InfoSecBulletin Cybersecurity for mankind
Cyber Threat Intelligence Unit of BGD e-Gov CIRT has found many suspicious files on Bangladesh government infra like gc.txt and uname.txt. Hackers use such files to check unauthorized write access to web servers.
The found artifacts match signs of a big global web defacement campaign that hit Magento systems, first noted on 27 February 2026. This campaign has led to the breach of over 15,000 hostnames from around 7,500 domains globally.
Apple iOS 27.2 Released Fixes 163 Flaws, Including Critical WebKit RCE
CISA adds PHP2Shell to KEV, PHP Releases New Security Updates to Fix Critical HTTP2Shell flaw
Cloudflare Unveils Emergency WAF Ruleset Update on Brotli flaw
Daily Cyber security update for 26.10. 2026
The Washington Post report
Ex-DOGE AI startup Cathedral Breaches Anthropic Internal Systems within 12 Hours
Daily Cyber security update for 25. 10. 2026
Daily Cyber security update for 24. 10. 2026
PHP shares new RCE flaw (CVE 2026-115560) with no patch but mitigation
US banks faced unauthorized access by AI agents in customer accounts: Axios reports
Atlassian patched 176 flaw in Jira and Confluence: Fortinet Urges to Patch Flaws Affecting FortiOS, FortiManager
CIRT found many government infra endpoints with unauthorized files, including gc.txt (defacement claim evidence) and uname.txt (system verification results).
These files typically contain attacker aliases, timestamps, proof-of-compromise messages, and system-level information. Their presence indicates successful exploitation and unauthorized file write access on affected servers.
Attackers commonly use such artifacts to validate intrusions and submit evidence to defacement tracking platforms (e.g., Zone-H).
Technical Root Cause Analysis
The recent campaign is connected to the PolyShell problem (APSB25-94), affecting Magento Open Source and Adobe Commerce platforms.
The flaw is an unauthenticated file upload weakness in the Magento REST API. It lets attackers upload harmful files without needing to log in.
Attack Mechanism: The vulnerability allows attackers to upload files encoded in base64 format through REST API endpoints without proper validation.
Example attack workflow:
POST /rest/V1/products
Content-Type: application/json
Malicious payload example:
{
“file”: “base64_encoded_payload”
}
If server-side validation is misconfigured, the uploaded payload can be written to the filesystem.
Ongoing use of Magento flaw has allowed attackers to upload harmful scripts, keep access to the server, and change website content without permission.
Incident Response Measures:
Immediate actions should be to take away any unauthorized files (like gc.txt, uname.txt). Next, check the whole file system for any problems. Look at web server logs for any strange activity and scan the systems carefully for hidden web shells or backdoors.
Application Security Measures:
All Magento setups need to be updated with the newest security fixes. Unused REST API endpoints should be turned off to lower the risk of attacks. Companies must apply strong checks on file uploads and limit write access in web-accessible folders.
