KNOWLEDGEdeliver ZERO-DAY EXPLOITED TO PLANT WEB SHELLS

Security researchers identified active exploitation of a previously unknown vulnerability in KnowledgeDeliver, a widely-used LMS platform. Threat actors leveraged the flaw to install Godzilla web shells—malicious tools that enable persistent remote code execution and administrative control over compromised systems. The vulnerability affects servers running unpatched versions of KnowledgeDeliver. Once exploited, attackers gain the ability to execute arbitrary commands, exfiltrate data, and maintain long-term access to educational institutions and corporate learning environments. Godzilla is a sophisticated web shell framework known for obfuscated functionality and evasion capabilities. Its deployment signals a targeted attack rather than opportunistic scanning, suggesting threat actors are actively hunting for vulnerable KnowledgeDeliver instances. Affected organizations should immediately identify systems running KnowledgeDeliver and implement available patches. Network defenders should monitor for suspicious web traffic, unusual process execution from web server processes, and unexpected file uploads in web root directories. KnowledgeDeliver has not yet released a public statement. Security teams recommend isolating affected servers from production networks pending vendor guidance, reviewing access logs for signs of compromise dating back to initial vulnerability discovery, and implementing web application firewalls to restrict administrative access. The zero-day highlights ongoing risks in educational technology infrastructure. Learning management systems often contain sensitive student and institutional data, making them valuable targets for data theft and credential harvesting campaigns.