CVE-2017-9841 — exploited in the wild

Observed by OffSeq honeypot sensors · last 7 days · last seen 2026-09-01

OffSeq's global honeypot fleet recorded 529 exploitation attempts against CVE-2017-9841 from 39 distinct attacker networks in the last 7 days. This is direct in-the-wild telemetry — every hit is a real attacker probing a decoy, not a scan of a vulnerability database.

Sample request paths

/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php /laravel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php /yii/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php /zend/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php /vendor/phpunit/phpunit/Util/PHP/eval-stdin.php

References