Sophos says the code patches Apache and hooks the PHP module loader so the shell never lands on disk, which leaves file-integrity checking on an appliance that was never running EDR unable to prove much.
Perspective Coverage
6 publishers
- Builder
- Builder 37%
- Operator
- Operator 57%
- Investor
- Investor 6%
Reality
- Evidence72
- Adoption
- Insufficient
- Hype gap+10
- Incentives35
- Confidence70
Two actor classes are using CVE-2026-20079 against the console that manages every Cisco Secure Firewall behind it. The same week brought a Linux rootkit planted on F5 BIG-IP APM appliances, with the installation route unreported.
Reality
- Evidence60
- Adoption
- Insufficient
- Hype gap0
- Incentives
- Insufficient
- Confidence55
Only permalinked URLs returned 500s, because the homepage resolves close to a direct hit on index.php and never reaches the forwarding rule WordPress wrote against the old subdirectory path. The usual four-element reading of the default block leaves out the line that held that path.
Reality
- Evidence45
- Adoption15
- Hype gap+15
- Incentives20
- Confidence50
A cloaker left a plain robots.txt in the web root of utilorax.com. Apache's !-f rule let it win over the generated one, and every instrument built after the first hack had its own reason to call the result healthy.
Reality
- Evidence58
- Adoption12
- Hype gap−8
- Incentives40
- Confidence60
A full attack chain against a self-hosted lab shows a clean split: reconnaissance that never authenticates logs nothing, while every login attempt and HTTP request produces correlated alerts.
Reality
- Evidence40
- Adoption
- Insufficient
- Hype gap0
- Incentives60
- Confidence45
Check Point says a Chinese-speaking crew has been running custom Apache modules on compromised Brazilian federal, state and municipal web servers since mid-2025, so the address bar and the TLD tell a visitor nothing useful.
Perspective Coverage
3 publishers
- Builder
- Builder 23%
- Operator
- Operator 58%
- Investor
- Investor 19%
Reality
- Evidence67
- Adoption58
- Hype gap+26
- Incentives66
- Confidence65
The keys work because they are keys. A standard sk_live carries refunds and sometimes payouts. The fix that matters today is rotation. The fix that lasts is a document root that refuses to serve dotfiles.
Reality
- Evidence54
- Adoption31
- Hype gap+9
- Incentives44
- Confidence52
Two disclosed DoS techniques turn HTTP/3-to-HTTP/1.1 conversion at six major CDNs into up to 350x load on the origin, with no configuration change by the customer.
Reality
- Evidence66
- Adoption34
- Hype gap+28
- Incentives52
- Confidence54