Loading story…
Craft CMS disclosed and patched two critical vulnerabilities, CVE-2025-32432 and CVE-2024-58136, that can be chained or abused to achieve unauthenticated remote code execution and full compromise of vulnerable servers. The flaws affect Craft CMS 5.x before 5.6.17, 4.x before 4.14.15, and 3.x before 3.9.15; one issue involves insufficient input validation in image transformation functionality, while the other stems from unsafe handling of the __class variable in the underlying Yii 2 framework.
Researchers and national defenders reported that the vulnerabilities are being actively exploited in the wild, with investigations tying attacks to malicious requests targeting the actions/assets/generate-transform endpoint and abuse of __class parameters. Organizations running exposed Craft CMS instances were urged to patch immediately, review logs for suspicious POST activity, check file and system integrity, and rotate credentials if compromise is suspected.
See which actors are running it and whether you're in range.
5 events from the most recent confirmed update back to the earliest known activity.
SensePost published research on an in-the-wild campaign exploiting remote code execution in Craft CMS. The reference indicates technical investigation of active exploitation, but the event date is not explicitly anchored in the provided content.
MBSD-SOC reported that it first observed attacks targeting Craft CMS CVE-2025-32432 on June 4, 2025. The observed exploit attempt used a Base64-decoded PHP shell_exec() payload to fetch and execute a shell script from 111.90.151.57.
CSIRT.SK reported that CVE-2025-32432 and CVE-2024-58136 were being actively exploited in the wild and said both could enable unauthenticated remote code execution and full system compromise. The advisory identified affected Craft CMS version ranges and urged administrators to update, review logs, and rotate credentials if compromise is found.
Sekoia reported that it observed active exploitation of Craft CMS CVE-2025-32432 on a honeypot between February 28 and May 2, 2025. The attacks used a crafted request sequence to plant a PHP webshell and deploy a Golang loader, XMRig cryptominer, and IPRoyal proxyware, which the report attributed to the Mimo (Hezb) intrusion set.
Craft CMS published a knowledge base article for CVE-2025-32432 describing the vulnerability and providing remediation guidance. CSIRT.SK later reported that Craft CMS developers released security updates addressing CVE-2025-32432 and CVE-2024-58136.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 27 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
6 references tracked. Mallory keeps watching after this page renders.
blog.sekoia.io
Open sourcembsd.jp
Open sourcecsirt.sk
Open sourcecraftcms.com
Open sourceasec.ahnlab.com
Open sourcesensepost.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**CVE-2024-56145** enables unauthenticated remote code execution in Craft CMS when PHP's `register_argc_argv` setting is enabled. Craft CMS bootstrap code accepted CLI-style options from the web-populated `$_SERVER['argv']` array, allowing query-string input to override application paths, including the templates directory. The affected condition was present in Craft CMS's official Docker configuration. An attacker can redirect template resolution to an attacker-controlled FTP server and leverage PHP's FTP stream wrapper to satisfy file-existence checks before Craft CMS downloads and renders a malicious Twig template. Although Twig blocked several direct dangerous callbacks, the published technique bypassed those restrictions through `call_user_func` used by the `sort` filter. Craft CMS fixed the flaw in versions **5.5.2** and **4.13.2** and later; organizations unable to upgrade should disable `register_argc_argv` and review exposed Craft deployments for suspicious template-path overrides.
Sep 3, 2026
Craft CMS disclosed six vulnerabilities affecting **4.x** and **5.x** releases, including a **critical** remote code execution flaw tracked as `CVE-2026-72781`. The most severe issue affects versions **5.0.0-RC1 through before 5.10.7** and **4.0.0-RC1 through before 4.18.3**, where an authenticated user with control panel access can render a malicious Twig template and execute arbitrary code even when the Twig sandbox is enabled. The flaw stems from Craft marking `ElementInterface` as safe and extending sandbox allowlisting through the class hierarchy to `yii\base\Component`, creating an arbitrary function-call gadget.
Aug 11, 2026
Researchers detailed how attackers can abuse improperly exposed "protected" method handling in vBulletin to achieve unauthenticated remote code execution on internet-facing forums. The issue affects vBulletin `5.0.0` through `5.7.5` and `6.0.0` through `6.0.3` running on PHP `8.1` or newer, and is tracked as **CVE-2025-48827** and **CVE-2025-48828**. Technical analysis showed the flaws can be chained from remote access to protected method invocation and full code execution on vulnerable servers. CSIRT.SK reported the vulnerabilities are being actively exploited in the wild, with abuse observed since at least May 2025, while many exposed instances remain unpatched. The vendor had reportedly released fixes in April 2024 without detailed public disclosure, leaving administrators unaware of the severity until later reporting. Defenders are being urged to update affected installations to the recommended patched versions or the latest release and to review server and application logs for evidence of compromise.
Jul 24, 2026