Determined Attacker Uploads Malicious Webshells to Parks and Rec Management Platform Servers

Reported 02 Oct 2026 by otx · Severity: medium

A threat actor compromised three web servers hosting recreation management software for municipalities and parks organizations by exploiting a file upload vulnerability. After multiple failed exploitation attempts, the attacker registered legitimate accounts and abused the member