CVE-2025-54068Active Exploitation(laravel / livewire)

Laravel-livewire RCE (CVE-2025-54068) - Video POC Here is the Exploit Github repo: https://github.com/synacktiv/Livepyre ~credit synacktiv For more bugbounty content Join my telegram channel: http://t.me/ShellSec https://t.co/XxjlowowWt

I JUST GOT HACKED TLDR: my old Micro SaaS was running smoothly and had a good position in Google. It got hacked because of a vulnerability in an old version of Livewire (v3.4.9) due to CVE-2025-54068. The attacker created tons of spam pages and set up permanent redirects to casino websites (classic black hat SEO). They also used an indexer to get all these pages into Google. I deleted the whole website for now and I'm going to nuke the server, and try to recover it. Full Story: I woke up this morning and noticed a weird email from Google Search Console. One of my old websites that was running smoothly and generating a few bucks every month had indexing issues. But I never had indexing issues on this website! It's a pretty small micro-SaaS targeting 10 bottom-of-funnel keywords and generating tiny revenue on the side. So I opened Search Console to see which page was causing issues, and I saw this: 3.99k new pages indexed, and 3.31k more waiting to be indexed! I immediately knew something was wrong. I SSH'd into the server, and yes, just as I thought, there were malicious files in my project's public folder. The attack was actually pretty smart!! First, they modified the index.php in the public folder and added encrypted code at the very top. But at the end of it, they included the normal Laravel bootstrap code. So when you use the tail command, or even cat (I use tmux), you probably won't see the first part of the code at first glance. Everything looks normal. But that first part of the code was preventing Laravel from running. Instead, it was running a tiny WordPress installation. They used this WordPress setup to first replicate my entire website template! So if I opened the website normally, I wouldn't notice any changes. Then they used the same WordPress to create all those spam pages and redirects. This project was running Laravel 10 and Livewire 3.4.9, and I hadn't updated it in a long time. In my opinion, it was running smoothly and had no problems! But I didn't know there was a critical vulnerability in this version of Livewire that allows unauthenticated RCE access. Attackers used it to slowly ruin everything. Now I have to nuke the server because I had two other projects running on it, and I'm not sure if they're affected or not. Then I'll probably have to rebuild this whole product with a newer version so I can feel more confident about security. And regarding SEO, it probably already had a huge negative effect on my rankings. But it is what it is. Here's my plan to hopefully fix it: 1. Download all the indexed spam pages, create a clean list of URLs that aren't mine, and manually request removal in Search Console 2. Recreate the legitimate pages and make sure to add proper canonical meta tags 3. Request new indexing and wait a few days to see results 4. Maybe build a few backlinks as well, once the spam pages are deleted Lesson learned: Never stop updating your dependencies, even if everything seems fine 🙂

Laravel Livewire RCE (CVE-2025-54068) & APP_KEY Leakage PoC. I've just released a repository containing scripts to demonstrate how leaked APP_KEYs can lead to full Remote Code Execution in Laravel Livewire apps. 🔗 https://github.com/Lu3ky13/Laravel-Livewire-Remote-Code-Execution-RCE-via-APP_KEY-Leakage #Laravel #BugBounty #RCE #CVE

CVE-2025-54068 Laravel Livewire Credential Theft Campaign: 6,000+ Applications Compromised https://www.imperva.com/blog/cve-2025-54068-laravel-livewire-credential-theft-campaign-6000-applications-compromised/

Back from @passthesaltcon🧂 Our team presented: 💥 Livewire RCE (CVE-2025-54068) – @_remsio_ & @_Worty 🔍 Dicozorus for smarter web fuzzing – @us3r777 💥 BadUSB Forensics – @acervoise Tools 👇 https://github.com/synacktiv/Livepyre https://github.com/synacktiv/dicozorus Thanks to the organizers and everyone who joined! 🙌

LE WEB A CASSÉ en DÉCEMBRE 2025. React2Shell, MongoBleed, Livewire... les piliers d'Internet se sont effondrés. 💥 J'ai invité les chercheurs de chez @Synacktiv, @_Worty et @_remsio_, pour décortiquer la RCE sur Livewire (CVE-2025-54068)🛠️ https://youtu.be/SZw5B-IJvHo https://t.co/yOEYnNeDos

Got pwned by Indonesians exploiting CVE-2025-54068 and as a thank you I'm gonna send take down requests for their whole infra tonight https://t.co/AQYof9tjj7

It has everything to do with file uploads. After investigating the exploit on my server, there were clear traces of a file-upload attack, 20+ webshells sitting in storage directories, all using fake extensions. If this were CVE-2025-54068 leading to RCE, there’d be no reason to upload persistent webshells. The attacker would simply execute commands directly. The attack pattern I observed doesn’t match that CVE at all. CVE-2025-54068 results in immediate RCE without the need for uploaded shells. That’s why I’m confident about what happened, because this is based on direct investigation of my own server, you can stop trying to dismiss my findings now. Thank you.

📚 You can find the associated resources here: ▪️ Finding the Needle in the Haystack with Dicozorus : https://www.synacktiv.com/sites/default/files/2026-07/dicozorus_passthesalt_2026.pdf ▪️ CVE-2025-54068: Deep drive into Livewire : https://www.synacktiv.com/sites/default/files/2026-07/pts_2026_livewire.pdf ▪️ BadUSB forensic : https://archives.pass-the-salt.org/Pass%20the%20SALT/2026/slides/PTS2026-RUMP-01-BadUSB-forensic.pdf

🚨 CVE-2025-54068 - critical 🚨 Laravel Livewire v3 - Remote Command Execution > Livewire v3 (Laravel) contains a vulnerability in its component hydration/update mech... 👾 https://cloud.projectdiscovery.io/library/CVE-2025-54068 @pdnuclei #NucleiTemplates #cve

CVE-2025-54068, a critical unauthenticated RCE in Laravel Livewire v3 up to v3.6.3, has been actively exploited in a mass credential theft campaign hitting 6,000+ applications across e-commerce, healthcare, finance, and government. Key findings: - The vulnerability lives in Livewire's hydration process: the framework fails to verify submitted component state before deserializing it, letting an unauthenticated attacker inject a PHPGGC gadget chain via a crafted HTTP request and achieve RCE. No auth required, fully automated at scale (T1190). - Once in, the attacker curls shoc.enz (SHA256: 548c3672fd3201dab56f714fdd5812bb024980815b3a2b6299f0126bdf16fb3e) from hxxps://xantibot[.]pw/database-sell/shoc.enz and pipes it to bash. The 5,269-byte script recursively hunts every .env file on the filesystem (T1083, T1552.001), stages and zips them, then exfiltrates to FTP at 47.129.100[.]149, Telegram, and GoFile before wiping the staging directory (T1070.004). - Recovered exfiltration infrastructure held credentials from 6,167 apps: 381 valid AWS IAM keys, 188 live Stripe secret keys, 14,566 real database passwords, 7,176 SMTP passwords, and 1,851+ full database dumps confirming active post-theft exploitation. #DFIR_Radar

米国CISAが悪用を確認した脆弱性 #KEV をカタログに追加しました。（3/20追加） 🛡️No.1548 CVE-2025-31277 Apple Multiple Products Buffer Overflow Vulnerability ==================================== ✅概要 ・深刻度：重要⚠️ 8.8 (CVSS Base) / CISA-ADP ・種別：バッファ境界の不適切な制限 (CWE-119) ・CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Apple の複数製品において、悪意ある Web コンテンツの処理によりメモリ破損が発生し得る脆弱性。 ✅ChatGPTによる脆弱性評価 ・国内影響度判定：高 ・悪用難易度：中 ✅攻撃前提条件 ・被害者が細工された Web コンテンツを処理すること ・脆弱な Apple 製品を利用していること ✅悪用時影響 ・メモリ破損 ・任意コード実行の可能性 ・端末侵害の初期侵入点化 ✅悪用事例等に関する公開情報 ・PoC/Exploit：確認できず ・ITW：あり（Google Threat Intelligence Group が DarkSword での利用を報告。） ✅関連情報 https://nvd.nist.gov/vuln/detail/CVE-2025-31277 https://cloud.google.com/blog/topics/threat-intelligence/darksword-ios-exploit-chain/ https://support.apple.com/en-us/124147 🛡️No.1549 CVE-2025-43510 Apple Multiple Products Improper Locking Vulnerability ==================================== ✅概要 ・深刻度：重要⚠️ 7.8 (CVSS Base) / NVD ・種別：不適切なロック (CWE-667) ・CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H 事前認証されていない攻撃者により、悪意あるアプリを介して、プロセス間で共有されるメモリに予期しない変更を生じさせる恐れがあります。 ✅ChatGPTによる脆弱性評価 ・国内影響度：中 ・悪用難易度：中 ✅攻撃前提条件 ・被害端末上で悪意あるアプリを実行させること ・脆弱な Apple 製品を利用していること ✅悪用時影響 ・共有メモリの不正変更 ・プロセス間干渉 ・後続の権限奪取やチェーン攻撃の踏み台化 ✅悪用事例等に関する公開情報 ・PoC/Exploit：確認できず ・ITW：あり（Google Threat Intelligence Group が、DarkSword の GPU サンドボックス脱出段階で使用したと説明。） ✅関連情報 https://nvd.nist.gov/vuln/detail/CVE-2025-43510 https://cloud.google.com/blog/topics/threat-intelligence/darksword-ios-exploit-chain/ https://support.apple.com/en-us/125632 🛡️No.1550 CVE-2025-43520 Apple Multiple Products Classic Buffer Overflow Vulnerability ==================================== ✅概要 ・深刻度：重要⚠️ 7.1 (CVSS Base) / NVD ・種別：境界外書き込み (CWE-787) / NVD、クラシックバッファオーバーフロー (CWE-120) / CISA-ADP ・CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H 事前認証されていない攻撃者により、悪意あるアプリを介して、予期しないシステム終了やカーネルメモリ書き込みを引き起こされる恐れがあります。 ✅ChatGPTによる脆弱性評価 ・国内影響度：中 ・悪用難易度：中 ✅攻撃前提条件 ・被害端末上で悪意あるアプリを実行させること ・脆弱な Apple 製品を利用していること ✅悪用時影響 ・システム異常終了 ・カーネルメモリ書き込み ・権限昇格や端末掌握の足掛かり ([NVD][6]) ✅悪用事例等に関する公開情報 ・PoC/Exploit：確認できず ・ITW：あり（GTIG が DarkSword の最終段階 `pe_main.js` において、脆弱性を悪用し物理/仮想メモリ でread/write primitive を構築すると説明) ✅関連情報 https://nvd.nist.gov/vuln/detail/CVE-2025-43520 https://cloud.google.com/blog/topics/threat-intelligence/darksword-ios-exploit-chain/ https://support.apple.com/en-us/125633 🛡️No.1551 CVE-2025-32432 Craft CMS Code Injection Vulnerability =================================== ✅概要 ・深刻度：緊急🔥 10.0 (CVSS Base) / NVD ・種別：コード生成の不適切な制御 (CWE-94) / GitHub, Inc. ・CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H 事前認証されていない攻撃者により、リモートからコード実行される恐れがあります。Craft CMS において、3.0.0-RC1 以上 3.9.15 未満、4.0.0-RC1 以上 4.14.15 未満、5.0.0-RC1 以上 5.6.17 未満が影響を受けます。 ✅ChatGPTによる脆弱性評価 ・国内影響度：中 ・悪用難易度：低 ✅攻撃前提条件 ・Craft CMS が外部公開されていること ・脆弱バージョンが稼働していること ・攻撃者は認証不要、ユーザー操作不要 ✅悪用時影響 ・未認証でのリモートコード実行 ・Web サーバ侵害 ・情報窃取 ・Web 改ざんや追加マルウェア設置 ✅悪用事例等に関する公開情報 ・PoC/Exploit：公開情報あり ・ITW：あり（Craft CMS は 2025-04-17 に “exploited in the wild” を示唆する証拠を確認したと公表） ✅関連情報 https://nvd.nist.gov/vuln/detail/CVE-2025-32432 https://github.com/craftcms/cms/security/advisories/GHSA-f3gw-9ww9-jmc3 https://craftcms.com/knowledge-base/craft-cms-cve-2025-32432](https://craftcms.com/knowledge-base/craft-cms-cve-2025-32432 🛡️No.1552 CVE-2025-54068 Laravel Livewire Code Injection Vulnerability ==================================== ✅概要 ・深刻度：緊急🔥 9.8 (CVSS Base) / NVD ・種別：コード生成の不適切な制御 (CWE-94) / GitHub, Inc. ・CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Livewire v3.0.0 以上 3.6.4 未満において、特定の component property update の hydration 処理に起因。事前認証されていない攻撃者により、特定条件下でリモートからコード実行される恐れがあります。 ✅ChatGPTによる脆弱性評価 ・国内影響度：中 ・悪用難易度：中 ✅攻撃前提条件 ・Livewire v3 系の脆弱バージョンが公開環境で稼働していること ・対象コンポーネントが特定の方法で mounted / configured されていること ✅悪用時影響 ・未認証でのリモートコマンド実行 ・アプリケーションサーバ侵害 ・情報窃取 ・追加マルウェア設置や横展開 ([NVD][7]) ✅悪用事例等に関する公開情報 ・PoC/Exploit：公開情報あり ・ITW：あり（ThreatHunter .ai はイラン系脅威アクターから、CVE-2025-54068 向け custom Nuclei template と 9 confirmed targets を報告） ✅関連情報 https://nvd.nist.gov/vuln/detail/CVE-2025-54068 https://github.com/livewire/livewire/security/advisories/GHSA-29cq-5w36-x7w3 https://www.threathunter.ai/blog/iranian-threat-actor-tools-techniques-iocs-ioas/ https://www.cisa.gov/news-events/alerts/2026/03/20/cisa-adds-five-known-exploited-vulnerabilities-catalog #vulnerability

Vous voulez en savoir plus sur la CVE-2025-54068 affectant Livewire 3 mais vous préférez un format vidéo ? Ça tombe bien ! On est passé en parler avec @_Worty dans la dernière vidéo de @Fransosiche ! 🎥

#threatreport #MediumCompleteness CVE-2025-54068 Laravel Livewire Credential Theft Campaign: 6,000+ Applications Compromised | 23-06-2026 Source: https://www.imperva.com/blog/cve-2025-54068-laravel-livewire-credential-theft-campaign-6000-applications-compromised/ Key details below ↓ 🎯Victims: E commerce, Healthcare, Financial services, Education, Government, Online gambling and betting, Logistics 🏭Industry: Government, Healthcare, E-commerce, Education, Logistic 🌐Geo: Asia, Indonesian, Asian, Brazilian 🔓CVEs: CVE-2025-54068 \[[Vulners](https://vulners.com/cve/CVE-2025-54068)] - CVSS V3.1: *9.8*, - Vulners: Exploitation: True Soft: - laravel livewire (<3.6.4) 📚TTPs: ⚔️Tactics: 4 🛠️Technics: 11 🧨IOCs: - Url: 1 - File: 2 - Hash: 1 - IP: 1 - Domain: 1 - Email: 1 💽Software: Laravel Livewire, Livewire, Laravel, telegram, Unix, curl 🔢Algorithms: zip, sha256 📜Programming Languages: php #threatreport: On May 24, 2026, a major credential theft campaign exploiting CVE-2025-54068 was observed targeting Laravel Livewire applications, primarily affecting versions up to v3.6.3. This critical vulnerability arises from inadequate validation of component property updates during the hydration process, which allows unauthenticated attackers to inject malicious serialized PHP objects leading to arbitrary code execution upon deserialization. The attacker leveraged this flaw to execute a payload that fetched and executed a Bash script from their command-and-control (C2) server. The captured payload indicated that the attacker used PHPGGC gadget chains, which exploit existing legitimate PHP classes within Laravel applications. The malicious Bash shell script, identified as shoc.enz, was a lightweight 5,269 bytes in size, and served as a credential stealer. Once executed, it set up a temporary working directory, ensured no other instances were running, searched for sensitive .env files containing crucial configuration data, archived these files, and subsequently exfiltrated them to multiple C2 channels, while also cleaning up to erase forensic traces. Analysis revealed that over 6,167 applications across diverse sectors, including e-commerce, healthcare, financial services, and even governmental bodies, had their credentials compromised. The extant data included more than 1,850 database dumps and extensive email lists, indicating the active exploitation of stolen credentials. Indicators attributing the campaign to an Indonesian threat actor included linguistic elements in the malware’s code and metadata associated with the C2 infrastructure, including Telegram handles and an email address linked to multiple prior breaches in underground forums. The targeted applications encompassed a wide array of Laravel deployments, including platforms related to online gambling, education, and logistics, thereby underscoring the indiscriminate nature of the scanning efforts. Any organization utilizing unpatched Laravel Livewire v3 versions was potential prey for this extensive campaign. Overall, the operation highlights significant vulnerabilities within widely used frameworks and the severe implications of their exploitation in the cyber realm.

@PovilasKorop Nothing to do with file uploads - he got pwned by the Livewire vulnerability (https://www.cvedetails.com/cve/CVE-2025-54068/)

A suspected Indonesian threat actor exploited the Laravel Livewire vulnerability (CVE-2025-54068) to steal credentials from over 6,000 web applications. #CyberSecurity #Laravel #CVE202554068 #Vulnerability #Infosec https://securityonline.info/laravel-livewire-vulnerability-cve-2025-54068 https://t.co/FAbT9yLI0I

just an indie dev trying to make it. Please don't try to hack me. CVE-2025-54068 is not open for this I guess monitoring do have a lot of benefits https://t.co/CPcQulRH1A

Brother, these guys brought down my app for almost a week. It was a vulnerability with livewire: CVE-2025-54068 A composer update fixed it for me. I also had to beef up all my file upload validation. Also set up watchers, monitors an alerts - affliction shall not rise again.

CISA adds actively exploited Apple, Craft CMS, and Laravel Livewire flaws to KEV catalog — including CVE-2025-32432 (RCE), CVE-2025-54068 (MuddyWater-linked), and multiple iOS bugs used by DarkSword exploit kit. Federal agencies must patch by April 3, 2026. #CISA #KEV #RCE #CyberSecurity https://securityaffairs.com/189776/security/u-s-cisa-adds-apple-laravel-livewire-and-craft-cms-flaws-to-its-known-exploited-vulnerabilities-catalog.html

Update your Livewire version! I heard two people report that they were hacked through an old Livewire website. CVE-2025-54068 is now actively exploited. If you're under &lt; 3.6.4, upgrade immediately.