CVE-2017-9841
published 2017-06-27CVE-2017-9841: Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a…
PriorityP196critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
KEVITWEXPLOITInitial access
CISA Known Exploited Vulnerabilitydue 2022-08-15
Exploited in the wild
EPSS
100.00%
100.0th percentile
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a "<?php " substring, as demonstrated by an attack on a site with an exposed /vendor folder, i.e., external access to the /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php URI.
Affected
14 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | phpunit | < phpunit 5.4.6-2 (bookworm) | phpunit 5.4.6-2 (bookworm) |
| drupal | drupal | — | — |
| oracle | communications_diameter_signaling_router | 8.0.0 – 8.5.0 | — |
| phpunit | phpunit | >= 4.8.19 < 4.8.28 | 4.8.28 |
| phpunit | phpunit | >= 5.0.10 < 5.6.3 | 5.6.3 |
| phpunit_project | phpunit | <= 4.8.27 | — |
| phpunit_project | phpunit | >= 0 < 5.4.6-2 | 5.4.6-2 |
| phpunit_project | phpunit | >= 0 < 5.4.6-2 | 5.4.6-2 |
| phpunit_project | phpunit | >= 0 < 5.4.6-2 | 5.4.6-2 |
| phpunit_project | phpunit | >= 0 < 5.4.6-2 | 5.4.6-2 |
| phpunit_project | phpunit | >= 5.0.0 < 5.6.3 | 5.6.3 |
| prestashop | autoupgrade | >= 4.0.0 < 4.10.1 | 4.10.1 |
| prestashop | gamification | >= 0 < 2.3.2 | 2.3.2 |
| prestashop | ps_facetedsearch | >= 0 < 3.4.1 | 3.4.1 |
Detection & IOCsextracted from sources · hover to see the quote
- →Detect inbound HTTP POST requests targeting any path ending in /eval-stdin.php where the POST body begins with the string '<?php '. This is the canonical exploit payload for CVE-2017-9841. ↗
- →Monitor for HTTP requests to the full list of known scanning paths for eval-stdin.php across common web root prefixes (e.g., /api/, /app/, /backup/, /blog/, /cms/, /laravel/, /public/, /vendor/, /www/, /yii/, /zend/, etc.). ↗
- →Check whether the eval-stdin.php file on disk references 'php://input' (vulnerable) rather than 'php://stdin' (patched). Presence of php://input in this file confirms exploitability. ↗
- →Review outgoing GET requests (via cURL) to external file hosting sites such as GitHub or Pastebin, especially when the request fetches a .php file — a common post-exploitation pattern following CVE-2017-9841 exploitation by Androxgh0st. ↗
- →CVE-2017-9841 was the top exploited CVE by volume in March 2025 with 69,433 attempts recorded, indicating active mass-scanning campaigns. Treat any hit on eval-stdin.php paths as high-priority. ↗
- →Androxgh0st botnet (Python-scripted malware) specifically exploits CVE-2017-9841 to gain initial access, then targets .env files for AWS, Office 365, SendGrid, and Twilio credentials. Correlate eval-stdin.php hits with subsequent .env file access attempts. ↗
- →RedTail malware uses CVE-2017-9841 for payload delivery. ThreatFox tags this CVE with RedTail payload delivery infrastructure at confidence 85%. ↗
- ·The vulnerability only exists when the /vendor directory (and specifically eval-stdin.php) is publicly accessible from the internet. Environments where the vendor directory is blocked at the web server level are not directly exploitable via HTTP. ↗
- ·Even after upgrading or removing the Mailchimp/Mailchimp E-Commerce Drupal modules, artifact files including eval-stdin.php may remain on disk and remain exploitable. ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
ghsa9.8CRITICAL
osv9.8CRITICAL
vulncheck9.8CRITICAL
cisa9.8CRITICAL
vendor_debian9.8CRITICAL
vendor_oracle9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Code Injection in PHPUnit
ghsa·2022-03-26
CVE-2017-9841 [CRITICAL] CWE-94 Code Injection in PHPUnit
Code Injection in PHPUnit
Util/PHP/eval-stdin.php in PHPUnit starting with 4.8.19 and before 4.8.28, as well as 5.x before 5.6.3, allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a `<?php ` substring, as demonstrated by an attack on a site with an exposed /vendor folder, i.e., external access to the /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php URI.
OSV
Code Injection in PHPUnit
osv·2022-03-26
CVE-2017-9841 [CRITICAL] Code Injection in PHPUnit
Code Injection in PHPUnit
Util/PHP/eval-stdin.php in PHPUnit starting with 4.8.19 and before 4.8.28, as well as 5.x before 5.6.3, allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a `<?php ` substring, as demonstrated by an attack on a site with an exposed /vendor folder, i.e., external access to the /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php URI.
OSV
PrestaShop gamification module ZIP archives were vulnerable from CVE-2017-9841
osv·2020-01-08·CVSS 9.8
CVE-2017-9841 [CRITICAL] PrestaShop gamification module ZIP archives were vulnerable from CVE-2017-9841
PrestaShop gamification module ZIP archives were vulnerable from CVE-2017-9841
### Impact
We have identified that some gamification module ZIP archives have been built with phpunit dev dependencies. PHPUnit contains a php script that would allow, on a webserver, an attacker to perform a RCE.
This vulnerability impacts
- phpunit before 4.8.28 and 5.x before 5.6.3 as reported in [CVE-2017-9841](https://nvd.nist.gov/vuln/detail/CVE-2017-9841)
- phpunit >= 5.63 before 7.5.19 and 8.5.1 (this is a newly found vulnerability that is currently being submitted as a CVE after disclosure was provided to phpunit maintainers)
You can read PrestaShop official statement about this vulnerability [here](https://build.prestashop.com/news/critical-security-vulnerability-in-prestashop-modules/).
### Patch
GHSA
PrestaShop autoupgrade module ZIP archives were vulnerable from CVE-2017-9841
ghsa·2020-01-08·CVSS 9.8
CVE-2017-9841 [CRITICAL] PrestaShop autoupgrade module ZIP archives were vulnerable from CVE-2017-9841
PrestaShop autoupgrade module ZIP archives were vulnerable from CVE-2017-9841
### Impact
We have identified that some autoupgrade module ZIP archives have been built with phpunit dev dependencies. PHPUnit contains a php script that would allow, on a webserver, an attacker to perform a RCE.
This vulnerability impacts
- phpunit before 4.8.28 and 5.x before 5.6.3 as reported in [CVE-2017-9841](https://nvd.nist.gov/vuln/detail/CVE-2017-9841)
- phpunit >= 5.63 before 7.5.19 and 8.5.1 (this is a newly found vulnerability that is currently being submitted as a CVE after disclosure was provided to phpunit maintainers)
You can read PrestaShop official statement about this vulnerability [here](https://build.prestashop.com/news/critical-security-vulnerability-in-prestashop-modules/).
### Patches
GHSA
PrestaShop gamification module ZIP archives were vulnerable from CVE-2017-9841
ghsa·2020-01-08·CVSS 9.8
CVE-2017-9841 [CRITICAL] PrestaShop gamification module ZIP archives were vulnerable from CVE-2017-9841
PrestaShop gamification module ZIP archives were vulnerable from CVE-2017-9841
### Impact
We have identified that some gamification module ZIP archives have been built with phpunit dev dependencies. PHPUnit contains a php script that would allow, on a webserver, an attacker to perform a RCE.
This vulnerability impacts
- phpunit before 4.8.28 and 5.x before 5.6.3 as reported in [CVE-2017-9841](https://nvd.nist.gov/vuln/detail/CVE-2017-9841)
- phpunit >= 5.63 before 7.5.19 and 8.5.1 (this is a newly found vulnerability that is currently being submitted as a CVE after disclosure was provided to phpunit maintainers)
You can read PrestaShop official statement about this vulnerability [here](https://build.prestashop.com/news/critical-security-vulnerability-in-prestashop-modules/).
### Patch
OSV
PrestaShop autoupgrade module ZIP archives were vulnerable from CVE-2017-9841
osv·2020-01-08·CVSS 9.8
CVE-2017-9841 [CRITICAL] PrestaShop autoupgrade module ZIP archives were vulnerable from CVE-2017-9841
PrestaShop autoupgrade module ZIP archives were vulnerable from CVE-2017-9841
### Impact
We have identified that some autoupgrade module ZIP archives have been built with phpunit dev dependencies. PHPUnit contains a php script that would allow, on a webserver, an attacker to perform a RCE.
This vulnerability impacts
- phpunit before 4.8.28 and 5.x before 5.6.3 as reported in [CVE-2017-9841](https://nvd.nist.gov/vuln/detail/CVE-2017-9841)
- phpunit >= 5.63 before 7.5.19 and 8.5.1 (this is a newly found vulnerability that is currently being submitted as a CVE after disclosure was provided to phpunit maintainers)
You can read PrestaShop official statement about this vulnerability [here](https://build.prestashop.com/news/critical-security-vulnerability-in-prestashop-modules/).
### Patches
OSV
PrestaShop module ps_facetedsearch might be vulnerable from CVE-2017-9841
osv·2020-01-07·CVSS 9.8
CVE-2017-9841 [CRITICAL] PrestaShop module ps_facetedsearch might be vulnerable from CVE-2017-9841
PrestaShop module ps_facetedsearch might be vulnerable from CVE-2017-9841
### Impact
We have identified that some ps_facetedsearch module ZIP archives have been built with phpunit dev dependencies. PHPUnit contains a php script that would allow, on a webserver, an attacker to perform a RCE.
This vulnerability impacts
- phpunit before 4.8.28 and 5.x before 5.6.3 as reported in [CVE-2017-9841](https://nvd.nist.gov/vuln/detail/CVE-2017-9841)
- phpunit >= 5.63 before 7.5.19 and 8.5.1 (this is a newly found vulnerability that is currently being submitted as a CVE after disclosure was provided to phpunit maintainers)
### Patches
In the [security patch](https://github.com/PrestaShop/ps_facetedsearch/releases/tag/v3.4.1), we look for the unwanted vendor/phpunit folder and remove it if we find
GHSA
PrestaShop module ps_facetedsearch might be vulnerable from CVE-2017-9841
ghsa·2020-01-07·CVSS 9.8
CVE-2017-9841 [CRITICAL] PrestaShop module ps_facetedsearch might be vulnerable from CVE-2017-9841
PrestaShop module ps_facetedsearch might be vulnerable from CVE-2017-9841
### Impact
We have identified that some ps_facetedsearch module ZIP archives have been built with phpunit dev dependencies. PHPUnit contains a php script that would allow, on a webserver, an attacker to perform a RCE.
This vulnerability impacts
- phpunit before 4.8.28 and 5.x before 5.6.3 as reported in [CVE-2017-9841](https://nvd.nist.gov/vuln/detail/CVE-2017-9841)
- phpunit >= 5.63 before 7.5.19 and 8.5.1 (this is a newly found vulnerability that is currently being submitted as a CVE after disclosure was provided to phpunit maintainers)
### Patches
In the [security patch](https://github.com/PrestaShop/ps_facetedsearch/releases/tag/v3.4.1), we look for the unwanted vendor/phpunit folder and remove it if we find
OSV
CVE-2017-9841: Util/PHP/eval-stdin
osv·2017-06-27·CVSS 9.8
CVE-2017-9841 [CRITICAL] CVE-2017-9841: Util/PHP/eval-stdin
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a "<?php " substring, as demonstrated by an attack on a site with an exposed /vendor folder, i.e., external access to the /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php URI.
VulnCheck
PHPUnit Command Injection Vulnerability
vulncheck·2017·CVSS 9.8
CVE-2017-9841 [CRITICAL] CWE-94 PHPUnit Command Injection Vulnerability
PHPUnit Command Injection Vulnerability
PHPUnit allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a "<?php " substring, as demonstrated by an attack on a site with an exposed /vendor folder, i.e., external access to the /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php URI.
Affected: PHPUnit PHPUnit
Required Action: Apply updates per vendor instructions.
Exploitation References: https://www.imperva.com/blog/crimeops-of-the-kashmirblack-botnet-part-ii/; https://blogs.juniper.net/en-us/threat-research/sysrv-botnet-expands-and-gains-persistence; https://unit42.paloaltonetworks.com/network-attack-trends-winter-2020/; https://www.lacework.com/blog/sysrv-hello-expands-infrastructure/; https://www.bleepingcomputer.com/news/security/new-cryptomining-malw
Ubuntu
PHPUnit vulnerability
vendor_ubuntu·2024-12-18
CVE-2017-9841 PHPUnit vulnerability
Title: PHPUnit vulnerability
Summary: PHPUnit could be made to crash or run programs if it received specially
crafted network traffic.
It was discovered that PHPUnit incorrectly handled web requests if exposed
to the internet. An attacker could possibly use this issue to achive remote
code execution or obtain sensitive information.
Instructions: In general, a standard system update will make all the necessary changes.
CISA
PHPUnit Command Injection Vulnerability
cisa·2022-02-15·CVSS 9.8
CVE-2017-9841 [CRITICAL] CWE-94 PHPUnit Command Injection Vulnerability
Vulnerability: PHPUnit Command Injection Vulnerability
Affected: PHPUnit PHPUnit
PHPUnit allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a "<?php " substring, as demonstrated by an attack on a site with an exposed /vendor folder, i.e., external access to the /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php URI.
Required Action: Apply updates per vendor instructions.
Notes: https://nvd.nist.gov/vuln/detail/CVE-2017-9841
Remediation Due Date: 2022-08-15
Oracle
Oracle Oracle Communications Risk Matrix: Signaling (PHP) — CVE-2017-9841
vendor_oracle·2021-10-15·CVSS 9.8
CVE-2017-9841 [CRITICAL] Oracle Oracle Communications Risk Matrix: Signaling (PHP) — CVE-2017-9841
Oracle Oracle Communications Risk Matrix: Signaling (PHP) vulnerability
CVE: CVE-2017-9841
CVSS: 9.8
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpuoct2021 (OCT 2021)
Drupal
Various Third-Party Vulnerabilities - PSA-2019-09-04
vendor_drupal·2019-09-04·CVSS 9.8
CVE-2017-9841 [CRITICAL] Various Third-Party Vulnerabilities - PSA-2019-09-04
Title: Various Third-Party Vulnerabilities - PSA-2019-09-04
Vulnerability Type: Various Third-Party Vulnerabilities
Description: In June of 2011, the Drupal Security Team issued Public Service Advisory PSA-2011-002 - External libraries and plugins . 8 years later that is still the policy of the Drupal Security team. As Drupal core and modules leverage third-party code more and more it seems like an important time to remind site owners that they are responsible for monitoring security of third-party libraries. Here is the advice from 2011 which is even more relevant today: Just like there's a need to diligently follow announcements and update contributed modules downloaded from Drupal.org, there's also a need to follow announcements by vendors of third-party libraries or plugins that are
Debian
CVE-2017-9841: phpunit - Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows rem...
vendor_debian·2017·CVSS 9.8
CVE-2017-9841 [CRITICAL] CVE-2017-9841: phpunit - Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows rem...
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a "<?php " substring, as demonstrated by an attack on a site with an exposed /vendor folder, i.e., external access to the /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php URI.
Scope: local
bookworm: resolved (fixed in 5.4.6-2)
bullseye: resolved (fixed in 5.4.6-2)
forky: resolved (fixed in 5.4.6-2)
sid: resolved (fixed in 5.4.6-2)
trixie: resolved (fixed in 5.4.6-2)
No detection rules found.
Exploit-DB
PHP Unit 4.8.28 - Remote Code Execution (RCE) (Unauthenticated)
exploitdb·2022-02-02·CVSS 9.8
CVE-2017-9841 [CRITICAL] PHP Unit 4.8.28 - Remote Code Execution (RCE) (Unauthenticated)
PHP Unit 4.8.28 - Remote Code Execution (RCE) (Unauthenticated)
---
# Exploit Title: PHP Unit 4.8.28 - Remote Code Execution (RCE) (Unauthenticated)
# Date: 2022/01/30
# Exploit Author: souzo
# Vendor Homepage: phpunit.de
# Version: 4.8.28
# Tested on: Unit
# CVE : CVE-2017-9841
import requests
from sys import argv
phpfiles = ["/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php", "/yii/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php", "/laravel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php", "/laravel52/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php", "/lib/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php", "/zend/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"]
def check_vuln(site):
vuln = False
try:
for i in phpfiles:
site = site+i
req = requests.get(site,headers=
Nuclei
PHPUnit - Remote Code Execution
nuclei·CVSS 9.8
CVE-2017-9841 [CRITICAL] PHPUnit - Remote Code Execution
PHPUnit - Remote Code Execution
PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a "
- |
GET /vendor/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
Host: {{Hostname}}
Content-Type: text/html
- |
GET /vendor/phpunit/Util/PHP/eval-stdin.php HTTP/1.1
Host: {{Hostname}}
Content-Type: text/html
- |
GET /phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
Host: {{Hostname}}
Content-Type: text/html
- |
GET /phpunit/phpunit/Util/PHP/eval-stdin.php HTTP/1.1
Host: {{Hostname}}
Content-Type: text/html
- |
GET /phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
Host: {{Hostname}}
Content-Type: text/html
- |
GET /phpunit/Util/PHP/eval-stdin.php HTTP/1.1
Host: {{Hostname}}
Content-Type: text/html
- |
GET /lib/phpunit
Bugzilla
CVE-2017-9841 php-phpunit-PHPUnit: allows attackers to execute arbitrary PHP code via HTTP POST data
bugzilla·2020-01-28·CVSS 9.8
CVE-2017-9841 [CRITICAL] CVE-2017-9841 php-phpunit-PHPUnit: allows attackers to execute arbitrary PHP code via HTTP POST data
CVE-2017-9841 php-phpunit-PHPUnit: allows attackers to execute arbitrary PHP code via HTTP POST data
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a "<?php " substring, as demonstrated by an attack on a site with an exposed /vendor folder, i.e., external access to the /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php URI.
Reference:
http://web.archive.org/web/20170701212357/http://phpunit.vulnbusters.com/
Discussion:
Created php-phpunit-PHPUnit tracking bugs for this issue:
Affects: epel-6 [bug 1795616]
---
PHPUnit is a developer tool
And if people deploy web app with developer stuff.... yes they are unsecure.
Bugzilla
CVE-2017-9841 php-phpunit-PHPUnit: allows attackers to execute arbitrary PHP code via HTTP POST data [epel-6]
bugzilla·2020-01-28·CVSS 9.8
CVE-2017-9841 [CRITICAL] CVE-2017-9841 php-phpunit-PHPUnit: allows attackers to execute arbitrary PHP code via HTTP POST data [epel-6]
CVE-2017-9841 php-phpunit-PHPUnit: allows attackers to execute arbitrary PHP code via HTTP POST data [epel-6]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of epel-6.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
Discussion:
Use the fol
abuse.ch
RedTail - payload delivery infrastructure (IP address and port)
abuse_ch·2026-06-07·CVSS 9.8
CVE-2017-9841 [CRITICAL] RedTail - payload delivery infrastructure (IP address and port)
ThreatFox IOC: RedTail payload delivery infrastructure
Indicator Type: IP address and port
Tags: CVE-2017-9841
Reference: https://twitter.com/NullBlue67
Confidence: 85%
Qualys
Inside the Surge of PHP and IoT Exploits with Qualys TRU | Qualys
blogs_qualys·2025-10-30·CVSS 10.0
CVE-2022-22947 [CRITICAL] Inside the Surge of PHP and IoT Exploits with Qualys TRU | Qualys
#### Table of Contents
- PHP Servers Are the Top Target for Vulnerabilities and Misconfigurations
- PHP Exploitation Trends and Noteworthy CVEs
- The Dangers of Exposed Secrets and Credentials
- IOT Devices Remain a Weak Link in Security
- MVPower DVR Shell Unauthenticated Command Execution
- Cloud Vulnerabilities: CVE-2022-22947
- Threat Actors Exploit Cloud Resources for Reconnaissance
- 5 Best Practices to Reduce Exploitation Risk
- Building Resilience with Integrated Security
Attack automation is accelerating, widening the window between detection and response. Qualys TRU telemetry reveals how these attacks unfold and what defenders can do next.
The Qualys Threat Research Unit (TRU) has identified a sharp increase in attacks targeting PHP servers, IoT devices, and cloud gateways, pr
Qualys
What Security Teams Need to Know as PHP and IoT Exploits Surge
blogs_qualys·2025-10-30·CVSS 10.0
CVE-2022-22947 [CRITICAL] What Security Teams Need to Know as PHP and IoT Exploits Surge
## Table of Contents
PHP Servers Are the Top Target for Vulnerabilities and Misconfigurations
PHP Exploitation Trends and Noteworthy CVEs
The Dangers of Exposed Secrets and Credentials
IOT Devices Remain a Weak Link in Security
MVPower DVR Shell Unauthenticated Command Execution
Cloud Vulnerabilities: CVE-2022-22947
Threat Actors Exploit Cloud Resources for Reconnaissance
5 Best Practices to Reduce Exploitation Risk
Building Resilience with Integrated Security
Attack automation is accelerating, widening the window between detection and response. Qualys TRU telemetry reveals how these attacks unfold and what defenders can do next.
The Qualys Threat Research Unit (TRU) has identified a sharp increase in attacks targeting PHP servers, IoT devices, and cloud gateways, primarily driv
Bleepingcomputer
Hackers target SSRF bugs in EC2-hosted sites to steal AWS credentials
blogs_bleepingcomputer·2025-04-09
Hackers target SSRF bugs in EC2-hosted sites to steal AWS credentials
## Hackers target SSRF bugs in EC2-hosted sites to steal AWS credentials
## Bill Toulas
A targeted campaign exploited Server-Side Request Forgery (SSRF) vulnerabilities in websites hosted on AWS EC2 instances to extract EC2 Metadata, which could include Identity and Access Management (IAM) credentials from the IMDSv1 endpoint.
Retrieving IAM credentials allows attackers to escalate their privileges and access S3 buckets or control other AWS services, potentially leading to sensitive data exposure, manipulation, and service disruption.
The campaign was discovered by F5 Labs researchers , who reports that the malicious activity culminated between March 13 and 25, 2025. The traffic and behavioral patterns strongly suggest that it was carried out by a single threat actor.
## Campaign over
Wiz
Crying Out Cloud - February Newsletter | Wiz
blogs_wiz·2024-02-01·CVSS 9.8
CVE-2023-33246 [CRITICAL] Crying Out Cloud - February Newsletter | Wiz
This month we’ve seen a lot of action, with both vulnerabilities and security incidents that have left users affected. We bring you the latest cloud security highlights, to help you stay informed and stay secure. Let's dive in.
Here are our top picks!
## 🐞 High Profile Vulnerabilities
Apache RocketMQ RCE vulnerability exploited in-the-wild
In August 2023 researchers identified attackers exploiting CVE-2023-33246, a critical vulnerability in Apache RocketMQ, to install the DreamBus bot, a malware strain last reported about publicly in 2021. On January 5, 2024 Apache stated that the patch for CVE-2023-33246 was in fact insufficient, and an additional CVE was assigned to the bypass - CVE-2023-37582. The latter vulnerability is also being exploited in the wild, so it is recommended to patc
Tenable
Cybersecurity Snapshot: Critical Infrastructure Orgs Cautioned About Chinese Drones, While Water Plants Advised To Boost Incident Response
blogs_tenable·2024-01-19
Cybersecurity Snapshot: Critical Infrastructure Orgs Cautioned About Chinese Drones, While Water Plants Advised To Boost Incident Response
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Bleepingcomputer
FBI: Androxgh0st malware botnet steals AWS, Microsoft credentials
blogs_bleepingcomputer·2024-01-16·CVSS 9.8
[CRITICAL] FBI: Androxgh0st malware botnet steals AWS, Microsoft credentials
## FBI: Androxgh0st malware botnet steals AWS, Microsoft credentials
## Sergiu Gatlan
CISA and the FBI warned today that threat actors using Androxgh0st malware are building a botnet focused on cloud credential theft and using the stolen information to deliver additional malicious payloads.
This botnet was first spotted by Lacework Labs in 2022 and was controlling over 40,000 devices almost one year ago, according to Fortiguard Labs data.
It scans for websites and servers vulnerable to the following remote code execution (RCE) vulnerabilities: CVE-2017-9841 (PHPUnit unit testing framework), CVE-2021-41773 (Apache HTTP Server), and CVE-2018-15133 (Laravel PHP web framework).
"Androxgh0st is a Python-scripted malware primarily used to target .env files that contain confidential informat
Dfir Report
Lets Open(Dir) Some Presents: An Analysis of a Persistent Actor’s Activity
blogs_dfir_report·2023-12-18
Lets Open(Dir) Some Presents: An Analysis of a Persistent Actor’s Activity
From a Single Click: How Lunar Spider Enabled a Near Two-Month Intrusion Read More
- dragonforce Blurring the Lines: Intrusion Shows Connection With Three Major Ransomware Gangs Read More
Services Overview
Threat Hunting
-
Integration
CTI Program Advisory
Incident Response Playbook
About us
Contact Us
Collaboration
Careers
Analysts
Access DFIR Labs
Get in Touch
Public Reports
Products Overview
Threat intel Overview
Threat Feed
Private DFIR Reports
All Intel
Active Defense
DFIR Labs
Case Artifacts
Detection Pack
AI Training Ground
Service Overview
Threat Hunting
Integration
CTI Program Advisory
Incident Response Playbook
Company Overview
About us
Contact Us
Careers
Analyst
SQL Brute Force Leads to BlueSky Ransomware
From OneNote to RansomNote: An Ice Col
Qualys
Risk Fact #4: Malware in your Cloud means Exploitation is underway | Qualys
blogs_qualys·2023-08-29
Risk Fact #4: Malware in your Cloud means Exploitation is underway | Qualys
#### Table of Contents
- Threats Known to Exploit High-Risk Assets
- Denonia
- Getting a Foothold AndroxGh0st/Legion RCE, SCARLETEEL
- AndroxGh0st/Legion RCE
- Leveraging Deep Learning AI to Detect Advanced Malware
- Critical Insights from Risk Fact 4
### Qualys Blog Series – 2023 TotalCloud Security Insights by the Threat Research Unit
The 2023 TotalCloud Security Insights report from the Qualys Threat Research Unit (TRU) provides research insights, best practices, and detailed recommendations organized by five separate Risk Facts. The insights will enable organizations using cloud technologies to better understand these risks and how they can be better prepared to face those challenges in today’s threat landscape.
Read the previous blog in this series: External-Facing Vulnerabilities
Qualys
Risk Fact #4: Malware in your Cloud means Exploitation is underway
blogs_qualys·2023-08-29
Risk Fact #4: Malware in your Cloud means Exploitation is underway
## Table of Contents
Threats Known to Exploit High-Risk Assets
Denonia
Getting a Foothold AndroxGh0st/Legion RCE, SCARLETEEL
AndroxGh0st/Legion RCE
Leveraging Deep Learning AI to Detect Advanced Malware
Critical Insights from Risk Fact 4
## Qualys Blog Series – 2023 TotalCloud Security Insights by the Threat Research Unit
The 2023 TotalCloud Security Insights report from the Qualys Threat Research Unit (TRU) provides research insights, best practices, and detailed recommendations organized by five separate Risk Facts. The insights will enable organizations using cloud technologies to better understand these risks and how they can be better prepared to face those challenges in today’s threat landscape.
Read the previous blog in this series: External-Facing Vulnerabilities Cloud Sec
Fortinet
Mirai, RAR1Ransom, and GuardMiner – Multiple Malware Campaigns Target VMware Vulnerability
blogs_fortinet·2022-10-21·CVSS 9.8
CVE-2022-22954 [CRITICAL] Mirai, RAR1Ransom, and GuardMiner – Multiple Malware Campaigns Target VMware Vulnerability
FORTIGUARD LABS THREAT RESEARCH
Mirai, RAR1Ransom, and GuardMiner – Multiple Malware Campaigns Target VMware Vulnerability
By Cara Lin | October 21, 2022
In April, VMware patched a vulnerability CVE-2022-22954. It causes server-side template injection because of the lack of sanitization on parameters “deviceUdid” and “devicetype”. It allows attackers to inject a payload and achieve remote code execution on VMware Workspace ONE Access and Identity Manager. FortiGuard Labs published Threat Signal Report about it and also developed IPS signature in April.
We observed attacks in the wild since then. Most of the payloads focus on probing a victim’s sensitive data, for example, passwords, hosts file, etc. But in August, there were a few particular payloads, which got our interest. They had th
Unit42
Top CVEs to Patch: Insights from the 2022 Unit 42 Network Threat Trends Research Report
blogs_unit42·2022-07-21·CVSS 9.8
CVE-2017-5638 [CRITICAL] Top CVEs to Patch: Insights from the 2022 Unit 42 Network Threat Trends Research Report
Threat Research Center
Trend Reports
Vulnerabilities
## Top CVEs to Patch: Insights from the 2022 Unit 42 Network Threat Trends Research Report
Unit 42
Published: July 21, 2022
Trend Reports
Vulnerabilities
Apache Log4j
CVE-2017-5638
CVE-2017-9841
CVE-2018-19986
CVE-2019-02320
CVE-2019-19597
CVE-2019-9082
CVE-2020-14882
CVE-2020-14883
CVE-2020-15505
CVE-2020-15506
CVE-2020-25078
CVE-2020-5902
CVE-2021-21315
CVE-2021-22986
CVE-2021-26855
CVE-2021-31805
CVE-2021-34473
CVE-2021-35464
CVE-2021-38647
CVE-2021-40438
CVE-2021-40539
CVE-2021-41773
CVE-2021-42013
CVE-2021-44228
CVE-2021-45046
CVE-2022-22963
CVE-2022-22965
Network security trends
Unit 42 Network Threat Trends Research Report
## Executive Summary
Tens of thousands of vulnerabilities are repo
Unit42
Top CVEs to Patch: Insights from the 2022 Unit 42 Network Threat Trends Research Report
blogs_unit42·2022-07-21·CVSS 9.8
[CRITICAL] Top CVEs to Patch: Insights from the 2022 Unit 42 Network Threat Trends Research Report
## Executive Summary
Tens of thousands of vulnerabilities are reported every year, but not all are used by threat actors in real-world attacks. There are many reasons for this: a proof of concept (PoC) may not be available for attackers to weaponize, it may be too difficult to exploit the vulnerability, there may be a lack of accessible vulnerable software on the internet, or attackers may simply deem a vulnerability not worth exploiting due to low impact. Real-world defenders need real-world data on which vulnerabilities attackers are choosing to exploit – and where to focus protections.
In the 2022 Unit 42 Network Threat Trends Research Report, we’ve used data captured by the Palo Alto Networks Advanced Threat Prevention security service on Next-Generation Firewall and Prisma SASE from
Qualys
Managing CISA Known Exploited Vulnerabilities with Qualys VMDR | Qualys
blogs_qualys·2022-02-23
Managing CISA Known Exploited Vulnerabilities with Qualys VMDR | Qualys
#### Table of Contents
- Situation
- Directive Scope
- CISA Catalog of Known Exploited Vulnerabilities
- Detect CISA Vulnerabilities Using Qualys VMDR
- CISA Exploited RTI
- Detailed Operational Dashboard
- Remediation
- Federal Enterprises and Agencies Can Act Now
- Summary
- Getting Started
CISA released a directive in November 2021, recommending urgent and prioritized remediation of actively exploited vulnerabilities. Both government agencies and corporations should heed this advice. This blog outlines how Qualys Vulnerability Management, Detection & Response can be used by any organization to respond to this directive efficiently and effectively.
## Situation
Last November 2021, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) released a Binding Operational Directiv
Unit42
Network Attack Trends: Internet of Threats (November 2020-January 2021)
blogs_unit42·2021-04-12·CVSS 7.5
CVE-2020-28188 [HIGH] Network Attack Trends: Internet of Threats (November 2020-January 2021)
# Executive Summary
Unit 42 researchers analyzed network attack trends over Winter 2020 and discovered many interesting exploits in the wild. During the period of Nov. 2020 to Jan. 2021, the majority of the attacks we observed were classified as critical (75%), compared to the 50.4% we reported in the fall of 2020. Several newly observed exploits, including CVE-2020-28188, CVE-2020-17519, and CVE-2020-29227, have emerged and were continuously being exploited in the wild as of late 2020 to early 2021.
This blog provides details of the newly observed exploits as well as a dive deep into the exploitation analysis, vendor analysis, attack origin, and attack category distribution.
Palo Alto Networks Next-Generation Firewall customers are protected from these attacks with the URL Filtering an
Unit42
Network Attack Trends: Internet of Threats (November 2020-January 2021)
blogs_unit42·2021-04-12·CVSS 7.5
[HIGH] Network Attack Trends: Internet of Threats (November 2020-January 2021)
Threat Research Center
Trend Reports
Vulnerabilities
## Network Attack Trends: Internet of Threats (November 2020-January 2021)
Lei Xu
Yue Guan
Vaibhav Singhal
Published: April 12, 2021
Malware
Trend Reports
Vulnerabilities
Botnet
DDoS
Exploit kit
IoT
Network security trends
## Executive Summary
Unit 42 researchers analyzed network attack trends over Winter 2020 and discovered many interesting exploits in the wild. During the period of Nov. 2020 to Jan. 2021, the majority of the attacks we observed were classified as critical (75%), compared to the 50.4% we reported in the fall of 2020 . Several newly observed exploits, including CVE-2020-28188 , CVE-2020-17519 , and CVE-2020-29227 , have emerged and were continuously being exploited in the wild as of late 2020 to earl
Unit42
Network Attack Trends: Internet of Threats (August-October 2020)
blogs_unit42·2021-01-22·CVSS 9.8
CVE-2012-2311 [CRITICAL] Network Attack Trends: Internet of Threats (August-October 2020)
Threat Research Center
Trend Reports
Vulnerabilities
## Network Attack Trends: Internet of Threats (August-October 2020)
Yue Guan
Lei Xu
Ken Hsu
Zhibin Zhang
Published: January 22, 2021
Malware
Trend Reports
Vulnerabilities
DDoS
Exploits
IoT
Network security trends
## Executive Summary
Unit 42 researchers observed interesting attack trends from August-October 2020. Despite a surge in scanner activities and HTTP directory traversal exploitation attempts, CVE-2012-2311 and CVE-2012-1823 , which were the most commonly exploited vulnerabilities in the wild in early summer 2020 , are no longer at the top of that list. Several new critical exploits, including but not limited to CVE-2020-17496 and CVE-2020-25213 , have emerged and were being utilized at a constant and concern
Unit42
Network Attack Trends: Internet of Threats (August-October 2020)
blogs_unit42·2021-01-22·CVSS 9.8
CVE-2012-2311 [CRITICAL] Network Attack Trends: Internet of Threats (August-October 2020)
## Executive Summary
Unit 42 researchers observed interesting attack trends from August-October 2020. Despite a surge in scanner activities and HTTP directory traversal exploitation attempts, CVE-2012-2311 and CVE-2012-1823, which were the most commonly exploited vulnerabilities in the wild in early summer 2020, are no longer at the top of that list. Several new critical exploits, including but not limited to CVE-2020-17496 and CVE-2020-25213, have emerged and were being utilized at a constant and concerning rate as of fall 2020. To complicate matters, malicious actors are well aware that new exploits aren’t always needed to get the job done. Based on observations of malicious traffic for the designated three months, weaponized ThinkPHP vulnerabilities like CVE-2018-20062 and CVE-2019-908
Tenable
CVE-2017-9841: Drupal Sites Exploited Using PHPUnit Vulnerability in Mailchimp Modules (PSA-2019-0904)
blogs_tenable·2019-09-05·CVSS 9.8
[CRITICAL] CVE-2017-9841: Drupal Sites Exploited Using PHPUnit Vulnerability in Mailchimp Modules (PSA-2019-0904)
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
CTF
Undetected / README
ctf_writeups·CVSS 9.8
CVE-2017-9841 [CRITICAL] Undetected / README
# Undetected - HackTheBox - Writeup
Linux, 30 Base Points, Medium
## Machine
## TL;DR
To solve this machine, we begin by enumerating open services using ```namp``` – finding ports ```22``` and ```80```.
***User***: On ```/vendor``` found ```phpunit```, Using ```CVE-2017-9841``` to get RCE, Using that we get a reverse shell as ```www-data```, Found file ```/var/backups/info```, ```strings``` on this file shows base64 string which contains the hashed password of the new user was created, decrypt the hash and we get the password of ```steven1``` user.
***Root***: By reading the mails of ```steven``` we found a hint about the ```Apache``` service, Found an odd module on ```/lib/apache2/modules``` directory, ```strings``` on this module and we found base64 strings which show the attacke
http://web.archive.org/web/20170701212357/http://phpunit.vulnbusters.com/http://www.securityfocus.com/bid/101798http://www.securitytracker.com/id/1039812https://github.com/sebastianbergmann/phpunit/commit/284a69fb88a2d0845d23f42974a583d8f59bf5a5https://github.com/sebastianbergmann/phpunit/pull/1956https://security.gentoo.org/glsa/201711-15https://www.oracle.com/security-alerts/cpuoct2021.htmlhttp://web.archive.org/web/20170701212357/http://phpunit.vulnbusters.com/http://www.securityfocus.com/bid/101798http://www.securitytracker.com/id/1039812https://github.com/sebastianbergmann/phpunit/commit/284a69fb88a2d0845d23f42974a583d8f59bf5a5https://github.com/sebastianbergmann/phpunit/pull/1956https://security.gentoo.org/glsa/201711-15https://www.oracle.com/security-alerts/cpuoct2021.htmlhttps://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-9841
2017-06-27
Published
2022-02-15
Added to CISA KEV
Exploited in the wild