CISA has added two actively exploited vulnerabilities to its Known Exploited Vulnerabilities catalog, both in popular Joomla extensions and both allowing attackers to upload dangerous files. The iCagenda event calendar flaw (CVE-2026-48939, rated 10.0) lets an attacker upload arbitrary files through its attachment feature, ending in PHP code execution, while the Balbooa Forms flaw (CVE-2026-56291) allows unauthenticated upload of executable files leading to full remote code execution. Federal agencies were ordered to fix them by July 13. The additions line up with a broader campaign, recently flagged by Australia's cyber agency, in which attackers scan the internet and exploit known content-management-system and plugin flaws to plant web shells on vulnerable sites.
Australia's Cyber Security Centre has warned of a large-scale global campaign in which attackers scan websites and exploit known vulnerabilities in content management systems and their plugins to plant web shells. The affected software spans WordPress, Joomla, Craft CMS, and others, with the flaws typically allowing unauthenticated file upload, remote code execution, or server-side request forgery. Once a web shell is installed, attackers can take a site offline, deface it, steal data stored on the server, or pivot deeper into the network. Many small and medium-sized businesses have already been hit, and the agency notes the campaign may be accelerated by AI, which helps attackers scale exploitation of newly disclosed flaws.
ReliaQuest has documented OP-512, a China-linked espionage cluster targeting Microsoft IIS web servers with a bespoke web-shell framework - the fourth such group after CL-STA-0048, DragonRank, and GhostRedirector to single out IIS in the past year. The framework uses three web shells that grant remote access while evading signature detection and complicating forensics: each deployment is uniquely generated, access is cryptographically restricted to the attacker, and compromised servers auto-report to centralized management. To hide, the web shells timestomp - scanning surrounding files, computing the median last-modified time, and overwriting their own timestamps to match. ReliaQuest notes close tactical proximity to CL-STA-0048, suggesting a revamped toolset or shared development.
Russian security firm Positive Technologies attributed an ongoing intrusion campaign to PhantomCore, a pro-Ukrainian group also tracked as Head Mare, Rainbow Hyena, and UNG0901. The group is chaining three TrueConf video-conferencing vulnerabilities (patched by the vendor August 27, 2025) to bypass authentication and run commands on TrueConf servers in Russian organizations. After break-in, they drop a PHP web shell, create a rogue user named 'TrueConf2' with admin rights on the conferencing server, and pivot into the wider network using tools including Velociraptor, Memprocfs, DumpIt, and custom backdoors MacTunnelRAT and PhantomSscp. First attacks observed mid-September 2025.
A critical vulnerability in the Ninja Forms File Uploads premium add-on for WordPress allows attackers to upload arbitrary files - including PHP web shells - without any authentication. Over 800,000 WordPress sites use Ninja Forms, and the File Uploads extension is one of its most popular premium add-ons. Successful exploitation gives an attacker full code execution on the web server. No user interaction required - just a crafted request to the file upload endpoint.
TrustStrike Labs