RondoDox botnet malware now hacks servers using XWiki flaw

Researchers observed active exploitation of a critical XWiki RCE (CVE-2025-24893) beginning in late October/early November, with the RondoDox botnet and other actors delivering a first-stage downloader via base64-encoded Groovy injection to the XWiki SolrSearch endpoint, leading to remote shell execution, cryptocurrency miner deployments, and reverse-shell attempts; affected XWiki versions are prior to 15.10.11 and 16.4.1, and immediate patching and blocking of known IoCs is advised.