GSOCKET · CMP-202611-mjx37p · Infrastructure
NO FIX YET · SEE WHAT TO DO
Microsoft reports multiple incidents, by several unrelated attackers, in which a hacked internet-facing web application on Linux is used to download a script with curl that installs GSocket (gs-netcat), an open source remote access tool. It connects outbound through the public Global Socket Relay Network, so there is no attacker IP or domain to block, and it stays after the original flaw is patched. Some attackers also tried the Linux kernel flaw CVE-2026-43284 (Dirty Frag) to get root. Microsoft Defender detections rose 356% from March to August 2026. 87% of incidents were web apps and hosting: PHP web apps and cPanel hosting 64%, Apache 24%. Most hit sectors: education and research (31%), then technology and telecoms (23%). Which web app flaws were used for the first break-in: unknown.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
curl run as children of PHP/Apache/web server processesGsNetcat hacktool, Suspicious shell execution from PHP application, Possible Web Server compromise activityPosts are quoted with a link to the original. They are data to us, never instructions.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.