: Cisco FMC and N-able N-central zero-days exploited in the wild, MikroTik RouterOS hijacks, Microsoft Patch Tuesday ships two exploited zero-days.

State-sponsored and financially-motivated attackers are actively exploiting CVE-2026-20079, a critical authentication bypass in Cisco Secure Firewall Management Center (FMC), alongside CVE-2026-20316. N-able issued an emergency hotfix for CVE-2026-86218, a critical pre-auth RCE in the N-central RMM platform exploited in the wild. CERT Polska disclosed six RouterOS vulnerabilities being chained to hijack internet-exposed MikroTik devices. Microsoft's September 2026 Patch Tuesday shipped a record patch count including two zero-days, while roughly 67,000 Trezor customers faced phishing after a shipping-partner breach and researchers privately disclosed a zero-click WeChat worm to Tencent.

Help Net SecuritySep 13, 08:00 UTC · 3d agoExploit / PoC in the wildCVE-2026-20079 CVE-2026-20316 CVE-2026-862182· 1 read

Over 440,000 Exploit Attempts Target Super Forms and Elementor Pro RCE Flaws

Wordfence blocked 440,000+ exploit attempts against critical unauthenticated RCE flaws in WordPress plugins Super Forms and Elementor Pro.

Wordfence reports mass exploitation of two unauthenticated arbitrary file upload RCE flaws: CVE-2026-14894 in Super Forms (CVSS 9.8, fixed in 6.3.314) and CVE-2026-32475 in Elementor Pro (CVSS 9.0/9.8, fixed in 4.2.2), with over 250,000 and 190,000 blocked exploit attempts respectively. Attackers upload Base64-encoded PHP web shells such as Mushr00w_upl.php to execute code, create administrator accounts, exfiltrate data, or seize sites. Super Forms exploitation began July 14, 2026 and peaked above 40,000 requests on August 18; Elementor Pro attacks started August 19. Successful Elementor Pro exploitation requires a published page with a Form widget containing a File Upload field.

The Hacker NewsSep 4, 08:48 UTC · 12d agoExploit / PoC in the wildCVE-2026-14894 CVE-2026-32475

More JFrog Artifactory bugs under attack, and all 3 have patches

Multiple attackers are exploiting three JFrog Artifactory CVEs, including critical auth-bypass CVE-2026-82329, to gain admin access and install backdoors.

Wiz confirmed in-the-wild exploitation of all three JFrog Artifactory vulnerabilities: CVE-2026-42018 (high, improper authentication token leak), CVE-2026-42016 (high, privilege escalation), and CVE-2026-82329 (critical, unauthenticated authentication bypass). Starting August 15, attackers chained the first two bugs against self-hosted instances to gain admin access and dropped a custom Rust backdoor for C2; from September 1-8 several attackers exploited CVE-2026-82329. Post-exploitation included persistent admin accounts, Groovy plugins for remote code execution, web shells, token minting, key theft, and reconnaissance. Patching velocity has been slow, with 49-62% of organizations still vulnerable to individual bugs weeks after fixes were released.

The Register · Securityupdated Sep 14, 09:27 UTC · 2d agofirst Sep 11, 17:43 UTC · 5d agoExploit / PoC in the wild 7 sources CVE-2026-42018 CVE-2026-42016 CVE-2026-82329

CISA Adds Six Exploited Flaws to KEV, Including NetScaler, Linux, and SQL Server Bugs

CISA added six actively exploited flaws to KEV, led by Citrix NetScaler CVE-2026-8452, with federal patch deadlines set.

CISA added six flaws to the KEV catalog on August 27, 2026, citing evidence of active exploitation, led by CVE-2026-8452, an improper buffer restriction in Citrix NetScaler ADC and Gateway that can cause denial-of-service. Defused Cyber and Previdian reported active exploitation of CVE-2026-8452, with 36 attempts over 12 days from 12 attacker IPs deploying web shells x.php and z.php. The other additions cover SQL Server RCE (CVE-2019-1068), Linux kernel out-of-bounds write (CVE-2022-0995), Red Hat ABRT and libuser privilege escalations (CVE-2015-5287, CVE-2015-3246), and AjaxPro deserialization RCE (CVE-2021-23758). FCEB agencies must patch CVE-2019-1068 and CVE-2026-8452 by August 29, 2026, and the rest by September 9, 2026.

The Hacker NewsAug 27, 07:05 UTC · 20d agoExploit / PoC in the wildCVE-2019-1068 CVE-2026-8452 CVE-2022-0995+3 CVEs

Poland's CERT Warns of Active Exploitation of Critical Zimbra Collaboration Suite Flaw

CERT Polska confirms active exploitation of critical unauthenticated RCE CVE-2026-73570 in Zimbra Collaboration Suite, patched July 20.

CERT Polska confirmed threat actors are actively exploiting CVE-2026-73570, an unauthenticated OS command injection in Zimbra Collaboration Suite allowing arbitrary shell commands as the zimbra user. Exploitation requires the SNMP trap service via snmp_notify with swatchdog running, which is enabled by default; Shadowserver tracks over 12,100 internet-exposed Zimbra servers. Zimbra fixed the flaw in version 10.1.20 on July 20, 2026, 28 days before exploitation was confirmed. Historical Zimbra targeting includes Winter Vivern, APT29, and APT28 campaigns.

Security AffairsAug 21, 09:14 UTC · 26d agoExploit / PoC in the wildCVE-2026-73570

⚡ Weekly Recap: Chrome 0-Day, Router Hijacks, Coder Supply Chain Attack and More

Weekly recap: actively exploited Chrome V8 zero-day, MikroTik RouterOS zero-day chain, Magento StyleSmuggler backdoor, and critical N-able N-central flaws.

Google patched an actively exploited Chrome V8 type confusion zero-day, CVE-2026-85046 (CVSS 8.8), the sixth exploited Chrome zero-day of 2026. CERT Polska warned of the MikroTrick exploit chain (CVE-2026-67276 and CVE-2026-86060, CVSS 9.2) giving unauthenticated full control of MikroTik RouterOS devices via SSH, observed since September 2. Sansec disclosed the StyleSmuggler Magento/Adobe Commerce zero-day used since September 4 to inject a Rust backdoor into online stores, while N-able patched three critical N-central flaws (CVE-2026-86206, CVE-2026-86207, and CVE-2026-86218, CVSS 10.0) with Huntress observing likely exploitation. Elastic and Morphisec also detailed RevStealer, an information stealer spread via game cheats and a fake Claude Desktop app.

The Hacker NewsSep 7, 14:36 UTC · 9d agoExploit / PoC in the wildCVE-2026-85046 CVE-2026-86206 CVE-2026-86207+7 CVEs

Telerik UI Padding-Oracle Bug Chained to Unauthenticated RCE — Public Exploit Released

TantoSec published a working exploit chaining a Telerik UI padding oracle to unauthenticated RCE; Progress patched the flaws in July.

TantoSec's Marcio Almeida released a full exploit chain and tooling for the RadAsyncUpload control in Telerik UI for ASP.NET AJAX, turning a padding oracle (CVE-2026-13182) into unauthenticated RCE via an unguarded type-resolution flaw (CVE-2026-13181, CVSS 8.1). Exploitation requires a rendered RadAsyncUpload handler and an explicit non-default encryption key, and took roughly 127,000 oracle requests (about an hour) in lab testing. Versions 2010.1.309 through 2026.2.519 are affected; Progress fixed the chain in 2026.2.708 on July 8, 2026, and no in-the-wild exploitation has been confirmed. A separate RCE chain in RadPersistenceManager and RadDockLayout (CVE-2026-13185, -13186, -13190) was also patched but has no public exploit.

The Hacker NewsSep 7, 11:20 UTC · 9d agoExploit / PoC CVE-2026-13181 CVE-2026-13182 CVE-2026-13183+5 CVEs1

Acronis Plugin Vulnerability in cPanel and Plesk Exploited in the Wild

Acronis patched CVE-2026-87886 (CVSS 7.8), a local privilege escalation flaw in its cPanel and Plesk backup plugins, exploited in targeted attacks.

Acronis released fixes for CVE-2026-87886 (CVSS 7.8, CWE-276), an insecure file permissions flaw in Linux-based backup components for cPanel & WHM and Plesk that enables local privilege escalation. The vendor observed limited, targeted exploitation in the wild before patches shipped. Fixes are available in Backup plugin for cPanel & WHM 1.9.3 HF3 and Backup extension for Plesk 1.8.11. A local attacker with low privileges could gain elevated access to backup data, control panels, and other customer accounts on shared hosting infrastructure.

Cyber Security Newsupdated 11:08 UTC · 7h agofirst 08:01 UTC · 11h agoExploit / PoC in the wild 6 sources CVE-2026-87886

U.S. CISA adds Microsoft Windows, N-able N-central, and Adobe flaws to its Known Exploited Vulnerabilities catalog

CISA added four actively exploited flaws to its KEV catalog: Magento StyleSmuggler RCE, two Windows privilege-escalation bugs, and N-able N-central RCE.

CISA added CVE-2026-75650 (Adobe Commerce/Magento, CVSS 10.0), CVE-2026-81963 and CVE-2026-85880 (Microsoft Windows local privilege escalation, CVSS 7.8 each), and CVE-2026-86218 (N-able N-central pre-auth RCE, CVSS 10.0) to its Known Exploited Vulnerabilities catalog. Sansec researchers report the StyleSmuggler Magento flaw, actively exploited since September 4, lets unauthenticated attackers run code on vulnerable online stores and deploy web shells and backdoors; Microsoft confirmed active exploitation of both Windows flaws, and N-able shipped an emergency hotfix. Federal civilian agencies must patch the Windows flaws by September 22, 2026, and the remaining entries by September 11, 2026 under BOD 22-01.

Security Affairsupdated 17:13 UTC · 1h agofirst Sep 10, 08:06 UTC · 6d agoExploit / PoC in the wild 19 sources CVE-2026-75650 CVE-2026-81963 CVE-2026-85880+1 CVEs1

StyleSmuggler (CVE-2026-75650): Frequently asked questions about Adobe Commerce and Magento zero-day

Critical unauthenticated RCE zero-day CVE-2026-75650 (StyleSmuggler) in Adobe Commerce and Magento is actively exploited; Adobe shipped hotfix VULN-39341 on September 7.

CVE-2026-75650 is a CVSS 10.0 unauthenticated remote code execution flaw in Adobe Commerce 2.4.4-2.4.9, Adobe Commerce B2B 1.3.3-1.5.3, and Magento Open Source 2.4.6-2.4.9, exploited via malicious style properties that inject PHP code executed through a transactional email template. Active exploitation began September 4, 2026, three days before Adobe released Hotfix VULN-39341 (APSB26-146) on September 7, with multiple victim stores confirmed by Sansec and Disrex across at least two distinct campaigns. Attackers deploy a persistent implant at ~/.local/share/.gvfsd/gvfsd-user masquerading as kworker, fc-cache, or chronyd, sustained by a cron job, while a second operator dropped a PHP web shell in product image caches. Tenable classified it as a Vulnerability of Interest; it is not yet in CISA KEV as of September 8, and Adobe also recommends rotating encryption keys and all protected credentials.

Tenable Blogupdated Sep 8, 14:13 UTC · 8d agofirst Sep 8, 14:00 UTC · 8d agoExploit / PoC in the wild 2 sources CVE-2026-75650 CVE-2025-54236 CVE-2024-34102+1 CVEs

Adobe fixes critical Magento zero-day exploited to backdoor servers

Adobe emergency-patches actively exploited max-severity Magento/Adobe Commerce zero-day CVE-2026-75650 (StyleSmuggler), used since Sept 4 to backdoor servers.

Adobe released an emergency hotfix (VULN-39341) for CVE-2026-75650, a max-severity zero-day dubbed StyleSmuggler affecting Adobe Commerce 2.4.4-2.4.9, Adobe Commerce B2B 1.3.3-1.5.3, and Magento Open Source 2.4.6-2.4.9, enabling arbitrary code execution. Sansec reports the flaw has been exploited since at least September 4 to plant a backdoor whose C2 host is disguised as an NTP server, leaving traces like 'Payment Transaction Failed Reminder' emails. A second attacker with unrelated tooling is exploiting the flaw to deploy a 485-byte PHP web shell that collects server details, checks pub/media writability, and exfiltrates data to an oast.site subdomain. Adobe recommends immediate hotpatching plus rotation of all secrets including admin passwords, API keys, database credentials, and SSH keys.

BleepingComputerSep 8, 13:34 UTC · 8d agoExploit / PoC in the wildCVE-2026-756501

Adobe Commerce max-severity bug comes under active attack

Attackers are actively exploiting CVE-2026-75650 (CVSS 10.0), an unauthenticated RCE zero-day in Adobe Commerce/Magento, deploying a Rust backdoor on e-commerce servers.

Sansec identified active exploitation of a CVSS 10.0 zero-day (CVE-2026-75650) in Adobe Commerce and Magento Open Source versions 2.4.4 through 2.4.9, dubbed StyleSmuggler. The attack abuses crafted style properties in Magento template processing to execute PHP while rendering a 'Payment Transaction Failed Reminder' email, then launches a Rust backdoor connecting to C2 at 99.84.67.186 disguised as NTP traffic. Exploitation began September 4, 2026; Adobe released emergency hotfix VULN-393411, but Sansec also observed a second attacker deploying a PHP web shell in the product-image cache.

CSO OnlineSep 8, 11:36 UTC · 8d agoExploit / PoC in the wildCVE-2026-75650

Human Attacker Exploits Marimo RCE, Reaches SSH Bastion in Eight Seconds

Sysdig documents a skilled human attacker exploiting Marimo pre-auth RCE CVE-2026-39987 (CVSS 9.3), reaching an SSH bastion in eight seconds without AI tooling.

Sysdig detailed exploitation of CVE-2026-39987 (CVSS 9.3), a pre-authenticated RCE affecting all Marimo versions that came under active exploitation within hours of disclosure. A human operator used a hand-written Python script to harvest an AWS key from Secrets Manager and SSH into a bastion host in eight seconds, issuing 850+ commands over nine hours. Separately, Hunt.io disclosed an XMRig cryptomining campaign compromising 3,562 Redis servers via SLAVEOF rogue replication and AOF authorized_keys injection. Operation CameraSwarm, linked to a single operator, compromised over 14,000 Dahua IP cameras using CVE-2021-33044 and CVE-2021-33045.

The Hacker NewsSep 15, 11:52 UTC · 1d agoExploit / PoC in the wild 4 sources CVE-2026-39987 CVE-2021-33044 CVE-2021-33045

A Deep Dive Into Attempted Exploitation of CVE-2023

Mirai-like botnet scans exploit TP-Link EOL router flaw CVE-2023-33538 after CISA KEV addition, though observed exploit code is flawed.

Unit 42 observed large-scale automated scans attempting to exploit CVE-2023-33538 in end-of-life TP-Link TL-WR940N, TL-WR740N and TL-WR841N routers after CISA added the flaw to its KEV catalog in June 2025. HTTP GET requests inject commands via the ssid1 parameter at the /userRpm/WlanNetworkRpm endpoint to download and execute an arm7 ELF binary, a Mirai variant related to the Condi IoT botnet. Firmware emulation and reverse engineering showed the observed exploits are flawed and would fail, but the underlying vulnerability is real and successful exploitation requires authentication to the router's web interface. TP-Link confirmed the devices are end-of-life with no patches available and recommends replacing units and eliminating default credentials.

Palo Alto Unit 42Aug 19, 12:03 UTC · 28d agoExploit / PoC in the wildCVE-2023-335381

Attackers Exploit Critical Switchvox Flaw to Deploy Reverse Shells Without Credentials

Attackers exploit unauthenticated SQL injection CVE-2026-9586 in Sangoma Switchvox to run PostgreSQL commands and deploy reverse shells.

Threat actors are exploiting CVE-2026-9586 (CVSS 9.3), an unauthenticated SQL injection in Sangoma Switchvox SMB Edition 8.3 (104997), since August 30, 2026, running arbitrary SQL as the PostgreSQL superuser and achieving remote code execution. The /pa endpoint concatenates the user-controlled PhoneIP value into PostgreSQL queries; attackers can extract database contents, escalate to Switchvox web administrator, exfiltrate the cookie signing key to forge authentication, and invoke reverse shells. Sangoma patched the flaw in Switchvox 8.4.0.2 on July 14, 2026, roughly 4,000 instances are internet-exposed (mostly in the US), and honeypot activity from IP 176.65.148.184 deploys reverse shells followed by Base64-encoded process enumeration.

The Hacker NewsSep 2, 07:08 UTC · 14d agoExploit / PoC in the wildCVE-2026-9586

Critical Issabel PBX Command Execution Vulnerability Exploited in the Wild

Unauthenticated attackers exploit CVE-2026-89026 in Issabel PBX via forged JWT tokens to run OS commands; exploitation observed since September 9.

CVE-2026-89026 (CVSS v4 9.3) stems from a hard-coded HS256 JWT signing key in Issabel Framework's pbxapi/index.php, letting unauthenticated attackers forge bearer tokens and execute OS commands through the Asterisk Manager Interface originate endpoint. Issabel Framework versions before commit b97dbaf0b71c1c36f841e672b664afbeb02773bd are affected. Shadowserver Foundation first observed exploitation on September 9, 2026, and VulnCheck added the flaw to its Known Exploited Vulnerabilities database.

Cyber Security Newsupdated 15:50 UTC · 3h agofirst 13:12 UTC · 5h agoExploit / PoC in the wild 2 sources CVE-2026-890261

wp2shell: incident response guide (CVE-2026-63030 + CVE-2026-60137)

Eye Security published forensic IR tooling for wp2shell (CVE-2026-63030/CVE-2026-60137), the unauthenticated WordPress core RCE chain, after WordPress.org forced auto-updates.

wp2shell chains a REST API batch-endpoint route-confusion bug (CVE-2026-63030) with an SQL injection in WP_Query's author__not_in parameter (CVE-2026-60137), giving unauthenticated attackers rogue admin and code execution on default installs. Adam Kues of Searchlight Cyber discovered the flaw, a public PoC exists on GitHub, and WordPress.org forced automatic updates across an estimated 200M+ sites. Eye Security released a compromise-scanner WordPress plugin and browser extension and notes database artifacts (oEmbed cache rows, changesets) are the primary evidence since the attack is log-blind; fixed versions are 6.8.6, 6.9.5, and 7.0.2.

Web discovery (articles for new exploits & KEV entries)Sep 8, 16:27 UTC · 8d agoExploit / PoC in the wild 2 sources CVE-2026-63030 CVE-2026-601371

One Click on a Malicious Link Lets Hackers Backdoor Sogou Input Method Users

Actively exploited one-click flaw in Sogou Input Method (CVE-2026-51990) let UNC3569 deploy the GRAYRABBIT espionage backdoor on Windows.

Gen Digital researchers found three weaknesses in Sogou Input Method's sgbiz protocol handler that chain into a one-click RCE running with the signed-in user's permissions. UNC3569 used the chain in an active intrusion, leveraging an unsandboxed Chromium 80 embedded browser, the known V8 flaw CVE-2021-38003, and DLL sideloading via 7-Zip to deploy the GRAYRABBIT backdoor. Tencent fixed the issue in version 16.3.0.3498 within 12 days of disclosure; Sogou is used by hundreds of millions of people, mainly in China.

Cyber Security NewsSep 14, 13:01 UTC · 2d agoExploit / PoC in the wild 3 sources CVE-2026-51990 CVE-2021-38003

Hackers exploit Tencent app flaw to deploy GrayRabbit malware

UNC3569 actively exploits one-click RCE in Tencent Sogou Input Method to deploy the GrayRabbit backdoor, patched in version 16.3.0.3498.

Gen Digital reports that China-aligned UNC3569 is actively exploiting CVE-2026-51990, a one-click RCE chain in Tencent Sogou Input Method for Windows, which has hundreds of millions of installations in China. The chain abuses unvalidated command-line argument injection via the sgbiz: URI handler, unrestricted URL navigation in a CEF-based webview, and an unsandboxed outdated Chromium 80 engine to gain code execution and install the GrayRabbit backdoor. The analyzed malware is a mature 64-bit variant with RC4-encoded C2 config supporting reverse shells, file transfer, and reflective plugin loading. Tencent patched the argument validation in version 16.3.0.3498, but the browser engine remains outdated and unsandboxed.

BleepingComputerupdated Sep 14, 11:51 UTC · 2d agofirst Sep 13, 14:26 UTC · 3d agoExploit / PoC in the wild 2 sources CVE-2026-519903

U.S. CISA adds Gitea flaw to its Known Exploited Vulnerabilities catalog

CISA added the actively exploited Gitea RCE flaw CVE-2026-60004 (CVSS 9.8) to its KEV catalog, with federal patching due by August 28, 2026.

CISA added CVE-2026-60004, a critical remote code execution flaw in Gitea (CVSS 9.8), to its Known Exploited Vulnerabilities catalog. The flaw affects Gitea versions since 1.17, fixed in 1.27.1, and lets attackers with repository write access execute shell commands via the diffpatch API and Git hooks. Open registration allows unauthenticated attackers to create accounts and exploit exposed instances, with a reported attack deploying a cryptocurrency-miner-like payload.

Security AffairsAug 26, 08:44 UTC · 21d agoExploit / PoC in the wildCVE-2026-60004

Attackers plant remote access tools on compromised PaperCut servers

Attackers chained two PaperCut NG/MF zero-days for unauthenticated access, installing SimpleHelp and AnyDesk remote access tools on compromised servers.

An ongoing campaign exploits chained zero-days CVE-2026-81578 (improper access control) and CVE-2026-82078 (unsafe dynamic class loading) in internet-facing PaperCut NG and MF Application Servers, enabling authentication bypass and arbitrary Java bytecode execution. Post-compromise activity includes user and domain enumeration, payload download from sendit.sh, and silent installation of SimpleHelp and AnyDesk for redundant remote access; Defused observed CVE-2026-81578/CVE-2026-82078 exploit activity in honeypots since August 29, including data theft via Derby database dumps. Emergency patches were released August 28 and August 30, but 47% of roughly 2,500 PaperCut installs tracked by Huntress run v23 or older, for which no patch is available.

Help Net SecuritySep 2, 08:12 UTC · 14d agoExploit / PoC in the wildCVE-2026-81578 CVE-2026-820781

Attackers Chain Two PaperCut Flaws to Execute Code Without Authentication

Attackers chain PaperCut NG/MF flaws CVE-2026-81578 and CVE-2026-82078 for unauthenticated RCE; exploitation observed and a second emergency patch issued.

Two flaws in PaperCut NG and MF — CVE-2026-81578 (CVSS 8.8, improper access control enabling auth bypass) and CVE-2026-82078 (CVSS 9.4, unsafe dynamic class loading) — are being chained for unauthenticated remote code execution. Huntress observed limited exploitation on two customer environments, including Base64-encoded commands, 'whoami & ver' fingerprinting, SimpleHelp execution, and AnyDesk installation for persistence. PaperCut released a second emergency patch for v24, v25, and v26, but watchTowr reports additional patch bypasses may still affect the latest version. Shared IoCs include crafted jdbc strings in server.log and attacker-written .class/.cmd files.

The Hacker NewsSep 2, 10:21 UTC · 14d agoExploit / PoC in the wildCVE-2026-82078 CVE-2026-815781

CVE-2026-81578 + CVE-2026-82078 | PaperCut NG/MF Authentication Bypass and Unsafe Dynamic Class Loading Vulnerabilities

Two chained PaperCut NG/MF flaws, CVE-2026-81578 and CVE-2026-82078, enable pre-auth RCE, with active exploitation confirmed in customer environments.

PaperCut NG/MF is affected by CVE-2026-81578, an improper access control flaw (CVSS 4.0 8.8) allowing unauthenticated configuration changes, and CVE-2026-82078, an unsafe dynamic class loading flaw (CVSS 4.0 9.4) enabling arbitrary Java bytecode execution. Chained, they yield pre-authentication remote code execution on the PaperCut Application Server. PaperCut confirmed active exploitation and customer incidents, and Huntress observed exploitation starting August 26, 2026. Emergency Patch Release 2 is available for NG/MF v24-v26, with IOCs including suspicious pc-app.exe child processes, truncated server.log files, and AnyDesk installs.

Horizon3.aiSep 1, 15:31 UTC · 15d agoExploit / PoC in the wildCVE-2026-81578 CVE-2026-820781

CISA Flags Actively Exploited Ray Flaw That Can Trigger Browser

CISA added actively exploited Ray flaw CVE-2025-62593 (CVSS 9.4) to its KEV catalog; the DNS rebinding RCE has powered crypto-mining and DDoS botnet campaigns.

CISA added CVE-2025-62593 (CVSS 9.4) to its Known Exploited Vulnerabilities catalog, citing active exploitation of a DNS rebinding-driven RCE flaw in the Ray distributed computing framework, fixed in version 2.52.0. The flaw stems from missing authentication on critical Ray endpoints and an insufficient User-Agent header guard, exploitable against developers running Ray in Firefox or Safari via malicious websites or ads. RondoDox botnet operators incorporated the PoC exploit before the November 26, 2025 disclosure, and unpatched GPU-equipped clusters were hijacked into self-replicating crypto-mining botnets in the ShadowRay 2.0 campaign. FCEB agencies must apply fixes by August 20, 2026.

The Hacker NewsAug 18, 06:34 UTC · 29d agoExploit / PoC in the wildCVE-2025-625931

New Mirai Variant Targeting Network Security Devices

New Mirai botnet variant exploits nine vulnerabilities in SonicWall, D-Link, Netgear, and other devices, with attacks ongoing at publication.

Unit 42 observed attacks exploiting VisualDoor (SonicWall SSL-VPN), CVE-2020-25506 (D-Link DNS-320), CVE-2020-26919 (Netgear ProSAFE Plus), and other flaws, with infrastructure rotating across at least three IP addresses between February 16 and March 13, 2021. Payloads were updated hours after CVE-2021-27561 and CVE-2021-27562 (Yealink Device Management, unauthenticated root RCE) and later added CVE-2021-22502 (Micro Focus Operation Bridge Reporter) and CVE-2019-19356 (Netis WF2419). Successful exploitation invokes wget to fetch shell scripts that download Mirai binaries compiled for multiple architectures and brute-forcers, and attacks were still ongoing when reported.

Palo Alto Unit 42Aug 19, 12:04 UTC · 28d agoExploit / PoC in the wildCVE-2020-25506 CVE-2020-26919 CVE-2019-19356+3 CVEs

Weekly Cybersecurity Newsletter Bulletin – Microsoft 0-day, FortiOS, PAN-OS Flaw, Revolut Data Breach, and 20+ Stories

Weekly roundup: Microsoft patches 973 flaws including two actively exploited zero-days; FortiOS CAPWAP flaw deploys PivotC2 RAT; PAN-OS root RCE disclosed.

Microsoft's September 2026 Patch Tuesday fixed 973 vulnerabilities, including two zero-days under active exploitation: CVE-2026-85880 (Windows ALPC) and CVE-2026-81963 (Windows Update Stack), both elevation-of-privilege bugs. SOCRadar reported active exploitation of CVE-2025-25249 (CVSS 9.8) in FortiOS CAPWAP, deploying a Node.js RAT called PivotC2 that exfiltrates Exchange mailboxes to Wasabi cloud storage; 178 devices were compromised out of 30,000 scanned IPs, attributed to a Russian-speaking financially motivated group. Palo Alto disclosed CVE-2026-0310, a 9.2-rated buffer overflow enabling root code execution on PA-Series firewalls, and Fortinet disclosed CVE-2026-84393, a ZTNA certificate validation MITM flaw. Cyera also revealed CVE-2026-6471 ('PostGREShell'), a 12-year-old PostgreSQL logical-decoding flaw allowing code execution via REPLICATION-privileged accounts.

Cyber Security NewsSep 14, 03:10 UTC · 2d agoExploit / PoC in the wildCVE-2026-85880 CVE-2026-81963 CVE-2025-25249+3 CVEs3

CISA Flags Exploited Cisco, Citrix, Fortinet Flaws, Sets Sept. 12 Federal Patch Deadline

CISA adds actively exploited Cisco, Citrix, and Fortinet edge-device flaws to KEV catalog, ordering federal agencies to patch by September 12, 2026.

CISA added CVE-2026-20079 (Cisco Secure Firewall Management Center authentication bypass, CVSS 10.0), CVE-2026-19490 (Citrix NetScaler ADC/Gateway authentication bypass, CVSS 9.3), and CVE-2025-25249 (FortiOS heap buffer overflow, CVSS 7.3) to the Known Exploited Vulnerabilities catalog with a September 12, 2026 deadline for FCEB agencies. Cisco confirmed active exploitation of CVE-2026-20079 in August 2026, while Previdian honeypots logged 56 NetScaler exploitation attempts since September 3. SOCRadar attributes Fortinet exploitation to a financially motivated Russian-speaking actor deploying the PivotC2 Node.js RAT, infecting 178 of over 3,000 targeted IP addresses, mostly in the US.

The Hacker Newsupdated Sep 10, 18:57 UTC · 6d agofirst Sep 10, 10:36 UTC · 6d agoExploit / PoC in the wild 5 sources CVE-2026-20079 CVE-2026-19490 CVE-2025-252491