PHPUnit - RCE (CVE-2017-9841)

CVE-2017-9841 is a critical vulnerability in PHPUnit that allows remote attackers to execute arbitrary PHP code by accessing a test script inadvertently left exposed in web-accessible locations.

CrowdSec has been tracking this vulnerability and its exploits since 15th of December 2023.

Based on data from the CrowdSec network, nearly all observed exploitation of CVE-2017-9841 is fully opportunistic, with attackers indiscriminately scanning the entire internet. These attacks are automated and lack any form of target selection or reconnaissance. Additionally, according to week-over-week analysis by CrowdSec, exploitation of CVE-2017-9841 is surging. Attack volumes are spiking well above historical norms, indicating widespread and escalating interest from threat actors. CVE-2017-9841 is currently experiencing high visibility and active exploitation across the internet.

Attack attempts are characterized by requests to URLs ending in /vendor/phpunit/phpunit/src/util/php/eval-stdin.php.