Laravel Livewire Unauthenticated RCE via Synthesizer Smuggling — MuddyWater Active Exploitation (CVE-2025-54068)
Laravel Livewire Unauthenticated RCE via Synthesizer (TL-2026-0265), also tracked as GHSA-29cq-5w36-x7w3, is a critical-severity software vulnerability scored CVSS 9.8, first published 2026-03-21. It is attributed to MuddyWater (Iran) with high confidence, affects Livewire (Laravel) Livewire, references 1 CVE (CVE-2025-54068), maps to 23 MITRE ATT&CK techniques (T1005, T1027, T1041), and is covered by 9 detection rules and 27 indicators of compromise.
Key facts for TL-2026-0265
- Threat ID
- TL-2026-0265
- Also known as
- GHSA-29cq-5w36-x7w3
- Severity
- CRITICAL
- CVSS
- 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
- Status
- MONITORING
- Category
- VULNERABILITY
- First published
- 2026-03-21
- Last reviewed
- 2026-03-21
- Attribution
- MuddyWater
- Attribution confidence
- HIGH
- Nation-state nexus
- Iran
- Motivation
- ESPIONAGE
- Target sectors
- government, critical-infrastructure, financial, defense, healthcare, energy, maritime, transportation, non-profit, technology
- Target regions
- North America, Middle East, Europe, Israel, United States, Jordan, Egypt, UAE, Portugal
- Detection rules
- 9
- Indicators of compromise
- 27
Malware and tooling in Laravel Livewire Unauthenticated RCE via Synthesizer
Malware and tooling: Fakeset, Tsundere Botnet - S9034, ArenaC2, KeyC2, Livepyre, Neo-reGeorg, PersianC2, Rclone - S1040
Critical unauthenticated remote code execution vulnerability in Laravel Livewire v3 (CVE-2025-54068, CVSS 9.8) exploited via synthesizer smuggling during property update hydration. Actively exploited by Iran-linked MuddyWater (MOIS) targeting government, critical infrastructure, and defense sectors. Added to CISA KEV on March 20, 2026 with April 3, 2026 remediation deadline.
How Laravel Livewire Unauthenticated RCE via Synthesizer works
CVE-2025-54068 is a critical code injection vulnerability in Laravel Livewire v3 that enables unauthenticated remote command execution through the framework's hydration mechanism. The vulnerability affects Livewire versions 3.0.0-beta.1 through 3.6.3, impacting an estimated 130,000+ applications and potentially millions of Laravel deployments. Livewire has been downloaded over 64 million times, and 1,754 packages depend on it, including Filament (18 million installations).
The root cause lies in HandleComponents.php, specifically in the hydrateForUpdate function. When component properties are updated via HTTP POST requests to the /livewire/update endpoint, the framework processes property updates through a hydration pipeline that synchronizes client-side state with server-side properties. The vulnerability exploits the recursive nature of this hydration process: when the raw snapshot data contains a synthesizer marker, Livewire calls the hydrate function on the new user-controlled value using that same synthesizer context, without proper validation of synthesizer types.
The attack technique, dubbed "synthesizer smuggling," works by nesting malicious synthesizers inside arrays within the updates field of Livewire requests. Since hydration is recursive, each nested array element undergoes independent validation. Attackers send a property update as an empty array, triggering automatic conversion to a synthetic tuple format. The recursive processor then handles each nested child independently, allowing the original snapshot's synthesizer metadata to apply to attacker-controlled values. This enables arbitrary class instantiation with attacker-supplied constructor parameters.
The exploit chains multiple synthesizers: CollectionSynth (clctn) allows instantiating arbitrary classes with array constructor parameters; FormObjectSynth (form) instantiates form objects and sets public properties directly; and ModelSynth (mdl) creates model instances without authentication. The proof-of-concept chains three phases: (1) function execution via GuzzleHttp\Psr7\FnStream with dynamic __toString binding, (2) RCE via Laravel\SerializableClosure\Serializers\Signed with controlled __invoke executing call_user_func_array(), chaining to Illuminate\Bus\Queueable dispatchNextJobInChain() which calls unserialize() on attacker-controlled data using a Laravel/RCE4Adapted gadget chain, and (3) clean exit via Laravel\Prompts\Terminal::exit().
Critically, the vulnerability entirely bypasses the APP_KEY checksum protection mechanism. Exploitation requires only knowledge of the target URL and component structure — no authentication, no user interaction, and no APP_KEY knowledge. Synacktiv released Livepyre, an automated exploitation tool that detects vulnerability presence and deploys payloads with or without APP_KEY knowledge.
Active exploitation has been attributed to MuddyWater (also known as Seedworm, Boggy Serpens, Static Kitten, Mercury, Mango Sandstorm), an Iranian state-sponsored group operating as a subordinate element of Iran's Ministry of Intelligence and Security (MOIS). The campaign began in early February 2026, with escalated activity following U.S. and Israeli military strikes on Iran. MuddyWater has deployed multiple custom C2 frameworks (KeyC2, PersianC2, ArenaC2) and novel malware including the Dindoor backdoor (leveraging Deno JavaScript runtime) and Fakeset (Python backdoor). Targets span government agencies, critical infrastructure, financial institutions, airports, defense supply chains, and non-profit organizations across the United States, Israel, Jordan, Egypt, UAE, and Portugal.
CISA added CVE-2025-54068 to the Known Exploited Vulnerabilities catalog on March 20, 2026, alongside CVE-2025-31277 (Apple WebKit), CVE-2025-43510 (Apple kernel), CVE-2025-43520 (Apple kernel), and CVE-2025-32432 (Craft CMS, CVSS 10.0). Federal agencies must remediate by April 3, 2026. The EPSS score of 48.851% places this vulnerability in the 98th percentile for exploitation probability.
MITRE ATT&CK techniques used in TL-2026-0265
collection
defense-evasion
T1027 Obfuscated Files or Information; T1070 Indicator Removal
exfiltration
T1041 Exfiltration Over C2 Channel; T1567 Exfiltration Over Web Service
discovery
T1046 Network Service Discovery
execution
T1059 Command and Scripting Interpreter; T1203 Exploitation for Client Execution
privilege-escalation
T1068 Exploitation for Privilege Escalation
command-and-control
T1071 Application Layer Protocol; T1090 Proxy; T1095 Non-Application Layer Protocol; T1102 Web Service; T1573 Encrypted Channel
credential-access
persistence
T1136 Create Account; T1505 Server Software Component; T1547 Boot or Logon Autostart Execution
initial-access
T1190 Exploit Public-Facing Application
lateral-movement
T1210 Exploitation of Remote Services
impact
resource-development
reconnaissance
Affected products and versions in Laravel Livewire Unauthenticated RCE via Synthesizer
- Livewire (Laravel) — Livewire
Vulnerable versions: 3.0.0-beta.1 through 3.6.3
Fixed in: 3.6.4 - Filament — Filament (depends on Livewire)
Vulnerable versions: All versions using Livewire < 3.6.4
Fixed in: Versions updated to Livewire >= 3.6.4
Remediation for Laravel Livewire Unauthenticated RCE via Synthesizer
Patches
- Livewire 3.6.4 — patches hydrateForUpdate() to preserve original snapshot raw context during recursive hydration
- Composer: composer require livewire/livewire:^3.6.4
Immediate actions
- Upgrade Laravel Livewire to version 3.6.4 or later immediately
- Block or rate-limit POST requests to /livewire/update endpoints at WAF level
- Monitor web server logs for unusual POST requests to /livewire/update with nested array structures
- Block known MuddyWater C2 infrastructure IPs at network perimeter: 162.0.230.185, 185.236.25.119, 193.17.183.126
Workarounds
- No official workaround exists — upgrade is the only reliable defense
- Temporary mitigation: restrict access to /livewire/update endpoint via network controls
- Audit and enforce strict property types on all mounted Livewire components
Longer-term hardening
- Enforce strict typing on all Livewire component properties to prevent type juggling
- Protect APP_KEY as critical infrastructure credential — rotate if exposure suspected
- Deploy EDR with behavioral detection for PHP deserialization gadget chains
- Implement network segmentation to limit lateral movement from compromised web servers
- Deploy web application firewall rules targeting serialized PHP object injection patterns
- Monitor for Deno runtime execution and unusual JavaScript runtime processes on servers
CVEs associated with Laravel Livewire Unauthenticated RCE via Synthesizer
Weaknesses (CWE) in Laravel Livewire Unauthenticated RCE via Synthesizer
CWE-94
Timeline of Laravel Livewire Unauthenticated RCE via Synthesizer
- GitHub Security Advisory GHSA-29cq-5w36-x7w3 published. Credited researchers remsio-syn and worty-syn (Synacktiv) as finders.
- CVE-2025-54068 publicly disclosed. Livewire 3.6.4 patch released fixing hydrateForUpdate() to preserve original snapshot raw context during recursive hydration.
- Synacktiv publishes detailed technical writeup of synthesizer smuggling technique and releases Livepyre automated exploitation tool.
- MuddyWater (Iran/MOIS) campaign begins targeting government and critical infrastructure organizations using CVE-2025-54068 among other vulnerabilities.
- PersianC2 command execution logged in MuddyWater infrastructure. Active operations confirmed across multiple target countries.
- Broadcom Symantec and Carbon Black teams report MuddyWater deploying Dindoor backdoor (Deno-based) and Fakeset (Python) against U.S. banks, airports, and non-profits.
- Ctrl-Alt-Intel publishes comprehensive MuddyWater research exposing 3+ custom C2 frameworks (KeyC2, PersianC2, ArenaC2), Tsundere Botnet, and multi-country targeting including Laravel exploitation.
- CISA adds CVE-2025-54068 to Known Exploited Vulnerabilities catalog alongside Apple and Craft CMS vulnerabilities. Federal remediation deadline set for April 3, 2026.
- Active exploitation by MuddyWater confirmed by multiple threat intelligence sources. EPSS score at 48.851% (98th percentile). Palo Alto Unit 42 documents targeting of diplomatic and critical infrastructure in Middle East.
- As of 2026-05-29, CVE-2025-54068 is patched in Livewire 3.6.4 but remains on CISA KEV with confirmed active exploitation, public exploit tooling, and lagging adoption across 130k+ apps. The Iran-linked MuddyWater (MOIS) actor is still operating in 2026, weaponizing this CVE against critical sectors, so the operational threat is ongoing.
Sources cited for Laravel Livewire Unauthenticated RCE via Synthesizer
- CISA KEV - CVE-2025-54068 Added March 20, 2026
- GitHub Security Advisory GHSA-29cq-5w36-x7w3
- Livewire Security Advisory — Remote Command Execution
- NVD - CVE-2025-54068
- Synacktiv — Livewire Remote Command Execution Through Unmarshaling
- Ctrl-Alt-Intel — MuddyWater Exposed: Inside an Iranian APT Operation
- The Hacker News — CISA Flags Apple, Craft CMS, Laravel Bugs in KEV
- The Hacker News — Iran-Linked MuddyWater Hackers Target U.S. Networks With Dindoor Backdoor
- SecurityOnline — Critical Livewire RCE Threatens Millions of Laravel Apps
- SecurityOnline — PoC Released for Critical Livewire RCE
- SentinelOne — CVE-2025-54068 Vulnerability Database Entry
- Wiz — CVE-2025-54068 Impact, Exploitability, and Mitigation
- SecuringLaravel — Livewire v3 RCE Security Notice
- Help Net Security — Iran-linked APT Targets US Critical Sectors With New Backdoors
- SOCRadar — Iranian APT MuddyWater Uses Dindoor Malware
Threats related to Laravel Livewire Unauthenticated RCE via Synthesizer
- Boggy Serpens (MuddyWater) AI-Enhanced Cyberespionage Campaign Deploying Nuso, LampoRAT, BlackBeard, Phoenix, and UDPGangster Malware
- APT35 (Charming Kitten) GCC Pre-Positioning Cyber Reconnaissance Campaign Enabling Kinetic Targeting
- Iranian APT MuddyWater (Seedworm) Deploys Novel Dindoor & Fakeset Backdoors Against U.S. Critical Infrastructure
- Seedworm (MuddyWater) Iranian MOIS APT Deploys Dindoor and Fakeset Backdoors Against U.S. Bank, Airport, and Defense Software Company
- Iranian MOIS Actors Leveraging Cybercrime Ecosystem — Void Manticore & MuddyWater Campaign
- Iranian State-Aligned Global Cyber Operations Surge Amid Iran Conflict (MuddyWater/Seedworm Dindoor & Fakeset Campaign)
Detection coverage for TL-2026-0265
As of 2026-03-21, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0265 across Splunk SPL, Microsoft KQL and Sigma, covering 27 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.