Do Son A suspected Indonesian threat actor exploited the Laravel Livewire vulnerability (CVE-2025-54068) to steal credentials from over 6,000 web applications.
CVE-2025-54068
CISA adds 5 actively exploited flaws to its KEV catalog, including a critical 10.0 CVSS Craft CMS bug and Apple zero-days linked to DarkSword malware.
Synacktiv unmasks CVE-2025-54068, a critical Livewire hydration flaw, and Livepyre, a tool that achieves RCE even if the APP_KEY is known.
A critical RCE (CVE-2025-54068) in Livewire v3.6.3 and earlier allows unauthenticated attackers to execute arbitrary code on millions of Laravel applications. Update now!