Exposed Infrastructure Reveals How Ransomware Affiliates Used AI Agents to Execute Intrusions

Cybersecurity researchers have discovered an artificial intelligence (AI)-driven intrusion ecosystem run by affiliates of the INC and The Gentlemen ransomware groups.

Central to the operation is an "Autonomous Red Team Kill Chain Framework" referred to as Phantom. The threat actor is assessed to be Russian-speaking and functions both as an intrusion and data-extortion operator, as well as an infrastructure provider supporting different partners across the ransomware ecosystem.

"The operators exploited edge and remote-access systems at scale, including FortiClient EMS, SimpleHelp, cPanel and VPN gateways," SOCRadar said. "They used AI-managed knowledge bases to track victims, stolen credentials and campaign progress."

A notable aspect that defines the campaign is its "AI-executed, human-approved operating structure" in which a human operator provides a victim-specific prompt and reviews every step, while the intrusions themselves are executed through OpenCode with OpenRouter-hosted commercial models.

An examination of the exposed directory at 45.227.254[.]43 has revealed the activity logged 8,257 messages across 133 sessions. Should the models refuse to act on the prompts, the operator has been found to rewrite requests as an authorized red team assessment instead of simply switching models.

Initial access is achieved by exploiting public-facing edge devices at scale, following which the attackers move laterally, establish persistence, exfiltrate data, and escalate toward ransomware deployment. Operator records indicate that the attacks involve the exploitation of the following flaws -

"Once inside, the operators followed a recurring lifecycle: enumerate the domain, escalate to domain admin where possible, harvest credentials with stealer tooling, prioritize finance, HR, legal and executive files, and collect them over reverse-SOCKS tunnels," SOCRadar said.

"Credential reuse was the main force multiplier; in one case, a single reused password unlocked the VPN, servers, RMM, backup and security management platforms at once. Security products were impaired with a BYOVD killer and loader-level evasion, although the operators' own logs record mixed results against enterprise EDRs."

Supporting the threat actor in their goals is a diverse toolkit comprising bespoke frameworks, modified open-source tools, and compiled binaries -

• Phantom, an AI-powered offensive security and penetration testing framework that's deployed in live operations via OpenCode and employs an agent that communicates with an external server to retrieve tasks, execute commands, and return outputs. It supports 18 skill modules to facilitate reconnaissance, binary reverse engineering, exploit research, steganography, telemetry assessment, and EDR fingerprinting, among others.
• WormGPT-MCP, a set of 32 Model Context Protocol (MCP) servers connecting the AI system to 32 different modules that span functions ranging from reconnaissance to extortion.
• Ghost C2, a collection of three generations of polymorphic implants that communicate with a remote server over Cloudflare, Telegram, or DNS, and execute tasking and maintain persistent beacons on compromised endpoints.
• RevSocks, a reverse SOCKS5 framework used to pivot inside victim networks and stage data for exfiltration.

Other tools include a Cloudflare-fronted Mythic agent dubbed QuickLine, a Quick Heal/Seqrite EDR killer that abuses the Zemana driver ("zam64.sys") as part of a BYOVD attack, and exfiltration programs such as rks3 and BackupAgent.

Analysis of dozens of AI-authored extortion records shows that the threat actors adopt a data-centric approach. It involves examining the stolen financials to determine the amount a victim can pay without having to involve a bank or an insurer, and then sending masked proof samples and ramping up pressure through scripted vishing calls and threatening to notify customers, partners, and regulators.

The stolen data is eventually published on the data leak site if the victim fails to pay within a 24-72 hour deadline. That said, the final outcomes of these ransom demands are unknown as no cryptocurrency wallet or payment record has been recovered.

A total of 62 organizations are estimated to have been targeted by the operation, out of which four of them ended up being listed on the data leak sites for INC and The Gentlemen ransomware. The U.S. accounts for more than 50% of the targets. The attacks also primarily targeted industrial, manufacturing, and energy sectors, followed by healthcare and pharmaceutical organizations.

"Across this exposed infrastructure, the actors engaged in widespread exploitation of exposed internet services, specifically targeting FortiClient EMS gateways, Ivanti/Citrix/SonicWall/OpenVPN gateways, SimpleHelp remote management servers, and cPanel hosting controls," SOCRadar said.

"Concurrently, they orchestrated operations via the Phantom framework, established RevSocks reverse-SOCKS proxies for network pivoting, deployed Ghost C2 variants, and utilized AI-managed knowledge bases to meticulously log victim telemetry, compromised credentials, and active campaign statuses."

from The Hacker News https://ift.tt/zlVbKrP
via IFTTT

Hackers Breach Enterprise Firewalls and VPNs, Exposing Over 70,000 Credentials

Cybersecurity researchers have disclosed details of a large-scale campaign that has targeted exposed network edge devices such as Fortinet FortiGate and Palo Alto Networks GlobalProtect firewalls.

"Artifacts from this investigation also indicate that operators in this campaign have obtained access to numerous organizations worldwide, and have attempted to further compromise some victims, resulting in persistent remote access and data exfiltration," according to a joint investigation published by Group-IB and NyxLab.

The widespread exploitation activity has been attributed to a threat actor known as k0t, who also goes by the aliases CryptoFeel, Member19, and QazWsxShop. The cybercriminal actor was first seen in the wild on October 22, 2025.

The threat actor is assessed to share connections with ransomware groups such as Qilin and The Gentlemen, likely operating as an initial access broker or an affiliate. Analysis of the threat actor's dark web activity reveals a keen interest in purchasing vulnerability exploit code and tools or premium accounts for metadata search engines like FOFA and ZoomEye.

The campaign's victims are global and belong to a broad range of sectors, given the indiscriminate targeting of exposed network devices. A significant chunk of compromises are said to have taken place between February and June 2026, which also overlaps with another credential harvesting campaign codenamed FortiBleed.

Nearly 38% of victims are concentrated in the Asia Pacific region, followed by 31.9% in Latin America, 15.8% in Europe, and 12.7% in the Middle East and North Africa.

The attack chain plays out as follows -

• Conduct reconnaissance through public scanning tools like FOFA and ZoomEye to enumerate internet-facing VPN and firewall appliances, filter candidates by product, and put together target lists of potentially vulnerable edge devices.
• Attempt to exploit these devices via known vulnerabilities like CVE-2025-64446 (a path traversal flaw in FortiWeb) and CVE-2026-0257 (an authentication bypass flaw in Palo Alto Networks PAN-OS and Prisma Access) through bespoke Python scripts named "fortnew.py" and "exploit_2026_0257.py," or perform brute-force attacks using common username and password combinations, to obtain initial access.
• Establish a foothold on the targets via an OpenConnect VPN connection.
• Conduct post-exploitation actions and additional credential theft like enumeration of Active Directory, SMB, and installed antivirus solution.
• Establish persistence on the host via legitimate remote access tools like MeshCentral Agent, Atera, Teramind, and AnyDes, as well as an open-source, adversary-emulation framework known as AdaptixC2.
• Exfiltrate harvested data using Rclone into Wasabi S3 buckets and MEGA cloud drives.

The attacks are also characterized by the use of legitimate administrator and pentesting utilities like NetExec, SoftPerfect, Impacket, noPac, Kerbrute, PetitPotam, and Mimikatz to burrow deeper into victims' corporate environments.

"k0t appears to select potential targets by enumerating exposed network appliances at scale rather than researching individual organizations," Group-IB and NyxLab researchers said. "His stated geographic priorities begin with the United States and Canada, followed by European countries and selected APAC markets."

"The product and location of an exposed device therefore appear to matter more than the industry of the organization operating it, consistent with the broad range of victims observed in this campaign."

k0t's links to Qilin and The Gentlemen stem from the fact that many victims of the campaign were also later listed by the ransomware groups on their data leak sites. However, the exact nature of the connection between the threat and these gangs is unclear.

What's more, Group-IB and NyxLab said they found a "negligible overlap" in compromised data between this activity and FortBleed. More than 70,000 exposed credentials associated with network devices and LDAP dumps have been identified in connection with the campaign.

"This aligns with reports that many operators are likely to be involved in the FortiBleed activity cluster, suggesting that this may be a separate dataset, operator subset, or related access operation within the broader FortiBleed-related activity," the researchers said. "Organisations are advised to act on ensuring that any vulnerabilities mentioned in this report are appropriately remedied."

from The Hacker News https://ift.tt/BbEVJC1
via IFTTT

Russian-Linked Hackers Used New Mesh Network Backdoor in Destructive Ukraine Attack

The Russian state-sponsored hacking group Sandworm teamed up with another threat actor to carry out a destructive wiping attack targeting a Ukrainian logistics company last year.

According to ESET, the attack involved UAC-0099 (aka Earth Sirrush) obtaining initial access to the target on July 16, 2025, via a spear-phishing email bearing a malware-laced attachment that led to the deployment of the MATCHWOK backdoor via a downloader called MATCHBOIL.

The activity ultimately culminated with the threat actor handing off access to Sandworm, which then conducted a data-wiping attack on September 17, 2025, more than two months after it obtained a foothold.

What makes the attack stand out is UAC-0099's use of a previously undocumented backdoor called MythicRatatoskr that communicates with a command-and-control (C2) server hosted inside the Yggdrasil mesh network. The backdoor was deployed a day after MATCHWOK was executed.

There are indications that development on the backdoor started sometime between December 2024 and February 2025. Its functionality is fairly straightforward in that it sends victim metadata to the C2 server, poll for new commands, transmit command output, take screenshots, and upload/download files.

It can also alter the current working directory, enumerate directory contents, change the C2 server URL, execute a shell command via "cmd.exe," and spawn a reverse SOCKS5 proxy. In addition, some artifacts include a 10-minute startup delay in a likely effort to avoid immediately connecting to the Yggdrasil network and evade detection.

"To our knowledge, this is the first documented case of Yggdrasil being abused in this way by a state-aligned threat actor, and it may signal a broader trend of adversaries adopting experimental peer-to-peer networks to increase the resilience and stealth of their infrastructure," ESET researchers Anton Cherepanov and Peter Strýček said.

MythicRatatoskr is said to have been used to deploy a SOCKS5 server to route connections through the compromised network. The attack culminated with Sandworm carrying out a data-wiping attack by dropping the SDelete utility via Active Directory Group Policy. It's worth noting that the Sandworm-linked NikoWiper malware is also derived from SDelete.

Yggdrasil map with the C&C serve

While the attack investigated by ESET compromised a Windows system, source code references to "crond" within MythicRatatoskr suggest there possibly exists an equivalent Linux version of the malware.

The assessment that UAC-0099 is likely collaborating with Sandworm is not new. In its APT Activity Report Q2 2025–Q3 2025, ESET said it observed UAC-0099 conducting initial access operations and subsequently transferring "validated targets" to Sandworm for further post-exploitation.

These attacks targeted government, energy, logistics, and grain sectors in Ukraine, the Slovak cybersecurity company noted at the time.

This sort of cooperation between Russia-aligned actors is also not new. Last year, ESET said it identified evidence that Gamaredon and Turla were working together to target and co-compromise Ukrainian entities, with one intrusion leveraging Gamaredon's PteroGraphin to deploy Turla's Kazuar backdoor.

Furthermore, a Gamaredon-linked downloader called Pterodo has been used to retrieve and execute InvisiMole, a modular spyware program put to use against targets in Ukraine and Russia.

"This kind of cooperation underscores the potential for coordinated cyber espionage campaigns among Russia-aligned groups, likely intended to amplify their operational impact," ESET said.

from The Hacker News https://ift.tt/7pBvdiI
via IFTTT

Critical Flaw in Python’s Popular Pillow Image Library Allows Code Execution via a Crafted Image

Pillow, the most widely used image library for Python, can be made to run operating system commands on a server by specifying the name of a file it is told to open.

The flaw, CVE-2026-112900, is in the way Pillow handles EPS images, which it opens by passing the file's name to Ghostscript, a separate program it runs to turn the image into pixels, without checking the name first.

Ghostscript can read a name chosen by an attacker as instructions rather than as a file, and point it to a second file that carries commands to run. Pillow's maintainers fixed it in version 13.0.0, released on October 16.

Pillow turns up almost everywhere Python handles images: web upload forms, avatar and thumbnail tools, document and PDF pipelines, and most machine-learning projects pull it in. OX Security, the firm whose report drew attention to the flaws, estimates the library is downloaded about 436 million times a month.

Version 13.0.0 is a large security release, with fixes across four severity levels, from low to critical, two of which are rated critical by the maintainers. None of the flaws is known to be under attack.

The weakness is the filename, not the picture. "The flaw is triggered by the filename, not by anything in the PostScript document," the advisory says, meaning a harmless EPS file can still cause damage when an attacker sets its name. That makes upload endpoints that keep or build a stored file's name from user input the realistic target.

The flaw only reaches Ghostscript on hosts that have the gs program installed, which Pillow needs to open EPS at all. It affects Pillow from version 2.6.0 up to 12.3.0.

The maintainers rate it moderate, because the attacker has to control the filename. The CVE record assigned by GitHub rates it 9.2 out of 10 and marks it as the same condition.

Two of the fixes sit in the maintainers' top "critical" tier. One is a separate memory bug, described in the release notes as stale image data reused after a mode change. The other covers two overflow flaws in Pillow's JPEG decoding.

One of those JPEG flaws, in the FlashPix (FPX) format, was shown to run an attacker's command from a single call to Image.open() on a crafted file, as long as the optional olefile package is installed. Pillow recognizes these files by their content, not their extension, so a server that opens untrusted uploads can be hit with no user action.

The other, CVE-2026-112403, overflows a memory buffer when a program makes a thumbnail of a crafted lossless JPEG. Its advisory reports a crash, not code execution. The bug was "found by Anthropic using Claude to study the security of open-source software, validated manually by Ada Logics," the advisory says, part of a wider effort by the company that has turned up hundreds of flaws in open-source libraries.

A third flaw, CVE-2026-112393, has been in Pillow since 2013. It overflows a memory buffer when a program saves a compressed TIFF image to memory rather than to a file on disk, the common pattern for a service that re-encodes an upload and hands it back. The advisory says the reporters crashed the process with it, and turned it into code execution only with the help of a second, separate flaw that leaked memory addresses. Saving to a real file on disk is not affected.

The CVE records, assigned by GitHub, score the EPS, TIFF, and JPEG-thumbnail flaws 9.2 out of 10, a critical rating. Each depends on conditions the score does not carry, and the maintainers' own ratings for the batch run from moderate to critical. In the CVE records, CISA's analysts mark no known exploitation for the EPS flaw and a public proof of concept for the TIFF one.

What to do

Upgrade to Pillow 13.0.0, which fixes all of these, and rebuild any containers, wheels, or base images that bundle an older copy. Pillow 13 drops Python 3.10, so installs still on 3.10 need Python 3.11 or newer as well.

pip install -U "Pillow>=13.0.0"

Until you can upgrade, Pillow's security guidance and the advisories point to steps that cut each path:

• EPS / Ghostscript: keep the gs program off any host that processes untrusted uploads, and never pass an attacker-controlled filename to Image.open() for EPS.
• JPEG thumbnails: avoid draft() and thumbnail() on untrusted JPEGs, or call load() first, or pass reducing_gap=None.
• TIFF: treat saving a TIFF to an in-memory buffer such as io.BytesIO as a sensitive path when the image came from a user.

from The Hacker News https://ift.tt/14jInFQ
via IFTTT

Critical x402 SDK Flaw Could Let Malicious APIs Drain AI Agents’ Token Balances

AI agents paying for API calls with the x402 SDKs could sign a payment for their full balance of a supported token if a malicious API asked for it, security firm V12 said on October 22.

The cause was the SDKs' default client, which set no spending limit until releases on August 18 added one. The risk was limited to agents who automatically signed payments and whose apps set no limits.

The missing limit is one of 25 flaws V12 found in the x402 code, and one of three it rated critical and described in detail. The x402 Foundation, which maintains the SDKs, had already fixed all three critical flaws in the August 18 releases.

One of the other two let a facilitator, the service that checks x402 payments, accept a Solana transaction that moved no tokens as a valid payment. Among the x402 SDKs, only the TypeScript one had this flaw. The other let a malicious server get an agent to sign a login message for a different website.

V12 found the flaws by reviewing the code and running local tests. Neither V12 nor the x402 Foundation has publicly reported any attacks using them.

The foundation has published no security advisory for the three flaws, and its changelogs list the fixes without calling them security fixes. As of October 23, npm audit returned no advisories for the last TypeScript releases before the fixes, and PyPI listed no vulnerabilities for the last Python release before them, The Hacker News found. A developer who relies on those checks gets no warning to upgrade.

Coinbase created x402 and handed it to the x402 Foundation this year, a Linux Foundation project whose members include Visa and Mastercard. Coinbase holds the most senior seat on the foundation's technical steering committee.

No Spending Limit in the Default Client

x402 is an open standard that lets software, including AI agents, pay for an API call within the web request itself, without requiring a person to approve each payment.

A server that wants payment answers with the HTTP status code 402 Payment Required and lists its payment options, each with an amount, a token, and a recipient. The client picks one, signs a payment, and sends the request again.

The default client took the first option on the list, and before the fix, it set no limit on the amount.

A hostile API could use that to turn a routine data request into a request for the wallet's full balance of a supported token, V12 said. An earlier small payment could reveal the wallet address, so the server could look up the balance first.

With an automatic signer and no payment policy set by the app, the client could sign a payment for that amount. For a token that supports signed transfers, the attacker could then submit the signed payment and collect the funds.

The August 18 releases added spend controls to the TypeScript, Python, and Go clients. By default, they now cap each payment at $1 and allow only US dollar stablecoins the SDK recognizes, such as USDC.

Token Approvals Accepted as Solana Payments

In x402, a merchant's server relies on a facilitator to check each payment and submit it to the blockchain. On Solana, the facilitator also pays the transaction fee.

The TypeScript facilitator code for Solana checked that a payment called an allowed token program, then read it as a transfer without checking the instruction type. A token approval, which lets another account spend tokens later but moves none itself, differs from a transfer only in its first byte.

In V12's local test, the facilitator accepted such an approval as a valid payment. The test did not send a live transaction.

A merchant relying on the facilitator could therefore deliver a paid resource while receiving no tokens, V12 said, calling it "a complete payment bypass." The attacker needed a token account, but no balance, and the facilitator paid the transaction fee each time.

The Python and Go SDKs already checked the instruction type. The August 18 releases added the same check to the TypeScript code.

Every published @x402/svm release from 2.0.0 to 2.22.0 lacks the check, and every release from 2.23.0 on has it, The Hacker News found by searching the published packages.

Logins Signed for Other Websites

x402 also has a sign-in extension called Sign-In-With-X (SIWx). It lets an agent log in by signing a short message with its wallet, for example to prove an earlier payment instead of paying again. On Ethereum, the message names the website, the wallet address, and a one-time code.

The automated client signed these messages without verifying that the website named in them was the one it had contacted.

A malicious server could get a fresh login message from another site, pass it to the agent, and use the signature to log in to that site as the agent's wallet, V12 said. That would work wherever the other site accepted the relayed message, and the attacker would get whatever access the login allowed.

The August 18 releases make the TypeScript, Python and Go clients refuse to sign unless the site in the message matches the site that sent the 402 response. The project also changed the SIWx specification, which now says a client must refuse to sign when the two do not match.

TypeScript code that calls createSIWxPayload directly must now pass the URL of the 402 response, after any redirects. The @x402/fetch and @x402/axios wrappers pass it on their own.

What to Update

Upgrading to the latest releases also brings later fixes, including one for a separate payment bypass in @x402/core 2.27.0 in September. As of October 23, the latest versions are 2.28.0 for @x402/core, @x402/svm, @x402/extensions, @x402/fetch and @x402/axios, v2.28.0 for the Go module and 2.25.0 for the Python package.

In TypeScript, clients get the spending fix by updating @x402/fetch or @x402/axios to 2.23.0 or later, which pulls in the matching @x402/core. Apps that use SIWx also need @x402/extensions 2.23.0 or later, which holds the login check. Facilitators that check Solana payments need @x402/svm 2.23.0 or later.

After the upgrade, existing clients are capped at $1 per payment and limited to recognized stablecoins unless the app sets its own spend controls. Apps that pass spendControls: false turn all of these controls off.

Teams that cannot upgrade yet can register a payment policy that drops any option above a set amount. The older clients support this with registerPolicy in TypeScript and Go and register_policy in Python, which also has a ready-made max_amount policy.

V12 advises clients to check that a SIWx login message identifies the site they contacted before signing, to set budgets for each payment and in total, and to limit which tokens, networks, and recipients they will pay.

from The Hacker News https://ift.tt/c3RWub6
via IFTTT

PHP2Shell Exploit Attempts Hit Millions as Attackers Try to Deploy Mirai Malware

Threat actors have been observed unsuccessfully attempting to exploit the newly disclosed PHP2Shell vulnerabilities to rope infected systems into a Mirai botnet variant called Potassium, as it emerges that weaponizing the flaws may be harder than previously thought.

The attacks aim to exploit CVE-2026-109618 and CVE-2026-109619 (CVSS scores: 9.2), which can result in unauthenticated remote code execution (RCE) via specially crafted HTTP requests. The vulnerabilities have been patched in PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35.

"However, analysis of the sample revealed that it is an updated and significantly expanded version of the Mirai-derived botnet variant identified in early 2026," Sophos said. "The sample displays downloader and network disruption functionality."

Specifically, it resolves a hard-coded, encrypted command-and-control (C2) address, establishes a TCP connection to 134.199.154[.]64, and sends an HTTP request. The malware then checks for an HTTP 200 response status and verifies that the resulting payload begins with the ELF magic bytes 7F 45 4C 46, indicating that it expects a Linux ELF binary as a follow-on payload.

"A resolver function supports IPv4 addresses and hostname resolution, with additional fallback resolution logic that includes hard-coded public DNS servers such as 8.8.8.8, 1.1.1.1, and 1.0.0.1," Sophos added. "As with Mirai malware historically, this sample can execute DDoS attacks."

The attacks have been found to originate from the following three IP addresses -

• 85.11.167[.]243
• 217.60.242[.]76
• 45.198.224[.]169

These attack sources have been found to contact 92.118.112[.]100 to retrieve a loader, which is responsible for deploying the Mirai botnet variant. Further analysis of the artifact within a network-contained sandbox has revealed that the botnet issues a DNS query for thunder.godofthunder[.]st, resolves it to 134.199.154[.]64, and establish a C2 channel on TCP port 50792.

The end goal is to launch sustained volumetric flood attacks against two adjacent hosts located within a single Ukrainian network -

• 45.88.138[.]0
• 45.88.138[.]44

The lack of a successful attack leveraging PHP2Shell in the wild suggests that threat actors are "struggling" to come up with reliable exploits, Sophos added.

Potassium was first flagged by botnet tracking platform Synthient in March 2026. In a follow-up analysis, Nokia Deepfield researchers described the malware as a Mirai fork which uses "ChaCha20 for the static config table (the first time we have seen ChaCha20 used this way in a Mirai variant), a single static byte (0xED) for everything on the wire, a named reverse-shell protocol (SHELL / SHOUT) on the same channel as attack commands, and a DNS misdirection scheme that swaps the two 16-bit halves of every resolved A record before connect()."

Arctic Wolf, which also shared additional details of the same weaponized PHP2Shell exploitation attempt, said the botnet supports 24 commands to facilitate flood attacks over ICMP, TCP, UDP, and OpenVPN protocol. Both builds for ARM and x86 also contain configuration for resolving C2 infrastructure through Ethereum Name Service (ENS).

"ENS resolution was disabled in both samples, indicating that the capability was present but inactive," the cybersecurity firm said. "If enabled in future variants, it could complicate disruption by reducing reliance on registrars and DNS providers, requiring defenders to block the ENS names, RPC infrastructure, and resolved command-and-control addresses."

Threat Actor Mass Exploits PHP2Shell

The development comes as SOCRadar said it found PHP2Shell exploit tooling for PHP 8.4.26 on an exposed attacker-controlled server ("206.188.197[.]105:9999"), alongside three screening scripts that check live websites for preconditions the PHP2Shell chain depends on.

The scripts, according to the cybersecurity company, checked about 20 public websites for the PHP version, server setup, and session settings the exploit needs. These websites span Canada, China, Finland, France, Poland, the U.K., and the U.S.

"The central file, aslr_exploit.py, is a Python exploit the operator labels a 'one-click' PHP2Shell exploit for PHP 8.4.26 under Apache mod_php," SOCRadar said. "It works entirely over ordinary HTTP requests in three broad steps: it recycles the target's PHP worker, leaks memory addresses through the session cookie to defeat address space layout randomization (ASLR), and then abuses PHP's session upload progress handling to run a shell command."

ASLR, short for Address Space Layout Randomization, is a cybersecurity mechanism that randomizes the memory locations used by system files and programs each time they are run, making it harder for attackers to predict where code will load. This built-in defense helps defend against memory-based exploits, such as buffer-overflow attacks.

The other three companion scripts are as follows -

• php2shell_fp.py, which reads PHP version and server setup from about 20 sites
• deep_probe.py, which examines 11 of those sites for visible errors, phpinfo pages, file inclusion, and session injection to ascertain whether they meet exploit prerequisites
• wp_attack.py, which focuses on five WordPress sites to conduct user and plugin enumeration

That said, there is no evidence of shell access on any screened site as of October 22, 2026, indicating the targeted sites did not meet the exploit's preconditions.

The toolset is assessed to be part of a broader operation that involves the attacker extracting API keys and backend URLs from websites' client-side JavaScript, systematically sweeping web and API routes for unauthenticated access, and using a pool of rotating proxies to spread traffic and evade rate limits and blocking.

"Related artifacts on the server additionally point to web-archive reconnaissance and automated CAPTCHA solving," SOCRadar noted. "Taken together, the toolset points to a financially motivated actor focused on cryptocurrency and Web3 targets."

The same exploitation server ("206.188.197[.]105") has also been flagged by Hunt.io, which said the threat actor behind the operation has targeted 123 servers across cloud, shared-hosting and ISP networks. "About 57 run PHP, many on unsupported 5.x to 7.x," the threat intelligence firm said. "Ten rejected the request outright, including three of the five sitting behind Cloudflare. None was exploited."

In all, 10 open directories hold PHP2Shell-related tooling -

• 206.188.197[.]105
• 102.210.149[.]166
• 122.10.110[.]72, 122.10.17[.]49
• 58.221.60[.]160:8000
• 41.223.30[.]7, 157.230.117[.]70
• 104.219.251[.]31
• 107.150.31[.]151
• 217.160.132[.]82
• 47.100.125[.]108, 54.169.109[.]7, 139.162.165[.]136

Defeating ASLR Protections

The disclosure also coincides with the development of a PHP2Shell exploit that can achieve remote code execution on ASLR-enabled x86-64 systems with PHP's recommended production configuration.

"One of the biggest obstacles has been address space layout randomization (ASLR), a protection designed to make memory corruption vulnerabilities much harder to exploit," Spencer McIntyre, director of exploit development at VulnCheck, told The Hacker News.

"Our team developed a novel technique [...] that chains the two vulnerabilities together, using a memory leak to bypass ASLR and achieve remote code execution on x86-64 systems, even with PHP's recommended production error-display setting."ir

"We haven't identified another public or commercial exploit that achieves this under the same conditions. Developing this capability was far from trivial, but it demonstrates that a major barrier to exploiting PHP2Shell on production-configured systems can be overcome."

Consequences of successful exploitation of the flaws are severe, as it permits an attacker to execute code with the permissions of the web application, potentially gaining access to API keys, database connections, and other internal services the application can reach, VulnCheck said.

"An attacker doesn't necessarily need administrator or root access to cause significant damage," McIntyre said. "Access to a vulnerable web application could provide a foothold into other parts of an organization's infrastructure."

Exploit Attempts Plenty, None Successful

The findings also coincide with reports indicating broad exploitation attempts targeting the flaws are underway, including by a China-based IP address that has been observed trying to drop a web shell via a server-side session file.

Web infrastructure company Cloudflare said it observed tens of thousands of attempts to exploit the flaw 45 minutes after the flaws were publicly announced, before climbing to hundreds of thousands within 2 hours and millions as of early October 22, 2026.

"So far, most of the activity is scanning, along with some uncoordinated attempts to deliver various payloads," Cisco Talos said. "This is expected: scanning or basic exploitation with public proof-of-concept (PoC) code takes far less effort than integrating a vulnerability into an actor's own tooling."

Data from Previdian's telemetry has so far recorded hundreds of exploitation attempts targeting CVE-2026-109618 from dozens of IP addresses, and against CVE-2026-109619 to a lesser degree. The first exploit event aimed at CVE-2026-109618 was recorded on October 21, 2026, at 1:05 p.m. UTC.

"We've seen plenty of php2shell probes and exploitation attempts in our honeypots," Previdian said. "At the time of writing, we've observed no successful remote code execution and no dropped PHP files. Reliable RCE may be harder to achieve than initially expected."

This assessment has also been echoed by Beelzebub, Dataminr, and Wordfence, with observed activity so far limited to scanning, fingerprinting, and attempts to confirm command execution, steal credentials and secrets from environment variables, install persistent access, and retrieve and execute a second-stage payload.

Wordfence has shared the following IP addresses as among those attempting to exploit the flaws -

• 87.121.84[.]174
• 181.215.186[.]252
• 185.196.220[.]132
• 185.161.210[.]29
• 152.233.51[.]69
• 45.134.225[.]16
• 107.189.14[.]87
• 193.47.62[.]24
• 2409:40d2:204e:4be:2a1f:f9c9:a055:e00b
• 103.147.220[.]17

The severity of the flaws has also led to several government, school and hospital websites going offline across Asia, Europe, and North America out of an abundance of caution. The U.K. government has confirmed that 32 digital services are unavailable and four are partially unavailable, largely stemming from the precautionary shutdowns while security updates and mitigations were applied. The National Cyber Security Centre (NCSC) has issued approximately 50,000 warnings to businesses and other organizations.

"The vulnerable code dates back to PHP 5.4, released in 2012," the Sysdig Threat Research Team said. "The bugs live in the PHP engine, not within any application. For that reason, any WordPress, Drupal, or Joomla site with clean application code is still exposed."

With the fixes not available for older versions of PHP, PHP2Shell is expected to have a long tail, along the lines of Log4Shell. According to estimates from Google-owned VirusTotal, about 272,000 hosts run a supported PHP branch (8.2 to 8.5), Organizations on PHP 7.4, 8.0, or 8.1 are advised to move to a supported branch, or use a distribution backport.

Attack surface management platform Censys said it currently detects over 3.08 million hosts and 56.6 million web properties running PHP. Of these, more than 34.4 million PHP services are still assessed to be vulnerable as of October 23, 2026.

"Many applications with web servers and similar will likely remain vulnerable until their respective vendors patch these items," Dataminr said. "The implications of this are that many organizations will likely remain vulnerable to some degree for far longer than when patches are directly applied to owned and managed applications."

from The Hacker News https://ift.tt/4SR8zpC
via IFTTT

Meta Ordered to Pay $25 Billion After Court Finds 43 Million Privacy Violations

Social media giant Meta was ordered to pay 25 billion in penalties by a New Mexico court on Wednesday as part of a data privacy lawsuit that sprang from the company's Cambridge Analytica data scandal, which came to light in 2018.

According to multiple reports from the Associated Press, the New York Times, Reuters, and the Wall Street Journal, state District Court Judge Francis J. Mathew called out Meta and Facebook for making misleading statements about the privacy of consumers in the state.

"Facebook promised users that they (the users) controlled their data," Mathew wrote in his ruling. "This was false."

The penalty relates to more than 43 million violations of the state's unfair practices law. The case, filed in 2021, was filed in the aftermath of revelations that Cambridge Analytica, a British political consulting firm, obtained data belonging to millions of Facebook users without their consent to build psychographic profiles.

The data was collected via a personality quiz app called "thisisyourdigitallife." Around 300,000 users are said to have taken the psychological test, although it later emerged that the app also collected the data associated with their friends, thereby amassing a dataset of 87 million profiles.

Meta banned the app in 2015 for violating its platform policy. The company also sent a legal request to Cambridge Analytica to delete the collected data. Following the data scandal, Cambridge Analytica announced in May 2018 that it was immediately ceasing operations. Notably, the company was involved in Donald Trump's campaign during the 2016 presidential election.

In December 2022, Meta agreed to pay $725 million to settle a class-action lawsuit that accused the company of improperly sharing users' information with Cambridge Analytica. Previously, it faced a $5 billion fine from the U.S. Federal Trade Commission in 2019 for undermining users' ability to control their privacy on Facebook.

Back in August, the company also reached a settlement with nearly all U.S. states and territories, except New Mexico and Florida, to pay $18 billion over the next decade and implement stronger child-safety measures on Facebook and Instagram. This also includes $459 million for claims related to the Cambridge Analytica matter.

Meta chief legal officer C.J. Mahoney criticized the latest penalty, adding the company intends to appeal the decision.

from The Hacker News https://ift.tt/PByzq3D
via IFTTT

INTERPOL Arrests 1,462 Suspects, Disrupts 10,909 Cybercrime Networks in Global Crackdown

INTERPOL on Thursday announced that a coordinated law enforcement action has disrupted 10,909 malicious networks and recovered more than $105 million in illicit funds.

In tandem, the effort saw law enforcement agencies from 21 countries arrest 1,462 suspects. Codenamed Operation Serengeti III, the cybercrime crackdown took place between June 29 and August 31, 2026.

"Authorities identified 65,929 victims targeted by cybercriminal networks, underscoring the scale and sophistication of today's digital threats," INTERPOL said in a statement. "Financial investigations linked criminal activity to losses exceeding USD 385 million."

Participating nations included Angola, Benin, Cameroon, Congo, Côte d'Ivoire, Democratic Republic of Congo, Eswatini, Gabon, Gambia, Ghana, Kenya, Mozambique, Nigeria, Rwanda, Senegal, South Africa, Tanzania, Uganda, United States, Zambia, and Zimbabwe.

Group-IB, which was one of the many private sector partners, said it provided INTERPOL with threat intelligence data on phishing kits, botnets, and other malicious resources hosted in Africa or used to conduct cyber attacks targeting the region.

"Criminals cannot operate without infrastructure. They have to build it, connect it and maintain it, and those activities create opportunities to find them," said Jacomo Piccolini, vice president of Global Data Partnerships at Team Cymru.

"Instead of waiting for an attack and then investigating the damage, we can help expose the networks behind criminal operations and enable defensive actions. Operation Serengeti III demonstrates the real-world impact of putting that intelligence in the hands of law enforcement."

Some of the key operational highlights are listed below -

• Disruption of two transnational fraud rings and the arrest of 365 foreign nationals in Uganda linked to sophisticated online investment and pension fraud schemes targeting victims across Asia.
• Dismantling of two illegal cryptocurrency mining centers and the arrest of nine suspects in Angola, along with the seizure of 2,000 cryptocurrency mining devices and six illegal power transformation stations valued at over $1 million.
• Arrest of a suspect in Nigeria in connection with a large-scale phishing and business email compromise operation that collected software credentials and amassed about 2.1 million email addresses.
• Arrest of another suspect in Nigeria for operating an international investment fraud scheme advertised via messaging apps. The operation led to the movement of more than $2.4 million in suspected criminal proceeds, with a huge chunk of the funds laundered through cryptocurrency transactions.
• Arrest of 30 suspects linked to a cybercrime operation in the Republic of Congo.

Operation Serengeti III follows two previous waves that took place between September and October 2024, and June and August 2025, leading to more than 2,000 arrests.

"Cybercrime networks operate without regard for borders, exploiting technology to target victims on an unprecedented scale," Neal Jetton, INTERPOL's director of cybercrime, said.

"Operation Serengeti III reinforces a clear message: while cybercrime is increasingly borderless, international cooperation remains one of the most effective tools for disrupting criminal networks, recovering criminal assets and protecting communities from digital harm."

from The Hacker News https://ift.tt/GYLknaA
via IFTTT

The AI Agent Nobody Owns: Watch Expert Webinar On Your Newest Insider Threat

Right now, there is probably an AI agent running on a laptop somewhere in your network. It stores API keys and database passwords, can access your internal systems, and works without anyone watching.

Nobody reviewed its access. Nobody owns it.

If an employee had that much reach with that little oversight, you would call it an insider risk. So why do we still call the agent a productivity tool?

Most of the conversation about AI security is about what threat actors are doing with it. But the bigger threat may already be inside your organization.

That's the focus of our upcoming webinar, AI as an Insider Threat: From Shadow AI to Governed AI, with expert guest Richard De La Torre, Technical Product Marketing Manager at Bitdefender. Save your seat for a practical security playbook on bringing that unseen AI under control.

Where AI is hiding on your endpoints

It isn't only developers. AI agents, coding assistants, MCP servers, and browser extensions are turning up across the business.

And most of them never cross your network gateway in a way the tools you already run would recognize.

The result is a hard irony. The AI with the most access is often the AI your security team can't see.

📅 Save Your Spot: Watch the Webinar

The visibility gap, by the numbers

According to Bitdefender's 2026 Cybersecurity Assessment report, only 51.8% of organizations report having full visibility into the AI tools their staff use. That leaves nearly half without the full picture.

That blind spot has a cost. IBM found that 20% of breached organizations were compromised through shadow AI.

Which raises the question: what can organizations realistically do about it? That's exactly what the webinar gets practical about. Register now to see what a lean team can do about the AI it can't yet see.

From shadow AI to governed AI

New research from Bitdefender Labs looks at what's really running on endpoints, based on real machines; among the findings: a malicious agent skill caught in the wild.

Blocking AI outright is the obvious response, but it tends to fail. The alternative is governed adoption, and the session shows what that looks like in practice.

What you'll take away

• Where AI is actually showing up on your endpoints, and why the tools you already run don't see most of it.
• New research from Bitdefender Labs on real machines, including the malicious agent skill caught in the wild.
• Why an AI agent with credentials and no owner behaves like an insider risk, and what to do about it.
• Why blocking AI outright tends to fail, and what governed adoption looks like instead.

The AI already running on your endpoints won't wait for a policy. Join expert guest Richard De La Torre, Technical Product Marketing Manager at Bitdefender, and save your seat for AI as an Insider Threat.

📅 Save Your Spot: Watch the Webinar

Found this article interesting? This article is a contributed piece from one of our valued partners. Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.

from The Hacker News https://ift.tt/yFBpHXx
via IFTTT

ActiveState Partners with Docker to Secure the Open Source in Enterprise Containers

Even security teams that have invested in a hardened base image often can’t say what’s running on top of it. In a recent survey of 250 North American DevSecOps leaders, 91% named visibility into container components as their single biggest blind spot. Not the base image, but everything layered onto it. And 90% said their teams still run lightly modified public images with little to no hardening. 

That gap is getting harder to ignore. AI coding assistants are adding dependencies faster than teams can review them. Vulnerability databases can no longer keep pace with the volume of submissions. New regulatory requirements, including the EU Cyber Resilience Act, are also increasing expectations around vulnerability handling, remediation, and software supply chain transparency. 

Docker Hardened Images meet ActiveState’s Curated Catalog

Docker, Inc. and ActiveState today announced a reselling partnership that brings Docker Hardened Images (DHI) together with ActiveState’s curated open source packages, giving enterprises a more consistent way to secure both the container base and the software dependencies layered on top.

DHI provides secure-by-default, minimal container images, with 4,000+ images built from source, near-zero CVEs, signed SBOMs, and SLSA Build Level 3 provenance. The catalog is free and open source under Apache 2.0, with production tiers backed by a 7-day SLA for critical and high-severity CVEs. 

ActiveState extends that trusted foundation to the open source dependencies developers add on top. Its curated components span more than a dozen language ecosystems, including Python, JavaScript, Java, Perl, Tcl, and Ruby. Components are built from source, continuously maintained and remediated against contractual SLAs, and delivered through the package managers, pipelines, IDEs, and AI coding tools development teams already use. 

Trust across the software stack

• A more consistent approach to trusted open source: Pair a hardened container base with curated open source dependencies, reducing the need to source and manage each layer separately
• Verifiable provenance across the stack: With both Docker and ActiveState building from source to SLSA Build Level 3 standards, teams get a more consistent evidence trail across the software supply chain
• Fewer vulnerabilities, without slowing teams down : DHI delivers near-zero CVEs, 95% smaller attack surface, 7-day SLA on critical/high CVEs. ActiveState provides 95% fewer CVEs and 90% faster remediation than community open source, backed by a 5-day SLA on critical vulnerabilities.

Available Now

The Docker and ActiveState reselling partnership is available now. Explore the partnership.

from Docker https://ift.tt/cexdiUf
via IFTTT

OpenCode Flaw Lets Malicious MCP Servers Execute Code During Sign-In on Windows and WSL

A flaw in the OpenCode AI coding agent allowed a malicious or hijacked MCP server to run code on a developer's Windows or WSL machine when the developer signed in. OpenCode connects to MCP (Model Context Protocol) servers to add outside tools, and such code would run with the developer's own access.

Anomaly, the company behind OpenCode, fixed the flaw in version 1.18.33 on September 28. It did not request a CVE or publish a security advisory, so vulnerability scanners will not flag the builds still at risk: 1.0.137 through 1.18.32.

During that sign-in, the server itself supplies the web address the user is sent to, an OAuth "authorization endpoint." On Windows and WSL, OpenCode handed that address to a helper that opens it in a browser. The helper built a PowerShell command around the address without escaping it, so an address written to carry a PowerShell command would run that command.

The browser step runs only when a developer starts the sign-in, by running opencode mcp auth or making the matching request. Having the server configured, or opening a session, does not reach it.

The attacker needs control of a remote MCP server the developer has added, and that server need not be hostile from the start. One that is later taken over, or a domain that changes hands, could carry the same address.

Pillar Security, which found the flaw and disclosed it on October 19, rates it critical, with a proposed severity score of 9.8 out of 10.

The flaw affects OpenCode on Windows and the Windows Subsystem for Linux (WSL). macOS and Linux are not affected, because OpenCode opens the browser there without passing the address through a shell.

OpenCode shipped the fix as a routine change. The pull request that carried it is described as a refactor of browser-launch code, and neither it nor the release notes mention a security flaw.

Anomaly did not request a CVE or publish an advisory. Its security policy says MCP servers that a user configures are "outside our trust boundary."

Pillar reported the flaw privately on August 29 and later asked Anomaly to reconsider and request a CVE. Anomaly's answer was that a malicious MCP server falls outside its threat model, according to Pillar.

Because there is no CVE, the flaw will not show up in scanners or dependency alerts, so finding affected installs means checking the OpenCode version directly. Anomaly has published advisories for other OpenCode code-execution flaws this year, including one fixed in August.

The same kind of flaw has surfaced before. In July 2025, the mcp-remote proxy carried an almost identical bug, in which a malicious server's authorization endpoint reached the command line. It was assigned CVE-2025-6514.

OpenCode's browser helper is a widely used package called open. Its Windows behavior was reported as a command-injection risk in 2023 and fixed in open's version 11, but OpenCode stayed on an older release.

The usual defense for this class is to check that the address uses HTTP or HTTPS. It does not help here, because the attack uses an ordinary HTTPS address. OpenCode added that check as well, but the hole was closed by updating it to the fixed version.

What to Do

Anyone running OpenCode on Windows or WSL should upgrade and check which servers they are connected to.

1. Upgrade to OpenCode 1.18.33 or later.
2. If you cannot upgrade yet, remove any remote MCP servers you have not vetted from your OpenCode configuration.
3. Run opencode mcp list to see which servers are configured.

Pillar reported no signs that the flaw has been used in attacks and published no indicators to check for past exploitation. The flaw is separate from a breach of OpenCode's hosted Console disclosed around the same time, which may have exposed some users' stored API keys for OpenAI, Anthropic, and Google.

from The Hacker News https://ift.tt/qj7Kevx
via IFTTT

Node.js Brotli Decoder Bug Could Allow Remote Code Execution in All Supported Versions

Node.js released security updates on October 21 for its three supported release lines, 22.x, 24.x and 26.x, fixing 10 flaws. The most serious is a bug in the Brotli decompression code that Node.js bundles, which the project says can allow remote code execution, meaning an attacker could run code of their choosing on the affected system.

Each supported line has one fixed version: 22.23.4 and 24.22.1 on the long-term support lines, and 26.12.1 on the current line. Node.js 20.x and earlier have reached end of life and will not receive the fix, so they should be moved to a supported line.

The Brotli flaw is in code Node.js bundles, not in a user's own program. Node.js runs that code whenever it decompresses Brotli data, either directly through the node:zlib module or automatically when code calls fetch() on a response sent with Brotli compression.

An application is exposed where it decompresses Brotli data an attacker controls, such as a request body or a response fetched from another server.

The Brotli Flaw

The flaw is an out-of-bounds write in the Brotli decoder, set off by malformed compressed input. The fix is an upstream patch from the Brotli project that Node.js copied in, and it makes the decoder catch invalid input and stop earlier rather than writing past the buffer.

Brotli is Google's compression library, and Node.js ships its own copy. The same fix shipped in Brotli 1.2.1, 1.1.1, and 1.0.10 on October 21, so other software that bundles Brotli may need the same update. The change was first made in Brotli's source in February 2026 and shipped as a security release only in October.

"Remote code execution" is the project's description of what the flaw could allow, and the flaw is rated high rather than critical. How far that has been shown in practice is narrower.

A public proof-of-concept published on October 22 reached code execution only against a deliberately weakened test build. On a standard Node.js build, its author reported a crash and a limited read of process memory, not code execution, and said a working attack on a normal build was not achieved.

Patched Node.js rejects the malformed input the proof-of-concept uses, and no exploitation of the flaw in the wild has been reported as of October 22.

The Other Flaws

Three of the other fixes are also rated high. Two are TLS certificate checks an attacker could bypass by writing a server's IP address in an unusual form, so a certificate matches a host it should not (CVE-2026-106069 and CVE-2026-105483). The third stops dns.resolve from cutting a hostname short at an embedded null byte (CVE-2026-105482).

Node.js rates CVE-2026-105483 high, though the commit that fixed it calls the bug low-severity and hard to exploit.

The rest are medium and low severity. One medium flaw makes crypto.randomUUID() and crypto.randomInt() hand back the same values in every process when an application is built as a startup snapshot or a single-executable application (CVE-2026-106074), which undermines anything that relies on those values being unpredictable.

The full set, and the lines each one affects:

CVE	What it is	Severity	Affected lines
CVE-2026-111497	Out-of-bounds write in the Brotli decoder; remote code execution, per the project	High	22.x, 24.x, 26.x
CVE-2026-106069	TLS hostname-check bypass when a host resolves to an IP address in non-canonical form	High	22.x, 24.x, 26.x
CVE-2026-105483	TLS hostname-check bypass when an IP is written in fullwidth digits	High	24.x, 26.x
CVE-2026-105482	dns.resolve truncates names that contain a null byte	High	22.x, 24.x, 26.x
CVE-2026-105481	Keep-alive socket can process a response written before the request was sent	Medium	22.x, 24.x, 26.x
CVE-2026-106072	Certificate validation for non-canonical IPv4 lets DNS names authenticate IP endpoints	Medium	22.x, 24.x, 26.x
CVE-2026-106074	randomUUID() and randomInt() caches reused in startup snapshots and single-executable apps	Medium	22.x, 24.x, 26.x
CVE-2026-106070	ZipFile returns attacker-controlled bytes after a failed header check	Low	26.x
CVE-2026-106071	Permission Model over-grants file access through a wildcard lookup	Low	26.x
CVE-2026-106073	Permission Model bypass with fs.realpathSync	Low	22.x, 24.x, 26.x

The eMudhra Certificate Block

The same updates also stop Node.js from trusting eight intermediate certificate authority keys from the Indian provider eMudhra that were reported compromised days earlier.

Node.js uses the Mozilla root certificate list but does not perform revocation checks by default, so before this update, a certificate chain built on one of the compromised keys still passed.

The releases add a built-in block on the eight keys and update the bundled root list to remove three emSign roots. Go made the same block in its own update on October 20.

Connections resumed from a session that began before the update are not re-checked until that session times out, and end-of-life lines do not get the block.

Updated Dependencies

Beyond the 10 flaws, the updates refresh several bundled parts. The copy of undici, the HTTP client behind fetch(), moves to a version that fixes three moderate advisories: one in its Subresource Integrity check and two memory-exhaustion flaws, one of them in the WebSocket client built into Node.js.

Node.js also updated its bundled c-ares on all lines, OpenSSL on 22.x and 24.x, and SQLite on 22.x, to include fixes for publicly known vulnerabilities.

If You Cannot Upgrade Yet

Upgrading is the fix. The advisory offers no temporary workaround for the Brotli flaw, so an application that cannot upgrade immediately has no fallback within Node.js itself.

Vercel, which runs Node.js for its customers, said it added firewall rules on October 21 that block the attack in inbound requests. The rules do not cover Brotli responses an application fetches from other servers, and do not replace upgrading.

from The Hacker News https://ift.tt/tcIeNi6
via IFTTT

Someone Tried to Exploit PHP2Shell 4 Days Before the Vulnerabilities Were Publicly Disclosed

Amazon's Threat Intelligence team on Wednesday said it detected an attempt to exploit the newly disclosed PHP2Shell vulnerabilities on October 17, 2026, against its MadPot honeypot service, as the flaws are being broadly exploited in the wild following the release of the patches.

"The exploit attempt originated from an IP address associated with a commercial anonymization network," CJ Moses, CISO of Amazon Integrated Security, said in a post shared with The Hacker News.

"While the vulnerability was under embargo, the targeting of a honeypot from an anonymized IP address suggests the activity was conducted by a threat actor, though it remains unclear how the actor acquired exploit information prior to disclosure."

The attempt, Amazon said, was recorded from "103.216.220[.]92," an IP address geolocated to Australia.

The activity relates to a set of two vulnerabilities impacting PHP core, both rated 9.2 on the CVSS scoring system. Tracked as CVE-2026-109618 and CVE-2026-109619 and discovered by researchers from Calif, OpenAI, and Google-owned Wiz, the flaws can be abused to achieve pre-authentication remote code execution on affected systems.

The shortcomings are present in every PHP release from the 7.x and 8.x series, and pose a risk to every reachable PHP endpoint on an affected server, including static forms, login routes, and health checks. According to CrowdStrike, an attack exploiting the flaws leaves virtually no digital traces.

"There is no authentication to bypass, no session to steal, and no vulnerable endpoint to discover," CrowdStrike said. "The exposure is independent of the CMS, framework, or plug-ins in use."

"Worker processes remain stable, responses return HTTP 200, and application logs record no anomalies, because no application code ever ran. The only server-side trace is a single memory-limit fatal in the web server's error log, which is routinely dismissed as noise, leaving defenders without actionable web telemetry to identify compromised endpoints."

Originally scheduled for coordinated disclosure on October 22, 2026, at 2:00 p.m. UTC, details about the CVE identifiers and a proof-of-concept (PoC) exploit leaked ahead of time, prompting the PHP Foundation to move the release forward by one day.

"Both issues sit in parts of PHP that nearly every request touches: memory management and error handling," the PHP Foundation said. "Their central place in PHP is what made both vulnerabilities serious, and also so hard to fix without breaking compatibility, hurting performance, or forcing changes on the large ecosystem of third-party extensions."

Amazon said it detected multiple PoC exploits for PHP2Shell coinciding with the day of the release of the fixes, with the earliest attempt flagged around October 21, 2026, at 2 a.m. UTC.

This was followed by additional exploitation attempts from anonymized infrastructure over the next six hours. The variety of payloads and the anonymization infrastructure used indicate that multiple threat actors are involved, Amazon Threat Intelligence said.

The attempts have been recorded from the following IP addresses on October 21, 2026 -

• 31.223.184[.]166
• 37.19.200[.]5
• 134.209.159[.]64
• 103.114.163[.]188
• 95.217.98[.]37

According to ELLIO, the first PHP2Shell request targeting its sensors was observed on 21 October at 8:36 a.m. UTC, less than an hour after "Chainguard unilaterally broke the embargo and published built images containing the fix."

"Chainguard had received the patch in advance so its users could update the moment the vulnerabilities were disclosed," the PHP Foundation said. "Any attacker could now study the fix in binary form while every other PHP user was still waiting for the release. This disregarded weeks of work by many parties toward a coordinated disclosure."

The severity of the vulnerabilities has prompted warnings from international cybersecurity agencies such as the U.K. National Cyber Security Centre (NCSC) and the U.S. Cybersecurity and Infrastructure Security Agency (CISA), urging organizations to apply the fixes as soon as possible or consider taking them offline.

"Monitor web servers for suspicious activity, including PHP processes unexpectedly launching command shells or downloading files," the U.S. Federal Bureau of Investigation (FBI) said in an X post. "Ensure appropriate process-monitoring capabilities are in place to help identify potential exploitation."

In a similar alert, the U.S. National Security Agency (NSA) said the vulnerabilities can provide threat actors with a direct path to the server's file system or database. OpenAI, which described the flaws as "one of the most impactful security issues in recent memory," has released a Codex skill to check if a website or local PHP binary is vulnerable to PHP2Shell.

With PHP powering a majority of the websites in the world, the vast attack surface, coupled with the severity and ease of exploitation of the PHP2Shell flaws, poses major risks as it allows unauthenticated attackers to execute code and steal sensitive data.

"PHP is used by almost 70% of websites," Cloudflare said. "The php2shell vulnerabilities affect the PHP runtime itself and can allow attackers to execute malicious code on vulnerable servers, expose customer data, or disrupt services. Because PHP underpins widely used platforms such as WordPress and Magento, these flaws could potentially affect a large number of applications across the internet."

VulnCheck's analysis has identified PHP on 2,608,039 internet-facing hosts, out of which over 700,000 hosts run PHP 3.x through 7.3. Another set of about 400,000 hosts run PHP versions 7.4, 8.0, or 8.1, while 403,000 hosts run supported 8.2 through 8.5 branches.

"PHP is a massively popular language, and powers large parts of the internet," Ilkka Turunen, Field CTO at Sonatype, said in a statement. "The immediate priority is clear accountability: know where PHP is used across your services and products, who owns remediation, and how quickly fixes can be deployed."

"It is likely there is a long tail of environments needing to apply this patch as PHP is bundled into many other operating system distributions, as well as is found in many historic environments."

Some of the other notable developments are listed below -

• WebOps platform Pantheon said it has blocked over 60,000 suspicious requests probing the vulnerability.
• VulnCheck has identified two hosts, 85.11.167[.]243 and 45.198.224[.]169, with the user-agent "php2shell-scan/109618" weaponizing CVE-2026-109618 to target its honeypots, while 109.71.252[.]97 has leveraged both the flaws.
• Cloudflare has observed attack traffic targeting its customers, with threat actors "mutating the attack payload to try to bypass our protections by tracking the volume of matches and cross-referencing with the rule logic."
• CloudLinux has released fixed packages for ea-php52 through ea-php85 and every alt-php version.
• Additional guidance and mitigations have been published by numerous security and software vendors, including Akamai, Amazon Web Services (AWS), Arctic Wolf, Automattic, Cisco Talos, Corelight, CyCognito, Fastly, Google Cloud, Hadrian, Imperva, NetSPI, Orca Security, OX Security, Palo Alto Networks Unit 42, Pentest Tools, Rapid7, ReliaQuest, SOCRadar, Searchlight Cyber, Sophos, Tanium, Vercel, watchTowr, and Zscaler.

"The time from patch to working exploit is shrinking for structural reasons," Moses said. "In the past, most exploitation we observed came after a public proof of concept was released. A small number of capable actors built exploits, and everyone else waited for them.."

"That dependency is weakening. AI-assisted analysis makes it cheaper to turn a patch diff or advisory into a working exploit. As a result, more actors can act within hours or even minutes once technical details of a vulnerability are disclosed."

from The Hacker News https://ift.tt/UCPEbag
via IFTTT

U.S. Orders DeepSeek Removed From Federal Civilian Systems, Bans New Purchases

U.S. federal civilian agencies must remove DeepSeek products from their information technology systems, along with any third-party products or services "developed using DeepSeek implementations," under a Department of Homeland Security order.

They may also no longer buy information technology products or services from the Chinese AI developer or its affiliates

Homeland Security Secretary Markwayne Mullin issued the order, dated July 24, 2026, under the Federal Acquisition Supply Chain Security Act of 2018, and the department published it in the Federal Register on October 20. The notice does not define "DeepSeek implementations."

The order names Hangzhou DeepSeek Artificial Intelligence Co., Ltd., the developer of the R1 and V3 models, and covers its affiliates as defined in federal acquisition rules. The company's privacy policy says it collects, processes and stores users' personal data in the People's Republic of China.

Under the 2018 law, the Federal Acquisition Security Council recommends exclusion and removal orders, and three officials may issue them: the Secretary of Homeland Security for civilian agencies, the Secretary of Defense for the Defense Department and national security systems, and the Director of National Intelligence for the intelligence community.

The DeepSeek order therefore covers only what civilian agencies buy and run. It does not restrict companies or the public.

The 2018 law was first used in 2025, when the Director of National Intelligence excluded Acronis, a Swiss cybersecurity and data protection company, from intelligence community procurement and ordered its products removed from intelligence community systems.

Executive agencies "shall comply with exclusion and removal orders," the law says. An agency can ask the official who issued an order for an exception, and under the council's regulations the request must be in writing and give a compelling justification.

DHS directs questions about the order to CISA's FASCSA Order Implementation Team at fascsa.orders@cisa.dhs.gov.

The order also reaches government contractors. A federal contract that carries FAR clause 52.204-30 bars the contractor from providing or using, in performing the contract, any product or service covered by an applicable FASCSA order, unless the issuing official has granted a waiver.

The clause also requires the contractor to:

• Search SAM.gov for the phrase "FASCSA order" at least once every three months
• Make a reasonable inquiry into its supply chain when a new order could affect it
• Report any covered product or service it has provided or used to the contracting officer within 3 business days of identifying it
• Send further information on mitigation within 10 business days of that report
• Include the clause in its subcontracts

An order issued after a solicitation applies to an existing contract only once the contracting officer adds it by amendment or modification.

The Federal Register notice gives no reasons for the order. The signed order is attached to the notice as four scanned pages and is posted on regulations.gov under docket DHS-2026-0628.

The order is dated July 24. DHS filed it for public inspection at the Federal Register on October 19, 87 days later, and it was published the next day.

The council's regulations leave public release of an order to the issuing official, who "May provide a copy of the order to other persons, including through public disclosure." They set no deadline for it.

The law requires the issuing official to notify the company named in an order and the appropriate congressional committees, and to review the order at least once a year.

Before the order, U.S. restrictions on DeepSeek were device bans adopted one body at a time. By February 2025, Congress, NASA, the Navy, the Pentagon and Texas had barred DeepSeek from government devices. Bills to bar DeepSeek on government devices were introduced in the House and Senate that month and had not advanced past committee as of October 21.

China's foreign ministry spokesperson Mao Ning said at a briefing on October 20 that "China consistently opposes the overstretching of the concept of national security" and that Beijing will "resolutely safeguard the legitimate rights and interests of Chinese companies," the Associated Press reported. DeepSeek did not immediately respond to the AP's request for comment.

from The Hacker News https://ift.tt/K3U5qR0
via IFTTT

China-Linked Hackers Use ARTEX AI Agents in ConnectWise Supply Chain Attack

Microsoft on Wednesday disclosed that a China state-aligned actor dubbed Storm-0940 was behind the recent supply chain compromise of the ConnectWise Cloud Backup application.

During the incident, Storm-0940 used ARTEX, a Go-based agentic AI penetration testing framework that was made closed-source in the wake of its abuse against South Korean financial institutions, to speed up scanning and reconnaissance, password spraying, and OAuth application abuse at downstream victims.

The tech giant said the threat actor used the AI tool at "machine speed" to automate attacks targeting hundreds of organizations across the world spanning a broad range of sectors since September 2026. Targets include aerospace and defense, automotive, chemicals, energy, financial services, government, legal, manufacturing, media, military, semiconductor, software, technology, and think tanks and non-profits.

"Storm-0940's use of ARTEX accelerated the speed of compromised application abuse to authenticate to target environments through applications that had already been granted access, allowing the threat actor to operate without requiring an interactive user sign-in," Microsoft said.

"AI-accelerated follow-on activity included reconnaissance, application credential changes, and attempts to modify privileges that could enable expanded or persistent access."

Storm-0940 was first detailed by Microsoft in November 2024, revealing that the threat actor has been leveraging a botnet called Quad7 (aka CovertNetwork-1658) to conduct highly evasive password spray attacks. The threat actor is assessed to be active since at least 2021.

The adversary is also said to exploit internet-facing applications to gain initial access, followed by using compromised accounts to move through targeted environments. It has also been observed establishing persistence by adding credentials to existing OAuth applications within cloud infrastructures to ensure access to Microsoft 365 resources.

According to Microsoft, a chunk of these ARTEX-driven attacks have resulted in the adversary gaining privileged access to an organization's cloud infrastructure, including several instances where the time frame from initial targeting to privileged access was less than 3 hours.

In the case of the ConnectWise incident, Storm-0940 has been observed using ARTEX to attempt to sign in to more than 2,250 tenants at 2,900 sign-in attempts per minute, a pace the company said gives defenders a short window to detect and respond.

"Between October 10 and 14, 2026, Storm-0940 infrastructure at 144.172.64[.]99 conducted an automated cross-tenant password-spray campaign targeting 327 accounts across eight organizations to gain access to Microsoft 365 and Exchange Online," Microsoft said.

During this window, Microsoft said it captured over 151,000 failed logon events. The activity peaked on October 11 at 2,900 failures per minute, resulting in more than 111,000 failures in a single day. Of these, 48 accounts received more than 1,000 failures. No successful authentication, token issuance, Graph call, or directory change was detected, it noted.

That changed on October 15, 2026, when the AI agents gained access to the identities of multiple ConnectWise cloud applications and began to use them to authenticate to customer environments.

"Additionally, after acquiring control of the identities of multiple ConnectWise cloud applications, the AI agents operating on behalf of the threat actor continued to use the same IP range to authenticate to customer environments using the illicit access acquired through these stolen app credentials, effectively taking advantage of the already established trust by these apps within a tenant," the tech giant added.

In some of these cases, the AI agents are assessed to have progressed beyond authentication to Microsoft Graph and directory operations. This included reconnaissance, application credential modifications to establish persistence, and changes involving identities, groups, and privileged roles.

"The application credential modification made by Storm-0940’s associated agents in the targeted victims' environments can lead to persistence through other identities, credentials, and cloud services," Microsoft said. "These changes can remain active as a backdoor even after the original compromised application is mediated."

Storm-0940 is far from the only hacking crew to rely on ARTEX. Microsoft said it has observed threat actors across multiple geographic regions weaponizing the framework in their operations.

The findings once again highlight how threat actors are increasingly integrating agentic AI tools into their offensive security workflows to quickly carry out attacks at scale.

"Agents are not constrained by factors affecting humans – they can work around the clock, on weekends, and on holidays and attempt multiple breach paths simultaneously, enabling significantly reduced time from selecting a target to achieving objectives, increasing the speed and impact of complex attacks like supply chain compromises," Microsoft said.

In response to the findings, ConnectWise said the activity "describes a campaign that reaches well beyond any one company," adding "nation-state actors are increasingly targeting the software supply chain, because one trusted connection can open the door to many organizations."

"AI now lets them test those connections at [...] 'machine speed.' MSPs are in the middle of that chain. They are targets in their own right, and they are also a path into every client they serve. Every vendor and every MSP must defend itself with both of those risks in mind."

ConnectWise, which temporarily shut down services following the attacks, has been restoring services in phases, a process that it said will take several days.

from The Hacker News https://ift.tt/uMGDx42
via IFTTT