Threat Intel
PHP Cryptomining Campaign Surge Oct/Nov 2025: ThinkPHP, PHP CGI, CVE-2024-4577
From August to November 2025, GreyNoise tracked a sharp rise in cryptomining attacks targeting PHP and its frameworks. Exploits centered on ThinkPHP LFI (CVE‑2022‑47945), PHP CGI (CVE‑2012‑1823), and the newly disclosed CVE‑2024‑4577. Defenders should patch immediately, block known malicious IP ranges, and monitor for suspicious mining activity.
What happened
GreyNoise recorded a marked increase in cryptomining attempts against PHP and its frameworks from August through November 2025. Attackers focused on ThinkPHP LFI (CVE‑2022‑47945), PHP CGI (CVE‑2012‑1823), and the recently disclosed CVE‑2024‑4577, with additional activity from older exploits such as ThinkPHP Code Execution (CVE‑2019‑9082) and PHPUnit RCE.
Impact
These campaigns leveraged cloud infrastructure—primarily Cloudflare, DigitalOcean, Google, and Contabo—to host malicious payloads. The coordinated use of shared tools suggests a common threat actor pool. Victims include any PHP‑based web applications, from small sites to enterprise deployments.
What to do
Defenders should:
- Patch all PHP installations and frameworks to the latest releases, closing CVE‑2024‑4577 and other known vulnerabilities.
- Deploy real‑time blocklists targeting the top offending IP ranges from Cloudflare, DigitalOcean, Google, and Contabo.
- Monitor web traffic for cryptomining indicators such as unexpected CPU spikes or outbound connections to mining pools.
- Harden file inclusion controls and disable unused PHP extensions to reduce the attack surface.
Related vulnerabilities
Hitachi Energy REB500: CVE‑2024‑8176 & CVE‑2025‑59375 Enable DoS via IEC61850
Hitachi Energy REB500 versions ≤8.3.3.1 suffer two libexpat flaws (CVE‑2024‑8176 and CVE‑2025‑59375) that can be leveraged by authenticated users to trigger a denial‑of‑service. The vendor has released a patch to 8.3.4.0; operators should update immediately and monitor IEC61850 traffic.
Read briefing
FortiOS SSL‑VPN RCE (CVE‑2024‑21762): Public Exploits, Patch Now
Fortinet’s FortiOS and FortiProxy software suffer a critical unauthenticated remote‑code‑execution flaw in the SSL‑VPN. Public exploit code and active attacks have been observed, with CISA confirming real‑world exploitation. Affected versions span FortiOS 6.0‑7.4.x and multiple FortiProxy releases. Apply the vendor patch immediately; if that’s not possible, disable the SSL‑VPN interface as a temporary stopgap.
Read briefing
CUPS RCE Vulnerabilities (CVE-2024-47176-47177) – Patch and Detect Now
CUPS printing system vulnerabilities (CVE-2024-47176-47177) allow unauthenticated remote code execution via IPP and mDNS on UDP port 631. Affected systems include Linux, BSD, ChromeOS and Solaris running CUPS <=2.0.1. Defenders should patch immediately, disable cups-browsed if unnecessary, block port 631, and deploy Elastic Security’s new detection rules.
Read briefing
REMCOS RAT 2024: Watchdog Persistence and Offline Keylogger Mechanisms
The 2024 REMCOS RAT uses a watchdog process to maintain persistence and a low‑profile offline keylogger that writes to a predictable AppData path. Defenders should monitor for injected svchost.exe or rmclient.exe processes, check HKCU\SOFTWARE\{MUTEX}\WD registry entries, and look for keylogger.dat files in %APPDATA%. Early detection can prevent data exfiltration and process restarts.
Read briefing