Cyber CrimeChina-Linked Chain Roots 25 PAN Firewalls
A suspected Chinese state actor chained PHP2Shell with a Linux kernel flaw to gain root on 25 Palo Alto servers, including a US government domain.
> Search
10 results for “php”
Cyber Crime
SecurityWooCommerce Plugin Flaw Fuels Web Shell Attacks
Attackers are exploiting a critical WooCommerce Wholesale Lead Capture vulnerability to upload PHP web shells and achieve remote code execution.
Cyber CrimeRootkit hides web shells in F5 BIG-IP memory
Sophos says a tailored Linux rootkit lets attackers run web shells inside F5 BIG-IP APM without leaving malicious PHP on disk.
SecurityIn-Memory PHP Shell Sidesteps Disk Scans
F5 BIG-IP APM malware hides a PHP web shell purely in memory, evading file checks, Sophos analysis shows.
SecurityTrojanized PHP Themes Target Unpatched iPhones
Researchers uncover 13 malicious Packagist packages that inject spyware into streaming sites, stealing crypto wallet seeds.
SecurityZero-click RCE in Avada leaves million sites exposed
A 9.8-rated flaw chain in the Avada WordPress theme lets unauthenticated attackers run PHP code.
SecurityCritical PHP Injection Flaw in MaxSite CMS
A critical PHP object injection vulnerability in MaxSite CMS allows unauthenticated attackers to execute arbitrary code via a malicious cookie.
SecurityMaxSite CMS Critical RCE Flaw Discovered
A critical remote code execution vulnerability in MaxSite CMS allows unauthenticated attackers to inject malicious PHP code into configuration files.
SecurityTwig Template Engine Vulnerability Allows Sandbox Policy Bypass
A critical vulnerability in Twig versions 3.9.0 through 3.25.0 allows sandboxed templates to bypass security policy enforcement.
SecurityCritical PHP Injection Vulnerability Patched in Twig Template Engine
A critical vulnerability in Twig versions prior to 3.26.0 allows attackers to inject arbitrary PHP code via crafted template names in {% use %} tags.