Attackers Are Actively Hijacking Unpatched Citrix NetScaler Appliances to Plant Web Shells
Security researchers have documented a live exploitation campaign against a critical, already-disclosed Citrix NetScaler flaw, using a clever log-poisoning technique to achieve remote code execution, install web shells,...
WP2Shell Chains WordPress Flaws Into Unauthenticated Server Takeover
The WP2Shell technique combines two WordPress Core vulnerabilities to create administrator access and deploy a plugin-based web shell without a login. Operators should upgrade to a fixed release...
South Korean Church Breaches Expose More Than One Million Congregant Records
Attackers penetrated two major South Korean churches through a web shell, leaked credentials and broken authorization controls, exposing records tied to more than one million congregants. The intrusions...
Citrix NetScaler Zero-Days Under Active Attack: Google Uncovers Hidden Web Shell Campaign
Google's threat intelligence team says attackers have been exploiting two critical, now-patched Citrix NetScaler zero-days since early September to plant a stealthy PHP web shell and pivot deep...
ShinyHunters Evades WAF Rules to Reopen Critical PeopleSoft Attack Path
ShinyHunters has resumed mass exploitation of a critical Oracle PeopleSoft flaw by encoding part of the attack path to slip past some WAF rules. Compromised servers received web...
Stealth Linux Rootkit Hides Fileless Web Shells Inside F5 BIG-IP Memory
Researchers have uncovered a Linux rootkit that alters PHP code only in memory on compromised F5 BIG-IP APM appliances. Its fileless web shell, local socket backdoor and upgrade...
China-Linked OP-512 Uses Cryptographically Unique Web Shells in Patient IIS Server Espionage Campaign
ReliaQuest has uncovered OP-512, a new China-linked threat cluster targeting IIS servers with a custom web shell framework that generates cryptographically unique signatures per deployment, evading traditional detection....