Cybersecurity articles tagged #Webshell on RuntimeRebel.https://runtimerebel.comhttps://runtimerebel.com/blog/cve-2026-73570-unauthenticated-rce-in-zimbra-zcs-exploitedhttps://runtimerebel.com/blog/cve-2026-73570-unauthenticated-rce-in-zimbra-zcs-exploitedThreat actors are actively exploiting CVE-2026-73570, an unauthenticated RCE flaw in Zimbra Collaboration Suite, to deploy web shells and exfiltrate sensitive data.Thu, 01 Oct 2026 03:05:44 GMTZimbraWebshellRemote Code ExecutionData ExfiltrationCVE-2026-73570https://runtimerebel.com/blog/cve-2026-12569-clop-exploits-windchill-with-custom-web-shellhttps://runtimerebel.com/blog/cve-2026-12569-clop-exploits-windchill-with-custom-web-shellClop ransomware group exploited CVE-2026-12569 in PTC Windchill and FlexPLM servers, deploying a custom web shell for deep data theft. Patch immediately.Wed, 19 Aug 2026 00:40:12 GMTClopPTC WindchillCVE-2026-12569WebshellData Thefthttps://runtimerebel.com/blog/bdthemes-wordpress-plugin-supply-chain-attack-creates-rogue-adminshttps://runtimerebel.com/blog/bdthemes-wordpress-plugin-supply-chain-attack-creates-rogue-adminsA supply chain attack on BdThemes WordPress plugins exploited an XSS vulnerability, creating stealthy rogue admin accounts and webshells.Tue, 11 Aug 2026 08:45:01 GMTWordPressSupply Chain AttackXSSWebshellBdThemeshttps://runtimerebel.com/blog/wordpress-core-rce-via-cve-2026-63030-wp2shell-mitigation-guidehttps://runtimerebel.com/blog/wordpress-core-rce-via-cve-2026-63030-wp2shell-mitigation-guideAttackers are exploiting critical wp2shell vulnerabilities in WordPress Core to deploy persistent webshells. Learn how to detect and secure your servers.Tue, 21 Jul 2026 17:23:43 GMTCVE-2026-63030CVE-2026-60137WordPressWebshellWp2shellhttps://runtimerebel.com/blog/op-512-analyzing-the-custom-web-shell-framework-targeting-microsoft-iishttps://runtimerebel.com/blog/op-512-analyzing-the-custom-web-shell-framework-targeting-microsoft-iisSecurity researchers have identified OP-512, a China-nexus threat cluster targeting Microsoft IIS servers with a bespoke web shell framework for espionage.Fri, 05 Jun 2026 16:54:33 GMTOP 512Microsoft IISWebshellEspionageChina Nexushttps://runtimerebel.com/blog/scanning-for-encystphp-webshell-on-freepbx-systems-detection-guidehttps://runtimerebel.com/blog/scanning-for-encystphp-webshell-on-freepbx-systems-detection-guideAttackers are actively scanning for the EncystPHP webshell, targeting vulnerable FreePBX systems to establish persistent access and execute remote commands.Mon, 13 Apr 2026 16:35:41 GMTEncystPHPFreepbxWebshellPHP MalwareThreat Intelhttps://runtimerebel.com/blog/cve-2024-34102-polyshell-exploits-target-56-of-magento-storeshttps://runtimerebel.com/blog/cve-2024-34102-polyshell-exploits-target-56-of-magento-storesAttackers are aggressively exploiting the CosmicSting vulnerability (CVE-2024-34102) in Magento and Adobe Commerce stores using PolyShell polyglot web shells.Thu, 26 Mar 2026 00:39:42 GMTCVE-2024-34102MagentoAdobe CommerceCosmicStingPolyShellWebshellhttps://runtimerebel.com/blog/900-sangoma-freepbx-servers-compromised-via-web-shell-exploitationhttps://runtimerebel.com/blog/900-sangoma-freepbx-servers-compromised-via-web-shell-exploitationOver 900 Sangoma FreePBX instances are currently infected with web shells following a command injection campaign first observed in late 2025.Fri, 27 Feb 2026 20:11:30 GMTSangomaFreepbxWebshellCommand InjectionShadowserverAsterisk