8 casos · pág. 1/1
F5 Labs, using Efflux sensor telemetry, analyzed December 2025 exploitation of React2Shell (CVE-2025-55182), a CVSS 10.0 unsafe deserialization RCE in React Server Components. It was disclosed on 3 December 2025 and rose to second place among the most exploited CVEs, behind only CVE-2017-9841. Within days of disclosure, actors moved from …
Hacktron analyzes wp2shell, an unauthenticated RCE chain in WordPress core found by Searchlight Cyber. It combines CVE-2026-63030, a route handler confusion in the REST API batch endpoint, with CVE-2026-60137, an SQL injection in WPQuery. Affected versions are WordPress 6.9.0-6.9.4, 7.0.0-7.0.1 and the 7.1 beta, fixed in 6.9.5, 7.0.2 and …
F5 Labs analyzed exploitation of CVE-2026-24423, a CVSS 9.8 unauthenticated remote code execution flaw in SmarterTools SmarterMail (CWE-306). CISA added it to the KEV catalog on February 2, 2026 and notes it has been used in ransomware campaigns. Despite public write-ups, F5 sensors saw only one IP, 193.24.123.58 (ASN 200593, Russian ISP …
F5 Labs, with Efflux sensor telemetry, profiled a persistent information-disclosure scanner operating from 78.153.140.203 in a netblock of AS202306 (HOSTGLOBAL.PLUS LTD), a UK ISP. The IP was first seen on 10 January 2025, vanished on 10 April, and returned on 11 July 2025. It scans 130 unique URLs: 80.23% are variations of /.env, 11.45% …
F5 Labs reports a scanning campaign observed on its Honeynet in March 2026. It recorded 1,897 session-grouped attempts (2,821 raw events) tied to CVE-2018-14028, a WordPress 4.9.7 unrestricted file upload flaw, and the CVE entered the monthly top 10 after being absent in February. Instead of exploiting the upload flaw, the operator probes…
F5 Labs honeynet telemetry shows overall hostile activity rising 55.5% month over month in June 2026, a return to the levels of the earlier-year spike. Highlighted is CVE-2024-44000, an unauthenticated account takeover flaw (CVSS 9.8, CWE-522) in the LiteSpeed Cache WordPress plugin, which rose by 1,128 to 2,603 attacks (8). Scanning is i…
F5 Labs, using attack telemetry from Efflux's global sensor network, analyzed the most exploited vulnerabilities in July 2025 and found that nearly all top-scanned CVEs are HTTP-based RCE or command injection flaws in web interfaces. CVE-2017-9841 (PHPUnit) was the most exploited, followed by CVE-2023-1389 (TP-Link Archer AX21), CVE-2022-…
FortiGuard Labs describes Evooo1Bot, a Linux botnet that embeds the Mirai DDoS engine in a more modular and capable framework. It uses encrypted C2 communications, layered string obfuscation (AES-256-CTR, ChaCha20, XOR-based key derivation) and a 28-command remote administration interface. It also ships an integrated exploit arsenal again…
