Ongoing intrusions exploiting a pair of old remote code execution flaws in the widely used open-source web app framework ThinkPHP, tracked as CVE-2018-20062 and CVE-2019-9082, have been conducted by Chinese hackers since April, following a similar attack campaign launched in October, according to SecurityWeek. Both vulnerabilities have been leveraged by attackers to facilitate the eventual deployment of the Dama web shell, which has been used to enable file tampering and uploading, information gathering, network port scanning, unauthorized database access, and privilege escalation, an Akamai report showed.

Source: SC Magazine