Search: “webshell”

307 stories

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Exploit / PoC 107 Vulnerability 82 Ransomware 49 Threat actor 32 Data breach 21 Malware 10 Advisory 5 Policy & legal 4

SeverityAll critical 271 high 37 medium 1 low 0 info 1

CVE-2022-22965: Spring Core Remote Code Execution Vulnerability Exploited In the Wild (SpringShell) (Updated)

Attackers actively exploit Spring Framework RCE CVE-2022-22965 (SpringShell, CVSS 9.8) to deploy webshells; patches 5.3.18/5.2.20 shipped March 31, 2022.

CVE-2022-22965 enables unauthenticated remote code execution in the widely used Spring Framework (CVSS 9.8), which Unit 42 has observed being exploited in the wild. The flaw stems from getCachedIntrospectionResults exposing the class object during parameter binding, letting attackers manipulate the class loader to modify Tomcat logging and upload a JSP webshell. Public PoCs require JDK 9+, Tomcat, WAR packaging, and spring-webmvc or spring-webflux dependencies on Spring 5.3.0-5.3.17, 5.2.0-5.2.19, or older. Fixes shipped in Spring Framework 5.3.18 and 5.2.20; the related Spring Cloud Function flaw CVE-2022-22963 was patched March 29, 2022.

Palo Alto Unit 42Aug 17, 10:58 UTC · Aug 17, 2026Exploit / PoC in the wildCVE-2022-22965 CVE-2022-22963 CVE-2010-16221

Actor Exploits Microsoft Exchange Server Vulnerabilities, Cortex XDR Blocks Harvesting of Credentials

Palo Alto Unit 42Jun 6, 13:23 UTC · Jun 6, 2024Vulnerability in the wildCVE-2021-26855 CVE-2021-26857 CVE-2021-26858+1 CVEs

APT Expands Attack on ManageEngine With Active Campaign Against ServiceDesk Plus

Palo Alto Unit 42Jun 6, 01:25 UTC · Jun 6, 2024Threat actor in the wildCVE-2021-44077 CVE-2021-33617

Why Patch Management Isn’t Enough: SharePoint, Webshells & the Modern Threat Landscape

Recorded FutureAug 11, 00:00 UTC · Aug 11, 2025Vulnerability CVE-2023-47246

(Re)check your patched NetScaler ADC and Gateway appliances for signs of compromise

Help Net SecurityAug 16, 00:00 UTC · Aug 16, 2023Vulnerability CVE-2023-3519

Hundreds of Citrix Endpoints Compromised With Webshells

Infosecurity MagazineAug 3, 10:00 UTC · Aug 3, 2023Exploit / PoC CVE-2023-3519 CVE-2023-3466 CVE-2023-3467

JSP webshells being dropped on unpatched PTC Windchill instances

Help Net SecurityJul 27, 12:30 UTC · Jul 27, 2026Vulnerability in the wildCVE-2026-12569 CVE-2026-4681

Australian Cyber Agency Warns of Global CMS Exploitation Campaign

Infosecurity MagazineJul 13, 08:30 UTC · Jul 13, 2026Threat actor

Exposed Hacker Server Reveals WP-SHELLSTORM Backdooring Thousands of WordPress Sites

The Hacker NewsJul 10, 11:30 UTC · Jul 10, 2026Malware in the wildCVE-2026-3844 CVE-2021-29441 CVE-2026-3300+10 CVEs

Cisco Unified CM flaw actively exploited to drop webshells (CVE-2026-20230)

Help Net SecurityJun 26, 09:26 UTC · Jun 26, 2026Vulnerability in the wildCVE-2026-20230 CVE-2026-20045

Compromised SAP NetWeaver instances are ushering in opportunistic threat actors

Help Net SecurityMay 15, 11:51 UTC · May 15, 2025Threat actor in the wildCVE-2025-31324 CVE-2025-42999

Experts warn of a second wave of attacks targeting SAP NetWeaver bug CVE-2025

Security AffairsMay 6, 13:55 UTC · May 6, 2025Exploit / PoC in the wildCVE-2025-313241

Cybercrime gang exploited VeraCore zero-day vulnerabilities for years (CVE-2025-25181, CVE-2024-57968)

Help Net SecurityFeb 11, 13:53 UTC · Feb 11, 2025Exploit / PoC CVE-2025-25181 CVE-2024-57968

Critical Zimbra Postjournal flaw CVE-2024-45519 actively exploited in the wild. Patch it now!

Security AffairsOct 2, 09:21 UTC · Oct 2, 2024Exploit / PoC in the wildCVE-2024-45519

APT VANGUARD PANDA uses a new tradecraft in recent attacks

Security AffairsJun 26, 12:55 UTC · Jun 26, 2023Exploit / PoC CVE-2021-40539

Australia Alerts Organizations to Ongoing CMS Exploitation Attacks

Security AffairsJul 13, 07:39 UTC · Jul 13, 2026Exploit / PoC in the wildCVE-2025-34085 CVE-2020-36847 CVE-2025-12057+15 CVEs

Ivanti EPMM exploitation: Researchers warn of "sleeper" webshells

Help Net SecurityFeb 11, 00:00 UTC · Feb 11, 2026Data breach in the wildCVE-2026-1281 CVE-2026-13401

Threat Brief: CVE-2022-41040 and CVE-2022-41082: Microsoft Exchange Server (ProxyNotShell)

Palo Alto Unit 42Jun 5, 17:51 UTC · Jun 5, 2024Vulnerability in the wildCVE-2022-41040 CVE-2022-41082 CVE-2021-34473+2 CVEs

Hackers already installed web shells on 581 Citrix servers in CVE-2023

Security AffairsAug 2, 20:50 UTC · Aug 2, 2023Exploit / PoC in the wildCVE-2023-3519

Critical SAP NetWeaver flaw exploited by suspected initial access broker (CVE-2025-31324)

Help Net SecurityAug 20, 08:46 UTC · Aug 20, 2025Vulnerability in the wildCVE-2025-31324

China-linked group Fire Ant exploits VMware and F5 flaws since early 2025

Security AffairsJul 28, 08:28 UTC · Jul 28, 2025Vulnerability CVE-2023-34048 CVE-2023-20867 CVE-2022-1388

U.S. CISA adds SAP NetWeaver flaw to its Known Exploited Vulnerabilities catalog

Security AffairsApr 30, 00:05 UTC · Apr 30, 2025Exploit / PoC in the wildCVE-2025-31324 CVE-2017-9844

SAP NetWeaver zero-day allegedly exploited by an initial access broker

Security AffairsApr 25, 15:48 UTC · Apr 25, 2025Exploit / PoC CVE-2025-31324 CVE-2017-9844

APT41 likely compromised Taiwanese government-affiliated research institute with ShadowPad and Cobalt Strike

Cisco TalosAug 1, 12:00 UTC · Aug 1, 2024Threat actor CVE-2018-08241

Threat Brief: VMware Vulnerabilities Exploited in the Wild (CVE-2022

Palo Alto Unit 42Jun 5, 20:43 UTC · Jun 5, 2024Exploit / PoC in the wildCVE-2022-22954 CVE-2022-22960 CVE-2022-22972+8 CVEs

China-Linked Hackers Used ROOTROT Webshell in MITRE Network Intrusion

The Hacker NewsMay 7, 12:55 UTC · May 7, 2024Exploit / PoC

Microsoft: Two New 0-Day Flaws in Exchange Server

Krebs on SecuritySep 30, 17:03 UTC · Sep 30, 2022Exploit / PoC in the wildCVE-2022-41040 CVE-2022-410821

Unpatched Atlassian Confluence zero-day exploited, fix expected today (CVE-2022-26134)

Help Net SecurityJun 3, 00:00 UTC · Jun 3, 2022Exploit / PoC in the wildCVE-2022-26134

China-linked APT groups targets orgs via Pulse Secure VPN devices

Security AffairsMay 28, 13:09 UTC · May 28, 2021Threat actor CVE-2021-22893

Hafnium Update: Continued Microsoft Exchange Server Exploitation

Cisco TalosMar 10, 00:52 UTC · Mar 10, 2021Exploit / PoC

Hackers Actively Exploit Critical WooCommerce Plugin Vulnerability to Upload PHP Backdoors

Attackers actively exploit CVE-2026-27540 (CVSS 9.8) in WooCommerce Wholesale Lead Capture plugin to upload PHP webshells; patch shipped in version 2.0.3.2.

CVE-2026-27540 (CVSS 9.8) in the WooCommerce Wholesale Lead Capture plugin affects versions 2.0.3.1 and earlier across roughly 6,000 active installations. The unauthenticated AJAX handler wwlc_file_upload_handler trusts a client-supplied file_settings allowlist, letting attackers upload shell.php for remote code execution. Wordfence has blocked more than 100,000 exploit attempts since disclosure, with spikes in June, July, and August 2026. The vendor fixed the flaw in version 2.0.3.2.

GBHackersupdated 05:48 UTC · 7h agofirst Sep 15, 12:05 UTC · 1d agoExploit / PoC in the wild 4 sources CVE-2026-27540