tag: Web-Shell · 13 items
- Engineer — Plan: Public PoCs exist for CVE-2026-109618/109619 but EPSS is low (0.05/0.06) and neither is KEV-listed; if you run PHP across shared-hosting stacks (cPanel, DirectAdmin) where upgrading lags, evaluate this extension as a temporary mitigation while scheduling the official PHP engine update.
- SOC/IR — Plan: php2shell exploitation delivers web shells via the upload-progress path — with public PoCs now circulating, build or tune detections for anomalous PHP upload-progress requests and unexpected shell artifacts in web directories.
- Leader — Skip
- Signals: CVE-2026-109618 — CISA KEV: not listed, EPSS 0.05, public PoC on GitHub, reported by 4 collected sources · CVE-2026-109619 — CISA KEV: not listed, EPSS 0.06, public PoC on GitHub, reported by 4 collected sources
- Engineer — Act: Active exploitation confirmed with web shells planted on Nextcloud servers since at least September 10. If you run Nextcloud with the Collabora Online Built-in CODE Server app, audit for web shell files in the web root and disable or patch the plugin immediately.
- SOC/IR — Act: Confirmed active exploitation with web shell deployment provides a concrete hunt target — sweep Nextcloud server logs for anomalous command execution spawned by the web server process dating back to September 10, and look for unauthorized files in Nextcloud’s web-accessible directories.
- Leader — Plan: Active backdooring of Nextcloud deployments via an optional collaboration plugin is a real risk if the organization runs self-hosted Nextcloud — confirm with engineering whether this plugin is in use and that incident response is underway; not yet a board-level event.
- Engineer — Act: Both CVEs are CISA KEV-listed with public PoCs and confirmed active exploitation deploying web shells and XMRig miners; update AhsayCBS to the latest patched release immediately and audit backup servers for existing web shell artifacts in the application directories.
- SOC/IR — Act: Active exploitation is dropping web shells and XMRig miners on AhsayCBS hosts — hunt for unexpected files in backup application directories, anomalous outbound connections to mining pools, and lateral movement from backup server accounts since the initial disclosure date.
- Leader — Skip
- Signals: CVE-2026-105133 — CISA KEV: listed, EPSS 0.01, public PoC on GitHub · CVE-2026-105134 — CISA KEV: listed, EPSS 0.03, public PoC on GitHub
- Engineer — Act: CISA KEV-listed, public PoC active, CVSS 8.9 unauthenticated RCE via SNMP path — patch Zimbra Collaboration Suite to the vendor-released fixed version immediately and audit Zimbra webroot directories for newly created or modified web shell files.
- SOC/IR — Act: Active exploitation confirmed with web shell staging and authentication secret harvesting; hunt for unexpected child processes spawned from the Zimbra service account since late September and sweep Zimbra webroot paths for recently written .jsp/.php files indicative of web shell deployment.
- Leader — Act: CISA KEV listing for an unauthenticated RCE in a widely-deployed enterprise mail platform with confirmed credential harvesting — confirm whether Zimbra is in your environment, verify patching status with the infrastructure team, and assess whether harvested mailbox credentials could expose sensitive communications or escalate to broader account compromise.
- Signals: CVE-2026-73570 — CISA KEV: listed, EPSS 0.12, public PoC on GitHub, reported by 2 collected sources
- Engineer — Act: Active exploitation of a critical pre-authentication command injection flaw in NetScaler ADC/Gateway is confirmed across multiple environments. Patch NetScaler immediately, audit for newly created superuser accounts, and scan access logs for web shell requests disguised as CSS resource paths.
- SOC/IR — Act: The campaign leaves distinctive artifacts: superuser account creation and web shells mapped to CSS-mimicking URL patterns to evade detection. Hunt for anomalous local account additions on NetScaler appliances and review NetScaler access logs for CSS-like paths that return interactive responses since at least early October 2026.
- Leader — Act: Active, multi-victim exploitation of a widely deployed VPN/ADC edge device with configuration data theft is board-level exposure. Confirm NetScaler presence in your environment, verify patch status with your infrastructure team this week, and assess whether stolen config data — credentials or certificates — warrants customer or auditor notification.
- Engineer — Act: CISA KEV-listed with public PoC and confirmed active exploitation on a common edge appliance — patch NetScaler immediately and audit appliances for web shell artifacts and tunneling malware in web roots and process trees.
- SOC/IR — Act: Attackers are deploying web shells and tunneling malware post-exploitation, then pivoting inward — sweep NetScaler appliances for unexpected child processes and outbound tunnels, and hunt for lateral movement originating from NetScaler IPs since exploitation began.
- Leader — Act: A CISA-KEV-listed zero-day on a widely deployed edge appliance with confirmed credential theft and internal network spread warrants immediate confirmation of NetScaler usage and a status check from engineering before leadership or customers raise the question.
- Signals: CVE-2026-88772 — CISA KEV: listed, EPSS 0.01, public PoC on GitHub, reported by 3 collected sources
- Engineer — Act: CVE-2026-35273 (CVSS 9.8, unauthenticated RCE) is CISA KEV-listed with a public GitHub PoC and confirmed mass exploitation; patch Oracle PeopleSoft immediately and audit web-accessible directories for newly created web shells.
- SOC/IR — Act: ShinyHunters-linked actors are actively deploying web shells post-exploitation, indicating persistent footholds; sweep PeopleSoft-adjacent hosts for web shell artifacts and hunt for anomalous outbound connections from PeopleSoft servers since this campaign began.
- Leader — Act: A mass global campaign by a known data-exfiltration actor targeting PeopleSoft — widely used for HR and ERP — warrants same-week action; confirm whether PeopleSoft is in your environment, verify patch status with engineering, and prepare a brief for leadership given ShinyHunters’ history of large-scale data theft.
- Signals: CVE-2026-35273 — CISA KEV: listed, EPSS 0.09, public PoC on GitHub, reported by 2 collected sources
- Engineer — Act: Unauthenticated file upload enabling PHP web shell deployment is being actively exploited against this WooCommerce plugin (~6,000 installs). Check all WordPress sites for this plugin, update to the patched version immediately, and audit the uploads directory for unexpected PHP files.
- SOC/IR — Act: Active exploitation is planting PHP backdoors on WordPress sites; sweep web servers for anomalous PHP files in WooCommerce plugin upload paths and hunt for POST requests to the plugin’s file-upload endpoint since exploitation began.
- Leader — Skip
- Engineer — Act: Active exploitation of a critical file-upload flaw is in progress; if you run WooCommerce Wholesale Lead Capture, update or disable it immediately and audit wp-content for recently created PHP files that could be backdoors.
- SOC/IR — Act: PHP backdoor upload attacks against WordPress sites are active; hunt for anomalous PHP files in wp-content/uploads and similar directories, and review web logs for suspicious POST requests to this plugin’s endpoints since the campaign began.
- Leader — Skip
- Engineer — Act: F5 BIG-IP APM is a widely-deployed enterprise edge appliance and the malware is linked to confirmed break-ins; disk-based file integrity checks won’t detect this web shell, so audit BIG-IP APM instances using network-based IOCs and memory forensics from the Sophos September 7 analysis.
- SOC/IR — Act: Active exploitation of an edge appliance combined with a memory-resident web shell means EDR and file-scan detections will miss it; assume-breach posture applies — hunt using any network or request-pattern IOCs from the Sophos report and flag all BIG-IP APM devices for manual inspection.
- Leader — Act: If your organization runs F5 BIG-IP APM, direct the security team to perform a compromise assessment this week — the memory-evasion technique means standard monitoring may have already missed a breach on this access gateway.
- Engineer — Act: Active exploitation since September 4 with public PoC and a CVSS 10.0 rating makes this urgent regardless of low EPSS: patch Adobe Commerce / Magento Open Source to the September 8 release immediately, then audit web roots and build logs for PHP web shells and unexpected Rust binaries introduced after September 4.
- SOC/IR — Act: Confirmed in-the-wild exploitation predates the patch by four days, meaning Magento estates may already be implanted; hunt for PHP web shell artifacts and Rust-based backdoor indicators (Sansec published IOCs under the StyleSmuggler moniker) and sweep file-integrity and EDR telemetry on Commerce hosts back to September 4.
- Leader — Plan: Confirm whether Adobe Commerce or Magento Open Source is present in your environment or used by a key e-commerce vendor, then verify engineering has treated this as an emergency patch — active exploitation with a backdoor payload elevates reputational and compliance risk for any org handling payment card data on the affected platform.
- Signals: CVE-2026-75650 — CISA KEV: not listed, EPSS 0.01, public PoC on GitHub, reported by 2 collected sources
- Engineer — Act: Clop-linked actors are actively exploiting a critical flaw in PTC Windchill and FlexPLM to deploy a purpose-built JSP web shell; if you run either platform, immediately audit PLM servers for rogue JSP files and apply the underlying critical patch.
- SOC/IR — Act: Active Clop-linked intrusion campaign targeting PLM servers with a web shell that harvests and decrypts credentials and maps vault contents — hunt for anomalous JSP execution and credential-access activity on Windchill/FlexPLM hosts, and review ReliaQuest’s analysis for behavioral indicators.
- Leader — Plan: A Clop-affiliated extortion tool specifically engineered to steal engineering IP from PLM systems is a sector-specific risk for manufacturing, aerospace, and defense organizations; if Windchill or FlexPLM is in your environment or your supply chain, verify exposure and confirm vendor incident posture this quarter.
- Engineer — Act: If you run PTC Windchill or FlexPLM, audit those servers for this Java web shell immediately — it is purpose-built to decrypt stored credentials and exfiltrate file repositories. Pull IOCs from the BleepingComputer article and sweep web-accessible directories on those hosts.
- SOC/IR — Act: Clop’s use of a bespoke web shell against Windchill/FlexPLM indicates an active, ongoing campaign with credential theft as a precursor step; hunt for anomalous Java process activity and unauthorized file enumeration on any PLM servers in your estate, and ingest the published IOCs into your SIEM.
- Leader — Plan: Clop is expanding its toolset to target PLM systems common in manufacturing and engineering sectors — verify whether Windchill or FlexPLM appears in your environment or third-party supply chain, and direct your security team to audit those systems this quarter.