Web Shell Poses As A GIF
Summary: Cisco Talos reported that attackers were heavily scanning for the TimThumb remote file include flaw, a WordPress module vulnerability released in August 2011, because a single request either drops a web shell or returns a 404. One Talos server logged well over two thousand attempts to drop a particular shell since the start of June 2012, hosted mainly on domains disguised to look like Blogger.com, with the dropped file beginning with a valid GIF header before obfuscated PHP code.
Bottom line: The shell's GIF header means file-type checks will read it as an image, so the detection Talos relies on is a Snort rule flagging a PHP opening tag within 100 bytes of that header - a signature your stack may not be running.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026