Exposed Hacker Server Reveals WP-SHELLSTORM Backdooring Thousands of Word Press Sites

Summary: A cybercrime crew tracked as WP-SHELLSTORM left a rented US server at 137.175.93[.]126 with no password for 22 days, exposing about 800MB across 434 files including webshells, exploit scripts, and target lists naming more than 1.4 million websites. The crew used automated scanners against 27 known plugin flaws, chiefly a Breeze caching plugin bug (CVE-2026-3844) fired at over 45,000 targets and backdoored over 17,000 by its own count, while Ctrl-Alt-Intel counted 25,195 sites with compromise evidence and SOCRadar counted 5,700-plus active webshells.
Key Takeaway: The 1.4 million figure is a scan list, not a victim count - a Joomla bug fired at more than 560,000 targets landed on only 77 - so the number that should hold a security leader's attention is the 5,700-plus live webshells still sitting on servers, planted through public exploits with no zero-day required.

Read the original at The Hacker News ↗

Topics: Detection & Response
Mentions: CVE-2026-3844
Related: LMDeploy CVE-2026-33626 Flaw Exploited Within 13 Hours of Disclosure Cyber Risks ·
YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026
Inside Falcon AI Gateway: One Control Point for AI Traffic Cyber Risks · Nov 13, 2026