Laravel Livewire Unauthenticated RCE via Synthesizer Smuggling — MuddyWater Active Exploitation (CVE-2025-54068)

Laravel Livewire Unauthenticated RCE via Synthesizer (TL-2026-0265), also tracked as GHSA-29cq-5w36-x7w3, is a critical-severity software vulnerability scored CVSS 9.8, first published 2026-03-21. It is attributed to MuddyWater (Iran) with high confidence, affects Livewire (Laravel) Livewire, references 1 CVE (CVE-2025-54068), maps to 23 MITRE ATT&CK techniques (T1005, T1027, T1041), and is covered by 9 detection rules and 27 indicators of compromise.

Key facts for TL-2026-0265

Threat ID
TL-2026-0265
Also known as
GHSA-29cq-5w36-x7w3
Severity
CRITICAL
CVSS
9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Status
MONITORING
Category
VULNERABILITY
First published
2026-03-21
Last reviewed
2026-03-21
Attribution
MuddyWater
Attribution confidence
HIGH
Nation-state nexus
Iran
Motivation
ESPIONAGE
Target sectors
government, critical-infrastructure, financial, defense, healthcare, energy, maritime, transportation, non-profit, technology
Target regions
North America, Middle East, Europe, Israel, United States, Jordan, Egypt, UAE, Portugal
Detection rules
9
Indicators of compromise
27

Malware and tooling in Laravel Livewire Unauthenticated RCE via Synthesizer

Malware and tooling: Fakeset, Tsundere Botnet - S9034, ArenaC2, KeyC2, Livepyre, Neo-reGeorg, PersianC2, Rclone - S1040

Critical unauthenticated remote code execution vulnerability in Laravel Livewire v3 (CVE-2025-54068, CVSS 9.8) exploited via synthesizer smuggling during property update hydration. Actively exploited by Iran-linked MuddyWater (MOIS) targeting government, critical infrastructure, and defense sectors. Added to CISA KEV on March 20, 2026 with April 3, 2026 remediation deadline.

How Laravel Livewire Unauthenticated RCE via Synthesizer works

CVE-2025-54068 is a critical code injection vulnerability in Laravel Livewire v3 that enables unauthenticated remote command execution through the framework's hydration mechanism. The vulnerability affects Livewire versions 3.0.0-beta.1 through 3.6.3, impacting an estimated 130,000+ applications and potentially millions of Laravel deployments. Livewire has been downloaded over 64 million times, and 1,754 packages depend on it, including Filament (18 million installations).

The root cause lies in HandleComponents.php, specifically in the hydrateForUpdate function. When component properties are updated via HTTP POST requests to the /livewire/update endpoint, the framework processes property updates through a hydration pipeline that synchronizes client-side state with server-side properties. The vulnerability exploits the recursive nature of this hydration process: when the raw snapshot data contains a synthesizer marker, Livewire calls the hydrate function on the new user-controlled value using that same synthesizer context, without proper validation of synthesizer types.

The attack technique, dubbed "synthesizer smuggling," works by nesting malicious synthesizers inside arrays within the updates field of Livewire requests. Since hydration is recursive, each nested array element undergoes independent validation. Attackers send a property update as an empty array, triggering automatic conversion to a synthetic tuple format. The recursive processor then handles each nested child independently, allowing the original snapshot's synthesizer metadata to apply to attacker-controlled values. This enables arbitrary class instantiation with attacker-supplied constructor parameters.

The exploit chains multiple synthesizers: CollectionSynth (clctn) allows instantiating arbitrary classes with array constructor parameters; FormObjectSynth (form) instantiates form objects and sets public properties directly; and ModelSynth (mdl) creates model instances without authentication. The proof-of-concept chains three phases: (1) function execution via GuzzleHttp\Psr7\FnStream with dynamic __toString binding, (2) RCE via Laravel\SerializableClosure\Serializers\Signed with controlled __invoke executing call_user_func_array(), chaining to Illuminate\Bus\Queueable dispatchNextJobInChain() which calls unserialize() on attacker-controlled data using a Laravel/RCE4Adapted gadget chain, and (3) clean exit via Laravel\Prompts\Terminal::exit().

Critically, the vulnerability entirely bypasses the APP_KEY checksum protection mechanism. Exploitation requires only knowledge of the target URL and component structure — no authentication, no user interaction, and no APP_KEY knowledge. Synacktiv released Livepyre, an automated exploitation tool that detects vulnerability presence and deploys payloads with or without APP_KEY knowledge.

Active exploitation has been attributed to MuddyWater (also known as Seedworm, Boggy Serpens, Static Kitten, Mercury, Mango Sandstorm), an Iranian state-sponsored group operating as a subordinate element of Iran's Ministry of Intelligence and Security (MOIS). The campaign began in early February 2026, with escalated activity following U.S. and Israeli military strikes on Iran. MuddyWater has deployed multiple custom C2 frameworks (KeyC2, PersianC2, ArenaC2) and novel malware including the Dindoor backdoor (leveraging Deno JavaScript runtime) and Fakeset (Python backdoor). Targets span government agencies, critical infrastructure, financial institutions, airports, defense supply chains, and non-profit organizations across the United States, Israel, Jordan, Egypt, UAE, and Portugal.

CISA added CVE-2025-54068 to the Known Exploited Vulnerabilities catalog on March 20, 2026, alongside CVE-2025-31277 (Apple WebKit), CVE-2025-43510 (Apple kernel), CVE-2025-43520 (Apple kernel), and CVE-2025-32432 (Craft CMS, CVSS 10.0). Federal agencies must remediate by April 3, 2026. The EPSS score of 48.851% places this vulnerability in the 98th percentile for exploitation probability.

MITRE ATT&CK techniques used in TL-2026-0265

collection

T1005 Data from Local System

defense-evasion

T1027 Obfuscated Files or Information; T1070 Indicator Removal

exfiltration

T1041 Exfiltration Over C2 Channel; T1567 Exfiltration Over Web Service

discovery

T1046 Network Service Discovery

execution

T1059 Command and Scripting Interpreter; T1203 Exploitation for Client Execution

privilege-escalation

T1068 Exploitation for Privilege Escalation

command-and-control

T1071 Application Layer Protocol; T1090 Proxy; T1095 Non-Application Layer Protocol; T1102 Web Service; T1573 Encrypted Channel

credential-access

T1110 Brute Force

persistence

T1136 Create Account; T1505 Server Software Component; T1547 Boot or Logon Autostart Execution

initial-access

T1190 Exploit Public-Facing Application

lateral-movement

T1210 Exploitation of Remote Services

impact

T1565 Data Manipulation

resource-development

T1587 Develop Capabilities

reconnaissance

T1595 Active Scanning

Affected products and versions in Laravel Livewire Unauthenticated RCE via Synthesizer

  • Livewire (Laravel) — Livewire
    Vulnerable versions: 3.0.0-beta.1 through 3.6.3
    Fixed in: 3.6.4
  • Filament — Filament (depends on Livewire)
    Vulnerable versions: All versions using Livewire < 3.6.4
    Fixed in: Versions updated to Livewire >= 3.6.4

Remediation for Laravel Livewire Unauthenticated RCE via Synthesizer

Patches

  • Livewire 3.6.4 — patches hydrateForUpdate() to preserve original snapshot raw context during recursive hydration
  • Composer: composer require livewire/livewire:^3.6.4

Immediate actions

  • Upgrade Laravel Livewire to version 3.6.4 or later immediately
  • Block or rate-limit POST requests to /livewire/update endpoints at WAF level
  • Monitor web server logs for unusual POST requests to /livewire/update with nested array structures
  • Block known MuddyWater C2 infrastructure IPs at network perimeter: 162.0.230.185, 185.236.25.119, 193.17.183.126

Workarounds

  • No official workaround exists — upgrade is the only reliable defense
  • Temporary mitigation: restrict access to /livewire/update endpoint via network controls
  • Audit and enforce strict property types on all mounted Livewire components

Longer-term hardening

  • Enforce strict typing on all Livewire component properties to prevent type juggling
  • Protect APP_KEY as critical infrastructure credential — rotate if exposure suspected
  • Deploy EDR with behavioral detection for PHP deserialization gadget chains
  • Implement network segmentation to limit lateral movement from compromised web servers
  • Deploy web application firewall rules targeting serialized PHP object injection patterns
  • Monitor for Deno runtime execution and unusual JavaScript runtime processes on servers

CVEs associated with Laravel Livewire Unauthenticated RCE via Synthesizer

CVE-2025-54068

Weaknesses (CWE) in Laravel Livewire Unauthenticated RCE via Synthesizer

CWE-94

Timeline of Laravel Livewire Unauthenticated RCE via Synthesizer

  • GitHub Security Advisory GHSA-29cq-5w36-x7w3 published. Credited researchers remsio-syn and worty-syn (Synacktiv) as finders.
  • CVE-2025-54068 publicly disclosed. Livewire 3.6.4 patch released fixing hydrateForUpdate() to preserve original snapshot raw context during recursive hydration.
  • Synacktiv publishes detailed technical writeup of synthesizer smuggling technique and releases Livepyre automated exploitation tool.
  • MuddyWater (Iran/MOIS) campaign begins targeting government and critical infrastructure organizations using CVE-2025-54068 among other vulnerabilities.
  • PersianC2 command execution logged in MuddyWater infrastructure. Active operations confirmed across multiple target countries.
  • Broadcom Symantec and Carbon Black teams report MuddyWater deploying Dindoor backdoor (Deno-based) and Fakeset (Python) against U.S. banks, airports, and non-profits.
  • Ctrl-Alt-Intel publishes comprehensive MuddyWater research exposing 3+ custom C2 frameworks (KeyC2, PersianC2, ArenaC2), Tsundere Botnet, and multi-country targeting including Laravel exploitation.
  • CISA adds CVE-2025-54068 to Known Exploited Vulnerabilities catalog alongside Apple and Craft CMS vulnerabilities. Federal remediation deadline set for April 3, 2026.
  • Active exploitation by MuddyWater confirmed by multiple threat intelligence sources. EPSS score at 48.851% (98th percentile). Palo Alto Unit 42 documents targeting of diplomatic and critical infrastructure in Middle East.
  • As of 2026-05-29, CVE-2025-54068 is patched in Livewire 3.6.4 but remains on CISA KEV with confirmed active exploitation, public exploit tooling, and lagging adoption across 130k+ apps. The Iran-linked MuddyWater (MOIS) actor is still operating in 2026, weaponizing this CVE against critical sectors, so the operational threat is ongoing.

Sources cited for Laravel Livewire Unauthenticated RCE via Synthesizer

Threats related to Laravel Livewire Unauthenticated RCE via Synthesizer

Detection coverage for TL-2026-0265

As of 2026-03-21, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0265 across Splunk SPL, Microsoft KQL and Sigma, covering 27 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats