Tag: ACME challenge

  • Webshells in Well-Known Paths: A Stealthy Persistence Vector

    Webshells in Well-Known Paths: A Stealthy Persistence Vector

    —

    by

    RedSecNinja
    in

    **TL;DR** Attackers are actively probing `/.well-known/` on public websites and, in some cases, planting webshells there to gain durable access that blends into routine traffic. SANS Internet Storm Center honeypots recorded a surge of requests for PHP files under `/.well-known/`—including the `acme-challenge/` and `pki-validation/` subfolders—on September 25, 2025, and highlighted why adversaries like this location:…