Knocking on Open Doors

THE WILD SIGNALS / EDITION 004

Nearly everything fell this week except one thing: the search for web shells that someone may have planted earlier.

SECTION 01

What the signals mean

A web shell is a small script an attacker plants on a compromised server so they can come back later and control it through an ordinary web request. Once planted, it is a door that stays open. This week, while almost every other kind of probing declined against the Venus decoy estate, the search for those doors grew sharply: 6,999 attempts, up 35.8%, from 90 sources of which 59 had never been seen by the platform before. The filenames requested tell the story plainly. Alongside the usual guesses, the decoys logged thousands of requests for names like 1.php, 222.php and a file called this_is_a_new_hello_world.php: names nobody chooses for legitimate software, and exactly what someone checks for when they want to know whether a shell they or someone else planted is still answering.

The rest of the week fell away around that one rising signal. Total events dropped 4.9% to 36,380, secret hunting fell 35.7%, database password attacks halved, and injection probing against SQL endpoints stopped entirely, from four attempts to zero. Six in ten of the week’s 2,377 sources were still brand new to the platform, continuing last edition’s pattern of unfamiliar hands doing familiar work.

The supply of new doors kept growing

A search for planted shells only pays off if shells keep getting planted, and the week’s vulnerability intelligence showed exactly how they do. The flaws that qualified as more important this week included several that let an attacker upload a file to a website without logging in: a WordPress form plugin exposing an estimated 300,000 sites, the widely used Elementor Pro page builder, a WooCommerce payment plugin, and a Joomla editor extension. Each is a route to planting precisely the kind of script the decoys watched attackers hunting for.

The speed problem from Edition 003 did not slow down either. A critical GitLab flaw disclosed this week was being exploited within days, before many organisations had scheduled the update. A Zimbra mail-server flaw went from patch to active exploitation inside the same window, confirmed by Poland’s national response team. And the US government added four more actively exploited flaws to its catalogue in one announcement, spanning macOS, SharePoint, VMware vCenter and a core Windows networking service. None of these required a sophisticated adversary; they required an unpatched system and a week of inattention.

A quiet tail worth noting

One more shape stood out. Every one of the week’s web-facing sweeps against the decoys, the shell hunting included, went quiet on the morning of 20 August and stayed quiet through the weekend, while the background password-guessing against remote-login services carried on uninterrupted all seven days. Coordinated tooling starts and stops together; background noise never stops. Watching the two behave differently in the same week is as clear a view of the distinction as the decoys have produced.

What organisations should ask this week

Four editions in, the volumes rise and fall but the direction holds: attackers spend less effort breaking in through the front and more effort finding what is already open. The cheapest door is one somebody else installed.

36,380 External events. 2,377 Distinct sources. −4.9% Event volume. −11.6% Distinct sources. 17 Active campaigns.

Event volume fell 4.9% and distinct sources fell 11.6%; 1,434 of the period’s 2,377 sources, 60.3%, were first observed this period. Seventeen campaigns were active, 10 flagged recurring, 6 reactivated; no campaign was first observed this period. By enterprise surface, Shell rose 2.2% to 21,571 events while Web fell 7.4% to 13,901, Database fell 55.4% to 711, and API, Portal, Auth and VPN each fell by more than half on small bases. By behaviour category, webshell upload rose 35.8% against falls everywhere else: scanner and recon fell 30.3%, path traversal 23.9%, RCE attempts 38.9%, and SQL injection went from 3 events to zero. Credential stuffing was flat at −0.4%.

Top-ranked signal: Webshell / RCE Script Probing

Fewer sources produced more events: the population narrowed by a third while its output rose by a third. The most requested paths:

Fabricated filenames of this shape are shell-locator wordlists, not vulnerability tests: the requester is checking whether a previously planted script answers. Cadence over the 114 classified sessions: 71.93% automated, 16.67% semi-automated, 9.65% agentic, with operator-associated and evasive under 1% each. The agentic share is the highest this signal has recorded across four editions. Eleven sessions exceeded 200 events, so their published cadence classifies the first 200 events only.

Second and third ranked: both falling, ranked on other factors

PHP Injection / Remote Include fell 41.4% to 34 events, from 8 sources against last week’s 14, yet ranks second because every event maps to KEV-listed CVE-2012-1823 and consequence saturates at 1.0. MySQL Credential Attack halved to 543 events from 57 sources and ranks third on recurrence, 33.33%, the highest of any signal this week: a third of its sources also produced it last week, the signature of a persistent rather than opportunistic population. Sensitive File & Secret Exposure fell 35.7% to 2,882 events, from 75 sources against last week’s 105, across 2,033 distinct paths versus 1,802 last week, with /.env, /.git/config and /.git/HEAD still leading. Backup and archive probing fell 71.7% to 15 events, with /terraform.tfstate again the most-requested path.

Full ranked population

Score weights meaningful change 0.35, recurrence 0.25, persistence 0.20 and mapped-vulnerability consequence 0.20; volume is not a factor. Credential-attack categories score zero on consequence because the mapping has no rule for them, not because they are inconsequential. SQL Injection Probing recorded no activity this period against 4 events last week and is listed so the disappearance is visible rather than silent. The taxonomy covered 88.65% of the period’s external events.

Behaviour progression

276 of the period’s 3,900 sessions carried behaviour from two or more distinct stages of the discovery, exploitation and persistence ladder, against 491 last week. 211 sessions ordered discovery before exploitation-shaped activity, from 110 distinct sources, with the busiest single source accounting for 18.01% of them. 65 sessions ran the ordering in reverse, which an escalation does not do; a fixed tool request order or an address reassigned mid-window explains it better.

For the first time in four editions, semi-automated sessions outnumber fully automated ones among forward-ordered progressions: 44.98% against 41.15%, where last week automation led 70.02% to 18.97%. Fewer sessions progressed, but a larger share of those that did show signs of adjustment between stages rather than a fixed list.

Vulnerability identifiers observed

The mapping reaches 17 identifiers; 13 were observed. Leading counts, with last week’s in parentheses: CVE-2021-41773 Apache traversal 7,016 hits from 94 sources (5,176, KEV), CVE-2019-0232 Tomcat CGI 6,999 from 90 (5,154), CWE-312 cleartext secrets 2,502 from 32 (3,516), CVE-2017-9841 PHPUnit 305 from 16 (391, KEV), CWE-527 Git exposure 145 from 33 (285), CVE-2023-2982 WordPress login bypass 49 from 21 (52), CVE-2012-1823 PHP-CGI 34 from 8 (58, KEV). The two Apache-family identifiers rose in step with the webshell signal they travel with; nearly everything else fell. Detection is inference from request path and tag mapping, never observed exploitation.

Medulus correlation

Upload flaws feed the locator sweeps. Qualifying this week were unauthenticated arbitrary-file-upload flaws in a WordPress form plugin with an estimated 300,000 exposed sites (CVE-2026-15748), Elementor Pro (CVE-2026-32475), the Pix for WooCommerce plugin (CVE-2026-3891), and the JCE editor extension for Joomla (CVE-2026-48907). Each is a route to planting exactly the scripts the decoys’ top signal goes looking for.

Disclosure to exploitation, again in days. GitLab CVE-2026-19478, a zero-click GraphQL flaw allowing unauthenticated modification or deletion of public projects, was exploited within days of its 18 August disclosure. Zimbra CVE-2026-73570, SNMP-triggered remote code execution, went from patch to confirmed in-the-wild exploitation inside the week, per CERT Polska.

Four KEV additions in one announcement. CISA added actively exploited flaws in Apple macOS (CVE-2026-65400), Microsoft SharePoint (CVE-2026-55040), VMware vCenter (CVE-2026-59310) and the Windows IKE service (CVE-2026-33824) to the Known Exploited Vulnerabilities catalogue on 19 August.

AI tooling joins the exposed-service list. Flaws qualifying this week in MLflow (CVE-2026-64849), IBM Langflow (CVE-2026-9198), Ray (CVE-2025-62593) and Flowise (CVE-2026-56274) all permit unauthenticated remote code execution against AI development platforms, a category increasingly reachable from the internet and rarely inventoried with the same rigour as web servers.

Technical checks for the week

Venus records activity reaching Elytra-operated observation infrastructure. Medulus provides public vulnerability and threat-intelligence context. An observed request establishes an attempt, not a successful compromise. Session-keyed figures are not external-only; every event-keyed figure is. The ranking constants remain provisional pending a complete uninterrupted baseline week.