---
id: "CMP-202611-mjx37p"
page: "https://infrastack.ai/live/CMP-202611-mjx37p"
kind: "campaign"
aliases: []
title: "Attackers break into Linux web servers (PHP, cPanel, Apache) and install GSocket, a relay-based remote access tool that keeps them in after the hole is patched (Microsoft)"
severity: "high"
cvss: null
epss: null
exploited: true
status: "open"
category: "infrastructure"
products: [{"name": "GSocket", "fixed": []}, {"name": "cPanel", "fixed": []}, {"name": "Apache HTTP Server", "fixed": []}, {"name": "PHP", "fixed": []}, {"name": "Linux kernel", "fixed": []}]
ecosystems: []
tags: ["campaign", "early-warning"]
not_affected_if: []
published_at: null
first_seen_at: "2026-11-11T20:44:07+00:00"
updated_at: "2026-11-11T20:45:46+00:00"
sources: [{"source": "analyst", "url": "https://www.microsoft.com/en-us/security/blog/", "first_seen_at": "2026-11-11T20:44:07+00:00", "cites": ["https://www.microsoft.com/en-us/security/blog/"]}]
exploit_sources: []
---

# Attackers break into Linux web servers (PHP, cPanel, Apache) and install GSocket, a relay-based remote access tool that keeps them in after the hole is patched (Microsoft)

Link for people: https://infrastack.ai/live/CMP-202611-mjx37p (this .md is for agents)

Microsoft reports multiple incidents, by several unrelated attackers, in which a hacked internet-facing web application on Linux is used to download a script with curl that installs GSocket (gs-netcat), an open source remote access tool. It connects outbound through the public Global Socket Relay Network, so there is no attacker IP or domain to block, and it stays after the original flaw is patched. Some attackers also tried the Linux kernel flaw CVE-2026-43284 (Dirty Frag) to get root. Microsoft Defender detections rose 356% from March to August 2026. 87% of incidents were web apps and hosting: PHP web apps and cPanel hosting 64%, Apache 24%. Most hit sectors: education and research (31%), then technology and telecoms (23%). Which web app flaws were used for the first break-in: unknown.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- :GSocket affected range not listed fixed no fixed version listed
- :cPanel affected range not listed fixed no fixed version listed
- :Apache HTTP Server affected range not listed fixed no fixed version listed
- :PHP affected range not listed fixed no fixed version listed
- :Linux kernel affected range not listed fixed no fixed version listed

## Cause

How the attacker got in: not disclosed yet (unknown). The record says the first break-in flaws are unknown ('Which web app flaws were used for the first break-in: unknown') and does not say how the incident reached users, customers or dependents beyond the compromised web servers.

How it reached others: not stated (unknown).

Last month's incidents with the same cause, and the full checklist: https://infrastack.ai/live/causes.md#unknown

## How to check

On internet-facing Linux servers, look for: a GSocket / gs-netcat binary, especially one staged in /dev/shm or another writable or memory-backed path; processes with kernel-thread-like names (e.g. in brackets) that are really user-space binaries run by the web server user; new cron entries, systemd units, shell profile lines (.bashrc/.profile) or watchdog scripts that start it; env vars GS_TG_TOKEN / GS_TG_CHATID (Telegram delivery of the secret); outbound connections to the Global Socket Relay Network (gsocket relay); shells or curl run as children of PHP/Apache/web server processes. Microsoft Defender alerts: 'GsNetcat' hacktool, 'Suspicious shell execution from PHP application', 'Possible Web Server compromise activity'.

## Fix

Patching the web app is not enough: on any server where a web app was compromised, find and remove the GSocket client, all its persistence (cron, systemd, shell profiles, watchdogs, extra copies) and staged files, then confirm outbound relay connections stop; rebuild the host if in doubt. Block or alert on egress to the Global Socket Relay Network and use deny-by-default outbound rules on web servers. Mount /dev/shm and /tmp noexec where possible. Patch the Linux kernel for CVE-2026-43284 (Dirty Frag) on internet-facing servers. Keep PHP apps, CMS plugins and cPanel up to date.

## Timeline

- 2026-11-11T20:44:07+00:00 analyst https://www.microsoft.com/en-us/security/blog/

## Documents

- [describes] @MsftSecIntel: Microsoft observed multiple incidents in which threat actors deployed GSocket on https://x.com/MsftSecIntel/status/2120609029001032115
- [describes] The global socket: how threat actors are weaponizing GSocket for stealthy C2 | Microsoft Security Blog https://www.microsoft.com/en-us/security/blog/

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_