KEV Entry

CVE-2017-9841

Known Exploited Vulnerability Entry SiberKapan

Confirmed Exploited

Vulnerability ID

Status Updated At

2026-11-07 13:23 UTC

First Seen At

2026-08-09

Last Seen At

2026-11-06

Notes

Observed on SiberKapan honeypot and production web server sensors located in Turkey. Regions reflect sensor coverage, not global exclusivity.

{'id': 'CVE-2017-9841', 'url': 'https://nvd.nist.gov/vuln/detail/CVE-2017-9841'}
{'id': 'CVE-2017-9841', 'url': 'https://siberkapan.org/kev-catalog'}

Entry UUID

137e673c-536f-411c-866d-b2ca761c998f

Catalog

SiberKapan
fc16d4f5-594d-5807-9bf1-71af4407c589

Created

2026-11-07 18:25 UTC

Last Updated

2026-11-07 18:25 UTC

Type	Source	Signal	Confidence	Details	GCVE Metadata
honeypot	SiberKapan	in_the_wild_attempts	0.80	View details `{ "attempts_90d": 322, "description": "PHPUnit eval-stdin RCE", "distinct_source_ips_90d": 163, "sensor_types": [ "nginx" ], "signature_strength": "strong", "successful_exploitation": false }`	-