Web shell
Also called: webshell
A malicious script planted on a web server that lets an attacker run commands, move files and use the server as a gateway into the internal network through ordinary web requests. Web shells are typically dropped after exploiting a web application or edge-device vulnerability and survive patching, so after a serious flaw, check web directories for new or modified files and review unusual requests in web logs.
Further reading: attack.mitre.org
Advisories that mention this term
Check Point Gaia privilege-escalation flaw CVE-2026-123039 chained with PHP2Shell in attacks to gain gateway root
Check Point says attacks exploiting PHP2Shell also used local privilege escalation flaw CVE-2026-123039 in the Gaia OS Dynamic CLI service (CVSS 7.
Attackers run self-hosted AntiFox AI pentest agents to plant webshells and steal AWS production secrets
BleepingComputer, citing Arctic Wolf, reports that attackers host self-managed instances of the open-source agentic pentest platform AntiFox, a fork of ARTEX 0.
South Korea's Yoido Full Gospel and SaRang megachurches breached; data of about 850,000 and 89,000 members suspected leaked
According to Yonhap, security firm Oasis Security found data from two large Korean churches on an overseas attacker server; one was breached via a web shell on its ERP server with database admin rights obtained, while the other's groupware was accessed with previously obtained accounts and then its ERP via single sign-on .
CISA Adds SharePoint 'ToolShell' Vulnerability CVE-2025-53770 to Known Exploited Vulnerabilities Catalog
On July 20, 2025, CISA added CVE-2025-53770 ('ToolShell') in on-premises Microsoft SharePoint to its Known Exploited Vulnerabilities (KEV) catalog .
CISA Warns of Active Exploitation of Ivanti Connect Secure Authentication Bypass and Command Injection Vulnerabilities
On January 10, 2024, CISA issued an alert warning that Ivanti Connect Secure and Policy Secure contain vulnerabilities CVE-2023-46805 and CVE-2024-21887 .