Reported by 5 outlets
Pakistani IP Chains CVE-2017-9841 and CVE-2021-41773 in Active Exploitation
Why this score
- Breadth
- 2.00 / 2.0 · 5 sources
- Authority
- 1.00 / 2.0 · best outlet weight
- Severity
- 5.00 / 5.0 · CVSS + KEV signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.00 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Desk analysis
Pakistani IP chains CVE-2017-9841 (Realtek Jungle SDK command injection) and CVE-2021-41773 (Apache path traversal) in active exploitation. The combination targets embedded routers and exposed web servers. Prioritize patching both CVEs in exposed infrastructure; review access logs from Pakistani IP ranges.
Timeline
-
original reporting
Spy IP of the Day: The Tinkerer from Lahore (165.99.207.153) Chaining CVE-2017-9841 and CVE-2021-41773
cyberveille.ch · 28d ago · September 15th, 2026
Spy IP of the day. "The Tinkerer from Lahore" (165.99.207.153 / AS45773, PK). Specialties: CVE-2021-41773 + 42013 (Apache path traversal), CVE-2017-9841 (PHPUnit RCE). Observed chaining these vulnerabilities in active exploitation campaigns.
via Mastodon https://cyberveille.ch/map/
-
update from imperva.com
The Resurrection of PHPUnit RCE Vulnerability (CVE-2017-9841)
imperva.com · 2430d ago · February 18th, 2020
Imperva reported on June 27, 2017 disclosure of CVE-2017-9841, a remote code execution vulnerability in PHPUnit before 4.8.28 and 5.x before 5.6.3 via eval-stdin.php. The study observed around nine million attack attempts through 2020, with campaigns such as sssp.php and traber targeting CMS modules that embed PHPUnit in production.
-
update from cve.org
CVE-2021-41773 CVE Record
cve.org · 1835d ago · October 5th, 2021
The CVE record for CVE-2021-41773 documents the Apache HTTP Server 2.4.49 path traversal vulnerability introduced by a change in path normalization, allowing attackers to map URLs outside the document root and, with mod_cgi enabled, achieve remote code execution.
-
update from blog.cloudflare.com
Helping Apache Servers Stay Safe From Zero-Day Path Traversal Attacks
blog.cloudflare.com · 1832d ago · October 8th, 2021
Cloudflare reported that on September 29, 2021, the Apache Security team was alerted to a path traversal vulnerability actively exploited in the wild (zero-day) against Apache HTTP Server 2.4.49, with exploitation observed before the official advisory.
-
update from blog.qualys.com
Apache HTTP Server Path Traversal & Remote Code Execution (CVE-2021-41773 & CVE-2021-42013)
blog.qualys.com · 1813d ago · October 27th, 2021
Qualys analyzed the Apache HTTP Server 2.4.49 path traversal and RCE flaw disclosed October 4, 2021. The vulnerability allows arbitrary file read and remote command execution when path normalization is bypassed and the server runs a non-default directory directive (Require all granted) with mod_cgi enabled. Fix is upgrade to 2.4.51 or greater.
-
update from cyberveille.ch
🕵️ IP of the day 🕵️ Profile: "The Path Traversal Tourist from Singapore" 📍 47.236.173.77 | AS45102 (Alibaba) 🎯 3 strikes: CVE-2017-9841 + CVE-2021-41773 + CVE-2021-42013
cyberveille.ch · 32d ago · September 11th, 2026
🕵️ IP of the day 🕵️ Profile: "The Path Traversal Tourist from Singapore" 📍 47.236.173.77 | AS45102 (Alibaba) 🎯 3 strikes: CVE-2017-9841 + CVE-2021-41773 + CVE-2021-42013
via Mastodon https://cyberveille.ch/map/
-
update from cyberveille.ch
IP of the day: The PHP Probe from Taipei. 213.209.159.154 | AS208137 (Feo Prest SRL). Target: 6 attempts: /.env, phpunit eval-stdin
cyberveille.ch · 31d ago · September 12th, 2026
IP of the day: The PHP Probe from Taipei. 213.209.159.154 | AS208137 (Feo Prest SRL).
-
update from cyberveille.ch
IP of the day: The Ho Chi Minh City Path Traversal Tourist at 160.250.132.238 (EZ Technology, AS150895) chaining CVE-2017-9841 and CVE-2021-41773
cyberveille.ch · 29d ago · September 14th, 2026
🕵️ 𝗜𝗣 𝗰𝗵𝗲𝗹𝗼𝘂 𝗱𝘂 𝗷𝗼𝘂𝗿 🕵️ Fiche : "Le Traverseur de Répertoires de Hô Chi Minh" 📍 160.250.132.238 | 🇻🇳 EZ Technology (AS150895) ⚔️ CVE-2021-41
via Mastodon https://cyberveille.ch/map/
-
update from cyberveille.ch
Spy IP: Oracle Cloud IP chains ThinkPHP, PHPUnit, and CVE-2021-41773 exploits
cyberveille.ch · 27d ago · September 16th, 2026
Profile: "The Oracle Consultant from Singapore" at 138.2.102.66 (AS31898, Oracle Cloud). Target: 5 attack chains including ThinkPHP, PHPUnit exploits, and CVE-2021-41773 (Apache path traversal). The IP chains multiple known vulnerabilities in active exploitation campaigns, targeting exposed services on Oracle Cloud infrastructure.
-
update from cyberveille.ch
IP of the day. The Double-Encoder from Singapore: 194.233.84.90 | AS141995 Contabo Asia chaining CVE-2021-41773 & 42013 (Apache path traversal)
cyberveille.ch · 23d ago · September 20th, 2026
Fiche: "The Double-Encoder from Singapore" 194.233.84.90 | AS141995 Contabo Asia.
-
update from cyberveille.ch
Investigative profile: The Double Encoder from Singapore (IP 45.78.224.85, AS150436 Byteplus) linked to CVE-2017-9841 and CVE-2021-41773 exploitation chain
cyberveille.ch · 12d ago · October 1st, 2026
Investigative profile: "Le Double-Encodeur de Singapour" (The Double Encoder from Singapore). IP 45.78.224.85 | AS150436 (Byteplus).
-
update from cyberveille.ch
IP of the Day: 'The Directory Traverser from Uzbekistan' — 89.126.211.166 (Uzbektelekom) chaining CVE-2017-9841
cyberveille.ch · 10d ago · October 3rd, 2026
IP of the Day file: 'The Directory Traverser from Uzbekistan' — 89.126.211.166, AS202660 (Uzbektelekom). Monitor this IP in your logs and block if seen in scan traffic.
-
mentioned by cyberveille.ch
IP of the day: The Path Traversal Tourist from Singapore
cyberveille.ch · 9d ago · October 4th, 2026