Loading story…
A large-scale credential theft campaign exploited CVE-2025-54068, a critical unauthenticated remote code execution flaw in Laravel Livewire v3 through 3.6.3, compromising more than 6,000 applications. Imperva said the attackers used PHP deserialization payloads built with PHPGGC gadget chains to fetch and run a Bash stealer known as shoc.enz from xantibot[.]pw, then harvested .env files and other sensitive data from exposed servers.
Recovered attacker infrastructure showed credentials stolen from 6,167 distinct applications, along with more than 1,850 database dumps and over 26 million email addresses spanning multiple countries and sectors. The malware collected database credentials, APP_KEY values, Stripe keys, AWS IAM credentials, JWT and OAuth secrets, and SMTP passwords, then exfiltrated data via FTP, Telegram, and GoFile; reporting also noted separate research into large-scale compromises of thousands of WordPress sites by a Chinese actor, underscoring continued mass exploitation of widely deployed web platforms.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
Imperva said malware and infrastructure indicators suggested an Indonesian-origin actor, citing Indonesian-language comments, Asia/Jakarta references, and linked account metadata. The report also advised upgrading to Laravel Livewire 3.6.4 or later and rotating compromised credentials.
Analysis of recovered infrastructure found credentials stolen from 6,167 distinct applications, along with more than 1,850 database dumps and over 26 million email addresses. The stolen data included Laravel APP_KEY values, database credentials, cloud keys, OAuth secrets, JWT secrets, and SMTP passwords.
Imperva reported a large-scale campaign exploiting CVE-2025-54068, a critical unauthenticated remote code execution vulnerability in Laravel Livewire v3 through 3.6.3. The attackers used PHPGGC deserialization gadget chains to fetch and run a Bash stealer that harvested .env files and exfiltrated data.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
my.f5.com
Open sourcecybersecuritynews.com
Open sourceimperva.com
Open sourcectrlaltintel.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A high-severity vulnerability in **Livewire Filemanager**, a file-management component used in **Laravel** web applications, allows **unauthenticated remote code execution** via malicious file upload. Tracked as **CVE-2025-14894** (CERT/CC note **VU#650657**; reported **CVSS 7.5**), the issue stems from inadequate file-type and MIME validation in `LivewireFilemanagerComponent.php`, enabling attackers to upload a PHP payload (e.g., a webshell) through the component’s upload interface. Exploitation is straightforward in common Laravel deployments: if the application exposes uploaded content through the public `/storage/` path—typically after running the standard setup command `php artisan storage:link`—an attacker can upload a malicious PHP file and then trigger execution by requesting it via the storage URL. Successful exploitation runs code with the privileges of the web server user, enabling broad read/write access to accessible files and potential pivoting to connected systems; at the time of reporting, the issue was described as **unpatched/unacknowledged by the vendor**, with the project’s documentation reportedly treating file validation as “out of scope” for the component itself.
Jun 29, 2026
A large-scale credential theft campaign, identified as PCPcat, compromised over 59,000 publicly exposed Next.js servers within a 48-hour period. Attackers exploited critical remote code execution vulnerabilities, specifically CVE-2025-29927 and CVE-2025-66478, using a custom malware (`react.py`) to scan and infiltrate targets. Once access was gained, the attackers extracted sensitive credentials from `.env` files, SSH keys, AWS configurations, Docker tokens, and Git credentials, and established persistent access through the installation of proxy and tunneling tools such as GOST SOCKS5 and FRP. The campaign's command-and-control infrastructure was exposed, revealing operational statistics and methods for target assignment, data exfiltration, and health checks, with key indicators of compromise including specific IP addresses, files, processes, and log artifacts. The operation was attributed to the group "PCP Cat," with evidence of their activity and communication channels found on Telegram. Security researchers provided detection rules for Suricata and YARA to identify malicious activity related to this campaign. The scale and speed of the attack, affecting over 59,000 servers in less than two days, highlight the critical need for organizations using Next.js to patch vulnerable systems and monitor for signs of compromise, especially given the attackers' use of prototype pollution and Docker API abuse for persistence and lateral movement.
Jun 29, 2026
Attackers rapidly weaponized the critical cPanel and WHM authentication-bypass flaw **`CVE-2026-41940`** to seize control of exposed hosting servers, with researchers and internet telemetry providers reporting exploitation within a day of disclosure and signs the bug may have been abused earlier. The vulnerability affects cPanel/WHM deployments after 11.40, and reporting tied the surge to a sharp rise in maliciously flagged cPanel hosts, widespread scanning from tens of thousands of IPs, and compromises across a large internet-facing footprint that some estimates placed in the hundreds of thousands to more than a million systems. Post-compromise activity included **Sorry ransomware** encrypting files with the `.sorry` extension, Mirai-related botnet deployment, cryptomining, and website hijacking, prompting CISA to add the flaw to its Known Exploited Vulnerabilities catalog and order federal agencies to patch. Separate investigations found the flaw was also used in targeted intrusions against government, military, MSP, and hosting-provider networks, especially in Southeast Asia, while QiAnXin XLab linked a major campaign to a long-running actor it tracks as **Mr_Rot13**. In that activity, attackers used automated exploitation from more than 2,000 source IPs to install SSH persistence, change root credentials, drop PHP web shells, inject fake cPanel login pages to steal credentials, exfiltrate data to attacker infrastructure and Telegram, and deploy the cross-platform **Filemanager** backdoor for remote command execution. Researchers also reported follow-on use of AdaptixC2, OpenVPN, Ligolo, and custom persistence tooling, as well as theft of about **4.37 GB** of sensitive data, underscoring that the bug enabled both broad opportunistic compromise and more deliberate espionage-style operations.
Jun 29, 2026