Inside the Surge of PHP and IoT Exploits with Qualys TRU | Qualys
Summary: Qualys Threat Research Unit telemetry shows a sharp rise in automated attacks on PHP servers, IoT devices, and cloud gateways, driven mainly by the Mirai, Gafgyt, and Mozi botnets exploiting known CVEs and cloud misconfigurations. The blog cites PHP powering more than 73% of websites and 82% of enterprises reporting incidents tied to cloud misconfigurations, and details exploitation of flaws including CVE-2022-47945 in ThinkPHP, CVE-2021-3129 in Laravel Ignition, CVE-2024-3721 in TBK DVRs, and CVE-2022-22947 in Spring Cloud Gateway.
What's compelling: A significant share of the scanning traffic originated from cloud providers including AWS, GCP, Azure, Digital Ocean, and Akamai Cloud, with attackers spinning up short-lived VMs to mask their origin - so source IPs pointing at trusted infrastructure no longer tell you much about who is knocking.
Read the original at Qualys Blog ↗
- Topics
- Threat Actors & Nation-State
- Mentions
- CVE-2021-3129CVE-2022-47945
- Related
- CVE-2021-3129: Laravel Ignition File Upload Vulnerability Known Exploited Vulnerabilities · Sep 18, 2023New Exploitation Surge: Attackers Target ThinkPHP and own Cloud Flaws at Scale | Grey Noise Blog Cyber Risks ·PHP Cryptomining Campaign: October/November 2025 Cyber Risks ·