Web Shell Archives • Daily CyberSecurity

Four Attacker Clusters Exploit Citrix NetScaler Flaw CVE-2026-88771 to Plant Web Shells CVE-2026-88771 exploitation by four clusters deploying NetScaler web shells, Platypus agents, and reverse shells

CVE-2026-88771 exploitation by four clusters deploying NetScaler web shells, Platypus agents, and reverse shells

Four Attacker Clusters Exploit Citrix NetScaler Flaw CVE-2026-88771 to Plant Web Shells

Do Son October 7, 2026

At a Glance Malware family PHP web shells, a Perl web shell installer, Platypus agents, and a...

Citrix NetScaler zero-day CVE-2026-88772 exploited to deploy WHIPSHOT web shell and SLAPSHOT tunneler

Attackers Exploit Citrix NetScaler Zero-Day CVE-2026-88772 to Plant Hidden Web Shells

Do Son October 1, 2026

Since at least early September 2026, attackers have taken root-level control of Citrix NetScaler appliances without a...

PaperCut Zero-Day Attack Hides AdaptixC2 Implant Inside Fake Microsoft Copilot Siemens PLC cyber threat with AI-generated exploit scripts targeting S7 series controllers in critical infrastructure

Siemens PLC cyber threat with AI-generated exploit scripts targeting S7 series controllers in critical infrastructure

PaperCut Zero-Day Attack Hides AdaptixC2 Implant Inside Fake Microsoft Copilot

Do Son October 1, 2026

On August 31, 2026, attackers broke into a school’s print server and ended up owning its entire...

Microsoft Tracks Zimbra CVE-2026-73570 Attacks That Steal Mail and Auth Keys Zimbra CVE-2026-73570 command injection attack chain from crafted email to web shells and mailbox theft

Zimbra CVE-2026-73570 command injection attack chain from crafted email to web shells and mailbox theft

Microsoft Tracks Zimbra CVE-2026-73570 Attacks That Steal Mail and Auth Keys

Do Son September 30, 2026

A single crafted email can give attackers a shell on an unpatched Zimbra mail server. Microsoft Threat...

ShinyHunters Renews Oracle PeopleSoft Attacks With One-Character WAF Bypass North Korean hackers behind open-source supply chain attacks on axios, debug, and chalk NPM packages

North Korean hackers behind open-source supply chain attacks on axios, debug, and chalk NPM packages

ShinyHunters Renews Oracle PeopleSoft Attacks With One-Character WAF Bypass

Do Son September 29, 2026

Changing one letter to its URL code let attackers walk past firewall rules meant to block a...

Clop Deploys Custom Web Shell in PTC Windchill Extortion Attacks Clop web shell exploiting PTC Windchill CVE-2026-12569 to steal credentials and engineering data

Clop web shell exploiting PTC Windchill CVE-2026-12569 to steal credentials and engineering data

Clop Deploys Custom Web Shell in PTC Windchill Extortion Attacks

Do Son August 25, 2026

At a glance Malware family Custom Java web shell (unnamed implant) Threat actor Clop / Cl0p (highly...

Head Mare APT Exploits TrueConf Server Flaws to Deploy PhantomCore Backdoor Head Mare TrueConf attack PhantomCore backdoor diagram

Head Mare APT Exploits TrueConf Server Flaws to Deploy PhantomCore Backdoor

Do Son August 17, 2026

At a glance Actor/group Head Mare (tracked by Kaspersky; reclassified from hacktivist group to APT) Activity type...

OP-512: China-Linked Hackers Hit IIS Servers With New Tool axios Supply Chain Attack WAVESHAPER.V2 SnappyBee Malware Salt Typhoon Stately Taurus ScoringMathTea RAT, Lazarus Reflective DLL

axios Supply Chain Attack WAVESHAPER.V2 SnappyBee Malware Salt Typhoon Stately Taurus ScoringMathTea RAT, Lazarus Reflective DLL

OP-512: China-Linked Hackers Hit IIS Servers With New Tool

Do Son June 15, 2026

An AI Agent Spots What Analysts Might Have Missed ReliaQuest Threat Research has identified a new espionage...

The N-Day Nightmare: How SHADOW-EARTH-053 Breaches Governments Using “Old” Exploits SHADOW-EARTH-053 ShadowPad Espionage

The N-Day Nightmare: How SHADOW-EARTH-053 Breaches Governments Using “Old” Exploits

Do Son May 5, 2026

TrendAI Research has identified a persistent and methodical China-aligned threat cluster targeting government entities and critical infrastructure...

Froxlor’s CVSS 10 Flaw Turns Config Files into Persistent Backdoors Froxlor RCE Persistent Backdoor

Froxlor’s CVSS 10 Flaw Turns Config Files into Persistent Backdoors

Do Son April 17, 2026

Security researchers have sounded the alarm on two critical vulnerabilities within Froxlor, the popular open-source server management...

Beyond the URL: How “Cookie-Gated” Web Shells Hide Silent RCE in Plain Sight Cookie-Gated Web Shell Stealth C2

Beyond the URL: How “Cookie-Gated” Web Shells Hide Silent RCE in Plain Sight

Do Son April 9, 2026

A technical analysis from the Microsoft Defender Security Research Team has revealed that threat actors are increasingly...

CVE-2026-34838 (CVSS 10): Critical RCE Flaw Uncovered in GroupOffice CRM GroupOffice RCE, Insecure Deserialization

CVE-2026-34838 (CVSS 10): Critical RCE Flaw Uncovered in GroupOffice CRM

Do Son April 6, 2026

In a significant discovery for enterprises and public sector organizations, a critical security vulnerability has been unmasked...

Silent Intruder: “EncystPHP” Web Shell Burrows into FreePBX Systems EncystPHP Web Shell FreePBX Vulnerability

Silent Intruder: “EncystPHP” Web Shell Burrows into FreePBX Systems

Do Son February 2, 2026

A sophisticated new web shell has been discovered burrowing into communication infrastructure, leveraging a critical vulnerability to...

Attacking from Within: How Adobe ColdFusion Admins Can Weaponize Remote Shares ColdFusion Archive (CAR), UNC Path Exploitation

Attacking from Within: How Adobe ColdFusion Admins Can Weaponize Remote Shares

Do Son January 6, 2026

Adobe has issued critical updates for its ColdFusion platform after security researcher Brian Reilly uncovered a clever...

Chinese Hackers Exploit Exposed ASP.NET Keys to Deploy TOLLBOOTH IIS Backdoor and Kernel Rootkit Mercenary Akula European Financial Targeting AI-Generated Malware React2Shell Exploit UAT-8837 Critical Infrastructure Attack APT36, BOSS Linux BRICKSTORM Malware, China Espionage Curly COMrades, MucorAgent Chinese APT - HTTP Client Tools Shuckworm Cyber Espionage

Mercenary Akula European Financial Targeting AI-Generated Malware React2Shell Exploit UAT-8837 Critical Infrastructure Attack APT36, BOSS Linux BRICKSTORM Malware, China Espionage Curly COMrades, MucorAgent Chinese APT - HTTP Client Tools Shuckworm Cyber Espionage

Chinese Hackers Exploit Exposed ASP.NET Keys to Deploy TOLLBOOTH IIS Backdoor and Kernel Rootkit

Do Son October 23, 2025

Researchers from Elastic Security Labs, in collaboration with Texas A&M University System (TAMUS) Cybersecurity, have uncovered a...

China-Backed Flax Typhoon APT Maintained Year-Long Access by Turning ArcGIS SOE into Web Shell Backdoor Flax Typhoon ArcGIS Backdoor, SOE Web Shell

Flax Typhoon ArcGIS Backdoor, SOE Web Shell

China-Backed Flax Typhoon APT Maintained Year-Long Access by Turning ArcGIS SOE into Web Shell Backdoor

Do Son October 16, 2025

A newly released report from ReliaQuest reveals how the China-backed advanced persistent threat (APT) group “Flax Typhoon”...

Huntress Uncovers Log Poisoning Campaign Linking Nezha and Ghost RAT in Widespread Asian Cyber Intrusions Nezha Web Compromise, Log Poisoning

Huntress Uncovers Log Poisoning Campaign Linking Nezha and Ghost RAT in Widespread Asian Cyber Intrusions

Do Son October 10, 2025

Huntress researchers have unveiled a new and highly creative intrusion technique that combines log poisoning, AntSword web...

Stealthy WordPress Malware Uncovered: Multi-Stage RAT Injects via Header.php, Hides Traces

Do Son June 30, 2025

Sucuri’s Puja Srivastava recently uncovered a stealthy and complex malware campaign targeting WordPress websites that left no...

Weaver E-cology RCE CVE-2026-22679 CVE-2026-20127 Cisco SD-WAN Exploitation AI-Driven Cyberattack ARXON Malware React Server Components Vulnerability CVE-2025-55182 FortiWeb Auth Bypass, Unauthenticated Admin Takeover RayInitiator Bootkit, LINE VIPER CVE-2025-59689 Department of the Treasury cybersecurity - CVE-2025-0108 PoC CVE-2025-31103 Dior Data Breach SK Telecom data breach, long-term intrusion

Three-Year Intrusion: SK Telecom Breach Exposes 27 Million User Records

Do Son May 21, 2025

In April 2025, South Korea’s leading telecommunications provider, SK Telecom, disclosed a major security incident. The company...

From Web Shell to Full Control: APT-Style Exploits Surge Against SAP NetWeaver Quest KACE Vulnerability CVE-2025-32975 FortiGate SSO Bypass, Active Exploitation GoAnywhere RCE, Storm-1175 Cisco VPN RCE, ASA Zero-Day TinyColor Supply Chain Attack SK Telecom, data breach Erlang/OTP RCE, OT Network Security Ivanti CSA Attacks WordPress RCE, Theme Vulnerability

Quest KACE Vulnerability CVE-2025-32975 FortiGate SSO Bypass, Active Exploitation GoAnywhere RCE, Storm-1175 Cisco VPN RCE, ASA Zero-Day TinyColor Supply Chain Attack SK Telecom, data breach Erlang/OTP RCE, OT Network Security Ivanti CSA Attacks WordPress RCE, Theme Vulnerability

From Web Shell to Full Control: APT-Style Exploits Surge Against SAP NetWeaver

Do Son May 11, 2025

In a report issued by Unit 42, researchers disclosed that the vulnerability CVE-2025-31324, affecting SAP NetWeaver’s Visual...

Sophisticated IIS Malware Targets South Korean Web Servers IIS malware, South Korea cyberattack

Sophisticated IIS Malware Targets South Korean Web Servers

Do Son May 9, 2025

In a targeted and technically advanced cyber operation discovered in February 2025, the AhnLab Security Intelligence Center...

Check Point VPN vulnerability exploited in the wild Check Point VPN exploit CVE-2026-50751 zero-day Checkmarx Breach Supply Chain Attack Ivanti EPMM RCE CVE-2026-1281 Modular DS Vulnerability CVE-2026-23550 D-Link RCE Vulnerability CVE-2026-0625 Christmas 2025 GreyNoise Campaign, Japan-Based Initial Access Broker React2Shell Zero-Day, APT Active Exploitation WordPress vulnerability, authentication bypass FreePBX, zero-day Trend Micro Apex One, Remote Code Execution BitoPro Hack, Crypto Theft UNC5337 - CVE-2022-47945 Safe{Wallet} hack Fortinet vulnerability, CVE-2024-21762, FortiGate attack Balloonfly, Play ransomware Ivanti EPMM CVE-2025-4427 and CVE-2025-4428

DslogdRAT Malware Targets Ivanti Connect Secure via CVE-2025-0282 Zero-Day Exploit

Do Son April 26, 2025

A newly published report by Yuma Masubuchi from the JPCERT Coordination Center (JPCERT/CC) has uncovered the deployment...

Critical Alert 5 Active Exploits Detected Today