Coordinated Cryptojacking Blitz: Hackers Exploit ThinkPHP and PHP RCE Flaws to Maximize Mining Profit

Analysts at GreyNoise Intelligence have reported a sharp, coordinated surge in attacks exploiting ThinkPHP, PHPUnit and PHP RCE flaws as cybercriminals rush to deploy cryptominers ahead of a high-profit window driven by rising cryptocurrency prices, according to GreyNoise. From August through October 2025, there was a clear ramp-up in exploitation attempts against PHP and PHP-based frameworks, with seven distinct attack patterns running in parallel and a spike in activity into October and November.

The most active campaigns exploit ThinkPHP Framework LFI (CVE-2022-47945), PHP CGI (CVE-2012-1823), and PHP CVE-2024-4577, while legacy exploits like ThinkPHP Code Execution (CVE-2019-9082) and PHPUnit RCE continue to appear, indicating ongoing volume from older chains.

The report notes cloud providers dominate attacker IPs—Cloudflare (1,000 IPs), DigitalOcean (688), Google (536), and Contabo (512)—with about one-third of attacking IPs tied to the top 21 organisations, reflecting the use of rented or compromised infrastructure for mining at scale. Attacks are global, with hosts traced to Germany, Taiwan, China (Volcano Engine, Huawei, Alibaba), and North America, and the timing aligns with Bitcoin’s price surge above $110,000 and a market cap of about $3.71 trillion.