CryptoPHP a week later: more than 23.000 sites affected

**Executive summary:** Fox-IT documents the CryptoPHP campaign in which backdoored WordPress/Joomla/Drupal plugins and themes deploy a PHP backdoor (social*.png) that communicates with C2 infrastructure; sinkhole data showed 23,693 unique IPs contacting C2, a new backdoor SHA1 was observed, and the post supplies detection scripts, IOCs and removal/recovery guidance.