T1505.003 - Web Shell - MITRE ATT&CK

Related Threat Clusters

• Critical Zero-Day Vulnerability CVE-2026-20182 Exploited in Cisco SD-WAN Systems

  Cisco has disclosed a critical authentication bypass vulnerability, CVE-2026-20182, affecting its Catalyst SD-WAN Controller and Manager. This flaw allows unauthenticated remote attackers to bypass authentication and…

  131 articles · Updated May 14, 2026
• Critical Joomla JCE Vulnerability Under Active Exploitation

  A critical vulnerability in the Joomla Content Editor (JCE), tracked as CVE-2026-48907, allows unauthenticated attackers to execute remote code on affected Joomla sites. This flaw affects JCE versions below 2.9.99.6 and…

  33 articles · Updated June 17, 2026
• Critical Unauthenticated RCE Vulnerability in LiteLLM Exploited in the Wild

  A critical command injection vulnerability, CVE-2026-42271, in LiteLLM, an open-source AI gateway, allows unauthenticated remote code execution (RCE) when chained with CVE-2026-48710, a Host header validation bypass in…

  17 articles · Updated June 9, 2026
• SHADOW-EARTH-053 Exploits Microsoft Exchange Vulnerabilities in Asia

  The China-aligned threat group SHADOW-EARTH-053 has been exploiting unpatched Microsoft Exchange and IIS server vulnerabilities, specifically the ProxyLogon vulnerability chain, to conduct cyberespionage. This group has…

  2 articles · Updated May 5, 2026
• FortiWeb WAF Vulnerability Enables Full Admin Control Exploitation

  A critical vulnerability in FortiWeb Web Application Firewall (WAF) has been actively exploited, allowing attackers to gain full administrative access to affected systems. Organizations using FortiWeb are at risk of…

  100 articles · Updated November 15, 2025
• Operation Escaneo Targets Latin American Critical Infrastructure

  Operation Escaneo is a coordinated cyberattack attributed to the MexicanMafia group, targeting critical infrastructure across Latin America, primarily Mexico. The campaign, which spanned from 2025 to 2026, utilized…

  4 articles · Updated June 18, 2026
• Critical cPanel Vulnerability Exploited in Southeast Asia Cyber Attacks

  A sophisticated cyber campaign has exploited a critical cPanel vulnerability (CVE-2026-41940) to breach government and military servers in Southeast Asia, particularly targeting Indonesia. The attackers utilized a…

  3 articles · Updated May 4, 2026
• Critical RCE Vulnerability in PTC Windchill and FlexPLM Under Active Exploitation

  Hackers are exploiting a critical vulnerability in PTC Windchill and FlexPLM, tracked as CVE-2026-12569, which allows remote code execution due to an unsafe deserialization flaw. This vulnerability affects product…

  2 articles · Updated June 29, 2026
• Critical Vulnerability in Ninja Forms Plugin Exposes 50,000 WordPress Sites to RCE

  A critical vulnerability (CVE-2026-0740) in the Ninja Forms File Uploads plugin for WordPress allows unauthenticated attackers to upload arbitrary files, potentially leading to remote code execution. This flaw, with a…

  6 articles · Updated April 7, 2026
• Critical RCE Vulnerability in Blocksy Companion Pro Plugin Discovered

  A critical vulnerability, CVE-2026-58480, has been identified in the Blocksy Companion Pro plugin for WordPress versions prior to 2.1.47. This unauthenticated arbitrary file upload vulnerability allows attackers to…

  2 articles · Updated July 9, 2026

Recent Intelligence Reports

• Symantec Threat Hunter Team — www.security.com · July 17, 2026
• Attackers execute a complete ransomware operation in under 24 hours | news — Scworld · July 16, 2026
• New Spirals ransomware can lock down an entire network in under 24 hours — Pcquest · July 16, 2026
• New Spirals ransomware encrypts victim network in under 24 hours — Bleepingcomputer · July 16, 2026
• Proofpoint: UNK_MassTraction Report — www.proofpoint.com · July 14, 2026
• Sk Telecom Says Malware Breach Lasted 3 Years Impacted 27 Million Numbers — www.bleepingcomputer.com · July 11, 2026
• Second alert from ACSC in two months shows unpatched CMS bugs still exploited — Itnews.Au · July 9, 2026
• CVE-2026-58480 — nvd.nist.gov · July 9, 2026

Related Entities