PHP Cryptomining Campaign: October/November 2025

Summary: GreyNoise observed a steady ramp-up in exploitation attempts against PHP and PHP-based frameworks from August through October 2025, with seven distinct attack patterns spiking into October and November. The loudest campaigns target ThinkPHP Framework LFI (CVE-2022-47945), PHP CGI (CVE-2012-1823), and PHP CVE-2024-4577, while older chains like ThinkPHP Code Execution (CVE-2019-9082) and PHPUnit RCE still produce roughly 50-150 attempts per day.
Why it matters: Over 1,700 attacking IPs from major cloud providers, with Cloudflare (1,000), DigitalOcean (688), Google (536), and Contabo (512) leading by count, point to large botnets or significant rented infrastructure timed to Bitcoin above $110,000 and a 25-basis-point Fed cut in early November. The exploited vulnerabilities span 2012 to 2024, so forgotten PHP installs remain a reliable revenue source for attackers while victims absorb the compute and electricity cost.

Read the original at GreyNoise Blog ↗

Mentions: CVE-2012-1823 CVE-2019-9082 CVE-2022-47945 CVE-2024-4577
Related: Network Attack Trends: Internet of Threats (August-October 2020) Cyber Risks ·
CVE-2024-4577: PHP-CGI OS Command Injection Vulnerability Known Exploited Vulnerabilities · Jun 12, 2024
CVE-2012-1823: PHP-CGI Query String Parameter Vulnerability Known Exploited Vulnerabilities · Mar 25, 2022