PHP WEB INFECTIONS |
| 2009-08-01 | Deborah Hale | Website Warnings |
PHP |
| 2024-12-17/a> | Guy Bruneau | Command Injection Exploit For PHPUnit before 4.8.28 and 5.x before 5.6.3 [Guest Diary] |
| 2024-11-06/a> | Jesse La Grew | [Guest Diary] Insights from August Web Traffic Surge |
| 2024-03-29/a> | Xavier Mertens | Quick Forensics Analysis of Apache logs |
| 2023-09-23/a> | Guy Bruneau | Scanning for Laravel - a PHP Framework for Web Artisants |
| 2022-09-07/a> | Johannes Ullrich | PHP Deserialization Exploit attempt |
| 2022-02-02/a> | Johannes Ullrich | Finding elFinder: Who is looking for your files? |
| 2021-11-30/a> | Johannes Ullrich | Hunting for PHPUnit Installed via Composer |
| 2020-06-05/a> | Remco Verhoef | Not so FastCGI! |
| 2019-07-18/a> | Xavier Mertens | Malicious PHP Script Back on Stage? |
| 2019-04-04/a> | Xavier Mertens | New Waves of Scans Detected by an Old Rule |
| 2018-11-16/a> | Xavier Mertens | Basic Obfuscation With Permissive Languages |
| 2018-07-11/a> | Remco Verhoef | Well, Hello Again Peppa! |
| 2018-07-02/a> | Guy Bruneau | Hello Peppa! - PHP Scans |
| 2018-06-13/a> | Xavier Mertens | A Bunch of Compromized Wordpress Sites |
| 2018-05-06/a> | Guy Bruneau | Scans Attempting to use PowerShell to Download PHP Script |
| 2017-09-14/a> | Xavier Mertens | Another webshell, another backdoor! |
| 2017-08-07/a> | Xavier Mertens | Increase of phpMyAdmin scans |
| 2017-02-28/a> | Xavier Mertens | Analysis of a Simple PHP Backdoor |
| 2016-12-26/a> | Russ McRee | Critical security update: PHPMailer 5.2.20 (CVE-2016-10045) |
| 2016-07-13/a> | Xavier Mertens | Drupal: Patch released today to fix a highly critical RCE in contributed modules |
| 2015-07-12/a> | Guy Bruneau | PHP 5.x Security Updates |
| 2014-09-19/a> | Guy Bruneau | PHP Fixes Several Bugs in Version 5.4 and 5.5 |
| 2014-08-22/a> | Richard Porter | PHP 5.4.32 Released http://www.php.net/ChangeLog-5.php#5.4.32 |
| 2014-08-22/a> | Richard Porter | PHP 5.5.16 is available http://www.php.net/ChangeLog-5.php#5.5.16 |
| 2014-08-16/a> | Lenny Zeltser | Web Server Attack Investigation - Installing a Bot and Reverse Shell via a PHP Vulnerability |
| 2014-04-04/a> | Stephen Hall | PHP 5.4.27 released |
| 2014-03-27/a> | Alex Stanford | Mass XSSodus in PHP |
| 2013-10-25/a> | Johannes Ullrich | PHP.net compromise aftermath: Why Code Signing Beats Hashes |
| 2013-10-24/a> | Johannes Ullrich | False Positive: php.net Malware Alert |
| 2013-09-19/a> | Bojan Zdrnja | Arrays in requests, PHP and DedeCMS |
| 2013-08-11/a> | Bojan Zdrnja | XATattacks (attacks on xat.com) |
| 2013-08-04/a> | Johannes Ullrich | BBCode tag "[php]" used to inject php code |
| 2013-06-07/a> | Daniel Wesemann | PHP patches - see http://www.php.net/ChangeLog-5.php - fixes CVE2013-2110 |
| 2013-02-22/a> | Chris Mohan | PHP 5.4.12 and PHP 5.3.22 released http://www.php.net/ChangeLog-5.php |
| 2013-01-17/a> | Russ McRee | PHP 5.4.11 and PHP 5.3.21 released |
| 2012-09-19/a> | Russ McRee | Script kiddie scavenging with Shellbot.S |
| 2012-06-14/a> | Johannes Ullrich | PHP 5.4.4 and 5.3.14 released with fixes for DES crypt issue and phar heap overflow |
| 2012-05-08/a> | Kevin Liston | PHP 5.4.3 and PHP 5.3.13 Released |
| 2012-04-05/a> | Johannes Ullrich | Evil hides everywhere: Web Application Exploits in Headers |
| 2012-03-07/a> | Johannes Ullrich | What happened to RFI attacks? |
| 2012-02-07/a> | Johannes Ullrich | Secure E-Mail Access |
| 2012-02-03/a> | Guy Bruneau | PHP 5.3.10 Released, Fixes CVE-2012-0830 available for download http://www.php.net/archive/2012.php#id2012-02-02-1 |
| 2012-02-03/a> | Johannes Ullrich | Critical PHP bug patched |
| 2012-01-16/a> | Kevin Shortt | php 5.3.9 released -Jan-10-2011 |
| 2012-01-12/a> | Rob VandenBrink | PHP 5.39 was release on the 10th, amongst other things, it addresses CVE-2011-4885 (prevents attacks based on hash collisions) and CVE-2011-4566 (integer overflow when parsing invalid exif header) |
| 2011-08-22/a> | Jim Clausing | DO NOT upgrade to PHP 5.3.7, significant bug in crypt() function, see http://www.php.net/ |
| 2011-08-18/a> | Rob VandenBrink | PHP 5.37 release. Some security updates, plus lots of bug fixes ==> http://www.php.net/archive/2011.php#id2011-08-18-1 |
| 2010-08-31/a> | Bojan Zdrnja | Interesting PHP injection |
| 2010-08-10/a> | Daniel Wesemann | SSH - new brute force tool? |
| 2010-07-04/a> | Manuel Humberto Santander Pelaez | Interesting analysis of the PHP SplObjectStorage Vulnerability |
| 2010-06-14/a> | Manuel Humberto Santander Pelaez | Another way to get protection for application-level attacks |
| 2010-05-23/a> | Manuel Humberto Santander Pelaez | e-mail scam announcing Fidel Castro's funeral ... and nasty malware to your computer. |
| 2010-02-27/a> | Guy Bruneau | PHP 5.2.13 Security Update |
| 2010-01-29/a> | Johannes Ullrich | Analyzing isc.sans.org weblogs, part 2, RFI attacks |
| 2009-12-28/a> | Johannes Ullrich | 8 Basic Rules to Implement Secure File Uploads http://jbu.me/48 (inspired by IIS ; bug) |
| 2009-11-20/a> | Mark Hofman | PHP 5.3.1 is released. With many of the websites on the net relying on PHP and the number of attacks we see, consider upgrading. This release has over 100 bug fixes, some of which are security related. |
| 2009-08-01/a> | Deborah Hale | Website Warnings |
| 2009-06-26/a> | Mark Hofman | PHPMYADMIN scans |
| 2009-06-24/a> | Kyle Haugsness | Exploit tools are publicly available for phpMyAdmin |
| 2009-06-21/a> | Scott Fendley | phpMyAdmin Scans |
| 2009-04-07/a> | Johannes Ullrich | Common Apache Misconception |
| 2009-02-03/a> | Swa Frantzen | On the importance of patching fast |
| 2008-12-10/a> | Stephen Hall | PHP Group has released PHP version 5.2.8 |
| 2008-09-09/a> | Swa Frantzen | wordpress upgrade |
| 2008-08-19/a> | Johannes Ullrich | A morning stroll through my web logs |
| 2008-05-05/a> | John Bambenek | PHP 5.2.6 out w/ security updates |
| 2006-12-24/a> | Swa Frantzen | phpBB 2.0.22 - upgrade time |
| 2006-11-29/a> | Toby Kohlenberg | New Vulnerability Announcement and patches from Apple |
| 2006-09-13/a> | Swa Frantzen | PHP - shared hosters, take note. |
WEB |
| 2025-03-09/a> | Johannes Ullrich | Commonly Probed Webshell URLs |
| 2025-02-26/a> | Jesse La Grew | [Guest Diary] Malware Source Servers: The Threat of Attackers Using Ephemeral Ports as Service Ports to Upload Data |
| 2024-12-26/a> | Jesse La Grew | Capturing Honeypot Data Beyond the Logs |
| 2024-11-06/a> | Jesse La Grew | [Guest Diary] Insights from August Web Traffic Surge |
| 2024-01-22/a> | Johannes Ullrich | Apple Updates Everything - New 0 Day in WebKit |
| 2024-01-08/a> | Jesse La Grew | What is that User Agent? |
| 2023-07-23/a> | Guy Bruneau | Install & Configure Filebeat on Raspberry Pi ARM64 to Parse DShield Sensor Logs |
| 2023-05-03/a> | Xavier Mertens | Increased Number of Configuration File Scans |
| 2023-04-18/a> | Johannes Ullrich | UDDIs are back? Attackers rediscovering old exploits. |
| 2023-02-25/a> | Didier Stevens | Crypto Inside a Browser |
| 2023-02-24/a> | Brad Duncan | URL files and WebDAV used for IcedID (Bokbot) infection |
| 2022-09-21/a> | Xavier Mertens | Phishing Campaigns Use Free Online Resources |
| 2022-08-23/a> | Xavier Mertens | Who's Looking at Your security.txt File? |
| 2022-08-17/a> | Johannes Ullrich | Apple Patches Two Exploited Vulnerabilities |
| 2022-08-01/a> | Johannes Ullrich | A Little DDoS In the Morning |
| 2022-04-05/a> | Johannes Ullrich | WebLogic Crypto Miner Malware Disabling Alibaba Cloud Monitoring Tools |
| 2022-03-11/a> | Xavier Mertens | Keep an Eye on WebSockets |
| 2022-02-07/a> | Johannes Ullrich | web3 phishing via self-customizing landing pages |
| 2021-12-07/a> | Johannes Ullrich | Webshells, Webshells everywhere! |
| 2021-12-01/a> | Xavier Mertens | Info-Stealer Using webhook.site to Exfiltrate Data |
| 2021-10-11/a> | Johannes Ullrich | Things that go "Bump" in the Night: Non HTTP Requests Hitting Web Servers |
| 2021-10-09/a> | Guy Bruneau | Scanning for Previous Oracle WebLogic Vulnerabilities |
| 2021-06-24/a> | Xavier Mertens | Do you Like Cookies? Some are for sale! |
| 2021-04-24/a> | Guy Bruneau | Base64 Hashes Used in Web Scanning |
| 2020-11-07/a> | Guy Bruneau | Cryptojacking Targeting WebLogic TCP/7001 |
| 2020-10-29/a> | Johannes Ullrich | PATCH NOW: CVE-2020-14882 Weblogic Actively Exploited Against Honeypots |
| 2020-08-10/a> | Bojan Zdrnja | Scoping web application and web service penetration tests |
| 2020-07-24/a> | Xavier Mertens | Compromized Desktop Applications by Web Technologies |
| 2019-11-22/a> | Xavier Mertens | Abusing Web Filters Misconfiguration for Reconnaissance |
| 2019-09-24/a> | Xavier Mertens | Huge Amount of remotewebaccess.com Sites Found in Certificate Transparency Logs |
| 2019-08-28/a> | Johannes Ullrich | [Guest Diary] Open Redirect: A Small But Very Common Vulnerability |
| 2019-08-01/a> | Johannes Ullrich | What is Listening On Port 9527/TCP? |
| 2019-06-19/a> | Johannes Ullrich | Critical Actively Exploited WebLogic Flaw Patched CVE-2019-2729 |
| 2019-04-28/a> | Johannes Ullrich | Update about Weblogic CVE-2019-2725 (Exploits Used in the Wild, Patch Status) |
| 2019-04-25/a> | Rob VandenBrink | Unpatched Vulnerability Alert - WebLogic Zero Day |
| 2019-02-02/a> | Guy Bruneau | Scanning for WebDAV PROPFIND Exploiting CVE-2017-7269 |
| 2018-11-17/a> | Xavier Mertens | Quickly Investigating Websites with Lookyloo |
| 2018-07-20/a> | Kevin Liston | Weblogic Exploit Code Made Public (CVE-2018-2893) |
| 2018-05-03/a> | Renato Marinho | WebLogic Exploited in the Wild (Again) |
| 2018-04-30/a> | Remco Verhoef | Another approach to webapplication fingerprinting |
| 2017-09-14/a> | Xavier Mertens | Another webshell, another backdoor! |
| 2017-07-19/a> | Xavier Mertens | Bots Searching for Keys & Config Files |
| 2017-06-01/a> | Xavier Mertens | Sharing Private Data with Webcast Invitations |
| 2017-05-12/a> | Xavier Mertens | When Bad Guys are Pwning Bad Guys... |
| 2017-04-07/a> | Xavier Mertens | Tracking Website Defacers with HTTP Referers |
| 2017-04-02/a> | Guy Bruneau | IPFire - A Household Multipurpose Security Gateway |
| 2017-02-28/a> | Xavier Mertens | Analysis of a Simple PHP Backdoor |
| 2017-01-24/a> | Johannes Ullrich | Critical Vulnerability in Cisco WebEx Chrome Plugin |
| 2017-01-14/a> | Xavier Mertens | Backup Files Are Good but Can Be Evil |
| 2016-07-13/a> | Xavier Mertens | The Power of Web Shells |
| 2016-01-29/a> | Xavier Mertens | Scripting Web Categorization |
| 2015-06-25/a> | Bojan Zdrnja | Web security subtleties and exploitation of combined vulnerabilities |
| 2015-04-23/a> | Bojan Zdrnja | When automation does not help |
| 2015-04-14/a> | Johannes Ullrich | Odd POST Request To Web Honeypot |
| 2014-08-16/a> | Lenny Zeltser | Web Server Attack Investigation - Installing a Bot and Reverse Shell via a PHP Vulnerability |
| 2014-08-09/a> | Adrien de Beaupre | Complete application ownage via Multi-POST XSRF |
| 2014-06-11/a> | Daniel Wesemann | Gimme your keys! |
| 2014-06-10/a> | Daniel Wesemann | Sampling Bias |
| 2014-04-24/a> | Rob VandenBrink | Apple IOS updates to 7.1.1, OSX Security update 2014-002, Airport Updates - http://support.apple.com/kb/HT1222, http://support.apple.com/kb/HT6208, http://support.apple.com/kb/HT6207, http://support.apple.com/kb/HT6203 |
| 2014-04-11/a> | Guy Bruneau | Heartbleed Fix Available for Download for Cisco Products |
| 2014-04-07/a> | Johannes Ullrich | Attack or Bad Link? Your Guess? |
| 2014-01-17/a> | Russ McRee | Massive RFI scans likely a free web app vuln scanner rather than bots |
| 2014-01-13/a> | Johannes Ullrich | Special Webcast today: HTML5, Risky Business or Hidden Security Toolchest? https://www.sans.org/webcasts/html5-risky-business-hidden-security-tool-chest-mobile-web-app-authentication-97650 |
| 2014-01-11/a> | Guy Bruneau | tcpflow 1.4.4 and some of its most Interesting Features |
| 2013-12-24/a> | Daniel Wesemann | Unfriendly crontab additions |
| 2013-11-02/a> | Rick Wanner | Protecting Your Family's Computers |
| 2013-10-04/a> | Pedro Bueno | CSAM: WebHosting BruteForce logs |
| 2013-09-05/a> | Rob VandenBrink | What's Next for IPS? |
| 2013-07-27/a> | Scott Fendley | Defending Against Web Server Denial of Service Attacks |
| 2013-06-25/a> | Bojan Zdrnja | The race for resources |
| 2013-06-10/a> | Johannes Ullrich | When Google isn't Google |
| 2013-04-08/a> | Johannes Ullrich | Cleaning Up After the Leak: Hiding exposed web content |
| 2013-03-26/a> | Daniel Wesemann | How your Webhosting Account is Getting Abused |
| 2013-02-25/a> | Johannes Ullrich | Punkspider enumerates web application vulnerabilities |
| 2013-02-22/a> | Johannes Ullrich | When web sites go bad: bible . org compromise |
| 2013-01-25/a> | Johannes Ullrich | Vulnerability Scans via Search Engines (Request for Logs) |
| 2012-10-26/a> | Adam Swanger | Securing the Human Special Webcast - October 30, 2012 |
| 2012-09-08/a> | Guy Bruneau | Webmin Input Validation Vulnerabilities |
| 2012-08-13/a> | Rick Wanner | Interesting scan for medical certification information... |
| 2012-07-23/a> | Johannes Ullrich | Most Anti-Privacy Web Browsing Tool Ever? |
| 2012-03-11/a> | Johannes Ullrich | An Analysis of Jester's QR Code Attack. (Guest Diary) |
| 2011-12-28/a> | Daniel Wesemann | Hash collisions vulnerability in web servers |
| 2011-11-01/a> | Russ McRee | Secure languages & frameworks |
| 2011-10-12/a> | Adam Swanger | We are experiencing technical issues with the webcast. The webcast will start as soon as these issues are resolved. |
| 2011-08-16/a> | Johannes Ullrich | What are the most dangerous web applications and how to secure them? |
| 2011-07-28/a> | Johannes Ullrich | Announcing: The "404 Project" |
| 2011-07-05/a> | Raul Siles | Helping Developers Understand Security - Spot the Vuln |
| 2011-05-17/a> | Johannes Ullrich | A Couple Days of Logs: Looking for the Russian Business Network |
| 2011-05-14/a> | Guy Bruneau | Websense Study Claims Canada Next Hotbed for Cybercrime Web Hosting Activity |
| 2011-05-11/a> | Swa Frantzen | Time to disable WebGL ? |
| 2011-04-10/a> | Raul Siles | Recent security enhancements in web browsers (e.g. Google Chrome) |
| 2011-04-01/a> | John Bambenek | LizaMoon Mass SQL-Injection Attack Infected at least 500k Websites |
| 2011-02-28/a> | Deborah Hale | Possible Botnet Scanning |
| 2011-02-01/a> | Lenny Zeltser | The Importance of HTTP Headers When Investigating Malicious Sites |
| 2010-12-18/a> | Raul Siles | Google Chrome (Stable and Beta) have been updated to 8.0.552.224 for all platforms (Chrome OS too). http://bit.ly/fW04cr |
| 2010-12-12/a> | Raul Siles | New trend regarding web application vulnerabilities? |
| 2010-12-02/a> | Kevin Johnson | Robert Hansen and our happiness |
| 2010-11-18/a> | Chris Carboni | All of your pages are belonging to us |
| 2010-08-16/a> | Raul Siles | Blind Elephant: A New Web Application Fingerprinting Tool |
| 2010-08-15/a> | Manuel Humberto Santander Pelaez | Python to test web application security |
| 2010-08-13/a> | Tom Liston | The Strange Case of Doctor Jekyll and Mr. ED |
| 2010-07-25/a> | Rick Wanner | Updated version of Mandiant's Web Historian |
| 2010-07-21/a> | Adrien de Beaupre | Update on .LNK vulnerability |
| 2010-07-20/a> | Manuel Humberto Santander Pelaez | LNK vulnerability now with Metasploit module implementing the WebDAV method |
| 2010-06-23/a> | Scott Fendley | Opera Browser Update |
| 2010-06-15/a> | Manuel Humberto Santander Pelaez | iPhone 4 Order Security Breach Exposes Private Information |
| 2010-04-26/a> | Raul Siles | Vulnerable Sites Database |
| 2010-04-13/a> | Adrien de Beaupre | Web App Testing Tools |
| 2010-03-24/a> | Johannes Ullrich | ".sys" Directories Delivering Driveby Downloads |
| 2010-03-21/a> | Scott Fendley | Skipfish - Web Application Security Tool |
| 2010-03-08/a> | Raul Siles | Samurai WTF 0.8 |
| 2010-02-06/a> | Guy Bruneau | Oracle WebLogic Server Security Alert |
| 2010-02-03/a> | Johannes Ullrich | Anatomy of a Form Spam Campaign (in progress against isc.sans.org right now) https://blogs.sans.org/appsecstreetfighter/ |
| 2010-01-29/a> | Johannes Ullrich | Analyzing isc.sans.org weblogs, part 2, RFI attacks |
| 2010-01-25/a> | William Salusky | "Bots and Spiders and Crawlers, be gone!" - or - "New Open Source WebAppSec tools, Huzzah!" |
| 2010-01-20/a> | Johannes Ullrich | Weathering the Storm Part 1: An analysis of our SANS ISC weblogs http://appsecstreetfighter.com |
| 2010-01-08/a> | Rob VandenBrink | Microsoft OfficeOnline, Searching for Trust and Malware |
| 2009-12-28/a> | Johannes Ullrich | 8 Basic Rules to Implement Secure File Uploads http://jbu.me/48 (inspired by IIS ; bug) |
| 2009-10-26/a> | Johannes Ullrich | Web honeypot Update |
| 2009-10-20/a> | Raul Siles | WASC 2008 Statistics |
| 2009-10-09/a> | Rob VandenBrink | THAWTE to discontinue free Email Certificate Services and Web of Trust Service |
| 2009-09-18/a> | Jason Lam | Results from Webhoneypot project |
| 2009-09-16/a> | Raul Siles | Review the security controls of your Web Applications... all them! |
| 2009-08-18/a> | Deborah Hale | Domain tcpdump.org unavailable |
| 2009-08-18/a> | Deborah Hale | Website compromises - what's happening? |
| 2009-08-17/a> | Adrien de Beaupre | YAMWD: Yet Another Mass Web Defacement |
| 2009-08-01/a> | Deborah Hale | Website Warnings |
| 2009-07-13/a> | Adrien de Beaupre | Vulnerability in Microsoft Office Web Components Control Could Allow Remote Code Execution |
| 2009-07-05/a> | Bojan Zdrnja | More on ColdFusion hacks |
| 2009-06-11/a> | Jason Lam | Dshield Web Honeypot going beta |
| 2009-05-27/a> | donald smith | WebDAV write-up |
| 2009-05-26/a> | Jason Lam | A new Web application security blog |
| 2009-05-24/a> | Raul Siles | IIS admins, help finding WebDAV remotely using nmap |
| 2009-05-21/a> | Adrien de Beaupre | IIS admins, help finding WebDAV |
| 2009-05-20/a> | Tom Liston | Web Toolz |
| 2009-05-05/a> | Bojan Zdrnja | Every dot matters |
| 2009-04-21/a> | Bojan Zdrnja | Web application vulnerabilities |
| 2009-03-26/a> | Mark Hofman | Webhoneypot fun |
| 2009-02-17/a> | Jason Lam | DShield Web Honeypot - Alpha Preview Release |
| 2009-01-12/a> | William Salusky | Web Application Firewalls (WAF) - Have you deployed WAF technology? |
| 2008-12-01/a> | Jason Lam | Call for volunteers - Web Honeypot Project |
| 2008-11-20/a> | Jason Lam | Large quantity SQL Injection mitigation |
| 2008-09-08/a> | Raul Siles | Quick Analysis of the 2007 Web Application Security Statistics |
| 2008-08-19/a> | Johannes Ullrich | A morning stroll through my web logs |
| 2008-08-15/a> | Jim Clausing | WebEx ActiveX buffer overflow |
| 2008-06-07/a> | Jim Clausing | Followup to 'How do you monitor your website?' |
| 2008-04-24/a> | donald smith | Hundreds of thousands of SQL injections |
| 2006-09-30/a> | Swa Frantzen | Yellow: WebViewFolderIcon setslice exploit spreading |
INFECTIONS |
| 2009-08-01/a> | Deborah Hale | Website Warnings |
