AntiFox AI pentest tool tied to AWS secret theft
Arctic Wolf says attackers used AntiFox after web shells and valid AWS credentials, including a successful production GetSecretValue call.
Stories per day · 30 days
9 RSS
Relatedkev5beyondtrust4citrix4netscaler4rce4remote-support4zero-day4armory-castle3cve-2026-1027643nextcloud3unc52213ahsaycbs2cl-unk-12112collabora2command-injection2cve-2026-1104472exploitation2freebsd2
62 stories, newest first · one card per story
Stories tagged #web-shell
Attackers exploit patched AhsayCBS flaws to plant a Python backdoor
Huntress says the October chain was used as zero-days to drop web shells, two XMRig miners, and tunneling tools.
Suspected North Korean campaign targets 216 vulnerable PHP hosts
Cyfirma links a Lazarus-linked group using AI-ranked public exploits to monitor and scan 216 unpatched PHP hosts via private I2P channel.
CISA lists exploited Collabora Online flaw CVE-2026-110447
Unauthenticated attackers can run OS commands as the web server user when the built-in CODE server is stopped; fix is 26.4.303.
6
Attackers exploit Citrix NetScaler RCE CVE-2026-88771
Unauthenticated attackers poison logs, plant web shells and try to run a FreeBSD implant; CISA listed the flaw.
Autonomous AI agents used to breach more than 1,200 websites
NorForge says exposed Cairn panels tied a Chinese-language cluster to web shells at named firms, with data theft unconfirmed.
WP2Shell chains two WordPress flaws into admin and web-shell access
Seqrite’s proof of concept uses CVE-2026-63030 and CVE-2026-60137 but does not show widespread live exploitation.
NetScaler intrusions chain CVE-2026-88771 and CVE-2026-88779
On an affected 14.1 appliance, attackers gained root, planted PHP web shells, and took configuration and key material.
BeyondTrust Remote Support auth bypass CVE-2026-102764 exploited before disclosure
Unauthenticated attackers can perform file operations on Remote Support 26.2.3 and earlier; CISA set a October 19 KEV due date.
8
Hackers Exploit Critical Collabora Online Flaw to Backdoor Nextcloud Servers
Attackers are exploiting CVE-2026-110447 in Nextcloud's Collabora CODE app to plant web shells.
CVE-2026-88771: Inside the Exploitation of a Critical NetScaler RCE Vulnerability
Attackers are actively exploiting critical unauthenticated NetScaler RCE CVE-2026-88771, now listed in CISA's KEV catalog.
Hackers Use AI-Generated Scripts to Hijack Linux Sudo Commands and Steal Passwords
Unit 42 says CL-UNK-1211 used AI-assisted scripts to steal Linux sudo passwords from government targets.
8
BeyondTrust 0-Day Vulnerability Exploited Since August to Gain Full Admin Access in Minutes
Attackers exploited BeyondTrust Remote Support zero-day CVE-2026-102764 from August to gain full admin access.
7
China-Linked Hackers Exploited BeyondTrust Zero-Day to Take Over Remote Support Servers
China-linked Armory Castle exploited BeyondTrust Remote Support zero-day CVE-2026-102764 to seize support appliances.
5
BeyondTrust patches zero-day exploited in attacks since August
BeyondTrust patched CVE-2026-102764, a Remote Support authentication bypass exploited since August by China-linked Armory Castle.
8
AI-Powered Espionage Campaign Targets Government Linux Infrastructure
Unit 42 says cluster CL-UNK-1211 used AI-generated payloads to spy on government Linux infrastructure.
13
AhsayCBS Flaws Exploited to Deploy Web Shells Get New Fixes After Incomplete Patches
Ahsay re-patched exploited AhsayCBS flaws after incomplete fixes still allowed web shells and XMRig miners.
Hackers Backdoor Nextcloud Servers Through Critical Flaw in Collabora’s Built-in CODE App
Attackers exploited CVE-2026-110447 in Nextcloud's optional Collabora CODE app to plant web shells.
WordPress Plugin Vulnerability Exploited in Attacks to Upload and eEecute Arbitrary PHP code
Attackers are exploiting unauthenticated Bricksforge flaw CVE-2026-85097 to upload and run arbitrary PHP.
4
Hackers target two South Korean megachurches, potentially exposing congregant data
Hackers breached two South Korean megachurches, potentially exposing personal and financial data of hundreds of thousands of members.
1
Hackers Exploit Critical Citrix NetScaler Flaw to Deploy Web Shells and Steal Configuration Data
Attackers are exploiting critical NetScaler flaw CVE-2026-88771 to plant web shells and steal appliance configurations.
Critical Citrix NetScaler CVE-2026-88771 Exploited for Reverse Shells and Persistent Access
Attackers are exploiting critical Citrix NetScaler CVE-2026-88771 for reverse shells and persistent privileged access.
Hackers Use ERP Web Shell and IDOR Flaws to Breach Major South Korean Churches
Attackers breached two major South Korean churches with ERP web shells and IDOR flaws, exposing hundreds of thousands of records.
4
Despite ShinyHunters arrests after FBI jobs data breach, enterprises still have no answers about PeopleSoft risks
PeopleSoft customers lack vendor guidance as ShinyHunters claims a second zero-day after the confirmed FBI breach.
5