CVE-2019-9082Vulnerability
ThinkPHP Remote Code Execution Vulnerability
Exploited in the wildCISA added it to its Known Exploited Vulnerabilities list on .
Reported by 2 independent sources · first reported by GreyNoise · last reported
Last reported 4 months ago
CISA KEVAdded 3 Nov 2021
Fix due 3 May 2022
Used by ransomware: not knownCISA KEV catalogue
Fix due 3 May 2022
Used by ransomware: not knownCISA KEV catalogue
EPSS97.4%
higher than 99% of CVEsFIRST EPSS, as of 15 Oct 2026
higher than 99% of CVEsFIRST EPSS, as of 15 Oct 2026
What the reports say
2 reports, newest first · the exact sentence from each-
Bulbature, beneath the waves of GobRAT“[ok]【CVE-2019-9082】Thinkphp5.txt2024-07-05355,149”
-
PHP Cryptomining Campaign: October/November 2025“Older chains (ThinkPHP Code Execution CVE-2019-9082, PHPUnit RCE) still produce meaningful volume—roughly 50–150 attempts per day—and the network graph implies these campaigns aren’t independent: they share infrastructure and tools, pointing to coordination or communal tooling.”
Indicators reported together
named in the same reports- 38.60.221[.]63in 1 report
- 38.60.221[.]174in 1 report
- 38.60.223[.]51in 1 report
- 38.60.223[.]81in 1 report
- nbt201.dynamic-dns[.]netin 1 report
- eyh.ocry[.]comin 1 report
- af4ad0bd9221ffc63ae5acff4034834ain 1 report
- hxxps://38.54.85[.]21:52208/in 1 report
- 38.54.85[.]21in 1 report
- hxxps://38.60.221[.]145/static/in 1 report
- 38.60.221[.]145in 1 report
Copy these 11 indicators · defanged
Also named with it: CVE-2024-4577, CVE-2019-13956, CVE-2017-5638, CVE-2022-47945, CVE-2012-1823
Thanks — we review every report.