Silent Intrusion: “Metro4Shell” Exploited in the Wild Since December

VulnCheck reports that CVE-2025-11953 (“Metro4Shell”) was being actively weaponized in the wild as early as late December 2025, with honeypot telemetry showing consistent delivery of advanced Windows and Linux payloads from multiple IP addresses; the report warns that publicly reachable development infrastructure functions as practical initial access and urges immediate patching rather than waiting for KEV guidance.