Suspected Remote Code Execution Attempt via PHP Injection in WebUI Endpoint

Anoozilla HunterX@AnoozillaHunterX

•updated Sep 22, 2025•1•0•95

Detects the creation of a PHP web shell file named 'hafuab.php' in '/usr/local/webui/' by an 'echo' command, which includes PHP code to display 'test - Open source project (github.com/test/test)' and 'phpinfo()'. This activity is indicative of an attacker attempting to establish persistent access and gain information about the web server environment.