PHP2Shell Exploit Attempts Hit Millions as Attackers Try to Deploy Mirai Malware

Threat actors have been observed unsuccessfully attempting to exploit the newly disclosed PHP2Shell vulnerabilities to rope infected systems into a Mirai botnet variant called Potassium, as it emerges that weaponizing the flaws may be harder than previously thought.

The attacks aim to exploit CVE-2026-109618 and CVE-2026-109619 (CVSS scores: 9.2), which can result in unauthenticated remote code execution (RCE) via specially crafted HTTP requests. The vulnerabilities have been patched in PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35.

"However, analysis of the sample revealed that it is an updated and significantly expanded version of the Mirai-derived botnet variant identified in early 2026," Sophos said. "The sample displays downloader and network disruption functionality."

Specifically, it resolves a hard-coded, encrypted command-and-control (C2) address, establishes a TCP connection to 134.199.154[.]64, and sends an HTTP request. The malware then checks for an HTTP 200 response status and verifies that the resulting payload begins with the ELF magic bytes 7F 45 4C 46, indicating that it expects a Linux ELF binary as a follow-on payload.

"A resolver function supports IPv4 addresses and hostname resolution, with additional fallback resolution logic that includes hard-coded public DNS servers such as 8.8.8.8, 1.1.1.1, and 1.0.0.1," Sophos added. "As with Mirai malware historically, this sample can execute DDoS attacks."

The attacks have been found to originate from the following three IP addresses -

• 85.11.167[.]243
• 217.60.242[.]76
• 45.198.224[.]169

These attack sources have been found to contact 92.118.112[.]100 to retrieve a loader, which is responsible for deploying the Mirai botnet variant. Further analysis of the artifact within a network-contained sandbox has revealed that the botnet issues a DNS query for thunder.godofthunder[.]st, resolves it to 134.199.154[.]64, and establish a C2 channel on TCP port 50792.

The end goal is to launch sustained volumetric flood attacks against two adjacent hosts located within a single Ukrainian network -

• 45.88.138[.]0
• 45.88.138[.]44

The lack of a successful attack leveraging PHP2Shell in the wild suggests that threat actors are "struggling" to come up with reliable exploits, Sophos added.

Potassium was first flagged by botnet tracking platform Synthient in March 2026. In a follow-up analysis, Nokia Deepfield researchers described the malware as a Mirai fork which uses "ChaCha20 for the static config table (the first time we have seen ChaCha20 used this way in a Mirai variant), a single static byte (0xED) for everything on the wire, a named reverse-shell protocol (SHELL / SHOUT) on the same channel as attack commands, and a DNS misdirection scheme that swaps the two 16-bit halves of every resolved A record before connect()."

Arctic Wolf, which also shared additional details of the same weaponized PHP2Shell exploitation attempt, said the botnet supports 24 commands to facilitate flood attacks over ICMP, TCP, UDP, and OpenVPN protocol. Both builds for ARM and x86 also contain configuration for resolving C2 infrastructure through Ethereum Name Service (ENS).

"ENS resolution was disabled in both samples, indicating that the capability was present but inactive," the cybersecurity firm said. "If enabled in future variants, it could complicate disruption by reducing reliance on registrars and DNS providers, requiring defenders to block the ENS names, RPC infrastructure, and resolved command-and-control addresses."

Threat Actor Mass Exploits PHP2Shell

The development comes as SOCRadar said it found PHP2Shell exploit tooling for PHP 8.4.26 on an exposed attacker-controlled server ("206.188.197[.]105:9999"), alongside three screening scripts that check live websites for preconditions the PHP2Shell chain depends on.

The scripts, according to the cybersecurity company, checked about 20 public websites for the PHP version, server setup, and session settings the exploit needs. These websites span Canada, China, Finland, France, Poland, the U.K., and the U.S.

"The central file, aslr_exploit.py, is a Python exploit the operator labels a 'one-click' PHP2Shell exploit for PHP 8.4.26 under Apache mod_php," SOCRadar said. "It works entirely over ordinary HTTP requests in three broad steps: it recycles the target's PHP worker, leaks memory addresses through the session cookie to defeat address space layout randomization (ASLR), and then abuses PHP's session upload progress handling to run a shell command."

ASLR, short for Address Space Layout Randomization, is a cybersecurity mechanism that randomizes the memory locations used by system files and programs each time they are run, making it harder for attackers to predict where code will load. This built-in defense helps defend against memory-based exploits, such as buffer-overflow attacks.

The other three companion scripts are as follows -

• php2shell_fp.py, which reads PHP version and server setup from about 20 sites
• deep_probe.py, which examines 11 of those sites for visible errors, phpinfo pages, file inclusion, and session injection to ascertain whether they meet exploit prerequisites
• wp_attack.py, which focuses on five WordPress sites to conduct user and plugin enumeration

That said, there is no evidence of shell access on any screened site as of October 22, 2026, indicating the targeted sites did not meet the exploit's preconditions.

The toolset is assessed to be part of a broader operation that involves the attacker extracting API keys and backend URLs from websites' client-side JavaScript, systematically sweeping web and API routes for unauthenticated access, and using a pool of rotating proxies to spread traffic and evade rate limits and blocking.

"Related artifacts on the server additionally point to web-archive reconnaissance and automated CAPTCHA solving," SOCRadar noted. "Taken together, the toolset points to a financially motivated actor focused on cryptocurrency and Web3 targets."

The same exploitation server ("206.188.197[.]105") has also been flagged by Hunt.io, which said the threat actor behind the operation has targeted 123 servers across cloud, shared-hosting and ISP networks. "About 57 run PHP, many on unsupported 5.x to 7.x," the threat intelligence firm said. "Ten rejected the request outright, including three of the five sitting behind Cloudflare. None was exploited."

In all, 10 open directories hold PHP2Shell-related tooling -

• 206.188.197[.]105
• 102.210.149[.]166
• 122.10.110[.]72, 122.10.17[.]49
• 58.221.60[.]160:8000
• 41.223.30[.]7, 157.230.117[.]70
• 104.219.251[.]31
• 107.150.31[.]151
• 217.160.132[.]82
• 47.100.125[.]108, 54.169.109[.]7, 139.162.165[.]136

Defeating ASLR Protections

The disclosure also coincides with the development of a PHP2Shell exploit that can achieve remote code execution on ASLR-enabled x86-64 systems with PHP's recommended production configuration.

"One of the biggest obstacles has been address space layout randomization (ASLR), a protection designed to make memory corruption vulnerabilities much harder to exploit," Spencer McIntyre, director of exploit development at VulnCheck, told The Hacker News.

"Our team developed a novel technique [...] that chains the two vulnerabilities together, using a memory leak to bypass ASLR and achieve remote code execution on x86-64 systems, even with PHP's recommended production error-display setting."ir

"We haven't identified another public or commercial exploit that achieves this under the same conditions. Developing this capability was far from trivial, but it demonstrates that a major barrier to exploiting PHP2Shell on production-configured systems can be overcome."

Consequences of successful exploitation of the flaws are severe, as it permits an attacker to execute code with the permissions of the web application, potentially gaining access to API keys, database connections, and other internal services the application can reach, VulnCheck said.

"An attacker doesn't necessarily need administrator or root access to cause significant damage," McIntyre said. "Access to a vulnerable web application could provide a foothold into other parts of an organization's infrastructure."

Exploit Attempts Plenty, None Successful

The findings also coincide with reports indicating broad exploitation attempts targeting the flaws are underway, including by a China-based IP address that has been observed trying to drop a web shell via a server-side session file.

Web infrastructure company Cloudflare said it observed tens of thousands of attempts to exploit the flaw 45 minutes after the flaws were publicly announced, before climbing to hundreds of thousands within 2 hours and millions as of early October 22, 2026.

"So far, most of the activity is scanning, along with some uncoordinated attempts to deliver various payloads," Cisco Talos said. "This is expected: scanning or basic exploitation with public proof-of-concept (PoC) code takes far less effort than integrating a vulnerability into an actor's own tooling."

Data from Previdian's telemetry has so far recorded hundreds of exploitation attempts targeting CVE-2026-109618 from dozens of IP addresses, and against CVE-2026-109619 to a lesser degree. The first exploit event aimed at CVE-2026-109618 was recorded on October 21, 2026, at 1:05 p.m. UTC.

"We've seen plenty of php2shell probes and exploitation attempts in our honeypots," Previdian said. "At the time of writing, we've observed no successful remote code execution and no dropped PHP files. Reliable RCE may be harder to achieve than initially expected."

This assessment has also been echoed by Beelzebub, Dataminr, and Wordfence, with observed activity so far limited to scanning, fingerprinting, and attempts to confirm command execution, steal credentials and secrets from environment variables, install persistent access, and retrieve and execute a second-stage payload.

Wordfence has shared the following IP addresses as among those attempting to exploit the flaws -

• 87.121.84[.]174
• 181.215.186[.]252
• 185.196.220[.]132
• 185.161.210[.]29
• 152.233.51[.]69
• 45.134.225[.]16
• 107.189.14[.]87
• 193.47.62[.]24
• 2409:40d2:204e:4be:2a1f:f9c9:a055:e00b
• 103.147.220[.]17

The severity of the flaws has also led to several government, school and hospital websites going offline across Asia, Europe, and North America out of an abundance of caution. The U.K. government has confirmed that 32 digital services are unavailable and four are partially unavailable, largely stemming from the precautionary shutdowns while security updates and mitigations were applied. The National Cyber Security Centre (NCSC) has issued approximately 50,000 warnings to businesses and other organizations.

"The vulnerable code dates back to PHP 5.4, released in 2012," the Sysdig Threat Research Team said. "The bugs live in the PHP engine, not within any application. For that reason, any WordPress, Drupal, or Joomla site with clean application code is still exposed."

With the fixes not available for older versions of PHP, PHP2Shell is expected to have a long tail, along the lines of Log4Shell. According to estimates from Google-owned VirusTotal, about 272,000 hosts run a supported PHP branch (8.2 to 8.5), Organizations on PHP 7.4, 8.0, or 8.1 are advised to move to a supported branch, or use a distribution backport.

Attack surface management platform Censys said it currently detects over 3.08 million hosts and 56.6 million web properties running PHP. Of these, more than 34.4 million PHP services are still assessed to be vulnerable as of October 23, 2026.

"Many applications with web servers and similar will likely remain vulnerable until their respective vendors patch these items," Dataminr said. "The implications of this are that many organizations will likely remain vulnerable to some degree for far longer than when patches are directly applied to owned and managed applications."

from The Hacker News https://ift.tt/4SR8zpC
via IFTTT

Meta Ordered to Pay $25 Billion After Court Finds 43 Million Privacy Violations

Social media giant Meta was ordered to pay 25 billion in penalties by a New Mexico court on Wednesday as part of a data privacy lawsuit that sprang from the company's Cambridge Analytica data scandal, which came to light in 2018.

According to multiple reports from the Associated Press, the New York Times, Reuters, and the Wall Street Journal, state District Court Judge Francis J. Mathew called out Meta and Facebook for making misleading statements about the privacy of consumers in the state.

"Facebook promised users that they (the users) controlled their data," Mathew wrote in his ruling. "This was false."

The penalty relates to more than 43 million violations of the state's unfair practices law. The case, filed in 2021, was filed in the aftermath of revelations that Cambridge Analytica, a British political consulting firm, obtained data belonging to millions of Facebook users without their consent to build psychographic profiles.

The data was collected via a personality quiz app called "thisisyourdigitallife." Around 300,000 users are said to have taken the psychological test, although it later emerged that the app also collected the data associated with their friends, thereby amassing a dataset of 87 million profiles.

Meta banned the app in 2015 for violating its platform policy. The company also sent a legal request to Cambridge Analytica to delete the collected data. Following the data scandal, Cambridge Analytica announced in May 2018 that it was immediately ceasing operations. Notably, the company was involved in Donald Trump's campaign during the 2016 presidential election.

In December 2022, Meta agreed to pay $725 million to settle a class-action lawsuit that accused the company of improperly sharing users' information with Cambridge Analytica. Previously, it faced a $5 billion fine from the U.S. Federal Trade Commission in 2019 for undermining users' ability to control their privacy on Facebook.

Back in August, the company also reached a settlement with nearly all U.S. states and territories, except New Mexico and Florida, to pay $18 billion over the next decade and implement stronger child-safety measures on Facebook and Instagram. This also includes $459 million for claims related to the Cambridge Analytica matter.

Meta chief legal officer C.J. Mahoney criticized the latest penalty, adding the company intends to appeal the decision.

from The Hacker News https://ift.tt/PByzq3D
via IFTTT

INTERPOL Arrests 1,462 Suspects, Disrupts 10,909 Cybercrime Networks in Global Crackdown

INTERPOL on Thursday announced that a coordinated law enforcement action has disrupted 10,909 malicious networks and recovered more than $105 million in illicit funds.

In tandem, the effort saw law enforcement agencies from 21 countries arrest 1,462 suspects. Codenamed Operation Serengeti III, the cybercrime crackdown took place between June 29 and August 31, 2026.

"Authorities identified 65,929 victims targeted by cybercriminal networks, underscoring the scale and sophistication of today's digital threats," INTERPOL said in a statement. "Financial investigations linked criminal activity to losses exceeding USD 385 million."

Participating nations included Angola, Benin, Cameroon, Congo, Côte d'Ivoire, Democratic Republic of Congo, Eswatini, Gabon, Gambia, Ghana, Kenya, Mozambique, Nigeria, Rwanda, Senegal, South Africa, Tanzania, Uganda, United States, Zambia, and Zimbabwe.

Group-IB, which was one of the many private sector partners, said it provided INTERPOL with threat intelligence data on phishing kits, botnets, and other malicious resources hosted in Africa or used to conduct cyber attacks targeting the region.

"Criminals cannot operate without infrastructure. They have to build it, connect it and maintain it, and those activities create opportunities to find them," said Jacomo Piccolini, vice president of Global Data Partnerships at Team Cymru.

"Instead of waiting for an attack and then investigating the damage, we can help expose the networks behind criminal operations and enable defensive actions. Operation Serengeti III demonstrates the real-world impact of putting that intelligence in the hands of law enforcement."

Some of the key operational highlights are listed below -

• Disruption of two transnational fraud rings and the arrest of 365 foreign nationals in Uganda linked to sophisticated online investment and pension fraud schemes targeting victims across Asia.
• Dismantling of two illegal cryptocurrency mining centers and the arrest of nine suspects in Angola, along with the seizure of 2,000 cryptocurrency mining devices and six illegal power transformation stations valued at over $1 million.
• Arrest of a suspect in Nigeria in connection with a large-scale phishing and business email compromise operation that collected software credentials and amassed about 2.1 million email addresses.
• Arrest of another suspect in Nigeria for operating an international investment fraud scheme advertised via messaging apps. The operation led to the movement of more than $2.4 million in suspected criminal proceeds, with a huge chunk of the funds laundered through cryptocurrency transactions.
• Arrest of 30 suspects linked to a cybercrime operation in the Republic of Congo.

Operation Serengeti III follows two previous waves that took place between September and October 2024, and June and August 2025, leading to more than 2,000 arrests.

"Cybercrime networks operate without regard for borders, exploiting technology to target victims on an unprecedented scale," Neal Jetton, INTERPOL's director of cybercrime, said.

"Operation Serengeti III reinforces a clear message: while cybercrime is increasingly borderless, international cooperation remains one of the most effective tools for disrupting criminal networks, recovering criminal assets and protecting communities from digital harm."

from The Hacker News https://ift.tt/GYLknaA
via IFTTT

The AI Agent Nobody Owns: Watch Expert Webinar On Your Newest Insider Threat

Right now, there is probably an AI agent running on a laptop somewhere in your network. It stores API keys and database passwords, can access your internal systems, and works without anyone watching.

Nobody reviewed its access. Nobody owns it.

If an employee had that much reach with that little oversight, you would call it an insider risk. So why do we still call the agent a productivity tool?

Most of the conversation about AI security is about what threat actors are doing with it. But the bigger threat may already be inside your organization.

That's the focus of our upcoming webinar, AI as an Insider Threat: From Shadow AI to Governed AI, with expert guest Richard De La Torre, Technical Product Marketing Manager at Bitdefender. Save your seat for a practical security playbook on bringing that unseen AI under control.

Where AI is hiding on your endpoints

It isn't only developers. AI agents, coding assistants, MCP servers, and browser extensions are turning up across the business.

And most of them never cross your network gateway in a way the tools you already run would recognize.

The result is a hard irony. The AI with the most access is often the AI your security team can't see.

📅 Save Your Spot: Watch the Webinar

The visibility gap, by the numbers

According to Bitdefender's 2026 Cybersecurity Assessment report, only 51.8% of organizations report having full visibility into the AI tools their staff use. That leaves nearly half without the full picture.

That blind spot has a cost. IBM found that 20% of breached organizations were compromised through shadow AI.

Which raises the question: what can organizations realistically do about it? That's exactly what the webinar gets practical about. Register now to see what a lean team can do about the AI it can't yet see.

From shadow AI to governed AI

New research from Bitdefender Labs looks at what's really running on endpoints, based on real machines; among the findings: a malicious agent skill caught in the wild.

Blocking AI outright is the obvious response, but it tends to fail. The alternative is governed adoption, and the session shows what that looks like in practice.

What you'll take away

• Where AI is actually showing up on your endpoints, and why the tools you already run don't see most of it.
• New research from Bitdefender Labs on real machines, including the malicious agent skill caught in the wild.
• Why an AI agent with credentials and no owner behaves like an insider risk, and what to do about it.
• Why blocking AI outright tends to fail, and what governed adoption looks like instead.

The AI already running on your endpoints won't wait for a policy. Join expert guest Richard De La Torre, Technical Product Marketing Manager at Bitdefender, and save your seat for AI as an Insider Threat.

📅 Save Your Spot: Watch the Webinar

Found this article interesting? This article is a contributed piece from one of our valued partners. Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.

from The Hacker News https://ift.tt/yFBpHXx
via IFTTT

ActiveState Partners with Docker to Secure the Open Source in Enterprise Containers

Even security teams that have invested in a hardened base image often can’t say what’s running on top of it. In a recent survey of 250 North American DevSecOps leaders, 91% named visibility into container components as their single biggest blind spot. Not the base image, but everything layered onto it. And 90% said their teams still run lightly modified public images with little to no hardening. 

That gap is getting harder to ignore. AI coding assistants are adding dependencies faster than teams can review them. Vulnerability databases can no longer keep pace with the volume of submissions. New regulatory requirements, including the EU Cyber Resilience Act, are also increasing expectations around vulnerability handling, remediation, and software supply chain transparency. 

Docker Hardened Images meet ActiveState’s Curated Catalog

Docker, Inc. and ActiveState today announced a reselling partnership that brings Docker Hardened Images (DHI) together with ActiveState’s curated open source packages, giving enterprises a more consistent way to secure both the container base and the software dependencies layered on top.

DHI provides secure-by-default, minimal container images, with 4,000+ images built from source, near-zero CVEs, signed SBOMs, and SLSA Build Level 3 provenance. The catalog is free and open source under Apache 2.0, with production tiers backed by a 7-day SLA for critical and high-severity CVEs. 

ActiveState extends that trusted foundation to the open source dependencies developers add on top. Its curated components span more than a dozen language ecosystems, including Python, JavaScript, Java, Perl, Tcl, and Ruby. Components are built from source, continuously maintained and remediated against contractual SLAs, and delivered through the package managers, pipelines, IDEs, and AI coding tools development teams already use. 

Trust across the software stack

• A more consistent approach to trusted open source: Pair a hardened container base with curated open source dependencies, reducing the need to source and manage each layer separately
• Verifiable provenance across the stack: With both Docker and ActiveState building from source to SLSA Build Level 3 standards, teams get a more consistent evidence trail across the software supply chain
• Fewer vulnerabilities, without slowing teams down : DHI delivers near-zero CVEs, 95% smaller attack surface, 7-day SLA on critical/high CVEs. ActiveState provides 95% fewer CVEs and 90% faster remediation than community open source, backed by a 5-day SLA on critical vulnerabilities.

Available Now

The Docker and ActiveState reselling partnership is available now. Explore the partnership.

from Docker https://ift.tt/cexdiUf
via IFTTT

OpenCode Flaw Lets Malicious MCP Servers Execute Code During Sign-In on Windows and WSL

A flaw in the OpenCode AI coding agent allowed a malicious or hijacked MCP server to run code on a developer's Windows or WSL machine when the developer signed in. OpenCode connects to MCP (Model Context Protocol) servers to add outside tools, and such code would run with the developer's own access.

Anomaly, the company behind OpenCode, fixed the flaw in version 1.18.33 on September 28. It did not request a CVE or publish a security advisory, so vulnerability scanners will not flag the builds still at risk: 1.0.137 through 1.18.32.

During that sign-in, the server itself supplies the web address the user is sent to, an OAuth "authorization endpoint." On Windows and WSL, OpenCode handed that address to a helper that opens it in a browser. The helper built a PowerShell command around the address without escaping it, so an address written to carry a PowerShell command would run that command.

The browser step runs only when a developer starts the sign-in, by running opencode mcp auth or making the matching request. Having the server configured, or opening a session, does not reach it.

The attacker needs control of a remote MCP server the developer has added, and that server need not be hostile from the start. One that is later taken over, or a domain that changes hands, could carry the same address.

Pillar Security, which found the flaw and disclosed it on October 19, rates it critical, with a proposed severity score of 9.8 out of 10.

The flaw affects OpenCode on Windows and the Windows Subsystem for Linux (WSL). macOS and Linux are not affected, because OpenCode opens the browser there without passing the address through a shell.

OpenCode shipped the fix as a routine change. The pull request that carried it is described as a refactor of browser-launch code, and neither it nor the release notes mention a security flaw.

Anomaly did not request a CVE or publish an advisory. Its security policy says MCP servers that a user configures are "outside our trust boundary."

Pillar reported the flaw privately on August 29 and later asked Anomaly to reconsider and request a CVE. Anomaly's answer was that a malicious MCP server falls outside its threat model, according to Pillar.

Because there is no CVE, the flaw will not show up in scanners or dependency alerts, so finding affected installs means checking the OpenCode version directly. Anomaly has published advisories for other OpenCode code-execution flaws this year, including one fixed in August.

The same kind of flaw has surfaced before. In July 2025, the mcp-remote proxy carried an almost identical bug, in which a malicious server's authorization endpoint reached the command line. It was assigned CVE-2025-6514.

OpenCode's browser helper is a widely used package called open. Its Windows behavior was reported as a command-injection risk in 2023 and fixed in open's version 11, but OpenCode stayed on an older release.

The usual defense for this class is to check that the address uses HTTP or HTTPS. It does not help here, because the attack uses an ordinary HTTPS address. OpenCode added that check as well, but the hole was closed by updating it to the fixed version.

What to Do

Anyone running OpenCode on Windows or WSL should upgrade and check which servers they are connected to.

1. Upgrade to OpenCode 1.18.33 or later.
2. If you cannot upgrade yet, remove any remote MCP servers you have not vetted from your OpenCode configuration.
3. Run opencode mcp list to see which servers are configured.

Pillar reported no signs that the flaw has been used in attacks and published no indicators to check for past exploitation. The flaw is separate from a breach of OpenCode's hosted Console disclosed around the same time, which may have exposed some users' stored API keys for OpenAI, Anthropic, and Google.

from The Hacker News https://ift.tt/qj7Kevx
via IFTTT

Node.js Brotli Decoder Bug Could Allow Remote Code Execution in All Supported Versions

Node.js released security updates on October 21 for its three supported release lines, 22.x, 24.x and 26.x, fixing 10 flaws. The most serious is a bug in the Brotli decompression code that Node.js bundles, which the project says can allow remote code execution, meaning an attacker could run code of their choosing on the affected system.

Each supported line has one fixed version: 22.23.4 and 24.22.1 on the long-term support lines, and 26.12.1 on the current line. Node.js 20.x and earlier have reached end of life and will not receive the fix, so they should be moved to a supported line.

The Brotli flaw is in code Node.js bundles, not in a user's own program. Node.js runs that code whenever it decompresses Brotli data, either directly through the node:zlib module or automatically when code calls fetch() on a response sent with Brotli compression.

An application is exposed where it decompresses Brotli data an attacker controls, such as a request body or a response fetched from another server.

The Brotli Flaw

The flaw is an out-of-bounds write in the Brotli decoder, set off by malformed compressed input. The fix is an upstream patch from the Brotli project that Node.js copied in, and it makes the decoder catch invalid input and stop earlier rather than writing past the buffer.

Brotli is Google's compression library, and Node.js ships its own copy. The same fix shipped in Brotli 1.2.1, 1.1.1, and 1.0.10 on October 21, so other software that bundles Brotli may need the same update. The change was first made in Brotli's source in February 2026 and shipped as a security release only in October.

"Remote code execution" is the project's description of what the flaw could allow, and the flaw is rated high rather than critical. How far that has been shown in practice is narrower.

A public proof-of-concept published on October 22 reached code execution only against a deliberately weakened test build. On a standard Node.js build, its author reported a crash and a limited read of process memory, not code execution, and said a working attack on a normal build was not achieved.

Patched Node.js rejects the malformed input the proof-of-concept uses, and no exploitation of the flaw in the wild has been reported as of October 22.

The Other Flaws

Three of the other fixes are also rated high. Two are TLS certificate checks an attacker could bypass by writing a server's IP address in an unusual form, so a certificate matches a host it should not (CVE-2026-106069 and CVE-2026-105483). The third stops dns.resolve from cutting a hostname short at an embedded null byte (CVE-2026-105482).

Node.js rates CVE-2026-105483 high, though the commit that fixed it calls the bug low-severity and hard to exploit.

The rest are medium and low severity. One medium flaw makes crypto.randomUUID() and crypto.randomInt() hand back the same values in every process when an application is built as a startup snapshot or a single-executable application (CVE-2026-106074), which undermines anything that relies on those values being unpredictable.

The full set, and the lines each one affects:

CVE	What it is	Severity	Affected lines
CVE-2026-111497	Out-of-bounds write in the Brotli decoder; remote code execution, per the project	High	22.x, 24.x, 26.x
CVE-2026-106069	TLS hostname-check bypass when a host resolves to an IP address in non-canonical form	High	22.x, 24.x, 26.x
CVE-2026-105483	TLS hostname-check bypass when an IP is written in fullwidth digits	High	24.x, 26.x
CVE-2026-105482	dns.resolve truncates names that contain a null byte	High	22.x, 24.x, 26.x
CVE-2026-105481	Keep-alive socket can process a response written before the request was sent	Medium	22.x, 24.x, 26.x
CVE-2026-106072	Certificate validation for non-canonical IPv4 lets DNS names authenticate IP endpoints	Medium	22.x, 24.x, 26.x
CVE-2026-106074	randomUUID() and randomInt() caches reused in startup snapshots and single-executable apps	Medium	22.x, 24.x, 26.x
CVE-2026-106070	ZipFile returns attacker-controlled bytes after a failed header check	Low	26.x
CVE-2026-106071	Permission Model over-grants file access through a wildcard lookup	Low	26.x
CVE-2026-106073	Permission Model bypass with fs.realpathSync	Low	22.x, 24.x, 26.x

The eMudhra Certificate Block

The same updates also stop Node.js from trusting eight intermediate certificate authority keys from the Indian provider eMudhra that were reported compromised days earlier.

Node.js uses the Mozilla root certificate list but does not perform revocation checks by default, so before this update, a certificate chain built on one of the compromised keys still passed.

The releases add a built-in block on the eight keys and update the bundled root list to remove three emSign roots. Go made the same block in its own update on October 20.

Connections resumed from a session that began before the update are not re-checked until that session times out, and end-of-life lines do not get the block.

Updated Dependencies

Beyond the 10 flaws, the updates refresh several bundled parts. The copy of undici, the HTTP client behind fetch(), moves to a version that fixes three moderate advisories: one in its Subresource Integrity check and two memory-exhaustion flaws, one of them in the WebSocket client built into Node.js.

Node.js also updated its bundled c-ares on all lines, OpenSSL on 22.x and 24.x, and SQLite on 22.x, to include fixes for publicly known vulnerabilities.

If You Cannot Upgrade Yet

Upgrading is the fix. The advisory offers no temporary workaround for the Brotli flaw, so an application that cannot upgrade immediately has no fallback within Node.js itself.

Vercel, which runs Node.js for its customers, said it added firewall rules on October 21 that block the attack in inbound requests. The rules do not cover Brotli responses an application fetches from other servers, and do not replace upgrading.

from The Hacker News https://ift.tt/tcIeNi6
via IFTTT

Someone Tried to Exploit PHP2Shell 4 Days Before the Vulnerabilities Were Publicly Disclosed

Amazon's Threat Intelligence team on Wednesday said it detected an attempt to exploit the newly disclosed PHP2Shell vulnerabilities on October 17, 2026, against its MadPot honeypot service, as the flaws are being broadly exploited in the wild following the release of the patches.

"The exploit attempt originated from an IP address associated with a commercial anonymization network," CJ Moses, CISO of Amazon Integrated Security, said in a post shared with The Hacker News.

"While the vulnerability was under embargo, the targeting of a honeypot from an anonymized IP address suggests the activity was conducted by a threat actor, though it remains unclear how the actor acquired exploit information prior to disclosure."

The attempt, Amazon said, was recorded from "103.216.220[.]92," an IP address geolocated to Australia.

The activity relates to a set of two vulnerabilities impacting PHP core, both rated 9.2 on the CVSS scoring system. Tracked as CVE-2026-109618 and CVE-2026-109619 and discovered by researchers from Calif, OpenAI, and Google-owned Wiz, the flaws can be abused to achieve pre-authentication remote code execution on affected systems.

The shortcomings are present in every PHP release from the 7.x and 8.x series, and pose a risk to every reachable PHP endpoint on an affected server, including static forms, login routes, and health checks. According to CrowdStrike, an attack exploiting the flaws leaves virtually no digital traces.

"There is no authentication to bypass, no session to steal, and no vulnerable endpoint to discover," CrowdStrike said. "The exposure is independent of the CMS, framework, or plug-ins in use."

"Worker processes remain stable, responses return HTTP 200, and application logs record no anomalies, because no application code ever ran. The only server-side trace is a single memory-limit fatal in the web server's error log, which is routinely dismissed as noise, leaving defenders without actionable web telemetry to identify compromised endpoints."

Originally scheduled for coordinated disclosure on October 22, 2026, at 2:00 p.m. UTC, details about the CVE identifiers and a proof-of-concept (PoC) exploit leaked ahead of time, prompting the PHP Foundation to move the release forward by one day.

"Both issues sit in parts of PHP that nearly every request touches: memory management and error handling," the PHP Foundation said. "Their central place in PHP is what made both vulnerabilities serious, and also so hard to fix without breaking compatibility, hurting performance, or forcing changes on the large ecosystem of third-party extensions."

Amazon said it detected multiple PoC exploits for PHP2Shell coinciding with the day of the release of the fixes, with the earliest attempt flagged around October 21, 2026, at 2 a.m. UTC.

This was followed by additional exploitation attempts from anonymized infrastructure over the next six hours. The variety of payloads and the anonymization infrastructure used indicate that multiple threat actors are involved, Amazon Threat Intelligence said.

The attempts have been recorded from the following IP addresses on October 21, 2026 -

• 31.223.184[.]166
• 37.19.200[.]5
• 134.209.159[.]64
• 103.114.163[.]188
• 95.217.98[.]37

According to ELLIO, the first PHP2Shell request targeting its sensors was observed on 21 October at 8:36 a.m. UTC, less than an hour after "Chainguard unilaterally broke the embargo and published built images containing the fix."

"Chainguard had received the patch in advance so its users could update the moment the vulnerabilities were disclosed," the PHP Foundation said. "Any attacker could now study the fix in binary form while every other PHP user was still waiting for the release. This disregarded weeks of work by many parties toward a coordinated disclosure."

The severity of the vulnerabilities has prompted warnings from international cybersecurity agencies such as the U.K. National Cyber Security Centre (NCSC) and the U.S. Cybersecurity and Infrastructure Security Agency (CISA), urging organizations to apply the fixes as soon as possible or consider taking them offline.

"Monitor web servers for suspicious activity, including PHP processes unexpectedly launching command shells or downloading files," the U.S. Federal Bureau of Investigation (FBI) said in an X post. "Ensure appropriate process-monitoring capabilities are in place to help identify potential exploitation."

In a similar alert, the U.S. National Security Agency (NSA) said the vulnerabilities can provide threat actors with a direct path to the server's file system or database. OpenAI, which described the flaws as "one of the most impactful security issues in recent memory," has released a Codex skill to check if a website or local PHP binary is vulnerable to PHP2Shell.

With PHP powering a majority of the websites in the world, the vast attack surface, coupled with the severity and ease of exploitation of the PHP2Shell flaws, poses major risks as it allows unauthenticated attackers to execute code and steal sensitive data.

"PHP is used by almost 70% of websites," Cloudflare said. "The php2shell vulnerabilities affect the PHP runtime itself and can allow attackers to execute malicious code on vulnerable servers, expose customer data, or disrupt services. Because PHP underpins widely used platforms such as WordPress and Magento, these flaws could potentially affect a large number of applications across the internet."

VulnCheck's analysis has identified PHP on 2,608,039 internet-facing hosts, out of which over 700,000 hosts run PHP 3.x through 7.3. Another set of about 400,000 hosts run PHP versions 7.4, 8.0, or 8.1, while 403,000 hosts run supported 8.2 through 8.5 branches.

"PHP is a massively popular language, and powers large parts of the internet," Ilkka Turunen, Field CTO at Sonatype, said in a statement. "The immediate priority is clear accountability: know where PHP is used across your services and products, who owns remediation, and how quickly fixes can be deployed."

"It is likely there is a long tail of environments needing to apply this patch as PHP is bundled into many other operating system distributions, as well as is found in many historic environments."

Some of the other notable developments are listed below -

• WebOps platform Pantheon said it has blocked over 60,000 suspicious requests probing the vulnerability.
• VulnCheck has identified two hosts, 85.11.167[.]243 and 45.198.224[.]169, with the user-agent "php2shell-scan/109618" weaponizing CVE-2026-109618 to target its honeypots, while 109.71.252[.]97 has leveraged both the flaws.
• Cloudflare has observed attack traffic targeting its customers, with threat actors "mutating the attack payload to try to bypass our protections by tracking the volume of matches and cross-referencing with the rule logic."
• CloudLinux has released fixed packages for ea-php52 through ea-php85 and every alt-php version.
• Additional guidance and mitigations have been published by numerous security and software vendors, including Akamai, Amazon Web Services (AWS), Arctic Wolf, Automattic, Cisco Talos, Corelight, CyCognito, Fastly, Google Cloud, Hadrian, Imperva, NetSPI, Orca Security, OX Security, Palo Alto Networks Unit 42, Pentest Tools, Rapid7, ReliaQuest, SOCRadar, Searchlight Cyber, Sophos, Tanium, Vercel, watchTowr, and Zscaler.

"The time from patch to working exploit is shrinking for structural reasons," Moses said. "In the past, most exploitation we observed came after a public proof of concept was released. A small number of capable actors built exploits, and everyone else waited for them.."

"That dependency is weakening. AI-assisted analysis makes it cheaper to turn a patch diff or advisory into a working exploit. As a result, more actors can act within hours or even minutes once technical details of a vulnerability are disclosed."

from The Hacker News https://ift.tt/UCPEbag
via IFTTT

U.S. Orders DeepSeek Removed From Federal Civilian Systems, Bans New Purchases

U.S. federal civilian agencies must remove DeepSeek products from their information technology systems, along with any third-party products or services "developed using DeepSeek implementations," under a Department of Homeland Security order.

They may also no longer buy information technology products or services from the Chinese AI developer or its affiliates

Homeland Security Secretary Markwayne Mullin issued the order, dated July 24, 2026, under the Federal Acquisition Supply Chain Security Act of 2018, and the department published it in the Federal Register on October 20. The notice does not define "DeepSeek implementations."

The order names Hangzhou DeepSeek Artificial Intelligence Co., Ltd., the developer of the R1 and V3 models, and covers its affiliates as defined in federal acquisition rules. The company's privacy policy says it collects, processes and stores users' personal data in the People's Republic of China.

Under the 2018 law, the Federal Acquisition Security Council recommends exclusion and removal orders, and three officials may issue them: the Secretary of Homeland Security for civilian agencies, the Secretary of Defense for the Defense Department and national security systems, and the Director of National Intelligence for the intelligence community.

The DeepSeek order therefore covers only what civilian agencies buy and run. It does not restrict companies or the public.

The 2018 law was first used in 2025, when the Director of National Intelligence excluded Acronis, a Swiss cybersecurity and data protection company, from intelligence community procurement and ordered its products removed from intelligence community systems.

Executive agencies "shall comply with exclusion and removal orders," the law says. An agency can ask the official who issued an order for an exception, and under the council's regulations the request must be in writing and give a compelling justification.

DHS directs questions about the order to CISA's FASCSA Order Implementation Team at fascsa.orders@cisa.dhs.gov.

The order also reaches government contractors. A federal contract that carries FAR clause 52.204-30 bars the contractor from providing or using, in performing the contract, any product or service covered by an applicable FASCSA order, unless the issuing official has granted a waiver.

The clause also requires the contractor to:

• Search SAM.gov for the phrase "FASCSA order" at least once every three months
• Make a reasonable inquiry into its supply chain when a new order could affect it
• Report any covered product or service it has provided or used to the contracting officer within 3 business days of identifying it
• Send further information on mitigation within 10 business days of that report
• Include the clause in its subcontracts

An order issued after a solicitation applies to an existing contract only once the contracting officer adds it by amendment or modification.

The Federal Register notice gives no reasons for the order. The signed order is attached to the notice as four scanned pages and is posted on regulations.gov under docket DHS-2026-0628.

The order is dated July 24. DHS filed it for public inspection at the Federal Register on October 19, 87 days later, and it was published the next day.

The council's regulations leave public release of an order to the issuing official, who "May provide a copy of the order to other persons, including through public disclosure." They set no deadline for it.

The law requires the issuing official to notify the company named in an order and the appropriate congressional committees, and to review the order at least once a year.

Before the order, U.S. restrictions on DeepSeek were device bans adopted one body at a time. By February 2025, Congress, NASA, the Navy, the Pentagon and Texas had barred DeepSeek from government devices. Bills to bar DeepSeek on government devices were introduced in the House and Senate that month and had not advanced past committee as of October 21.

China's foreign ministry spokesperson Mao Ning said at a briefing on October 20 that "China consistently opposes the overstretching of the concept of national security" and that Beijing will "resolutely safeguard the legitimate rights and interests of Chinese companies," the Associated Press reported. DeepSeek did not immediately respond to the AP's request for comment.

from The Hacker News https://ift.tt/K3U5qR0
via IFTTT

China-Linked Hackers Use ARTEX AI Agents in ConnectWise Supply Chain Attack

Microsoft on Wednesday disclosed that a China state-aligned actor dubbed Storm-0940 was behind the recent supply chain compromise of the ConnectWise Cloud Backup application.

During the incident, Storm-0940 used ARTEX, a Go-based agentic AI penetration testing framework that was made closed-source in the wake of its abuse against South Korean financial institutions, to speed up scanning and reconnaissance, password spraying, and OAuth application abuse at downstream victims.

The tech giant said the threat actor used the AI tool at "machine speed" to automate attacks targeting hundreds of organizations across the world spanning a broad range of sectors since September 2026. Targets include aerospace and defense, automotive, chemicals, energy, financial services, government, legal, manufacturing, media, military, semiconductor, software, technology, and think tanks and non-profits.

"Storm-0940's use of ARTEX accelerated the speed of compromised application abuse to authenticate to target environments through applications that had already been granted access, allowing the threat actor to operate without requiring an interactive user sign-in," Microsoft said.

"AI-accelerated follow-on activity included reconnaissance, application credential changes, and attempts to modify privileges that could enable expanded or persistent access."

Storm-0940 was first detailed by Microsoft in November 2024, revealing that the threat actor has been leveraging a botnet called Quad7 (aka CovertNetwork-1658) to conduct highly evasive password spray attacks. The threat actor is assessed to be active since at least 2021.

The adversary is also said to exploit internet-facing applications to gain initial access, followed by using compromised accounts to move through targeted environments. It has also been observed establishing persistence by adding credentials to existing OAuth applications within cloud infrastructures to ensure access to Microsoft 365 resources.

According to Microsoft, a chunk of these ARTEX-driven attacks have resulted in the adversary gaining privileged access to an organization's cloud infrastructure, including several instances where the time frame from initial targeting to privileged access was less than 3 hours.

In the case of the ConnectWise incident, Storm-0940 has been observed using ARTEX to attempt to sign in to more than 2,250 tenants at 2,900 sign-in attempts per minute, a pace the company said gives defenders a short window to detect and respond.

"Between October 10 and 14, 2026, Storm-0940 infrastructure at 144.172.64[.]99 conducted an automated cross-tenant password-spray campaign targeting 327 accounts across eight organizations to gain access to Microsoft 365 and Exchange Online," Microsoft said.

During this window, Microsoft said it captured over 151,000 failed logon events. The activity peaked on October 11 at 2,900 failures per minute, resulting in more than 111,000 failures in a single day. Of these, 48 accounts received more than 1,000 failures. No successful authentication, token issuance, Graph call, or directory change was detected, it noted.

That changed on October 15, 2026, when the AI agents gained access to the identities of multiple ConnectWise cloud applications and began to use them to authenticate to customer environments.

"Additionally, after acquiring control of the identities of multiple ConnectWise cloud applications, the AI agents operating on behalf of the threat actor continued to use the same IP range to authenticate to customer environments using the illicit access acquired through these stolen app credentials, effectively taking advantage of the already established trust by these apps within a tenant," the tech giant added.

In some of these cases, the AI agents are assessed to have progressed beyond authentication to Microsoft Graph and directory operations. This included reconnaissance, application credential modifications to establish persistence, and changes involving identities, groups, and privileged roles.

"The application credential modification made by Storm-0940’s associated agents in the targeted victims' environments can lead to persistence through other identities, credentials, and cloud services," Microsoft said. "These changes can remain active as a backdoor even after the original compromised application is mediated."

Storm-0940 is far from the only hacking crew to rely on ARTEX. Microsoft said it has observed threat actors across multiple geographic regions weaponizing the framework in their operations.

The findings once again highlight how threat actors are increasingly integrating agentic AI tools into their offensive security workflows to quickly carry out attacks at scale.

"Agents are not constrained by factors affecting humans – they can work around the clock, on weekends, and on holidays and attempt multiple breach paths simultaneously, enabling significantly reduced time from selecting a target to achieving objectives, increasing the speed and impact of complex attacks like supply chain compromises," Microsoft said.

In response to the findings, ConnectWise said the activity "describes a campaign that reaches well beyond any one company," adding "nation-state actors are increasingly targeting the software supply chain, because one trusted connection can open the door to many organizations."

"AI now lets them test those connections at [...] 'machine speed.' MSPs are in the middle of that chain. They are targets in their own right, and they are also a path into every client they serve. Every vendor and every MSP must defend itself with both of those risks in mind."

ConnectWise, which temporarily shut down services following the attacks, has been restoring services in phases, a process that it said will take several days.

from The Hacker News https://ift.tt/uMGDx42
via IFTTT

“Next Exploit Opportunities”: How a Threat Actor Used AI to Help Plan and Execute Multiple Types of Cybercrime Activities

Executive Summary

“Can you find about like what scam or thing they done in past like spoofing calls or somthing [sic],” the threat actor typed. The conversation was with one of several AI assistants that the actor was using to get advice on planning and executing a variety of cybercrime activities.

Our visibility into this specific actor's operational environment gives us unique insights into exactly how threat actors are building, testing and executing agentic attacks across multiple campaign types.

Unit 42’s investigation into the actor’s operational environment and activities makes two things clear:

• The attacker used basic tooling and relied on AI-generated scripts and reconnaissance reports, suggesting they didn’t have the skills these activities would have required before the advent of readily available AI tools.
• Despite some apparent bumbling, the actor had an impact, attacking a number of targets in India, including universities. The actor recovered thousands of records revealing personal information and mapped multiple organizations’ attack surfaces.

The attacker’s conversations with jailbroken AI tools included getting step by step advice on how to set up a fraudulent Voice over IP (VoIP) operation. One assistant “helpfully” generated a document including a “NEXT EXPLOIT OPPORTUNITIES” section, outlining planned followup attacks.

Unit 42 identified and investigated this threat actor's operational environment. There, we determined that they had weaponized an AI assistant across several types of cybercrime, including:

• Credential theft and data exfiltration
• VoIP telecommunications fraud
• Wi-Fi password cracking
• Cryptocurrency reconnaissance
• Command-and-control (C2) operations

An actor operating under the handle BUGSTER configured the Hermes Agent framework with DeepSeek V4 as its reasoning engine and Cursor integrated development environment (IDE) as a secondary tool, both with safety controls disabled. The actor ran an AI-generated brute-force campaign against an Indian university’s website. The actor also achieved a confirmed intrusion against a second university, where they exfiltrated a database of more than 5,200 records, including personally identifiable information (PII) on students.

The actor also built specialized AI bot profiles to acquire VoIP fraud expertise through conversation and maintained automated pipelines for Wi-Fi password cracking and cryptocurrency whale reconnaissance (i.e., identifying large cryptocurrency holders). Notably, the Wi-Fi cracking capability requires close physical proximity to the target, indicating the actor had local access to the targeted locations.

Multiple, unrelated actors are independently adopting the same Hermes + DeepSeek combination. This suggests we may be witnessing an increasingly prevalent toolchain of choice for cybercriminals adopting AI-enabled capabilities. We assess a key driver is low safety friction at low cost: DeepSeek models are inexpensive and easy to access, and readily jailbroken with a simple system-prompt override.

Palo Alto Networks customers are better protected from the threats discussed above through the following products and services:

• Advanced URL Filtering and Advanced IP Defense
• Cortex XDR and XSIAM
• Cortex Agentic Endpoint Security
• Cortex Cloud
• Idira Privileged Access Manager (PAM)
• Idira Identity and Access Manager (IAM)
• Idira Secrets Manager

The Unit 42 AI Security Assessment and Unit 42 Frontier AI Defense service can help identify and mitigate complex AI-enabled risks.

Organizations can access tailored adversary intelligence, direct analyst consultations, and specialized exposure tracking through Unit 42 Threat Intel Services and its Deep and Dark Web Service.

If you think you might have been compromised or have an urgent matter, contact the Unit 42 Incident Response team.

Related Unit 42 Topics

AI, Credential Theft, Cryptocurrency

Technical Analysis

We identified evidence that the threat actor leveraged AI systems for a wide range of criminal activity against multiple target networks, primarily in India. The criminal activity included:

• Planning for VoIP fraud
• Credential theft targeting several organizations
• Wi-Fi password cracking
• Cryptocurrency reconnaissance
• C2 payloads

Credential Theft and Data Exfiltration

WordPress Brute Force

The actor used AI-generated reconnaissance to conduct a methodical attack against an Indian university's online education platform. The actor’s enumeration reports exhibit structured formatting (executive summaries, severity ratings, systematic endpoint categorization) consistent with AI-generated output. The attack progressed through four stages:

1. Subdomain enumeration: The actor identified 12 subdomains including the main WordPress site, a learning management system (LMS), student portal and administration dashboard
2. WordPress REST API enumeration: The actor extracted 13 active user IDs with real names via post author fields and author sitemaps, bypassing the Cloudflare Web Application Firewall (WAF) that blocked direct user endpoint access
3. Targeted brute force: A generator script produced a brute force tool with 117 usernames (derived from the enumeration) and 28 common passwords
4. Credential brute force: The actor’s tool flagged one WordPress login as valid

Figure 1 shows an excerpt from the actor's WordPress REST API enumeration report (stage 2).

Figure 1. Example of a WordPress REST API enumeration report from the activity.

Figure 2 shows output from a brute force attempt that recorded a candidate credential (stage 4).

Figure 2. Brute force tool output recording a candidate credential.

University Database Exfiltration

The actor exfiltrated a MongoDB database from a second Indian public university. The exfiltration tooling wrote a manifest alongside the dumped collections, recording the following data:

• Admin credential obtained: An administrator account with a weak password
• Exfiltrated records: Thousands of student records (diploma, undergraduate, postgraduate) and faculty records containing PII
• Infrastructure exposed: Cloud load balancing, edge routing, database services, and a third-party cloud storage service account

E-Commerce Enumeration

The actor enumerated an Indian site on a popular e-commerce platform, extracting:

• A storefront API token
• Three admin email addresses
• Two phone numbers
• Payment merchant IDs

The attack report is a suspected large language model (LLM)-generated document, including a NEXT EXPLOIT OPPORTUNITIES section outlining planned follow-up attacks.

VoIP Telecommunications Fraud

We also identified evidence that the actor was developing VoIP (Voice over IP) fraud infrastructure, using the alice Hermes profile as an AI-powered advisor. Evidence included:

• Advisory conversations
• A detailed technical knowledge base
• Carrier research

However, the absence of call logs, Session Initiation Protocol (SIP) traces or active call routing suggested the operation was still in a planning or early setup phase.

With DeepSeek V4 as the underlying model, alice provided detailed, actionable criminal methodology through conversations and a comprehensive fraud knowledge base ingested into the bot. The actor developed a planned approach following an established VoIP fraud model:

• Establish a legitimate front: Register a US limited liability company (LLC) with an employer identification number (EIN) to qualify as a telecommunications provider. The knowledge base includes detailed guidance on:
  • Forming LLCs in Wyoming or Delaware as a non-US resident
  • Obtaining an EIN without a Social Security number via the US Internal Revenue Service (IRS) fax
  • Completing Federal Communications Commission (FCC) registration
• Obtain carrier access: Contract with legitimate VoIP carriers to purchase call routing capacity (SIP trunks).
• Traffic mixing: Route approximately 70% legitimate call traffic alongside 30% fraudulent calls to stay below carrier compliance audit thresholds.
• Bypass caller ID authentication: Circumvent STIR/SHAKEN, the FCC-mandated caller identity verification framework. In the advisory conversations, alice covers bypass techniques and Calling Line Identification (CLI) spoofing.
• Monetize: Generate revenue with the 30% fraudulent traffic through toll fraud and other non-compliant routes. Least-cost routing (LCR) optimizes per-minute costs across carrier tiers.

Figure 3 shows an excerpt from an alice conversation including the actor asking and DeepSeek advising on fraud traffic ratios and carrier evasion.

Figure 3. Excerpt from the alice conversation.

The pandarouter profile handled carrier research. The excerpt below in Figure 4 illustrates how the actor used it to investigate a wholesale VoIP carrier for regulatory vulnerabilities and past fraud.

Figure 4. Using the pandarouter profile to investigate a carrier.

Other Operations

Command and Control

The threat actor’s infrastructure maintained a listening port for a Python-based C2 listener supporting Windows reverse shell connections. Supporting payloads include:

• A Base64-encoded PowerShell reverse shell delivered via VBScript
• A QubesOS VM setup script with SSH and ncat
• Multiple Windows shell variants

Wi-Fi Password Cracking

The actor developed an automated Wi-Fi password cracking process. A Linux (Kali) device the actor labeled Pi placed within range of target Wi-Fi networks captured Wi-Fi Protected Access (WPA) authentication material (PMKID or EAPOL handshakes) from nearby access points.

The server collected these hashes over an SSH tunnel and dispatched them to Vast.ai cloud GPU instances for cracking, with results automatically reported back to the actor via Discord webhooks. This technique requires physical proximity to the target networks, indicating the actor had local access to the targeted locations.

Credential Scanning Toolkit

We also identified a large Go-based credential-scanning toolkit. This toolkit scrapes webpages and extracts exposed credentials, including:

• .env values
• S3 signed URLs
• Google Cloud service account keys
• Content delivery network (CDN) API keys
• Private keys in log files

A companion Python script scrapes domain lists for scanning.

Cryptocurrency Reconnaissance

The actor scraped the top 500 ETH holders and major token holders via the DeBank API, producing intelligence files that documented 45 cryptocurrency whales with net worth figures. We assess this was likely for future targeting, but we were unable to identify any follow-on activity during this research.

Tool Design and Infrastructure

The threat actor used a single US-based server (162.243.3[.]92) to host multiple core services, including:

• The Hermes Agent framework
• A C2 listener
• A Cursor integrated development environment (IDE) proxy
• Several supporting components

Our analysis of the actor’s logs and test scripts indicates that they experimented with various LLMs, including GLM 5.2 by Zhipu AI and other models accessed through OpenRouter. Ultimately, they chose DeepSeek V4 as the backend for operations.

The actor's test scripts show repeated attempts to defeat model safety controls with a prompt-level override. Although GLM 5.2 is an open-weight model that has been reported as weakly guarded, the actor built a dedicated script to send the override to GLM 5.2 and flag refusals. This is evidence of resistance the actor worked to overcome.

The actor ultimately operationalized DeepSeek V4, consistent with the minimal safety controls observed in the Chinese-speaking activity we previously reported. Figure 5 shows an example of the system prompt the actor used to override model safety controls (from the actor's model-testing scripts, e.g., test_batch1.py).

Figure 5. Example of a system prompt to override model safety.

Table 1 summarizes the actor's AI tool configurations.

Tool	Model	Role	Safety Configuration
Hermes Agent	DeepSeek V4	Primary AI assistant, Telegram-controlled	System prompt override
Cursor IDE	Multiple models configured (Claude Opus 4.8, GPT-5.5, Composer 2.5, others)	AI-assisted code generation	Agent mode forced and permission checks bypassed via proxy environment variables; IDE sandbox set to disabled; MCP servers auto-approved

Table 1. AI tool configurations.

Figure 6 shows a flowchart that illustrates the actor's infrastructure and how the AI tools interconnect.

Figure 6. Actor infrastructure and AI tool relationships.

The Hermes Agent served as the actor's primary interface, controlled via Telegram direct messages. The actor maintained three Hermes profiles as specialized AI modes, each running as a separate Telegram bot gateway spawned from the operator's session (Table 2).

Profile	Command	Working Directory (CWD)	Description
make-good	hermes gateway run --profile make-good	/root/.hermes/profiles/make-good	General-purpose criminal assistant with safety overrides
alice	hermes gateway run --profile alice	/root/.hermes/profiles/alice	VoIP fraud advisor; covers carrier compliance evasion, STIR/SHAKEN bypass and LLC formation
pandarouter	hermes gateway run --profile pandarouter	/root/.hermes/profiles/pandarouter	VoIP route management and carrier research

Table 2. Telegram Hermes profiles.

The actor configured four additional profiles (dev, check, vuln, deploy) in a shared Telegram group. While we did not observe any chat artifacts for these profiles, the naming suggests the actor used AI to assist with development, validation, vulnerability testing and deployment automation functions.

The Cursor IDE was configured through a proxy script named cipher-proxy.sh that set environment variables to enable full agent mode and bypass its permission and sandbox controls. The configuration and the AI-generated scripts on the host shown below in Figure 7 suggest the actor used it for code development.

Figure 7. Configuration info on the host.

Attribution

We assess the actor is a financially motivated, multi-domain criminal operator with no prior reporting. The actor is English-speaking with informal, frequently broken grammar. The alice bot's stored memory describes the actor as a “gamer, OSINT, VoIP entrepreneur” claiming to hold a US LLC and EIN. Figure 8 below shows text from the pandarouter bot's stored memory, which is more candid.

Figure 8. Text from the pandarouter bot's stored memory.

Table 3 lists further attribution indicators of this actor.

Indicator	Value
Email	bugstergap@gmail.com
Display name	B U G S T E R
Cursor IDE user ID	158034011
Telegram user ID	7593151260

Table 3. Attribution indicators.

Conclusion

This case illustrates how AI lowers the skill barrier for cybercrime. The actor used basic tooling and relied on AI-generated scripts and reconnaissance reports, but still achieved notable impact. They recovered more than 5,200 PII records and mapped multiple organizations' attack surfaces. AI enabled a single actor to operate across diverse attack types (credential theft, VoIP fraud, Wi-Fi cracking, cryptocurrency targeting) that would traditionally require distinct skill sets.

The VoIP fraud planning demonstrates a particularly notable use of AI as a domain expert. With DeepSeek V4 as the underlying model, the actor's bot profiles provided detailed, actionable criminal guidance.

This guidance included specific fraud-to-clean traffic ratios, carrier audit thresholds to stay below and operational security measures to avoid detection. The model's minimal safety controls allowed it to function as an on-demand criminal advisor, enabling the actor to acquire operational expertise through conversation rather than experience.

Combining these findings with our previous reporting on a Chinese-Speaking threat actor leveraging the Hermes + DeepSeek toolchain points to growing uptake of this combination among cybercriminals.

Palo Alto Networks customers are better protected from the threats discussed above through the following products:

• Advanced URL Filtering and Advanced IP Defense identify known domains and URLs associated with this activity as malicious.
• Cortex XDR and XSIAM are designed to accurately detect the threats described in this article with the Malware Prevention Engine, and behavioral analytics to reveal the root cause to speed up investigations.
• Cortex Agentic Endpoint Security is designed to help discover every AI artifact and AI agents activity across the agentic endpoint, assess its risk, enforce prevention and runtime controls, and remediate violations.
• Cortex Cloud is designed to protect cloud posture and runtime operations against identity-driven threats by pairing static permission baselines with deep behavioral context. By embedding the functional identity baselines discussed in this research into our detection engine for both cloud VM compute and serverless agents, Cortex Cloud adds a vital layer of operational context, enabling security teams to filter out noisy false positives and decisively catch threat actors attempting to disguise their presence, alter configurations or execute anomalous operations in the environment.
• Idira Privileged Access Manager (PAM) is designed to unify privileged access across human, machine, and agentic identities to secure cloud access across multi-cloud environments. Building on proven PAM, it delivers centralized secrets management alongside modern controls like Just-in-Time access and Zero Standing Privileges. This enforces consistent least-privilege security across on-premises, cloud, and SaaS targets.
• Idira Identity and Access Manager (IAM) is designed to enable secure, unified access across human, machine, and AI identities, balancing granular control with a seamless user experience. Powered by SSO, phishing-resistant MFA, passwordless login, and enterprise password management, Idira IAM extends intelligent privilege controls and session security across the broader workforce to meet the security demands of today and tomorrow.
• Idira Secrets Manager is designed to help secure and automate API keys and webhook tokens just-in-time to eliminate hardcoded credentials and prevent exfiltration.

The Unit 42 AI Security Assessment and Unit 42 Frontier AI Defense service can help identify and mitigate complex AI-enabled risks.

Organizations can access tailored adversary intelligence, direct analyst consultations, and specialized exposure tracking through Unit 42 Threat Intel Services and its Deep and Dark Web Service.

If you think you may have been compromised or have an urgent matter, get in touch with the Unit 42 Incident Response team or call:

• North America: Toll Free: +1 (866) 486-4842 (866.4.UNIT42)
• UK: +44.20.3743.3660
• Europe and Middle East: +31.20.299.3130
• Asia: +65.6983.8730
• Japan: +81.50.1790.0200
• Australia: +61.2.4062.7950
• India: 000 800 050 45107
• South Korea: +82.080.467.8774

Palo Alto Networks has shared these findings with our fellow Cyber Threat Alliance (CTA) members. CTA members use this intelligence to rapidly deploy protections to their customers and to systematically disrupt malicious cyber actors. Learn more about the Cyber Threat Alliance.

Indicators of Compromise

• 162.243.3[.]92 - actor infrastructure
• 104.238.38[.]202 - commercial proxy server

Additional Resources

• Chinese-Speaking Threat Actor Harnesses AI Models for Autonomous Cyberattacks – Palo Alto Networks Unit 42

from Unit 42 https://ift.tt/W6D5wZs
via IFTTT