🎯 Web shell deployment

The items that name it 18

• PHP2Shell Attacks Root Palo Alto Firewalls but Fail Against WordPress
  article2026-10-30It is written here as Webshell deployment.

  Attackers deployed webshells with root privileges on compromised PAN-OS firewalls.

• CISA warns of Fragnesia Linux flaw chained in PHP2Shell attacks
  article2026-10-29It is written here as Webshell deployment.

  PHP webshells are implanted on unpatched systems through the PHP2Shell flaws.

• AI-Powered Espionage Campaign Targets Government Linux Infrastructure
  article2026-10-15

  Custom and open-source web shells on Linux servers for initial access and persistence

• Unpatched AhsayCBS Vulnerabilities Exploited in the Wild
  article2026-10-09It is written here as Webshell deployment.

  Dropping a JSP webshell into the application directory served by the CBS application after exploitation

• Threat Actors Exploit Critical AhsayCBS Flaws to Drop Webshells and XMRig Cryptominer
  writeup2026-10-08It is written here as Webshell deployment.

  JSP webshell dropped into the application directory served by the CBS application after exploitation.

• Post-Exploitation Analysis & Artifacts – Citrix NetScaler CVE-2026-88771
  writeup2026-10-07It is written here as Webshell deployment.

  PHP webshell hidden under /var/netscaler/logon/LogonPoint/, served via httpd config patched for /logon/LogonPoint/css/LogonUISimple.html.style.min.<HEX>.css paths

• Threat Brief: NetScaler Zero Days CVE-2026-88771 and CVE-2026-88772 Exploited in the Wild (Updated September 30)
  advisory2026-09-30

  Persistence via .deb files hosted in /vpn/scripts/linux/ and a PHP shell at /var/netscaler/logon/LogonPoint/custom/.ctxs.receiver

• Tracking CVE-2026-73570: unauthenticated command injection on internet-facing mail servers
  writeup2026-09-30It is written here as Web shell deployment (T1505.003).

  Deployment of JSP web shells by temporarily changing webroot permissions, reconstructing encoded/compressed payloads from staged fragments, and writing them to publicly accessible application directories across Jetty and mailboxd paths and peer mailbox nodes.

• Determined Attacker Uploads Malicious Webshells to Parks and Rec Management Platform Servers
  writeup2026-09-30It is written here as Webshell deployment.

  Uploaded .aspx webshells used to execute arbitrary commands via cmd.exe on the compromised IIS servers

• Zero-Day Exploitation of Citrix NetScaler ADC and Gateway: CVE-2026-88771 and CVE-2026-88772
  advisory2026-09-28It is written here as Webshell deployment.

  Webshell placed at /var/netscaler/logon/LogonPoint/custom/.ctxs.receiver (SHA256: ed082f744f035035900f67edf438f2f7d0528ac501234f63d476d65273cdb9a1), observed by Rapid7 on September 24, 2026, as a follow-on access method after exploitation of CVE-2026-88771.

• ShinyHunters Renewed Mass Exploitation Campaign Targeting Oracle PeopleSoft
  writeup2026-09-25

  Bursts of POSTs followed by JSP files such as x.jsp in PSEMHUB.war, repeated so every load-balanced node gets a copy

• When Business Email Compromise Starts Rewriting Reality
  writeup2026-09-24It is written here as Web shell deployment (JSP shell).

  Attackers dropped a JSP shell on Zimbra servers via the chained path traversal/authentication bypass vulnerabilities.

• Active exploitation of Cisco Secure Firewall Management Center vulnerabilities
  writeup2026-09-09

  UAT-12197 placed a JSP-based web shell in the CSM Tomcat webroot directory for persistent remote command execution

• UAT-10147: Chinese-speaking adversary integrates agentic AI into post-compromise operations
  writeup2026-08-20

  Deploying web shells (e.g. ASHX 'sss.ashx') on compromised servers for persistent interactive command execution

• AI Security Briefing
  advisory2026-07-18

  Uploader shell planted at /media/com_pagebuilderck/gfonts/bhup.php, keyed on $_POST['_upl'] field, with attacker-controlled destination folder.

• Velociraptor Misuse, Pt. II: The Eye of the Storm
  writeup2025-12-03

  Threat actor modified default SharePoint landing page start.aspx into a web shell to execute arbitrary commands on the server after exploiting ToolShell

• MicroSocks: Convenient access through a compromised SonicWall SMA
  writeup2024-03-30

  Placement of wafxSummary web shell on the compromised device for persistent access, installed by April 25, 2023

• Two in a row - You mitigated wrong (Kentico CMS RCE)
  writeup2024-03-06

  Multiple webshells found: xoso.aspx, WebPartZone.ashx, help.aspx-style files; WebPartZone.ashx uses Rijndael decryption of payload and dynamic assembly loading via Session state