CVE Intel / CVE-2017-9841
CVE-2017-9841
communications diameter signaling router · oracle, phpunit_project
What it is
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a "<?php " substring, as demonstrated by an attack on a site with an exposed /vendor folder, i.e., external access to the /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php URI.
Live exploitation on the huntback network (30 days)
167
attempts captured
11
distinct source IPs
2026-09-23
last seen
huntback carries a network signature for this CVE. Exploitation attempts are detected on the decoy fleet in real time.
How huntback helps
Deploy a decoy that emulates communications diameter signaling router and you will see every attempt at this CVE the moment it lands, with the full payload, the attacker's infrastructure, and any stage-2 loader. Then huntback can scan the attacker back.
CVSSn/a Critical
EPSS1.00 (99% pct)
In CISA KEVyes
Publishedn/a
Network detectableyes, signatured