#Web Shell
All CosmicBytez Labs articles tagged #Web Shell, across news, security advisories, how-to guides, and projects.
- Security
CVE-2026-111832: WP Mailster Plugin — Critical Unrestricted File Upload Leads to Web Shell
A CVSS 10.0 unrestricted file upload flaw in the WP Mailster WordPress plugin (through 1.9.1.0) lets attackers upload a web shell to the server.
- Security
CVE-2026-111834: Mang Board WP Plugin — Critical Unrestricted File Upload Leads to Web Shell
A CVSS 9.9 unrestricted file upload flaw in the Mang Board WP plugin (through 2.4.4) allows attackers to upload a web shell to WordPress servers.
- News
Hackers Use Autonomous AI Agents to Breach Company Websites, Target Over 1,200 Sites
A Chinese-speaking criminal pointed Cairn AI agents at 1,200+ sites with brief instructions. Exposed panels let NorForge watch, with a ~10% success rate.
- News
Hackers Exploit Collabora RCE Flaw to Backdoor Nextcloud Servers
Attackers are exploiting CVE-2026-110447, a critical unauthenticated RCE in Nextcloud's Collabora Online CODE Server app, to plant PHP web shells.
- News
Citrix NetScaler CVE-2026-88771 Exploitation Spawns Superuser Backdoor, CSS-Disguised Web Shell
LevelBlue found CVE-2026-88771 exploitation on Citrix NetScaler creating a sec_monitor superuser account and a PHP web shell mapped to CSS-like URLs.
- News
Microsoft Tracks Active Zimbra CVE-2026-73570 Exploitation: Web Shells, Root Escalation, Stolen Secrets
Microsoft found attackers exploiting Zimbra flaw CVE-2026-73570 to drop JSP web shells, escalate to root via PAM, and steal mailbox auth secrets.
- News
"Poisoned Refresh" Rootkit Injects Fileless PHP Web Shells on Breached F5 BIG-IP Devices
Sophos found a stealthy Linux rootkit hooking PHP on F5 BIG-IP APM servers to inject memory-only web shells, leaving disk files untouched.
- Security
CVE-2026-80235: EFence Unauthenticated Arbitrary File Upload to RCE
EFence by Thinking Software Technology allows unauthenticated remote attackers to upload web shells and achieve full code execution.
- Security
CVE-2026-16286: Unauthenticated Web Shell Upload in TRtek Software Repository Management
Unrestricted file upload flaw lets attackers plant a web shell on TRtek's Software Repository Management with no authentication required.
- Security
CVE-2026-11839: Unrestricted File Upload Enables Web Shell Deployment in Rotaban
A critical unrestricted file upload vulnerability in the Rotaban platform by Basarsoft Information Technologies allows authenticated attackers to upload...
- News
Hackers Exploited KnowledgeDeliver Zero-Day for Web Shell
A hardcoded machineKey value in KnowledgeDeliver's configuration enabled ViewState deserialization attacks leading to remote code execution and web shell.
- News
KnowledgeDeliver Flaw Exploited as Zero-Day to Install Web
Attackers exploited a critical zero-day vulnerability in KnowledgeDeliver LMS servers to deploy the Godzilla web shell, giving persistent backdoor access to.
- News
KnowledgeDeliver LMS Flaw Exploited to Deploy Godzilla and Cobalt Strike
A now-patched high-severity zero-day vulnerability in Digital Knowledge's KnowledgeDeliver LMS, a popular learning management system in Japan, was actively.
- Security
CVE-2026-6885: Borg SPM 2007 Arbitrary File Upload Enables
A critical arbitrary file upload vulnerability in the end-of-life Borg SPM 2007 application allows unauthenticated attackers to upload web shell backdoors...