New PCPJack Worm Targets Docker, Kubernetes, Redis, and MongoDB for Credential Theft

Summary

A new worm called PCPJack has emerged, targeting Docker, Kubernetes, Redis, and MongoDB environments to steal credentials. This malware leverages a variety of vulnerabilities, including those in Next.js middleware, React Server Actions, WPVivid Backup plugin, W3 Total Cache, and CentOS Web Panel Filemanager.

Key Points

• Target Environments: PCPJack primarily targets Docker containers, Kubernetes clusters, Redis databases, and MongoDB instances.

• Malware Capabilities:

  • Credential Theft: The worm steals credentials from affected systems.
  • Persistence Mechanisms: It employs various techniques to maintain persistence on compromised hosts.

• Vulnerability Exploitation:

  • CVE-2025-29927: Authentication bypass in Next.js middleware via crafted headers.
  • CVE-2025-55182: Server Actions deserialization flaw in React and Next.js (React2Shell).
  • CVE-2026-1357: Unauthenticated file upload in WPVivid Backup plugin.
  • CVE-2025-9501: PHP injection in W3 Total

Read the full article at Cyber Security News

---

Want to create content about this topic? Use Nemati AI tools to generate articles, social posts, and more.