Laravel Livewire Unauthenticated RCE via Synthesizer Smuggling — MuddyWater Active Exploitation (CVE-2025-54068) — Threadlinqs Intelligence
As of 2026-05-30, Laravel Livewire Unauthenticated RCE via Synthesizer Smuggling — MuddyWater Active Exploitation (CVE-2025-54068) is a critical-severity vulnerability threat attributed to MuddyWater (Iran), tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 27 indicators of compromise.
Threat ID: TL-2026-0265 · Severity: CRITICAL · CVSS: 9.8 · Status: MONITORING · Category: VULNERABILITY
Attribution: MuddyWater · Iran · ESPIONAGE
Critical unauthenticated remote code execution vulnerability in Laravel Livewire v3 (CVE-2025-54068, CVSS 9.8) exploited via synthesizer smuggling during property update hydration. Actively exploited
CVE-2025-54068 is a critical code injection vulnerability in Laravel Livewire v3 that enables unauthenticated remote command execution through the framework's hydration mechanism. The vulnerability affects Livewire versions 3.0.0-beta.1 through 3.6.3, impacting an estimated 130,000+ applications and potentially millions of Laravel deployments. Livewire has been downloaded over 64 million times, and 1,754 packages depend on it, including Filament (18 million installations).
The root cause lies in HandleComponents.php, specifically in the hydrateForUpdate function. When component properties are updated via HTTP POST requests to the /livewire/update endpoint, the framework processes property updates through a hydration pipeline that synchronizes client-side state with server-side properties. The vulnerability exploits the recursive nature of this hydration process: when the raw snapshot data contains a synthesizer marker, Livewire calls the hydrate function on the new user-controlled value using that same synthesizer context, without proper validation of synthesizer types.
The attack technique, dubbed "synthesizer smuggling," works by nesting malicious synthesizers inside arrays within the updates field of Livewire requests. Since hydration is recursive, each nested array element undergoes independent validation. Attackers send a property update as an empty array, triggering automatic conversion to a synthetic tuple format. The recursive processor then handles each nested child independently, allowing the original snapshot's synthesizer metadata to apply to attacker-controlled values. This enables arbitrary class instantiation with attacker-supplied constructor parameters.
The exploit chains multiple synthesizers: CollectionSynth (clctn) allows instantiating arbitrary classes with array constructor parameters; FormObjectSynth (form) instantiates form objects and sets public properties directly; and ModelSynth (mdl) creates model instances without authentication. The proof-of-concept chains three phases: (1) function execution via GuzzleHttp\Psr7\FnStream with dynamic __toString binding, (2) RCE via Laravel\SerializableClosure\Serializers\Signed with controlled __invoke executing call_user_func_array(), chaining to Illuminate\Bus\Queueable dispatchNextJobInChain() which calls unserialize() on attacker-controlled data using a Laravel/RCE4Adapted gadget chain, and (3) clean exit via Laravel\Prompts\Terminal::exit().
Critically, the vulnerability entirely bypasses the APP_KEY checksum protection mechanism. Exploitation requires only knowledge of the target URL and component structure — no authentication, no user interaction, and no APP_KEY knowledge. Synacktiv released Livepyre, an automated exploitation tool that detects vulnerability presence and deploys payloads with or without APP_KEY knowledge.
Active exploitation has been attributed to MuddyWater (also known as Seedworm, Boggy Serpens, Static Kitten, Mercury, Mango Sandstorm), an Iranian state-sponsored group operating as a subordinate element of Iran's Ministry of Intelligence and Security (MOIS). The campaign began in early February 2026, with escalated activity following U.S. and Israeli military strikes on Iran. MuddyWater has deployed multiple custom C2 frameworks (KeyC2, PersianC2, ArenaC2) and novel malware including the Dindoor backdoor (leveraging Deno JavaScript runtime) and Fakeset (Python backdoor). Targets span government agencies, critical infrastructure, financial institutions, airports, defense supply chains, and non-profit organizations across the United States, Israel, Jordan, Egypt, UAE, and Portugal.
CISA added CVE-2025-54068 to the Known Exploited Vulnerabilities catalog on March 20, 2026, alongside CVE-2025-31277 (Apple WebKit), CVE-2025-43510 (Apple kernel), CVE-2025-43520 (Apple kernel), and CVE-2025-32432 (Craft CMS, CVSS 10.0). Federal agencies must remediate by April 3, 2026. The EPSS score of 48.851% places this vulnerability in the 98th percen
Target sectors: government, critical-infrastructure, financial, defense, healthcare, energy, maritime, transportation, non-profit, technology
Target regions: North America, Middle East, Europe, Israel, United States, Jordan, Egypt, UAE, Portugal
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 27 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
VULNERABILITY, CRITICAL, threat intelligence, cybersecurity, CVE-2025-54068, T1190, T1203, T1059, T1059, T1059, T1505, T1547, T1136, T1068, T1027