NewsPublished 22 Jun 2026

Webshells Remain Popular, (Mon, Jun 22nd)

Source SANS ISC Handlers Diary

Description

Webshells have been popular for a long time. We already covered this topic across multiple diaries[1][2]. I spent some time to track them[3] and slighly paid less attention to them but today I found another one. It seems to be a new player (pushed on Github two months ago). 

Impact

The presence of ZypeerShell on compromised web servers could allow attackers to maintain persistent remote access and control. The obfuscation and advanced features may hinder detection and analysis by defenders. However, there is no evidence of widespread exploitation or specific vulnerable software versions. The impact is consistent with typical webshell risks, including unauthorized access and potential data compromise.

Defensive guidance

No official patches or vendor advisories are available for this webshell. Since it is a generic malicious tool rather than a vulnerability in a specific product, mitigation focuses on prevention and detection: ensure web applications and servers are securely configured and patched, monitor for unauthorized webshell files, and use security tools capable of detecting obfuscated webshells like ZypeerShell. Incident response should include removal of the webshell and investigation of the initial compromise vector.

Summary

ZypeerShell is a newly observed PHP webshell published approximately two months ago on GitHub. It offers classic webshell features for remote control and includes an unused function to deploy a GSocket-based connection to a C2 server. The tool is obfuscated with Fortress Layer, enhancing its stealth and integrity verification. While it is promoted as undetectable and feature-rich, no active exploitation or targeted affected software versions have been documented. It is also mentioned in red-team contexts, indicating potential use in penetration testing or adversarial scenarios.

References

isc.sans.edu/diary/rss/33096 (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 22 Jun 2026, 14:39 UTC

References

Community reviews

Related threats