CVE-2025-54068

Name of the Vulnerable Software and Affected Versions Livewire versions 3.0 through 3.6.3

Description An issue in the hydration process of component property updates allows unauthenticated attackers to achieve remote command execution (RCE). The flaw occurs because the framework fails to verify submitted component state before deserializing it, enabling the injection of malicious serialized PHP objects via crafted HTTP requests. This process often utilizes PHPGGC gadget chains, which are sequences of existing legitimate PHP classes used to execute arbitrary code.

Real-world exploitation has been observed in a large-scale credential theft campaign affecting over 6,167 applications across sectors such as e-commerce, healthcare, financial services, and government. Attackers deployed a Bash script named shoc.enz to search for and exfiltrate sensitive .env files containing database passwords, AWS IAM keys, and Stripe secret keys. In other instances, the flaw was used to install unauthorized WordPress sites for black hat SEO and spam page generation.

Recommendations Update Livewire to version 3.6.4 or later.