Seems to come from the From email field: https://github.com/PHPMailer/PHPMailer/compare/v5.2.17...v5.2.18 https://github.com/PHPMailer/PHPMailer/compare/v5.2.17

Seems to come from the From email field: https://github.com/PHPMailer/PHPMailer/compare/v5.2.17...v5.2.18 https://github.com/PHPMailer/PHPMailer/compare/v5.2.17...v5.... More details here: https://www.saotn.org/exploit-phps-mail-get-remote-code-execution/ https://www.saotn.org/exploit-phps-mail-get-remote-code-exec... PHP mail doc: http://php.net/manual/en/function.mail.php http://php.net/manual/en/function.mail.php A function that allows to pass arbitrary flags to a command line, what could go wrong... :) mail('nobody@example.com', 'the subject', 'the message', null, '-fwebmaster@example.com');