Attacker signs up as a member to plant webshells on parks and recreation platform, hunts for card data

Security researchers at Huntress have detailed a multi-stage intrusion in which a threat actor compromised three web servers belonging to a popular recreation management platform used by local municipalities and parks organisations, planting webshells and going after payment card data. The activity, first observed on 10 September 2026, began noisily. Over roughly six hours the attacker threw a string of unauthenticated techniques at the first server, including brute-forcing the admin and member