Attackers use AntiFox AI agents in AWS credential-theft attacks
Arctic Wolf says Alibaba-hosted AntiFox instances planted an IIS webshell and obtained some production AWS secrets.
Stories per day · 30 days
10 RSS
Relatedprivilege-escalation10php2shell9armory-castle6beyondtrust6china6cve-2026-1027646zero-day6active-directory5ahsaycbs5credential-theft5e-commerce5firewall5linux-kernel4magento4pan-os4rce4xmrig4ahsay3
83 stories, newest first · one card per story
Stories tagged #webshell
Attackers exploit AhsayCBS flaws to hide code in PNGs and plant backdoors
Three servers in one organization were hit October 8–11, 2026, via auth bypass and unauthenticated SYSTEM RCE before hotfixes.
Honeypot sees scans for SAP NetWeaver webshells via CVE-2025-31324
SANS logged requests for ant.jsp and other upload paths, including an unauthenticated upload bug scored CVSS 10.
Storm-2603 Exploits SharePoint ToolShell Flaws and Cloudflare Tunnels
Storm-2603 installed webshells and deployed Cloudflare Tunnels after exploiting SharePoint vulnerabilities.
1
Magento StyleSmuggler exploited to deploy PSK Agent RAT
CVE-2026-75650, scored 10.0, was hit September 9–13, 2026, before Adobe’s emergency hotfix, across stores in three regions.
2
Hackers weaponize ARTEX AI agents for network intrusions
Attackers use autonomous ARTEX AI agents to automate intrusions, privilege escalation, and data theft across multiple organizations.
PHP2Shell attacks root Palo Alto firewalls; WordPress largely spared
A China-linked group chained PHP2Shell with Fragnesia to plant root webshells on at least 25 PAN-OS firewalls.
Suspected Chinese actor roots PAN-OS firewalls via chained PHP2Shell
The chain rooted 25 servers in four countries and reached a US government Active Directory domain, Unit 42 says.
CISA says attackers exploit Linux kernel flaw CVE-2026-46300
Federal agencies face an October 31 deadline; CISA says the bug is chained to plant PHP webshells and run as root.
4
Reports say PHP2Shell bugs were exploited, including on firewalls
GreyNoise reports at least six successful hits; Dream claims 24 firewalls and two US-linked servers were compromised.
Suspected Chinese attackers rooted 25 servers with custom PHP2Shell chain
The chain hit PAN-OS 12.1 and 12.2 from October 23; Dream says remote access likely remains.
CISA warns Fragnesia Linux flaw is chained in PHP2Shell attacks
Agencies must patch CVE-2026-46300 by Saturday 10; researchers say the chain rooted 25 servers, including three US government-affiliated hosts.
INJ3CTOR3 malware steals FreePBX SIP credentials for phone fraud
An updated installer uploads 17 configuration files every minute to two staging servers, Cyble reported on October 28.
Chained PHP2Shell exploit roots 25 firewalls, including US government systems
Dream says a custom PHP2Shell build plus the Fragnesia kernel bug yielded unauthenticated root and Active Directory access.
INJ3CTOR3 steals FreePBX credentials so toll fraud survives cleanup
A September installer uploads secrets from 17 telephony, database, and mail files; researchers saw no live theft.
Attackers chain PHP2Shell flaws to root 25 firewall servers
Dream says the chain, including kernel flaw CVE-2026-46300, rooted devices in the US, Japan, Taiwan, and South Korea in under 15 minutes.
Attackers chain PHP2Shell and kernel exploits for root on 25 servers
Dream says custom exploits for CVE-2026-109618, CVE-2026-109619 and CVE-2026-46300 reached government-affiliated firewalls and Active Directory.
China-linked hackers root firewalls via PHP2Shell and Fragnesia
Dream says attackers exploited 25 of 19,000 internet-facing firewalls on October 23-24 and planted root webshells on 24.
INJ3CTOR3 FreePBX implant now steals SIP trunk and admin credentials
Cleaning the host no longer ends exposure: stolen trunk secrets let the operator place calls from anywhere.
CISA KEV: Linux kernel CVE-2026-46300 due October 31
The flaw can alter page-cache data and, chained with two other CVEs, implant PHP webshells that run as root.
7
Attackers infect 953 Magento stores with scanner-evading JavaScript
Sansec says the campaign, active since July 2025, has used five loader domains and the final payload is still unknown.
Magento stores hit by hidden CMS-block JavaScript loaders, Sansec says
Sansec saw the latest loader on 83 stores; the wider operation has hit 953 stores since July 2025.
1
Magecart-style script hits 953 Magento stores, Sansec says
The loader hides from scanners, and earlier waves used PolyShell and SessionReaper to plant webshells.
AI-scripted campaign hit government Linux servers, Unit 42 says
Cluster CL-UNK-1211 used web shells, a sudo-password hook, and SysGoRAT while hunting databases and mailboxes.