Attackers have weaponized a critical zero-day vulnerability in KnowledgeDeliver learning management systems to deploy Godzilla web shells. The exploit grants unauthorized remote access to affected servers.
Security researchers identified active exploitation of a previously unknown vulnerability in KnowledgeDeliver, a widely-used LMS platform. Threat actors leveraged the flaw to install Godzilla web shells—malicious tools that enable persistent remote code execution and administrative control over compromised systems.
The vulnerability affects servers running unpatched versions of KnowledgeDeliver. Once exploited, attackers gain the ability to execute arbitrary commands, exfiltrate data, and maintain long-term access to educational institutions and corporate learning environments.
Godzilla is a sophisticated web shell framework known for obfuscated functionality and evasion capabilities. Its deployment signals a targeted attack rather than opportunistic scanning, suggesting threat actors are actively hunting for vulnerable KnowledgeDeliver instances.
Affected organizations should immediately identify systems running KnowledgeDeliver and implement available patches. Network defenders should monitor for suspicious web traffic, unusual process execution from web server processes, and unexpected file uploads in web root directories.
KnowledgeDeliver has not yet released a public statement. Security teams recommend isolating affected servers from production networks pending vendor guidance, reviewing access logs for signs of compromise dating back to initial vulnerability discovery, and implementing web application firewalls to restrict administrative access.
The zero-day highlights ongoing risks in educational technology infrastructure. Learning management systems often contain sensitive student and institutional data, making them valuable targets for data theft and credential harvesting campaigns.
A newly launched dark web marketplace is selling digital scans of over 153 million driver's licenses from U.S. and Canadian residents. The FBI's New Orleans field office has opened an investigation into the breach, which appears to originate from a Louisiana-based identity verification company.
Five Venezuelan nationals have pleaded guilty to conducting ATM jackpotting attacks across the United States, using malware to extract cash from automated teller machines.
Hackers infiltrated thousands of Dropbox accounts last month, accessing and downloading user files stored on the cloud platform. The company confirmed the breach in a statement reviewed by Bloomberg News.
Threat actors are leveraging the legitimate Faronics Deploy endpoint-management platform to gain administrative control over targeted computers and install ScreenConnect remote support software.