{
  "Event": {
    "analysis": "1",
    "date": "2026-05-19",
    "extends_uuid": "",
    "info": "[Threat Intel] 9 Year-Old PHP Vulnerability Keeps Swinging As One of the Most Targeted Vulnerabilities",
    "protected": false,
    "publish_timestamp": "1780139030",
    "published": true,
    "threat_level_id": "2",
    "timestamp": "1780139030",
    "uuid": "aa2425c7-fd98-4e8e-84c7-d5a56208bbfe",
    "Orgc": {
      "name": "Rectifyq",
      "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4"
    },
    "Tag": [
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#004646",
        "local": false,
        "name": "type:OSINT",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"none-from-src\"",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"from-OTX\"",
        "relationship_type": ""
      },
      {
        "colour": "#7773ac",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"External Remote Services - T1133\"",
        "relationship_type": ""
      },
      {
        "colour": "#7d7034",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"System Information Discovery - T1082\"",
        "relationship_type": ""
      },
      {
        "colour": "#ff841f",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Application Layer Protocol - T1071\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Upload Malware - T1608.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#9feaf0",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Exploit Public-Facing Application - T1190\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Vulnerability Scanning - T1595.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#fe1ef0",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Web Shell - T1505.003\"",
        "relationship_type": ""
      },
      {
        "colour": "#866c0c",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Active Scanning - T1595\"",
        "relationship_type": ""
      },
      {
        "colour": "#36a9d8",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Account Discovery - T1087\"",
        "relationship_type": ""
      },
      {
        "colour": "#20f80d",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Command and Scripting Interpreter - T1059\"",
        "relationship_type": ""
      },
      {
        "colour": "#0c0051",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"File and Directory Discovery - T1083\"",
        "relationship_type": ""
      },
      {
        "colour": "#c9dbdd",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Stage Capabilities - T1608\"",
        "relationship_type": ""
      },
      {
        "colour": "#7628f7",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Unix Shell - T1059.004\"",
        "relationship_type": ""
      },
      {
        "colour": "#e08bb2",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Obfuscated Files or Information - T1027\"",
        "relationship_type": ""
      },
      {
        "colour": "#bf2644",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Server Software Component - T1505\"",
        "relationship_type": ""
      },
      {
        "colour": "#92e858",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Web Protocols - T1071.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#3970d7",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Remote System Discovery - T1018\"",
        "relationship_type": ""
      },
      {
        "colour": "#50bd28",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Network Service Discovery - T1046\"",
        "relationship_type": ""
      },
      {
        "colour": "#4c0fbb",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Ingress Tool Transfer - T1105\"",
        "relationship_type": ""
      },
      {
        "colour": "#49a260",
        "local": false,
        "name": "rectifyq:category=\"vulnerability\"",
        "relationship_type": ""
      },
      {
        "colour": "#170057",
        "local": false,
        "name": "rectifyq:sub-category=\"critical-vuln\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffd12e",
        "local": false,
        "name": "rectifyq:target=\"broad-based\"",
        "relationship_type": ""
      },
      {
        "colour": "#55acee",
        "local": false,
        "name": "rectifyq:MY-relevancy=\"potentially-relevant\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"Tria.ge\"",
        "relationship_type": ""
      },
      {
        "colour": "#3800d9",
        "local": false,
        "name": "rectifyq:action-taken=\"VT-comment\"",
        "relationship_type": ""
      },
      {
        "colour": "#3d00e9",
        "local": false,
        "name": "rectifyq:action-taken=\"telegram\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1779332423",
        "to_ids": false,
        "type": "link",
        "uuid": "9059ce58-e2c7-40cd-8523-1f45c46e163e",
        "value": "https://www.vulncheck.com/blog/cve-2017-9841",
        "Tag": [
          {
            "colour": "#6b003a",
            "local": true,
            "name": "workflow:todo=\"create-missing-misp-galaxy-cluster\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Other",
        "comment": "Description",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1779332423",
        "to_ids": false,
        "type": "text",
        "uuid": "2b43ce19-8e14-4ccb-9ed2-feaa8f723cbc",
        "value": "CVE-2017-9841, a remote code execution vulnerability in PHPUnit's eval-stdin.php file, remains highly exploited nearly a decade after disclosure. Analysis reveals over 80,000 exploitation attempts detected in 30 days, with 36,500 hits in the last 10 days alone. The vulnerability affects PHPUnit versions prior to 4.8.28 and 5.x before 5.6.3, allowing attackers to execute arbitrary PHP code via POST requests without authentication. Mass-scanning infrastructure targets dozens of framework-specific paths across Laravel, Drupal, Yii, and WordPress installations. Primary attack sources include compromised infrastructure in the UK and US, delivering webshells and botnet payloads. Multiple botnets including RondoDox, Kinsing, KashmirBlack, Sysrv, and Androxgh0st actively exploit this vulnerability. The persistent exploitation stems from developers failing to exclude development dependencies in production environments and exposing vendor directories to web servers."
      },
      {
        "category": "Other",
        "comment": "Summary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1779332423",
        "to_ids": false,
        "type": "text",
        "uuid": "2755773a-3194-4abc-a021-c79d39e8c162",
        "value": "Name: 9 Year-Old PHP Vulnerability Keeps Swinging As One of the Most Targeted Vulnerabilities\nAuthor: AlienVault\nAdversary: \nTags: [\"kinsing\", \"cve-2022-47945\", \"androxgh0st\", \"rondodox\", \"cve-2024-4577\", \"php vulnerability\", \"phpunit\", \"cve-2021-41773\", \"sysrv\", \"cve-2017-9841\", \"web application security\", \"mass scanning\", \"botnet campaigns\", \"remote code execution\", \"kashmirblack\"]\nTgtd countries: []\nMlwr families: [\"RondoDox\", \"Kinsing - S0599\", \"KashmirBlack\", \"Sysrv\", \"Androxgh0st\"]\nAttack_ids: [\"T1133\", \"T1082\", \"T1071\", \"T1608.001\", \"T1190\", \"T1595.002\", \"T1505.003\", \"T1595\", \"T1087\", \"T1059\", \"T1083\", \"T1608\", \"T1059.004\", \"T1027\", \"T1505\", \"T1071.001\", \"T1018\", \"T1046\", \"T1105\"]\nIndustries: []"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1779332423",
        "to_ids": false,
        "type": "vulnerability",
        "uuid": "a133e8b7-6e4d-41aa-8282-bc0e687ffc3f",
        "value": "CVE-2017-9841"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1779332423",
        "to_ids": false,
        "type": "vulnerability",
        "uuid": "78dca074-bef2-4445-ad89-5472d588d377",
        "value": "CVE-2021-41773"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1779332423",
        "to_ids": false,
        "type": "vulnerability",
        "uuid": "a66ccdb5-0eaa-45a9-af7c-7c9af77abee2",
        "value": "CVE-2022-47945"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1779332423",
        "to_ids": false,
        "type": "vulnerability",
        "uuid": "e4eaa22d-16b8-4860-bbd7-40f1612e24ba",
        "value": "CVE-2024-4577"
      },
      {
        "category": "Network activity",
        "comment": "Secondary C2 IP \u2014 observed in payload decode",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780136170",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "efa4bf81-2842-4d50-8a39-fc6be05c938a",
        "value": "185.177.72.51",
        "Tag": [
          {
            "colour": "#ad6fee",
            "local": false,
            "name": "asn:asn=\"211590\"",
            "relationship_type": ""
          },
          {
            "colour": "#00cde3",
            "local": false,
            "name": "asn:as-owner=\"BUCKLOG\"",
            "relationship_type": ""
          },
          {
            "colour": "#93736f",
            "local": false,
            "name": "asn:as-country=\"FR\"",
            "relationship_type": ""
          },
          {
            "colour": "#f6cea1",
            "local": false,
            "name": "misp-galaxy:country=\"france\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "Secondary C2 IP \u2014 observed in payload decode",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780136191",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "0df6801c-c706-4723-b56a-0c56e8992edc",
        "value": "185.177.72.68",
        "Tag": [
          {
            "colour": "#ad6fee",
            "local": false,
            "name": "asn:asn=\"211590\"",
            "relationship_type": ""
          },
          {
            "colour": "#00cde3",
            "local": false,
            "name": "asn:as-owner=\"BUCKLOG\"",
            "relationship_type": ""
          },
          {
            "colour": "#93736f",
            "local": false,
            "name": "asn:as-country=\"FR\"",
            "relationship_type": ""
          },
          {
            "colour": "#f6cea1",
            "local": false,
            "name": "misp-galaxy:country=\"france\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "Primary C2/dropper host \u2014 observed in payloads from multiple source IPs",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780136213",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "1a2472ad-0a1c-4fdb-a85f-ddf05be30059",
        "value": "125.135.169.171",
        "Tag": [
          {
            "colour": "#e44b9d",
            "local": false,
            "name": "asn:asn=\"4766\"",
            "relationship_type": ""
          },
          {
            "colour": "#dfa1b3",
            "local": false,
            "name": "asn:as-owner=\"KIXS-AS-KR Korea Telecom\"",
            "relationship_type": ""
          },
          {
            "colour": "#0735ba",
            "local": false,
            "name": "asn:as-country=\"KR\"",
            "relationship_type": ""
          },
          {
            "colour": "#061c19",
            "local": false,
            "name": "misp-galaxy:country=\"south korea\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780136234",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "3723b022-9bfe-411d-8b85-82a663a02c8b",
        "value": "83.168.88.41",
        "Tag": [
          {
            "colour": "#a6fcd6",
            "local": false,
            "name": "asn:asn=\"35179\"",
            "relationship_type": ""
          },
          {
            "colour": "#3c7723",
            "local": false,
            "name": "asn:as-owner=\"KORBANK-AS Korbank S. A.\"",
            "relationship_type": ""
          },
          {
            "colour": "#ec0428",
            "local": false,
            "name": "asn:as-country=\"PL\"",
            "relationship_type": ""
          },
          {
            "colour": "#c9412f",
            "local": false,
            "name": "misp-galaxy:country=\"poland\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780136255",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "38b2ade1-188d-4366-b29e-ce79e302d429",
        "value": "116.99.50.13",
        "Tag": [
          {
            "colour": "#b74175",
            "local": false,
            "name": "asn:asn=\"7552\"",
            "relationship_type": ""
          },
          {
            "colour": "#be5d8c",
            "local": false,
            "name": "asn:as-owner=\"VIETEL-AS-AP Viettel Group\"",
            "relationship_type": ""
          },
          {
            "colour": "#b8567e",
            "local": false,
            "name": "asn:as-country=\"VN\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"vietnam\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780136284",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "62b7fc09-c499-4844-8471-b44b681b2aa9",
        "value": "185.38.148.2",
        "Tag": [
          {
            "colour": "#23d92f",
            "local": false,
            "name": "asn:asn=\"25369\"",
            "relationship_type": ""
          },
          {
            "colour": "#0e9e0b",
            "local": false,
            "name": "asn:as-owner=\"BANDWIDTH-AS\"",
            "relationship_type": ""
          },
          {
            "colour": "#e1449b",
            "local": false,
            "name": "asn:as-country=\"GB\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"united kingdom\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780136305",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "5bb0eaa0-948e-40d5-86b5-6ad3a1953ad5",
        "value": "66.179.137.126",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "Shell download endpoint \u2014 fetched via wget/curl and piped to sh",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780136326",
        "to_ids": true,
        "type": "url",
        "uuid": "38d5bcdf-9c67-45b5-a78e-67155e22a5b4",
        "value": "https://125.135.169.171/sh",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      }
    ]
  }
}