Met Info CMS CVE-2026-29014 Exploited for Remote Code Execution Attacks

Summary: VulnCheck reports active exploitation of CVE-2026-29014, a CVSS 9.8 unauthenticated PHP code injection flaw in MetInfo CMS versions 7.9, 8.0, and 8.1 that allows remote attackers to execute arbitrary code and gain full control of the server. Patches were released April 7, 2026; exploitation began April 25 against honeypots in the U.S. and Singapore, then surged on May 1, 2026, targeting China and Hong Kong IP addresses.
Bottom line: As many as 2,000 MetInfo instances are reachable online, most in China, and the flaw requires no authentication - only that the /cache/weixin/ directory exists, which the official WeChat plugin creates on install.

Read the original at The Hacker News ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2026-29014
Related: ⚡ Weekly Recap: Linux Rootkit, macOS Crypto Stealer, Web Socket Skimmers and More Cyber Risks ·
Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026