Search: “PHP webshell”

16 stories

Attackers actively exploit CVE-2026-27540 (CVSS 9.8) in WooCommerce Wholesale Lead Capture plugin to upload PHP webshells; patch shipped in version 2.0.3.2.

CVE-2026-27540 (CVSS 9.8) in the WooCommerce Wholesale Lead Capture plugin affects versions 2.0.3.1 and earlier across roughly 6,000 active installations. The unauthenticated AJAX handler wwlc_file_upload_handler trusts a client-supplied file_settings allowlist, letting attackers upload shell.php for remote code execution. Wordfence has blocked more than 100,000 exploit attempts since disclosure, with spikes in June, July, and August 2026. The vendor fixed the flaw in version 2.0.3.2.

GBHackersupdated Sep 16, 15:00 UTC · 10h agofirst Sep 15, 12:05 UTC · 1d agoExploit / PoC in the wild 6 sources CVE-2026-27540

ThreatsDay Bulletin: $290M DeFi Hack, macOS LotL Abuse, ProxySmart SIM Farms +25 New Stories

The Hacker NewsApr 24, 04:36 UTC · Apr 24, 2026Exploit / PoC CVE-2026-27175 CVE-2026-27174 CVE-2025-22952+1 CVEs

SessionReaper attacks have started, 3 in 5 stores still vulnerable

Sansec (Magento / e-commerce security)Apr 14, 19:49 UTC · Apr 14, 2026Exploit / PoC in the wildCVE-2025-54236 CVE-2026-75650

U.S. CISA adds Microsoft WSUS, and Adobe Commerce and Magento Open Source flaws to its Known Exploited Vulnerabilities catalog

Security AffairsOct 24, 19:05 UTC · Oct 24, 2025Exploit / PoC in the wildCVE-2025-54236 CVE-2025-59287

Attackers are chaining flaws to breach Palo Alto Networks firewalls

Help Net SecurityApr 18, 10:11 UTC · Apr 18, 2025Exploit / PoC in the wildCVE-2025-0108 CVE-2024-9474 CVE-2025-0111+1 CVEs

Citrix NetScaler zero-day exploited in the wild, patch is available (CVE-2023-3519)

Help Net SecurityJul 21, 11:15 UTC · Jul 21, 2023Exploit / PoC in the wildCVE-2023-3519 CVE-2023-3466 CVE-2023-3467+2 CVEs

A critical flaw in WordPress GDPR compliance plugin exploited in the wild

Security AffairsNov 12, 10:08 UTC · Nov 12, 2018Exploit / PoC in the wild

New ToddyCat APT targets high

Security AffairsJun 21, 15:05 UTC · Jun 21, 2022Exploit / PoC

Unauthenticated file upload in Amasty Order Attributes for Magento

Sansec (Magento / e-commerce security)Jun 15, 20:13 UTC · Jun 15, 2026Exploit / PoC in the wildCVE-2026-53787

wp2shell: incident response guide (CVE-2026-63030 + CVE-2026-60137)

Eye Security published forensic IR tooling for wp2shell (CVE-2026-63030/CVE-2026-60137), the unauthenticated WordPress core RCE chain, after WordPress.org forced auto-updates.

wp2shell chains a REST API batch-endpoint route-confusion bug (CVE-2026-63030) with an SQL injection in WP_Query's author__not_in parameter (CVE-2026-60137), giving unauthenticated attackers rogue admin and code execution on default installs. Adam Kues of Searchlight Cyber discovered the flaw, a public PoC exists on GitHub, and WordPress.org forced automatic updates across an estimated 200M+ sites. Eye Security released a compromise-scanner WordPress plugin and browser extension and notes database artifacts (oEmbed cache rows, changesets) are the primary evidence since the attack is log-blind; fixed versions are 6.8.6, 6.9.5, and 7.0.2.

Web discovery (articles for new exploits & KEV entries)Sep 8, 16:27 UTC · 8d agoExploit / PoC in the wild 2 sources CVE-2026-63030 CVE-2026-601371

Search: “PHP webshell”

Hackers Actively Exploit Critical WooCommerce Plugin Vulnerability to Upload PHP Backdoors

China-linked group Houken hit French organizations using zero

Chinese Hackers Target France in Ivanti Zero

2,000 Palo Alto Networks devices compromised in latest attacks