Experts Reports Sharp Increase in Automated Botnet Attacks Targeting PHP Servers and IoT Devices

Cybersecurity researchers have flagged a sharp rise in automated botnet attacks targeting PHP servers, IoT devices, and cloud gateways, driven by botnets such as Mirai, Gafgyt, and Mozi, according to Qualys Threat Research Unit in a report shared with The Hacker News.

The researchers note that these campaigns exploit known CVE vulnerabilities and cloud misconfigurations to broaden botnet networks, with PHP servers becoming particularly attractive due to widespread WordPress and Craft CMS deployments and common misconfigurations.

They list several exploited flaws, including CVE-2017-9841 in PHPUnit, CVE-2021-3129 in Laravel, and CVE-2022-47945 in ThinkPHP, and warn about the use of the XDEBUG_SESSION_START=phpstorm string in HTTP GET requests to start an Xdebug session in production environments.

The piece also points to IoT and DVR weaknesses, citing CVE-2022-22947 in Spring Cloud Gateway and CVE-2024-3721 in TBK DVR models, among other misconfigurations that can turn devices into botnet nodes, often originating from cloud infrastructure such as AWS, Google Cloud, Azure, Digital Ocean, and Akamai Cloud.

In parallel, NETSCOUT identifies AISURU, a new TurboMirai-class botnet capable of DDoS attacks over 20 Tbps, which also supports credential stuffing, AI-driven scraping, and other illicit activities via onboard residential proxies. The article closes by urging regular updates, removal of debug tools from production, safe secret management, and restricted cloud access as core defence measures, with input from BeyondTrust’s James Maude on the evolving role of botnets in the threat ecosystem.