Attackers chained Craft CMS zero-days attacks in the wild

Orange Cyberdefense’s CSIRT reported an in-the-wild campaign that chained two vulnerabilities—CVE-2025-32432 (Craft CMS RCE) and CVE-2024-58136 (Yii input validation)—to execute code via PHP session injection and install a PHP file manager on compromised servers; researchers identified ~13,000 vulnerable instances and ~300 potentially compromised sites, and published IoCs and patched versions.