CVE-2015-10141Active Exploitation

MEDIUMCVSS 9.3 · CRITICAL

Exploitation ongoing with high activity in latest observed window (1 mentions)

Immediate actions

Prioritize remediation for affected systems immediately
Assume compromise if assets are exposed
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft
Track advisory updates for patch or workaround availability

Recommended action window: Immediate (within 24h)

NVD description

An unauthenticated OS command injection vulnerability exists within Xdebug versions 2.5.5 and earlier, a PHP debugging extension developed by Derick Rethans. When remote debugging is enabled, Xdebug listens on port 9000 and accepts debugger protocol commands without authentication. An attacker can send a crafted eval command over this interface to execute arbitrary PHP code, which may invoke system-level functions such as system() or passthru(). This results in full compromise of the host under the privileges of the web server user.

Back to dashboard

5.0/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-78CWE-306

Priority

MEDIUM

Exploitation

ACTIVE

PoC

YES

Patch

NONE

Momentum

NONE

Threat summary

Active exploitation appears in 1 classified signals
Public PoC is present in monitored signal
1 mentions across 1 observed day

What's happening

Active exploitation reported across 1 signal
PoC mentioned or linked in 1 signal
Technical details provided in 1 signal
1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d

Signal classification1 categories

Active Exploitation

1100.0%

Referenced assets1 URL

By indicator

https://zerodaysignal.com/vulnerability/CVE-2015-10141

Full discourse1 post

0day Signal@0dayPublishing183d
Active Exploitation
🚨 CVE-2015-10141: Xdebug Remote Debugger Unauthent... Port 9000 wide open, no auth, eval() straight to RCE - dev environments bleeding into prod makes this a mass exploitati... https://zerodaysignal.com/vulnerability/CVE-2015-10141 #netsec #vulnerability #CVE #sysadmin #zeroday
Post summary
The post highlights that CVE‑2015‑10141 in Xdebug’s remote debugger allows unauthenticated RCE via an open port 9000 and is reportedly being widely exploited in production environments.
0000055
204 followersView on X

Explore more

Back to dashboard