What is a web shell?
Summary: Cisco Talos Incident Response reported that web shells were the most observed threat in its 2023 Q1 Incident Response Quarterly Trends report, appearing in almost a quarter of all incidents, up from 6% in the prior report. A web shell is a web script uploaded to a vulnerable system, such as a content management system or unpatched web server, that attackers use to interact with the underlying operating system and maintain persistent access after an initial compromise.
What you should know: Web shell usage in Talos incident response engagements grew from 6% to 25% between reports, and exploitation of public-facing applications was the top observed initial access technique, with the increased web shell activity likely contributing to it.
Read the original at Cisco Talos ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026