Plesk 0Day For Sale As Thousands of Sites Hacked
Summary: A longtime member of an exclusive cybercrime forum is selling an exploit for $8,000 that recovers the master admin password from Parallels Plesk Panel version 10.4.4 and earlier, packaged as a point-and-click tool that can also read and write files on the panel. Sucuri Malware Labs told SC Magazine that roughly 50,000 sites were recently compromised in a sustained malware injection attack, with a majority of the hacked sites running Plesk installations.
Key Takeaway: Plesk administrators can be found at scale through Shodan queries on headers like X-Powered-By-Plesk, which one commenter cites as returning about 115,000 hits, so an $8,000 tool does not need many buyers to reach a large population of hosted servers.
Read the original at Krebs on Security ↗
- Topics
- Data Breaches
- Related
- TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026