Loading story…
Attackers are actively exploiting a critical ShowDoc vulnerability, CVE-2025-0520 (also referenced as CNVD-2020-26585), to compromise unpatched servers exposed to the internet. The flaw affects ShowDoc versions before 2.8.7 and stems from an unauthenticated unrestricted file upload weakness that lets attackers upload arbitrary PHP files, plant web shells, and achieve remote code execution; it carries a CVSS score of 9.4.
Researchers reported observed exploitation against a vulnerable U.S.-based honeypot, where attackers dropped a web shell after targeting the application. More than 2,000 internet-exposed ShowDoc instances were identified online, most of them in China, underscoring the continued risk from older N-day vulnerabilities that remain unpatched years after a fix was released in ShowDoc 2.8.7; the current version is 3.8.1, and users are being urged to upgrade and lock down exposed systems.
See which actors are running it and whether you're in range.
3 events from the most recent confirmed update back to the earliest known activity.
Researchers said more than 2,000 internet-exposed ShowDoc instances were still reachable online, with most located in China. The exposure increased the risk that unpatched systems could be compromised through the actively exploited vulnerability.
VulnCheck researcher Caitlin Condon reported the first observed in-the-wild exploitation of the ShowDoc flaw, including an attack that dropped a web shell on a U.S.-based honeypot running a vulnerable instance. The activity showed attackers were targeting unpatched internet-exposed ShowDoc servers.
ShowDoc addressed an unauthenticated unrestricted file upload vulnerability affecting versions before 2.8.7 with the release of version 2.8.7. The flaw, later tracked as CVE-2025-0520 and also identified as CNVD-2020-26585, can allow attackers to upload PHP files and achieve remote code execution.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
7 references tracked. Mallory keeps watching after this page renders.
hackread.com
Open sourcecybersecuritynews.com
Open sourcescworld.com
Open sourcesecurityaffairs.com
Open sourcesecurityaffairs.com
Open sourcethehackernews.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical flaw in the open-source file-sharing platform **ProjectSend** is being actively exploited in the wild, allowing unauthenticated attackers to take over vulnerable servers. The vulnerability, tracked as `CVE-2024-11680`, affects versions earlier than **r1720** and stems from crafted HTTP requests to `options.php` that let attackers alter application configuration without logging in. Researchers reported exploitation dating back to at least September 2024, while the bug itself had been patched earlier, leaving many internet-exposed instances still vulnerable. Successful exploitation can enable attackers to create user accounts, enable new-user registration, upload webshells, inject malicious JavaScript, and ultimately achieve remote code execution with full control of the system. Defenders were urged to upgrade immediately to **ProjectSend r1720 or later** and investigate for signs of compromise, including suspicious PHP files under `/upload/files/`, unexpected changes to homepage text, and unauthorized account or registration-setting changes.
Jul 24, 2026
Attackers are actively scanning for and attempting to exploit critical Apache Struts file upload vulnerabilities `CVE-2024-53677` and `CVE-2023-50164`, both of which stem from improper handling of upload parameters that can enable path traversal and unauthorized file placement. Security researchers reported internet-wide enumeration and exploitation activity following public disclosure and the appearance of proof-of-concept code on GitHub and in technical write-ups, with attackers seeking to upload malicious files into restricted directories. Successful exploitation can allow deployment of JSP web shells and lead to remote code execution on vulnerable Struts applications, depending on how file upload features are exposed and sanitized in each environment. The flaws affect multiple Struts branches, including legacy 2.x and 6.x releases, and defenders have been urged to upgrade to fixed versions such as Struts `2.5.33`, `6.3.0.2`, or `6.4.0` as applicable, migrate away from legacy upload mechanisms, restrict access to upload interfaces, apply WAF protections, and monitor for suspicious JSP file creation and execution.
Aug 21, 2026
Attackers are actively exploiting critical SAP NetWeaver Visual Composer vulnerability **CVE-2025-31324** in the Metadata Uploader component. Insufficient access controls allow unauthenticated remote attackers to upload malicious files to vulnerable servers, with observed intrusions deploying webshells to establish persistent access. SAP issued an emergency patch, while the Dutch National Cyber Security Centre assessed the threat at **High/High** and warned that webshells linked to the exploit are being sold online, increasing the risk of widespread abuse. Organizations should immediately apply SAP’s fixes, identify internet-exposed NetWeaver instances, and investigate affected systems for uploaded webshells and other indicators of compromise.
Aug 31, 2026