GCVE-110-OSM-2019-1

Advisory PublishedCVSS 9.6/10

Vulnetix · Advisory published July 22, 2019

Typosquatting attack mimicking symfony/process (300M+ downloads). Package phones home to C2 server with server information including IP, port, and hostname via $_SERVER superglobal exfiltration. Malware executes via new Symfony\Process\Process() call in tests/test.php. Sends HTTP request to C2 at hxxp://www.yls333[.]com/dev.php with base64-encoded $_SERVER data. Related infrastructure includes iosinstall.yls333[.]com resolving to 183.60.141.147, which hosts Apple phishing domains using homoglyph techniques.

Download JSON Open in Console

Weaknesses (CWE)

CWE-506Embedded Malicious Code

Risk Scores

CVSS 3.1

9.6/10

Critical · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Affected Products

Vendor	Product	Versions	Platforms
unknown	symfont/process	All versions affected (affected), All versions affected (affected), * (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), * (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), * (affected), All versions affected (affected), * (affected), * (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), * (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), * (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), * (affected), * (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), * (affected), All versions affected (affected), All versions affected (affected), * (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), * (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), * (affected), All versions affected (affected), All versions affected (affected), * (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), * (affected), All versions affected (affected), All versions affected (affected), * (affected), All versions affected (affected), * (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), * (affected), * (affected), All versions affected (affected), All versions affected (affected), * (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), * (affected), * (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), * (affected), All versions affected (affected), All versions affected (affected), * (affected), All versions affected (affected), * (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), * (affected), All versions affected (affected), All versions affected (affected), * (affected), All versions affected (affected), All versions affected (affected), * (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), * (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), * (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), * (affected), * (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), * (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), * (affected), All versions affected (affected), All versions affected (affected), All versions affected (affected), * (affected), All versions affected (affected), * (affected), * (affected), * (affected), * (affected), * (affected), * (affected), * (affected), * (affected), * (affected), * (affected), * (affected), * (affected), * (affected), All versions affected (affected), * (affected)	—
unknown		all (affected), all (affected), all (affected), all (affected), * (affected), all (affected), all (affected), all (affected), all (affected), all (affected), all (affected), all (affected), all (affected), all (affected), all (affected), all (affected), * (affected), all (affected), all (affected), * (affected), all (affected), all (affected), all (affected), all (affected), all (affected), all (affected), all (affected), all (affected), all (affected), all (affected), all (affected), all (affected), all (affected), all (affected), * (affected), all (affected), all (affected), all (affected), all (affected), all (affected), * (affected), * (affected), all (affected), all (affected), all (affected), all (affected), all (affected), * (affected), all (affected), all (affected), all (affected), all (affected), all (affected), all (affected), all (affected), all (affected), all (affected), all (affected), all (affected), all (affected), all (affected), all (affected), all (affected), all (affected), * (affected), all (affected), all (affected), all (affected), all (affected), all (affected), all (affected), all (affected), * (affected), all (affected), all (affected), all (affected), all (affected), all (affected), * (affected), all (affected), all (affected), all (affected), all (affected), all (affected), all (affected), all (affected), all (affected), all (affected), all (affected), * (affected), * (affected), all (affected), all (affected), all (affected), all (affected), * (affected), all (affected), all (affected), all (affected), all (affected), * (affected), all (affected), all (affected), all (affected), all (affected), all (affected), all (affected), all (affected), all (affected), all (affected), * (affected), all (affected), all (affected), all (affected), all (affected), all (affected), all (affected), all (affected), all (affected), all (affected), all (affected), all (affected), all (affected), all (affected), * (affected), * (affected), * (affected), all (affected), all (affected), * (affected), all (affected), all (affected), all (affected), all (affected), all (affected), all (affected), all (affected), all (affected), all (affected), all (affected), all (affected), * (affected), all (affected), all (affected), all (affected), all (affected), all (affected), all (affected), all (affected), all (affected), all (affected), all (affected), all (affected), all (affected), all (affected), all (affected), all (affected), all (affected), all (affected), * (affected), * (affected), * (affected), * (affected), * (affected), * (affected), * (affected), * (affected), * (affected), * (affected), all (affected), * (affected)	—

References

Malicious package:

advisory

Malicious packagist package: symfont/process

advisory

vendor

Browse GCVE Records

71,925 records in the GCVE database · Updated July 13, 2026

No matching records found.

Explore Further

Investigate this vulnerability in the interactive console or download the raw GCVE record.

Open in Console Download JSON