Loading story…
Craft CMS disclosed and patched two critical vulnerabilities, CVE-2025-32432 and CVE-2024-58136, that can be chained or abused to achieve unauthenticated remote code execution and full compromise of vulnerable servers. The flaws affect Craft CMS 5.x before 5.6.17, 4.x before 4.14.15, and 3.x before 3.9.15; one issue involves insufficient input validation in image transformation functionality, while the other stems from unsafe handling of the __class variable in the underlying Yii 2 framework.
Researchers and national defenders reported that the vulnerabilities are being actively exploited in the wild, with investigations tying attacks to malicious requests targeting the actions/assets/generate-transform endpoint and abuse of __class parameters. Organizations running exposed Craft CMS instances were urged to patch immediately, review logs for suspicious POST activity, check file and system integrity, and rotate credentials if compromise is suspected.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
SensePost published research on an in-the-wild campaign exploiting remote code execution in Craft CMS. The reference indicates technical investigation of active exploitation, but the event date is not explicitly anchored in the provided content.
CSIRT.SK reported that CVE-2025-32432 and CVE-2024-58136 were being actively exploited in the wild and said both could enable unauthenticated remote code execution and full system compromise. The advisory identified affected Craft CMS version ranges and urged administrators to update, review logs, and rotate credentials if compromise is found.
Craft CMS published a knowledge base article for CVE-2025-32432 describing the vulnerability and providing remediation guidance. CSIRT.SK later reported that Craft CMS developers released security updates addressing CVE-2025-32432 and CVE-2024-58136.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers detailed how attackers can abuse improperly exposed "protected" method handling in vBulletin to achieve unauthenticated remote code execution on internet-facing forums. The issue affects vBulletin `5.0.0` through `5.7.5` and `6.0.0` through `6.0.3` running on PHP `8.1` or newer, and is tracked as **CVE-2025-48827** and **CVE-2025-48828**. Technical analysis showed the flaws can be chained from remote access to protected method invocation and full code execution on vulnerable servers. CSIRT.SK reported the vulnerabilities are being actively exploited in the wild, with abuse observed since at least May 2025, while many exposed instances remain unpatched. The vendor had reportedly released fixes in April 2024 without detailed public disclosure, leaving administrators unaware of the severity until later reporting. Defenders are being urged to update affected installations to the recommended patched versions or the latest release and to review server and application logs for evidence of compromise.
Jul 24, 2026
A critical authentication bypass in the **UpdraftPlus: WP Backup & Migration** WordPress plugin, tracked as `CVE-2026-10795`, is being actively exploited against sites running versions up to and including `1.26.4`. The flaw affects a plugin installed on more than three million WordPress sites and stems from insufficient validation in UpdraftCentral remote procedure call handling, including signature-verification weaknesses and unchecked decryption return values that can collapse to a predictable all-zero key. Wordfence reported blocking **4,987** exploitation attempts in a 24-hour period. Successful exploitation lets unauthenticated attackers impersonate the connected administrator and issue arbitrary RPC actions, including uploading and auto-activating a malicious plugin for **remote code execution** and full site compromise. The vulnerability has been classified under `CWE-347`, with a `CVSS v3.1` vector of `AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H`. The issue was reportedly discovered by researcher **vtim**, and the vendor released a patch that adds stricter return-value validation; administrators are being urged to update immediately.
Jun 29, 2026
Threat actors are actively exploiting **CVE-2026-29014**, a critical `CVSS 9.8` vulnerability in the open-source **MetInfo CMS** that allows unauthenticated remote code execution through PHP code injection. The flaw affects MetInfo versions **7.9, 8.0, and 8.1** and stems from insufficient sanitization in Weixin/WeChat API requests handled by `weixinreply.class.php`, located under `/app/system/weixin/include/class/`. Successful exploitation can let attackers execute arbitrary code and potentially take full control of vulnerable servers. MetInfo issued patches on **April 7, 2026**, but exploitation was observed by **April 25** against honeypots in the United States and Singapore, before surging on **May 1** with attacks concentrated on China and Hong Kong. Exploitation depends on the presence of the `/cache/weixin/` directory, which is commonly created when the WeChat plugin is installed. Researchers said roughly **2,000** MetInfo CMS instances were reachable online, with the majority exposed in China.
Jun 29, 2026