Web Shell

Head Mare APT group exploited a chain of two vulnerabilities (KLCERT-26-057 and KLCERT-26-058) in unpatched TrueConf Server instances to achieve unauthenticated remote code execution as SYSTEM via port 4307/TCP. Attackers deployed a web shell by replacing locale.php, then trojanized the TrueConf Client installer to deliver PhantomCore and PhantomGraph backdoors to meeting participants. PhantomGraph uses Microsoft OneDrive for C2 and is split into two DLLs to evade EDR. The vulnerabilities were patched in TrueConf Server versions 5.3.9, 5.4.9, and 5.5.5 released on June 18, 2026.

Head Mare APT group exploited a chain of two vulnerabilities (KLCERT-26-057, KLCERT-26-058) in unpatched TrueConf Server instances to achieve unauthenticated remote code execution as SYSTEM. After gaining elevated privileges, attackers replaced the locale.php file with a web shell, then trojanized the TrueConf client installer to deliver the PhantomCore backdoor to all clients downloading it. A second backdoor, PhantomGraph, uses Microsoft OneDrive as C2 and splits its functionality across two service-installed DLLs to evade EDR detection.

2026-07-2212 minElastic Security Labscritical

wp2shell is a pre-authentication remote code execution chain in WordPress Core that exploits a route confusion bug in the REST batch endpoint (/wp-json/batch/v1) to achieve SQL injection, escalate to administrator, and upload a plugin-backed webshell. The chain affects WordPress 6.9.0–6.9.4 and 7.0.0–7.0.1 with fixes available in 6.9.5 and 7.0.2 respectively. Elastic Defend detects the exploit through behavioral rules targeting web server processes spawning shells and PHP file creation in plugin directories, with prevention capable of terminating the shell execution at the moment of compromise.

Volexity discovered threat actor UTA0533 exploiting two zero-day vulnerabilities in SonicWall SMA 1000 series VPN appliances to achieve root-level remote code execution. CVE-2026-15409 enables pre-auth SSRF via /wsproxy to tunnel to localhost services, while CVE-2026-15410 enables command injection via path traversal in the sysCtrl.execRemoveHotfix endpoint. The actor deployed custom malware including KNUCKLEBALL (Java agent injector), ORANGETAIL (webshell), and ROOTRUN (privilege escalation binary), then used tcpdump to capture LDAP credentials and attempted lateral movement from over 200 IP addresses.

A previously unseen Rust-based ransomware family named Spirals was deployed in a double extortion attack against a South Asian IT services company in June 2026. The attackers compromised an internet-facing IIS web server via an ASP.NET web shell, established multiple redundant C2 channels using revsocks, Chisel, and Cloudflare tunnel, performed credential theft via SAM and LSASS dumps, and deployed the ransomware payload via PsExec across the network within 24 hours of initial access. The ransomware uses AES-128 file encryption with ECDH P-256 key wrapping and includes capabilities for defense evasion, lateral movement, and process termination.

UNK_MassTraction, a suspected China-aligned threat cluster, has been exploiting chained n-day vulnerabilities in Roundcube mailservers (CVE-2024-42009 XSS followed by CVE-2025-49113 PHP deserialization) targeting physics and engineering departments at US and Canadian universities since May 2026. The campaign deploys a custom JavaScript credential stealer (IceCube), a webshell (SquareShell), and the VShell backdoor via an in-memory ELF loader, treating mailservers as edge devices for network pivot. The tooling demonstrates mature operational security including anti-forensics, fallback mechanisms, and process spoofing.

Adobe ColdFusion security bulletin APSB26-68 patches 11 CVEs across ColdFusion 2025 and 2023, including critical arbitrary file read/write vulnerabilities in the RDS module and a path traversal in the CKEditor file manager upload endpoint. When RDS is enabled with authentication disabled, attackers can use the simple length-prefixed RDS RPC protocol to read or write arbitrary files, achieving remote code execution as SYSTEM by deploying a CFML webshell. A separate unauthenticated path traversal in the CKEditor file manager allows file uploads to arbitrary directories, also executing as SYSTEM.

Kaspersky's 2025 compromise assessment report reveals that organizations consistently fail to detect long-dwelling threats, with 30.8% of incidents persisting over 3 months and 52% of high-severity compromises going undetected for 90+ days. Key findings include widespread abuse of LoLBins and remote management tools in every incident-bearing engagement, 40% of web shells surviving in backups to be restored post-remediation, and a strong correlation between in-house forensics/reverse-engineering capability and reduced incident severity. Multiple case studies document dormant crypto-mining on domain controllers (4 years), in-memory LionTail implants on critical servers, PurpleFox rootkit infections evading EDR with disabled memory scanning, and ClipBanker persistence via registry Run keys with Defender exclusions.

Within five days of exposing an Ivanti Sentry management surface to the internet, a controlled sensor recorded ten distinct operators attempting to exploit CVE-2026-10520, the CVSS 10.0 pre-authentication command-injection flaw that CISA had added to its Known Exploited Vulnerab…

2026-05-245 minCheck Pointcritical

This threat intelligence report highlights a surge in ransomware activity, critical zero-day vulnerabilities in Windows, and the active exploitation of Cisco Catalyst SD-WAN controllers. Additionally, it details emerging AI-driven threats, including malicious Hugging Face repositories and the abuse of AI website generators for phishing, alongside an APT intrusion by FamousSparrow targeting the energy sector.

2026-05-136 minMicrosoftcritical

A sophisticated threat actor compromised a third-party IT services provider to abuse legitimate HPE Operations Agent infrastructure, enabling stealthy execution and discovery. The attackers established persistence and harvested credentials using malicious network provider and password filter DLLs on domain controllers, while utilizing web shells and ngrok tunnels to maintain long-term, undetected access.

2026-05-135 minRecorded Futurecritical

In March 2026, 31 high-impact vulnerabilities were actively exploited, highlighted by the Interlock Ransomware Group leveraging a CVSS 10.0 zero-day in Cisco Secure FMC (CVE-2026-20131). The attackers utilized insecure Java deserialization to gain root access, deploying custom RATs, memory-resident web shells, and ransomware across enterprise networks.

2026-05-134 minAkamaicritical

A critical unauthenticated remote code execution vulnerability (APSB25-94) in Magento Open Source and Adobe Commerce allows attackers to upload polyglot files containing PHP code. By exploiting the REST API's cart item custom options, attackers can bypass basic image validation to deploy web shells and execute arbitrary code on the server.

2026-05-135 minCisco Taloshigh

Threat actors increasingly abuse legitimate native utilities, third-party tools, and cloud service clients for data exfiltration, bypassing traditional static detections. The Exfiltration Framework models the behavioral and forensic characteristics of these tools to enable detection based on execution context, network patterns, and artifact persistence rather than tool presence.