/
← Voltar ao feed
medium exploit público

F5 Labs June 2026: Honeynet attacks up 55.5%; LiteSpeed Cache CVE-2024-44000 debug.log scanning surges alongside Exchange and PHP exploits

1 fonte(s) · 1 atualização(ões) · publicado 20/07/2026 15:09 · coletado há 1 dia

F5 Labs honeynet telemetry shows overall hostile activity rising 55.5% month over month in June 2026, a return to the levels of the earlier-year spike. Highlighted is CVE-2024-44000, an unauthenticated account takeover flaw (CVSS 9.8, CWE-522) in the LiteSpeed Cache WordPress plugin, which rose by 1,128 to 2,603 attacks (#8). Scanning is indiscriminate and comes from a single operation using shared, purpose-built tooling on rented VPS infrastructure. Low-interaction sensors cannot confirm any compromise; the traffic is reconnaissance for readable WordPress debug logs. The Top 10 is led by CVE-2024-4577 (14,706) and CVE-2017-9841 (11,585). CVE-2021-26855 (ProxyLogon) re-entered at #4 and the React Server Components pre-auth RCE CVE-2025-55182 climbed to #5.

Technical Details

  • Mechanism: with WordPress debug logging enabled, LiteSpeed Cache (versions up to 6.5.0.1) writes session and cookie data to /wp-content/debug.log. If that file is web-accessible, an unauthenticated attacker can fetch it, extract a valid session cookie and replay it, gaining administrator access if an admin session is logged. The CVE is not in the CISA KEV catalog, and public PoC code exists.
  • Scanner behavior: probes /wp-content/debug.log, /wp-content/uploads/wp-content/debug.log, /logs/wp-content/debug.log, /wordpress/wp-content/debug.log and the rotated debug.log.1. It also uses URL-encoding evasion (debug%2elog) and cache-busting query strings.
  • Fingerprints: HTTP/1.0 with Connection: close, two spoofed User-Agents shared across unrelated IPs, and X-Real-IP/X-Forwarded-For set to the scanner's own IP. Two header-casing variants suggest at least two tool builds.
  • Co-occurrence: CVE-2005-0869 (phpSysInfo, #9, 1,846 attacks) fires at near-identical per-IP counts, indicating one tool with a broad check library rather than chained exploits.
  • Other trends: four Exchange-related CVEs are active (CVE-2021-26855 debuted at #4 with 3,163 attacks, alongside CVE-2022-41082 and CVE-2021-34523). CVE-2025-55182 grew by 1,526 to 3,086. CVE-2025-55184 fell from #7 to #12. Information Leakage events rose 77% to 1,149,567.
  • Sources: the US is the top origin (7.73M events), followed by Germany, France and Singapore. China appeared as a new origin with 690,212 events after zero the prior month. Attribution is infrastructure-based only.
  • Scanner IPs (top cluster): 5.189.184.50, 2.59.156.103, 144.126.159.74, 103.200.219.112, 195.26.240.180.

Remediation

  • Update LiteSpeed Cache beyond 6.5.0.1 and disable debug logging in production; if logging is required, keep the log path non-web-accessible.
  • Block external requests to debug.log paths, including nested, rotated and URL-encoded variants. Prefer path-based signatures over IP blocking, since source IPs rotate.
  • Rotate WordPress secrets and force re-authentication if a vulnerable version ran with debug logging enabled; audit admin accounts for unexpected sessions or new administrators.
  • Verify patch levels for on-premise Exchange (ProxyLogon/ProxyShell), prioritize patching PHP-CGI (CVE-2024-4577), and treat React SSR exposure to CVE-2025-55182 as urgent.
  • Use ASN-level filtering rather than blanket geo-blocking of US/DE/FR/SG traffic.

9 exploits públicos

Há código de exploração publicado no Exploit-DB para CVE-2025-55182, CVE-2024-4577, CVE-2024-44000 e outros. O código não é reproduzido aqui: o link leva à fonte, e a explicação foi escrita pela IA a partir do arquivo publicado.

  1. exploit-db.com · EDB-52506 ↗ · aplicação web · multiple · pub. 09/04/2026 não verificado

    React Server 19.2.0 - Remote Code Execution

    The script targets CVE-2025-55182, a flaw in how React Server Components deserialize data sent to server function endpoints, as used by frameworks such as Next.js. An unauthenticated attacker with network access to an app running React 19.0.0 to 19.2.0 can trigger it with one crafted POST, no user interaction. It abuses object handling to run JavaScript on the server, giving command execution as the app user. It is a working-looking, blind PoC that scans a target list and leaks command output via DNS lookups; it only prints HTTP status.

    CVE-2025-55182 · autor: danieljavanrad · explicação gerada por IA
  2. exploit-db.com · EDB-52331 ↗ · aplicação web · php · pub. 15/06/2025 não verificado

    PHP CGI Module 8.3.4 - Remote Code Execution (RCE)

    This script exploits CVE-2024-4577, an argument injection flaw in PHP running as CGI on Windows, where a soft hyphen in the query string is turned into a dash and lets the attacker pass configuration options to the interpreter. It needs only network access to an exposed php-cgi executable, with no login or user interaction. The options make PHP run code sent in the request body, giving command execution as the web server user. It looks like a working exploit with multi-host scanning and an interactive shell.

    CVE-2024-4577 · autor: İbrahimsql · explicação gerada por IA
  3. exploit-db.com · EDB-52099 ↗ · aplicação web · php · pub. 28/03/2025 não verificado

    Litespeed Cache 6.5.0.1 - Authentication Bypass

    This script targets WordPress sites running LiteSpeed Cache up to 6.5.0.1 (CVE-2024-44000), where debug logging can record request data, including the session cookies of logged-in users. It needs only network access and no login, but the site must have debug logging on and the log file publicly readable. It downloads that log, extracts login cookies per user and lets the attacker pick one to reuse in a browser, enabling account takeover, possibly of an administrator. It looks like a simple working tool, though unverified.

    CVE-2024-44000 · autor: Caner Tercan · explicação gerada por IA

Linha do tempo

  1. f5.com ↗ · pub. 20/07/2026 15:09 · coletado 19/10 18:02 primeiro registro

    F5 Labs June 2026: Honeynet attacks up 55.5%; LiteSpeed Cache CVE-2024-44000 debug.log scanning surges alongside Exchange and PHP exploits

    ler a análise desta fonte

    F5 Labs honeynet telemetry shows overall hostile activity rising 55.5% month over month in June 2026, a return to the levels of the earlier-year spike. Highlighted is CVE-2024-44000, an unauthenticated account takeover flaw (CVSS 9.8, CWE-522) in the LiteSpeed Cache WordPress plugin, which rose by 1,128 to 2,603 attacks (#8). Scanning is indiscriminate and comes from a single operation using shared, purpose-built tooling on rented VPS infrastructure. Low-interaction sensors cannot confirm any compromise; the traffic is reconnaissance for readable WordPress debug logs. The Top 10 is led by CVE-2024-4577 (14,706) and CVE-2017-9841 (11,585). CVE-2021-26855 (ProxyLogon) re-entered at #4 and the React Server Components pre-auth RCE CVE-2025-55182 climbed to #5.

    Technical Details

    • Mechanism: with WordPress debug logging enabled, LiteSpeed Cache (versions up to 6.5.0.1) writes session and cookie data to /wp-content/debug.log. If that file is web-accessible, an unauthenticated attacker can fetch it, extract a valid session cookie and replay it, gaining administrator access if an admin session is logged. The CVE is not in the CISA KEV catalog, and public PoC code exists.
    • Scanner behavior: probes /wp-content/debug.log, /wp-content/uploads/wp-content/debug.log, /logs/wp-content/debug.log, /wordpress/wp-content/debug.log and the rotated debug.log.1. It also uses URL-encoding evasion (debug%2elog) and cache-busting query strings.
    • Fingerprints: HTTP/1.0 with Connection: close, two spoofed User-Agents shared across unrelated IPs, and X-Real-IP/X-Forwarded-For set to the scanner's own IP. Two header-casing variants suggest at least two tool builds.
    • Co-occurrence: CVE-2005-0869 (phpSysInfo, #9, 1,846 attacks) fires at near-identical per-IP counts, indicating one tool with a broad check library rather than chained exploits.
    • Other trends: four Exchange-related CVEs are active (CVE-2021-26855 debuted at #4 with 3,163 attacks, alongside CVE-2022-41082 and CVE-2021-34523). CVE-2025-55182 grew by 1,526 to 3,086. CVE-2025-55184 fell from #7 to #12. Information Leakage events rose 77% to 1,149,567.
    • Sources: the US is the top origin (7.73M events), followed by Germany, France and Singapore. China appeared as a new origin with 690,212 events after zero the prior month. Attribution is infrastructure-based only.
    • Scanner IPs (top cluster): 5.189.184.50, 2.59.156.103, 144.126.159.74, 103.200.219.112, 195.26.240.180.

    Remediation

    • Update LiteSpeed Cache beyond 6.5.0.1 and disable debug logging in production; if logging is required, keep the log path non-web-accessible.
    • Block external requests to debug.log paths, including nested, rotated and URL-encoded variants. Prefer path-based signatures over IP blocking, since source IPs rotate.
    • Rotate WordPress secrets and force re-authentication if a vulnerable version ran with debug logging enabled; audit admin accounts for unexpected sessions or new administrators.
    • Verify patch levels for on-premise Exchange (ProxyLogon/ProxyShell), prioritize patching PHP-CGI (CVE-2024-4577), and treat React SSR exposure to CVE-2025-55182 as urgent.
    • Use ASN-level filtering rather than blanket geo-blocking of US/DE/FR/SG traffic.