Leaks on the Livewire: How a Few Blocked Requests Led to a Shocking Discovery - Daniel Johnston

What started as unremarkable PHP deserialization attacks blocked by our Cloud WAF unravelled to reveal a sprawling credential theft operation. This talk walks through the full lifecycle of our investigation into exploit attempts against CVE-2025-54068 (a critical unauthenticated RCE in Laravel Livewire v3), from initial detection to recovery and analysis of the attacker's exfiltration infrastructure. We'll cover the vulnerability mechanics, the PHP gadget chains used to exploit it, and the credential-stealing malware deployed post-exploitation. The real story, however, lies in what came next: gaining access to the attacker's C2 infrastructure and analysing over 21,000 stolen Laravel .env files. A single .env file contains the keys to an entire application: database credentials, payment processor secrets, cloud access keys, and encryption keys. The scale of what we found across thousands of compromised applications may surprise you, as will the OSINT trail that led us to the threat actor. We close with practical detection and mitigation guidance and a clear-eyed look at what .env exposure really means for an organisation.