Webshell

A misconfigured hacker server exposed 22 days of logs revealing a webshell access-brokerage operation that compromised over 25,000 WordPress sites using 27 weaponized CVEs.

Attackers exploit CVE-2026-20230 in Cisco Unified Communications Manager to deploy webshells via Tor-routed automated attacks. Patching alone won't remove existing compromises.