Attackers exploiting WSUS vulnerability drop Skuld infostealer (CVE-2025-59287)

Some attacks take real skill. Others just need someone to leave a door open. This week has both. Exposed passwords, old bugs still getting exploited, and trusted software doing things it shouldn't. There's a strange mix of clever tricks and careless mistakes. Hackers are borrowing trust from familiar apps, websites, and AI tools. Some are using AI to speed things up. Others are leaving their own attack files exposed. Not exactly careful work. Different stories, familiar weak spots. Here's what showed up this week. The threats change every week. Subscribe, and we’ll alert you when each new ThreatsDay Bulletin is out. PHP2Shell attacks persist WordPress security company Wordefence said it's not aware of any WordPress site compromised through PHP2Shell (CVE-2026-109618 and CVE-2026-109619) as of October 28, 2026. "We continue to see PHP2Shell-related requests across the more than 5 million sites we protect," it said. "Those requests show ongoing scanning and exploitation attempts; they do not show whether an attempt succeeded. Our site-cleaning and incident response teams have not handled a WordPress compromise attributed to these vulnerabilities." 40,573 secrets exposed Hudson Rock's investigation into the FortiBleed credential harvesting campaign has uncovered 975 newly identified domains and 40,573 exposed secrets, including 37,076 local-user records and 1,576 Active Directory LDAP bind records. The data comes from newly obtained 1,703 FortiGate source files associated with 1,689 host identifiers. "The configuration material dates to around February 2026, earlier than the likely May/June material examined in the first investigation," Hudson Rock said. The latest discovery has been codenamed FortiBleed 2.0. Institutional DNS hijacked Threat actors have used domain shadowing to place illegal gambling content beneath legitimate school and government domains in two unrelated operations. "In both cases, an unauthorized party appears to have gained access to DNS administration and created records that the original domain owners may not have noticed," Infoblox said. "Because the resulting hostnames sat within established institutional namespaces, they provided especially useful infrastructure for search-engine optimization (SEO) and traffic acquisition." One cluster, linked to a threat actor called Hidden Hawk, has been found to add individual CNAME records that mapped institutional hostnames to gambling pages hosted largely on Cloudflare Pages. The second campaign exploiting an Indian government domain "delegated entire subzones to third-party authoritative nameservers and used a wildcard, allowing many hostnames to be managed outside the victim's DNS environment." Put differently, the unauthorized DNS access creates new institutional hostnames, which resolve to infrastructure serving illegal gambling doorway pages. The pages also leverage the established reputation of school and government namespaces to ensure that the malicious URLs show up prominently in search engine results. AI banking credential warning Bank of America is reminding customers not to share banking credentials with AI agents. In an email blast to customers titled "Protecting your finances in the AI World," the financial institution urged customers to never share their username and password with another person or an outside service, "including an AI-enabled tool or agent that offers to act on your behalf." Android tightens contact access Google has announced that an upcoming Android release will no longer be able to directly write to contacts with the WRITE_CONTACTS permission. "Instead, you can use the standard contact intents (ACTION_INSERT, ACTION_EDIT, and ACTION_INSERT_OR_EDIT)," Google said. "Currently, if your app needs to save even one contact, you might be requesting WRITE_CONTACTS. But that permission grants broad access, allowing an app to make widespread changes to contacts across the device in the background, even without user interaction. Most apps don’t need such broad permission." 26,400 live credentials exposed A scan of 7.25 million public repositories on Gitee, China's largest indigenous Git hosting platform, has uncovered 26,400 unique verified-live credentials, including an active organization-admin credential for a major enterprise AI platform and thousands of live cloud provider access keys, independent security researcher Ben Zimmermann said. Critical Fortinet fixes released Fortinet has released a "coordinated set of security updates for FortiOS, FortiManager, and FortiAnalyzer" to address critical and high-severity flaws that were flagged using an AI-assisted vulnerability discovery approach. Details of the issues are being kept under wraps until November 10, 2026. With Fortinet devices becoming a favorite target for attackers, it's essential that users move quickly to apply the fixes. Zero-permission token theft Details have emerged about a now-patched flaw in Microsoft Authenticator (CVE-2026-80097 aka AuthMask) that could be exploited by installing and running a malicious application on an affected Android device and convincing the user to complete an authentication flow in the app by claiming to be a trusted app and getting the corresponding tokens. The flaw could be exploited to take over work accounts without requiring additional permissions. "Successful exploitation could allow the attacker to obtain authentication tokens and access resources as the affected user," Microsoft said. According to Enclave, "an unprivileged Android app with zero permissions could impersonate any installed Microsoft first-party app and have the Microsoft Authenticator broker hand it that app's tokens. The setup is a device with Authenticator installed and one work account signed into it." 32 fake AI bots hunt secrets Attackers are disguising themselves as AI agents to steal credentials. Cequence said it has tracked a single actor running AI agent impersonation at scale by posing as about 32 different AI bots, including ChatGPT, Claude, and Perplexity, while searching for passwords, API keys, and cloud credentials. "The malicious scanner runs from a major cloud provider and rotates through about 32 AI bot identities, spanning crawlers and assistants from OpenAI, Anthropic, Meta, Perplexity, and others," Will Glazier said. "It ignores web pages and requests files that commonly store secrets, including .env configuration files, cloud credential files, private SSH keys, and server environment data, working from a list of roughly 90 file paths. Each address sends a short burst of 50 to 190 requests in about eight seconds and then moves on. The scanner works through targets one at a time, around the clock, and first sends random nonsense paths to find websites that answer every request, a common scanning technique. It hit organizations in financial services, retail, telecommunications, energy, and software, and stayed active from at least late September through late October." China-linked network intrusion The U.S. Embassy in Fiji has revealed that hackers linked to China broke into a regional organization based in Suva between July and August 2026. "Hackers with links to China maintained access to the organization's network over several days," it said. The embassy did not name the threat actor. Nor did it disclose what data the attackers may have accessed. Camera software weaponized Attackers have been breaking into enterprise networks via camera management software, according to new research from security firm Huntress, which observed multiple incidents in September and October 2026 and traced them back to a compromised application. Source code artifacts point to a Korean company selling analog and IP cameras and digital and network video recorders. The activity abuses the legitimate "WpcMon.exe" binary to sideload DLLs that establish outbound connections to a remote server. "This activity demonstrates how attackers can blend malicious code with trusted Windows components to evade detection," Huntress said. 68 GB government data breach In a major operational security blunder, an unknown threat actor stole 68 GB from a Philippine government agency, maintained a detailed log of the transfer, then left that log open on the internet at 13.163.205[.]35:80. "The copy finished in under 24 minutes on September 6, 2026," Hunt.io said. "The transfer log records 27 SQL Server backups whose filenames correspond to the case-management systems of a Philippine overseas-employment and migrant-worker administration. Beside the log sat the operator's toolkit, a rebranded GodPotato build, a PowerShell stager, two payloads and a full Impacket environment." AI model data exfiltration concerns Canadian AI company Cohere has claimed that it caught Alibaba's Qwen3.8-Flash-Next model unsuccessfully attempting to send data to China from its evaluation sandbox as part of a prompt instructing the LLM to detect malicious file download and execution by monitoring for curl processes downloading bash scripts to /tmp followed by bash execution. "Asked to write a defensive detection rule, Qwen3.8-Flash-Next ignored instructions and inventoried the machine it was running on and then tried to upload a probe file to an Alibaba Cloud storage bucket in Beijing," Cohere said. "We cannot answer whether this is deliberate or a leftover glitch from training." Cohere has also released a dataset containing the model trace and corresponding raw token IDs in connection with the behavior. "The exact output is not guaranteed all the time, and many trials may be required to reproduce the behavior," Cohere said, adding "there are similarly unexpected URLs that the model also tends to output, most containing aliyunc." However, the findings have also led to social media chatter that the company is resorting to geopolitical fearmongering and that they are an attempt to clamp down on open-weights models. Post-quantum migration roadmap The U.S. National Institute of Standards and Technology (NIST) has released guidelines that detail the timelines for transitioning away from quantum-vulnerable algorithms to quantum-resistant standards. "The report describes different use cases and says why one migration might take longer than another," said NIST mathematician Dustin Moody, who heads the PQC standardization project. "We understand there's not one strategy that fits all use cases, and we want to help people handle their migration while staying abreast of what's changing." AI-powered ransomware operation exposed SOCRadar has uncovered the live workspace (i.e., open directory) of a threat actor tied to the n0n ransomware group, which exposed the operation's full workflow as of September 2026. The directory at 185.157.161[.]148 includes an AI coding agent configured with about 150 models to produce hundreds of attack scripts, with more than $7,216 in usage costs. "Entry points included a credential stuffing campaign against 305 FortiGate SSL-VPN devices, exposed AWS keys, weak RDP/WinRM credentials, and compromised hosting management portals," SOCRadar said. At least 23 organizations across 14 countries are said to have been identified in the workspace, including a U.S. sports retailer, a cloud provider, a teachers’ union, a Venezuelan ISP, an Argentine ministry and a pharmaceutical subsidiary. Government AI access restricted The Swedish government has barred employees from accessing browser-based versions of ChatGPT or Claude on their work computers over security concerns relating to the processing of sensitive data. "Officials were concerned that entering sensitive information into these models without an agreement setting out how to protect and secure the data could lead to it being fed into the model and stored for training," Euro News reported. 42 repositories hijacked JFrog and SafeDep have uncovered a campaign in which threat actors hijacked third-party 42 GitHub repositories across 11 owners to deploy payload blobs large enough "to evade the GitHub search and API paths normally used to find this kind of compromise." JFrog said, "The repositories contain execution hooks for AI coding assistants and IDEs, plus 12.9 to 13.7 MB polymorphic wrappers that all decode to the same hidden CI-publisher payload." The activity is assessed to be related to a Miasma-family npm worm propagated under various packages ending with "testmetest." According to SafeDep, the worm "shares code with Miasma 'Phantom Gyp' from June 2026 and adds the token-revocation wiper from Mini Shai-Hulud. The malicious versions steal credentials, spread to other packages and repositories, and install a wiper that deletes the home directory when the victim revokes the stolen GitHub token." Unsuspecting developers who installed the packages had their data stolen and repositories compromised with malicious code to produce further malicious testmetest releases and run shellpanel workflows targeting cPanel systems through CVE-2026-41940, overlapping with a prior campaign detailed by Socket in July 2026. Android banking malware-as-a-service A new Android malware operation called MR ROBOT is targeting customers of Indian banks and transforming banking fraud into a subscription business, with cybercriminals renting customized banking trojans to steal OTPs, card details, UPI PINs and credentials while secretly forwarding calls to bypass security checks. "It is not a single-actor campaign but a rented crimeware platform: a master operator leases access to affiliates, who use a Telegram bot ('APK Shield) and a web control panel (v7.0) to build personalized banking trojans on demand and distribute them through fake Play-Store-style pages and messaging-app lures," CloudSEK said. The kit impersonates around 36 lure apps, including banks, utility providers, and government services. One affiliate is estimated to have intercepted 5407 text messages from 153 infected devices. MDM platforms abused for remote access Threat actors are abusing legitimate mobile device management (MDM) platforms, like Hexnode and Rippling, by using social engineering to enroll devices or install management agents, per Huntress. "Once established, MDM provides a trusted, privileged path for malicious activity, such as deploying rogue RMM tools and maintaining remote access," it said. Critical Gotenberg RCE exploited Threat actors are exploiting CVE-2026-42589 (CVSS score: 9.8), a critical remote code execution flaw in Gotenberg, to deliver a Go-based reverse shell called "cache_base." The flaw was patched in May 2026. According to VulnCheck, the activity originated from a residential Japanese IP address in early October 2026. "The execution flow is straightforward: acquire a lock, collect host information, connect to C2, register the victim, and open a shell," VulnCheck said. Over the past 30 days, the vulnerability has recorded 1,358 exploitation events from 128 unique source IP addresses. Discord discussions go public Discord has announced it will allow search engines to index discussions in Discoverable Servers and make them accessible on the web to users outside the platform without an account or invitation, starting mid-December 2026. "Discussions in Discoverable Servers will soon be easier to find when you search the web, so you can find the answer you're looking for and step straight into the conversation on Discord," it said. The changes apply only to Discoverable Servers and do not extend to private servers and direct messages. 800+ ransomware victims claimed The Gentlemen ransomware operation has claimed more than 800 victims across multiple regions and sectors, with most attacks targeting organizations in the U.S. and Europe. "The group supports multiple platforms, with ransomware variants targeting Windows, Linux, NAS, and BSD systems, allowing its affiliates to target a broad range of enterprise environments," Acronis said. "The group's operations include the use of EDR-killing tools. In a recent incident, a custom dropper was observed deploying vulnerable Safetica ProcessMonitorDriver [CVE-2025-70795] and Lenovo BootRepair.sys drivers to terminate security processes." AI model loading RCE risk Pillar Security has disclosed an arbitrary-code-execution vulnerability in Unsloth's core model-loading path (CVE-2026-93348, CVSS score: 8.6). It has been fixed in unsloth_zoo 2026.8.14. "An attacker-controlled model configuration could cause Python code to execute during loading," researcher Ariel Fogel said. "The affected code ran inside the model-loading process, with access to whatever that process could read, modify, or authenticate to. In an AI development environment, that can include proprietary datasets, model artifacts, Hugging Face tokens, and cloud credentials. Exploitation required an affected loading path to process an attacker-controlled configuration." Unauthenticated root-level RCE XBOW said it identified an unauthenticated, critical-severity remote code execution bug in a public web application belonging to the U.S. Election Assistance Commission (EAC). "The vulnerable application was a resource/logistics calculator, not a voting machine or voter registration system," XBOW researcher Ariel Walter Garcia said. "The flaw allowed an unauthenticated attacker to execute code as root inside the backend container, with access to locally protected resources and outbound network connectivity, a privileged foothold reachable via a crafted unauthenticated web request." Session-hijacking RAT emerges A new remote access trojan called DarkCore comes with a dedicated browser that could let attackers access Gmail, WhatsApp, and MediaFire accounts using stolen sessions, while giving the impression that the activity is originating from the victim's own IP address. DarkCore was first advertised on cybercrime forums in August 2026. "The seller describes a browser that reuses those sessions to access work mailboxes, instant messaging apps, cloud storage and other services through the infected machine's IP address," BlackFog said. "The purpose is to make the access look like legitimate activity from the user." AI-powered malware framework Cisco Talos has disclosed details of a new AI-integrated command-and-control (C2) framework called NIK C2. The implant features surveillance, theft, lateral movement, and evasion capabilities, including credential dumping, RDP session hijacking, process hollowing, and a C2-driven screen lock ransomware module. "NIK C2 contains a Windows implant, using which, an actor can dump credentials, stream the victim's keystrokes to collect the targeted victim's sensitive data, and instruct an integrated AI model to analyze the harvested data, all within the compromised session," Talos said. "In this framework, the actor has abused the OpenAI Chat Completions application programming interface (API), which is an HTTP endpoint that enables ChatGPT-style conversations programmatically. In addition to the features that enable theft, an actor can also deploy desktop screen-locking ransomware via the NIK C2 implant onto the victim machine, leading to a ransom demand in Bitcoin or USDT cryptocurrencies." Three different versions of the malware have been identified to date since August 12, 2026. Talos said NIK C2 alters adversary tradecraft by collapsing collection and exploitation into a single continuous session. Malicious PDF delivers backdoor A phishing email using a FedEx tax invoice lure and containing a ZIP archive with a PDF has been observed triggering a multi-stage infection process to deliver a previously undocumented variant of the Sirius Backdoor. "The PDF abuses /OpenAction and /Launch objects to trigger an embedded Base64-encoded PowerShell command upon opening," Trellix said. "Execution relies on social engineering to trick the user into approving the PDF reader's security confirmation prompt. The PowerShell stager decrypts and reflectively loads a .NET assembly in memory. This loader performs process hollowing into legitimate Windows processes such as msbuild.exe, svchost.exe, etc., allowing the malware to operate under trusted process contexts." The final payload is SIRIUS, a Microsoft Visual C++ based backdoor with extended remote access capabilities. AI reshapes ransomware economics A new analysis from Flare has revealed that threat actors are building a mixed AI toolkit, combining commercial models with local, open-weight, and jailbroken alternatives, as well as leaning on stolen AI credentials to shift costs to victims. "Where AI can help is with understanding systems, writing tools and troubleshooting. The threat actor still needs access, decisions and a way to obtain payment," Flare said. "If AI helps an affiliate write a working data-export script without hiring a specialist, the affiliate may avoid that specialist’s fee and the wait for their help. AI makes expertise cheaper to obtain only when the cost of using and checking its work is lower than the cost of the specialist help it replaces." Emerging data-extortion threat A recently observed cyber-extortion actor named ScarlettGroup is publicly advertising alleged data compromises and uses negotiation deadlines and threatened disclosures to pressure targeted organizations. The group's dark web site listing includes victims from technology, education, government, and entertainment sectors. "ScarlettGroup demonstrates characteristics associated with financially motivated data-extortion operations, including public victim claims, deadline-based pressure, and underground forum activity," Foresiet said. "Its dedicated leak-site infrastructure and structured disclosure mechanism indicate an organized approach to promoting alleged compromises and exerting reputational pressure." Infostealers evolve into RATs Following its disruption in June 2026 as part of Operation Endgame, StealC has returned four months later as Stadia. "This time it's not a stealer: it's a full remote access trojan," Varonis said. "The RAT's features include hidden desktop control, a live command shell, a file explorer, a process manager and an in-memory loader, with StealC's stealer welded on as one module among six. The actor behind Stadia is working hard to win back original StealC customers: every former StealC customer is offered a free month on the top ($900) tier." The development comes as Moonlock Lab revealed that the Icarus macOS stealer has similarly evolved from a smash-and-grab crypto and data stealer to a malware with remote-access capabilities. The new iteration is called ICMacOS. "The stealer is actively advertised on cybercrime forums by a Russian-speaking actor operating under the handle GlowComa, with feature updates regularly announced via Telegram," SOCRadar said. "GlowComa promotes ICMacOS alongside Icarus ClickFix, a companion panel designed to deliver payloads using malicious copy-and-paste terminal commands. The infection chain relies on initial dropper scripts to detect the host architecture and harvest administrator passwords using fake system dialogs before delivering the primary payload." Another macOS-focused stealer is Aokigahara, which goes beyond browsers, VPN clients, cryptocurrency wallets, FTP/SFTP clients, password managers, and email applications to also target AI applications and development tools. "The stealer collects authentication files, session data, and configuration files associated with Claude, ChatGPT Desktop, Codex, Cursor, Windsurf, GitHub Copilot, Gemini CLI, and other tools," Check Point said. "Stolen AI credentials could offer opportunities for monetization. Usable credentials or session tokens could enable unauthorized access to paid AI services or the resale of compromised accounts." That's the week's mess. Some attacks were clever, some were painfully simple, and a few attackers made life easier for the people investigating them. The common problem? Too much trust in things nobody was watching closely. AI is adding new tricks, but the old ones aren't going anywhere. Stolen credentials, weak access controls, and forgotten bugs still get plenty of work done. New tools, familiar mistakes. The useful part is knowing where those mistakes keep showing up. That's usually where the next problem starts.

On October 21, 2026, the PHP project released emergency fixes for two critical remote code execution (RCE) vulnerabilities in the PHP core runtime, tracked as CVE-2026-109618 and CVE-2026-109619 and collectively named PHP2Shell. Both are rated 9.2 (Critical) under CVSS v4.0, and both allow an unauthenticated attacker to run code on a vulnerable server. The fixed releases are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Patching is the only complete fix, and you should upgrade PHP as your first priority. But patching a fleet takes time: you need to inventory where PHP runs, schedule maintenance windows and test applications against the new builds. This post shows you how to use AWS Web Application Firewall ( AWS WAF ) to help reduce exposure to the confirmed attack paths during that window. You’ll learn which request patterns to block, how to write the rules in AWS WAFv2, how to deploy them without breaking legitimate traffic and where its protection ends, so you don’t develop a false sense of safety. For how Amazon threat intelligence detected PHP2Shell exploitation before public disclosure, see Amazon Threat Intelligence identifies PHP2Shell exploitation prior to public disclosure in MadPot . For AWS service status and the AWS WAF rule that AWS recommends, see AWS Security Bulletin 2026-143-AWS . IMPORTANT: Patching is the only complete fix, and you should upgrade PHP as your first priority. The vulnerabilities in brief Both PHP2Shell vulnerabilities are unauthenticated RCE issues rooted in how PHP handles multipart/form-data request processing (the request format browsers use for file uploads) before your application code runs, which is why the AWS WAF rules in this post focus on multipart traffic, request body size, and the session upload progress field. At a high level, CVE-2026-109618 corrupts memory when PHP runs out of memory mid-request, and CVE-2026-109619 lets one request leave behind stale data that a later request on the same worker process reuses. For the root-cause analysis, affected versions, and PHP’s own guidance, see the official PHP advisories and release announcement: CVE-2026-109618 (out-of-memory corruption) – PHP advisory GHSA-w8hw-w9fx-j79w CVE-2026-109619 (stale global state) – PHP advisory GHSA-6wmf-4rv5-p3rp PHP security release announcement, October 21, 2026 Where AWS WAF fits in your response AWS WAF is a defense-in-depth control in this situation, not a replacement for the PHP upgrade. The PHP advisories are explicit: updating to a patched release is the only complete mitigation. One of the two vulnerabilities is largely outside the reach of any web application firewall, as explained later. Treat the rules in this post as mitigating controls that help reduce exposure while you patch, then remove them or keep them as supporting controls after you’ve patched. AWS WAF inspects HTTP requests at the edge. It doesn’t parse the internal structure of a multipart body, and it has no visibility into PHP worker memory or server-side configuration. The following table maps each attack element to whether AWS WAF can help mitigate it. Attack element AWS WAF coverage Session upload progress field in a multipart POST ( PHP_SESSION_UPLOAD_PROGRESS , the form field that turns on PHP’s upload-tracking feature) Yes. A targeted rule can block requests carrying that field. Multipart upload path ( multipart/form-data , the request type used for file uploads and the entry point for both vulnerabilities) Yes, if the application has no legitimate multipart uploads. Block multipart/form-data. Out-of-memory condition from an oversized body Partial. Cap the request body size. Doesn’t catch header amplification (many small part headers that cost far more memory to represent than their size on the wire) that stays under the cap. Repeated attempts against the same worker (the reused PHP process that handles many requests) Yes. A rate-based rule blunts the volume an exploit needs. fatal_error_backtraces producer (a PHP 8.5 setting that stores crash-trace state across a request) No. This is a server configuration setting ( fatal_error_backtraces=0 ). Invalid or deprecated INI diagnostics as a consumer (warnings PHP raises when applying bad configuration settings) No. This path runs server-side, not over client HTTP. Where an application does not accept multipart uploads, an edge rule that blocks multipart/form-data removes the multipart out-of-memory path that works against any application, plus the session-upload-progress trigger, which is a defense-in-depth control during the patch window. If your application does use multipart uploads, AWS WAF reduces risk but does not close the vulnerability, because header amplification (a few kilobytes of part headers that expand into far more memory inside PHP) stays within size limits and the firewall cannot parse the headers inside individual body parts. In that case, prioritize the PHP upgrade and apply the server-side mitigations described later. Implementing the AWS WAF rules The rules below are AWS WAFv2 JSON, deploy each of them on the WAF protection pack (web ACL) associated with the Amazon CloudFront distribution, Application Load Balancer, or Amazon API Gateway stage in front of your PHP workloads. IMPORTANT: Before implementing any changes, ensure that your WAFv2 logging is setup in line with AWS WAF Logging guidance. Start every rule in Count mode, confirm it does not match legitimate traffic, then switch to Block. Request body inspection limits AWS WAF inspects a bounded portion of the request body. On Application Load Balancer and AWS AppSync the limit is a fixed 8 KB. For AWS services such as CloudFront and API Gateway, the default is 16 KB and you can raise it to 32, 48, or 64 KB through the web ACL AssociationConfig as seen below. Any part of the body beyond the inspection limit counts as oversize. Choose the limit that fits the rules you deploy, because a body-size rule can only enforce a cap up to the inspected size. aws wafv2 update-web-acl ... --association-config \ 'RequestBody={CLOUDFRONT={DefaultSizeInspectionLimit=KB_16}}' AWS WAF Rule This rule targets both CVEs by blocking a request only when all three conditions in its AndStatement are true at once: The method is exactly POST – matched on the HTTP method, no transformation. A PHP session identifier is present (the nested OrStatement , so either sub-condition satisfies this leg): PHPSESSID appears as a cookie key (exact match on the key, scanning all cookies), or PHPSESSID appears anywhere in the request body (contains match). The body contains PHP_SESSION_UPLOAD_PROGRESS – the form field that activates PHP’s session upload progress feature. Pair the rule with session.upload_progress.enabled=0 on the server, which turns the feature off. { "Name": "PHP2Shell", "Priority": 0, "Statement": { "AndStatement": { "Statements": [ { "ByteMatchStatement": { "SearchString": "POST", "FieldToMatch": { "Method": {} }, "TextTransformations": [ { "Priority": 0, "Type": "NONE" } ], "PositionalConstraint": "EXACTLY" } }, { "OrStatement": { "Statements": [ { "ByteMatchStatement": { "SearchString": "PHPSESSID", "FieldToMatch": { "Cookies": { "MatchPattern": { "All": {} }, "MatchScope": "KEY", "OversizeHandling": "CONTINUE" } }, "TextTransformations": [ { "Priority": 0, "Type": "NONE" } ], "PositionalConstraint": "EXACTLY" } }, { "ByteMatchStatement": { "SearchString": "PHPSESSID", "FieldToMatch": { "Body": { "OversizeHandling": "CONTINUE" } }, "TextTransformations": [ { "Priority": 0, "Type": "NONE" } ], "PositionalConstraint": "CONTAINS" } } ] } }, { "ByteMatchStatement": { "SearchString": "PHP_SESSION_UPLOAD_PROGRESS", "FieldToMatch": { "Body": { "OversizeHandling": "CONTINUE" } }, "TextTransformations": [ { "Priority": 0, "Type": "NONE" } ], "PositionalConstraint": "CONTAINS" } } ] } }, "Action": { "Block": {} }, "VisibilityConfig": { "SampledRequestsEnabled": true, "CloudWatchMetricsEnabled": true, "MetricName": "PHP2Shell" } } Additional WAF Rules to consider Block multipart requests when the application has no uploads NOTE: This rule, if implemented in Block mode, will break applications that require file uploads. If your application does not require file uploads, then blocking multipart/form-data removes the multipart out-of-memory path that works against any application for both CVEs at the edge. A single named header is inspected in full, with no 8 KB header cap, so matching the Content-Type header is reliable. { "Name": "Block-Multipart-FormData", "Priority": 1, "Action": { "Count": {} }, "Statement": { "ByteMatchStatement": { "FieldToMatch": { "SingleHeader": { "Name": "content-type" } }, "PositionalConstraint": "CONTAINS", "SearchString": "multipart/form-data", "TextTransformations": [ { "Priority": 0, "Type": "LOWERCASE" } ] } }, "VisibilityConfig": { "SampledRequestsEnabled": true, "CloudWatchMetricsEnabled": true, "MetricName": "PHP2ShellBlockMultipart" } } Cap the request body size Capping body size reduces the out-of-memory condition behind CVE-2026-109618 and the stale state it can leave behind. Use OversizeHandling: MATCH with a size constraint so that any body larger than the threshold is blocked, including bodies that exceed the inspection limit. To enforce a cap of N bytes, the web ACL body inspection limit must be at least N. Note that you can’t cap the numeric Content-Length with a size constraint, because the constraint measures the length of the header value string, not the number it contains. If your application has legitimate large uploads, scope this rule to non-upload paths with an AndStatement on the URI path, or it will break those uploads. { "Name": "Block-Oversize-Body", "Priority": 3, "Action": { "Count": {} }, "Statement": { "SizeConstraintStatement": { "FieldToMatch": { "Body": { "OversizeHandling": "MATCH" } }, "ComparisonOperator": "GT", "Size": 8192, "TextTransformations": [ { "Priority": 0, "Type": "NONE" } ] } }, "VisibilityConfig": { "SampledRequestsEnabled": true, "CloudWatchMetricsEnabled": true, "MetricName": "PHP2ShellBlockOversizeBody" } } NOTE: if you already have the AWSManagedRulesCommonRuleSet managed rule group, the SizeRestrictions_BODY rule blocks bodies larger than 8 KB by default. If a specific managed rule breaks legitimate traffic, override that rule to Count rather than disabling the whole group. Rate-limit repeated attempts A rate-based rule on POST requests can reduce the volume an attacker can send, lowering the possibility that the vulnerabilities can be triggered by overloading the worker, while the stale-state path needs a producer request and a consumer request to land on the same worker. This rule complements a server setting of pm.max_requests=1 , which recycles the worker on each request. { "Name": "RateLimit-Posts", "Priority": 4, "Action": { "Count": {} }, "Statement": { "RateBasedStatement": { "Limit": 100, "EvaluationWindowSec": 60, "AggregateKeyType": "IP", "ScopeDownStatement": { "ByteMatchStatement": { "FieldToMatch": { "Method": {} }, "PositionalConstraint": "EXACTLY", "SearchString": "POST", "TextTransformations": [ { "Priority": 0, "Type": "NONE" } ] } } } }, "VisibilityConfig": { "SampledRequestsEnabled": true, "CloudWatchMetricsEnabled": true, "MetricName": "PHP2ShellRateLimitPosts" } } Server-side mitigations that complement AWS WAF These host and runtime changes address the parts of CVE-2026-109619 that sit below the HTTP layer a WAF inspects, so they fall outside its scope by design. Apply them alongside the AWS WAF rules as the host and runtime layer of your defense. Upgrade PHP to 8.5.12, 8.4.27, 8.3.36, or 8.2.35. This is the only complete fix. PHP 8.1 and earlier are no longer supported upstream, so check with your distribution or long-term support vendor for a backported fix, or plan a move to a supported branch. Address CVE-2026-109618 at the PHP level. Set memory_limit=-1 so applications cannot override it, and keep post_max_size low (8M where the application accepts no uploads, 32M where it does). Enforce memory bounds through container or cgroup limits, never through RLIMIT_AS or RLIMIT_DATA, which trigger the vulnerable out-of-memory path. Set fatal_error_backtraces=0 on PHP 8.5 and restart every worker. This disables the setting that stores crash-trace state across a request, one of the confirmed ways the vulnerability is triggered. Set session.upload_progress.enabled=0 and restart every worker. This turns off the upload-tracking feature that’s the other confirmed trigger, and is prudent to keep off even after patching. Prefer php.ini , FPM pool, or server startup configuration over per-request INI overrides (settings applied per request through .htaccess , php_value , or FastCGI PHP_VALUE) . Remove obsolete directives so they don’t raise diagnostic warnings. Eliminate fatal errors and execution timeouts on attacker-reachable routes, including upload, import, error-page, shutdown, serialization, and extension paths. Set pm.max_requests=1 if performance allows , so each worker process is recycled after one request, which breaks the link between the request that plants stale data and a later request that would reuse it. Turn on error logging ( log_errors=On , a working error_log , error_reporting=E_ALL ) and review your Apache, FPM, or proxy logs for repeated warnings, deprecations, fatal errors, and timeouts on attacker-controlled routes. The absence of errors is not proof of safety. Getting started Complete the following steps to get started: Inventory where PHP runs and which versions and server APIs (mod_php, FPM, FrankenPHP, LSAPI) are in use. Identify any public endpoint that accepts a request body. Decide whether each application uses multipart uploads. This determines whether you can deploy the WAF rule to block multipart requests. Create or update the web ACL in front of each PHP workload and add the applicable rules in Count mode. Raise the body inspection limit on CloudFront or API Gateway if a rule needs it. Watch the sampled requests and Amazon CloudWatch metrics for each rule. Confirm that legitimate uploads and large JSON POSTs aren’t matched. Switch the rules to Block after the metrics are clean. Order the priorities so the session upload progress and multipart rules run before the size and rate rules. Test with a benign multipart/form-data POST, an oversized body, and a request carrying PHP_SESSION_UPLOAD_PROGRESS . Expect a 403 response and the matching rule metric. In parallel, apply the PHP upgrade and the configuration mitigations. Remove or retain the AWS WAF rules as supporting controls after your fleet is patched. Conclusion The PHP2Shell vulnerabilities—CVE-2026-109618 and CVE-2026-109619—are unauthenticated RCE vulnerabilities that reach PHP before your application code runs. AWS WAF gives you a way to help narrow the attack surface during the patch window: block the session upload progress field, block multipart requests where no uploads are expected, cap request body size, and rate-limit repeated attempts. These mitigating controls can help reduce exposure, but they don’t close the vulnerabilities. Upgrade PHP to a fixed release, apply the server configuration changes, and treat the AWS WAF rules as the edge layer that supports those fixes rather than the fix itself. To learn more about the rule types used here, see the AWS WAF documentation on the web ACL body inspection limit , oversize request component handling , and handling oversize HTTP request bodies . For the vulnerability details, see the PHP advisories GHSA-w8hw-w9fx-j79w and GHSA-6wmf-4rv5-p3rp , and the PHP session upload progress manual . Alex Waddell Alex Waddell is a Principal Solutions Architect at AWS specializing in security within the Worldwide Specialist Organization, based in Scotland. Alex has been working in the security domain since 1999 and joined AWS in 2021 to work with customers across EMEA on cloud security architecture, identity, threat detection and application security. When he is not working, Alex enjoys spending time sampling rum from around the world (Alex is one of those rarely found Scottish people that doesn’t like whisky), walking his dogs in the local forest trails and traveling. Lawton Pittenger Lawton is a Worldwide Security Specialist Solutions Architect at AWS, based in New York City. He specializes in helping customers design and implement effective network security controls. At AWS, he works with customers at scale and collaborates closely with service teams to drive continuous improvement in security services based on customer needs and feedback. Outside of work, his interests include skateboarding, snowboarding, and spending time in nature. Ian Olson Ian is a Senior Security Specialist Solutions Architect at AWS. He helps customers automate security services to safeguard against threats like DDoS and web exploitations. Through intelligent automation, he delivers security solutions tailored to organizations of any scale. When he’s not working, Ian enjoys spending quality time with his two young children.

Unit 42 stopped monitoring this threat and updating the brief on Jan. 30, 2026. Please refer to Microsoft’s website for the latest information. On Oct. 14, 2025, a critical, unauthenticated remote code execution (RCE) vulnerability was identified in Microsoft's Windows Server Update Services (WSUS), a core enterprise component for patch management. Microsoft's initial patch during the October Patch Tuesday did not fully address the flaw, necessitating an emergency out-of-band security update released Oct. 23, 2025. Within hours of the emergency update, Unit 42 and other security researchers observed active exploitation in the wild. The combination of a remotely exploitable, unauthenticated RCE in a core infrastructure service, coupled with observed active exploitation in the wild, represents a severe and time-sensitive risk. Key details of the threat are summarized below: Vulnerability: Critical Remote Code Execution (RCE) in Windows Server Update Services (WSUS), tracked as CVE-2025-59287 (CVSS 9.8). Impact: Allows a remote, unauthenticated attacker to execute arbitrary code with system privileges on affected servers. Status: Actively Exploited. Threat actors were observed exploiting the vulnerability within hours of Microsoft releasing an emergency patch on Oct. 23. Urgency: The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added this vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog on Oct. 24, underscoring the immediate risk. For organizations unable to deploy the emergency patches immediately, Microsoft has recommended temporary workarounds to mitigate the risk. Palo Alto Networks customers are better protected from activity related to CVE-2025-59287 through the following products and services: The Unit 42 Incident Response team can also be engaged to help with a compromise or to provide a proactive assessment to lower your risk. WSUS is a foundational tool for IT administrators, enabling the centralized management and distribution of Microsoft product updates across corporate networks. Its role as a trusted source for software patches makes it a high-value target; a compromise of a WSUS server can provide a foothold for lateral movement and widespread network compromise. The vulnerability is rooted in an "unsafe deserialization of untrusted data." Security researchers have identified multiple attack paths including sending a specially crafted request to the GetCookie() endpoint, which causes the server to improperly deserialize an AuthorizationCookie object using the insecure BinaryFormatter. Another path targets the ReportingWebService to trigger unsafe deserialization via SoapFormatter. In both cases, a remote, unauthenticated attacker can trick the system into executing malicious code with the highest level of system privileges. The scope of this vulnerability is specific to systems with the WSUS role enabled: Affected Software: Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022 (including 23H2 Edition) and 2025. Required Condition: The vulnerability only affects servers where the WSUS Server Role is enabled. This feature is not enabled by default. Following the public disclosure of a proof-of-concept exploit, Unit 42 in addition to other security firms quickly detected active scanning and exploitation. Analysis of the attacks observed by Unit 42 reveals a consistent methodology focused on initial access and internal network reconnaissance. Initial Access: Attackers target publicly exposed WSUS instances on their default TCP ports, 8530 (HTTP) and 8531 (HTTPS). Execution: Malicious PowerShell commands are executed via specific parent processes. Observed forensic process chains include wsusservice.exe → cmd.exe → cmd.exe → powershell.exe and w3wp.exe → cmd.exe → cmd.exe → powershell.exe. Reconnaissance: The initial payload executes commands to gather intelligence on the internal network environment, including whoami, net user /domain, and ipconfig /all. This initial command set is designed to rapidly map the internal domain structure and identify high-value user accounts, providing the attacker with an immediate blueprint for lateral movement. Data Exfiltration: Collected information is exfiltrated to a remote, attacker-controlled Webhook.site endpoint using a PowerShell payload that attempts Invoke-WebRequest and falls back to curl.exe if needed. Cortex Xpanse identified approximately 5,500 WSUS instances exposed to the internet, providing a tangible metric for the global attack surface. This reconnaissance-focused TTP indicates that initial exploitation is a precursor to broader network compromise, making immediate remediation and threat hunting paramount. Microsoft has recommended temporary workarounds to mitigate the risk for organizations unable to deploy the emergency patches immediately. These measures should be considered interim solutions until patching can be completed. We recommend that affected organizations follow this guidance to address the issue, and check back on official Microsoft language regularly for updates. As of Oct. 27, the guidance consisted of the following mitigations: 1. Disable the WSUS Server Role: Disabling the WSUS role on the server removes the attack vector entirely. However, this will prevent the server from managing and distributing updates to client systems. 2. Block High-Risk Ports: Block all inbound traffic to TCP ports 8530 and 8531 on the host-level firewall. As recommended by Microsoft, this removes the attack vector but will prevent the server from managing and distributing updates. Unit 42 Managed Threat Hunting Queries The Unit 42 Managed Threat Hunting team continues to track any attempts to exploit this CVE across our Managed Services customers, using telemetry available within Cortex XDR. Cortex XDR customers who don’t leverage Unit 42 Managed Services can also use the following XQL query to search for signs of exploitation. Based on the amount of publicly available information, the ease of use and the effectiveness of this exploit, Palo Alto Networks highly recommends following Microsoft’s guidance to protect your organization. This vulnerability and subsequent weaponization serves as an illustration of how configuration failures enable exploitation. While the WSUS vulnerability provides the technical vector, its potentially severe impact is a direct consequence of lapses in security hygiene. The exposure of an internal-facing service, such as WSUS, to the public internet constitutes a significant misconfiguration that elevates a localized server vulnerability into a potential enterprise-wide, supply-chain compromise. This underscores that rigorous asset management and disciplined network segmentation are critical security controls, essential for mitigating the escalation of isolated flaws into systemic organizational breaches. Palo Alto Networks has shared our findings with our fellow Cyber Threat Alliance (CTA) members. CTA members use this intelligence to rapidly deploy protections to their customers and to systematically disrupt malicious cyber actors. Learn more about the Cyber Threat Alliance. Palo Alto Networks customers are better protected by our products, as listed below. We will update this threat brief as more relevant information becomes available. Palo Alto Networks customers can leverage a variety of product protections and updates to help identify and defend against this threat. If you think you might have been compromised or have an urgent matter, get in touch with the Unit 42 Incident Response team or call: North America: Toll Free: +1 (866) 486-4842 (866.4.UNIT42) UK: +44.20.3743.3660 Europe and Middle East: +31.20.299.3130 Asia: +65.6983.8730 Japan: +81.50.1790.0200 Australia: +61.2.4062.7950 India: 000 800 050 45107 Advanced Threat Prevention Next-Generation Firewall with the Advanced Threat Prevention security subscription can help block the attacks with best practices via the following Threat Prevention signature 96657 and 96684. Cortex XDR and XSIAM help protect against post-exploitation activities using the multi-layer protection approach. Cortex has released a response pack and playbook for CVE-2025-59287 - Microsoft WSUS Remote Code Execution to help automate and speed the mitigation process. This playbook automates the following tasks: Identifies and fingerprints WSUS hosts via XQL query Collects indicators from the Unit 42 article Detects any suspicious command lines indicative of exploitation of this vulnerability via an XQL query Investigates the command lines to identify malicious indicators related to the vulnerability Hunts for malicious indicators via an XQL query Isolates compromised WSUS servers (requires analyst approval) Blocks malicious indicators Provides mitigation recommendations hxxp://webhook[.]site/22b6b8c8-2e07-4878-a681-b772e569aa6a Updated Oct. 27, 2025, at 1:50 p.m. PT to update Cortex product protection language. Updated Oct. 27, 2025, at 2:37 p.m. PT to add Managed Threat Hunting query. Updated Oct. 28, 2025, at 2:07 p.m. PT to revise Managed Threat Hunting query and add product protection language for Advanced Threat Prevention. Updated Oct. 30, 2025, at 9:45 a.m. PT to correct the Managed Threat Hunting query. Updated Nov. 3, 2025, at 4:50 p.m. PT to add an additional Threat Prevention signature. Added product protection information for Cortex XSOAR. Updated Nov. 4, 2025, at 7:00 a.m. PT to correct Cortex playbook information.

Phantom Taurus is a previously undocumented nation-state actor whose espionage operations align with People’s Republic of China (PRC) state interests. Over the past two and a half years, Unit 42 researchers have observed Phantom Taurus targeting government and telecommunications organizations across Africa, the Middle East, and Asia. Our observations show that Phantom Taurus’ main focus areas include ministries of foreign affairs, embassies, geopolitical events and military operations. The group’s primary objective is espionage. Its attacks demonstrate stealth, persistence and an ability to quickly adapt their tactics, techniques and procedures (TTPs). What sets Phantom Taurus apart from other actors in the Chinese advanced persistent threat (APT) nexus is its distinctive set of TTPs. These enable the group to conduct highly covert operations and maintain long-term access to critical targets. This article sheds more light on the threat actor’s recently observed TTPs and reveals a previously undocumented custom tool in Phantom Taurus’ arsenal called NET-STAR. We published our first article about this activity cluster (originally tracked as CL-STA-0043) in June 2023. In May 2024, we promoted the classification of this cluster to a temporary group, which we designated TGR-STA-0043 and nicknamed Operation Diplomatic Specter. Our ongoing investigations into this group deepened our understanding of the threat actor’s operations and enabled us to determine its connection to the Chinese nexus. This rare level of insight reflects the depth and duration of our investigation. After sustained observation and intelligence collection over the past year, we have accumulated sufficient evidence to classify the temporary group as a new threat actor. Our attribution and cluster maturation process is based on Unit 42’s attribution framework. Figure 1 shows the process of promoting Phantom Taurus from a cluster of activity to a formally named threat actor. Figure 1 shows the process of promoting Phantom Taurus from a cluster of activity to a formally named threat actor. Palo Alto Networks customers are better protected from the threats discussed above through the following products and services: If you think you might have been compromised or have an urgent matter, contact the Unit 42 Incident Response team. Phantom Taurus is a Chinese APT group that conducts long-term intelligence collection operations against high-value targets to obtain sensitive, non-public information. The group primarily targets government entities and government service providers across the Middle East, Africa and Asia. The targeting patterns align consistently with the People's Republic of China (PRC) economic and geopolitical interests. We observed that the group takes an interest in diplomatic communications, defense-related intelligence and the operations of critical governmental ministries. The timing and scope of the group’s operations frequently coincide with major global events and regional security affairs. Our technical analysis reveals that the group employs a unique set of custom-developed tools and implements techniques that are rarely observed in the threat landscape. The list of TTPs is provided in Appendix A. This group's distinctive modus operandi, combined with its advanced operational practices, sets Phantom Taurus apart from other Chinese APT groups. The designation of this group as a distinct Chinese APT is supported by multiple attribution factors, as illustrated in the Diamond Model of attribution [PDF] shown in Figure 2. We established the attribution of Phantom Taurus through a comprehensive analysis of the following Diamond Model elements: Infrastructure: Phantom Taurus uses a shared Chinese APT operational infrastructure that has been exclusively used by Chinese threat actors, including Iron Taurus (aka APT27), Starchy Taurus (aka Winnti) and Stately Taurus (aka Mustang Panda). However, the specific infrastructure components used by Phantom Taurus have not been observed in operations by other threat actors, indicating operational compartmentalization within this shared ecosystem. Victimology: The group consistently targets high-value organizations that have access to sensitive non-public information. Over the past several years, we have observed Phantom Taurus targeting government and telecommunications sector organizations, particularly those that provide services and infrastructure. This group focuses its operations on the Middle East, Africa and Asia, reflecting intelligence collection priorities that align with Chinese strategic interests. Capabilities: Phantom Taurus employs a set of TTPs that differentiate it from other threat actors. Several of these techniques have not been observed in operations by other groups, while others are sufficiently rare that only a handful of actors have been observed using similar methods. In addition to common tools such as China Chopper, the Potato suite and Impacket, the group uses customized tools, including the Specter malware family, Ntospy and the NET-STAR malware suite described later in this article. By using the Diamond Model of attribution with the three nodes shown in Figure 2, we mapped the group’s similarities and overlaps with other threat actors. As we tracked the activity for an extended period, it became clear that the activities that we observed were carried out by a new threat actor. Our continuous monitoring of Phantom Taurus activities has revealed a tactical evolution that we first observed in early 2025. Since 2023, Phantom Taurus has focused on stealing sensitive and specific emails of interest from email servers, as we described in a previous article. However, our telemetry indicates a shift from this email-centric methodology to the direct targeting of databases. We observed Phantom Taurus using a script named mssq.bat to connect to and collect data from a targeted database. The mssq.bat script operates in the following manner: Connects to an SQL Server database with a given server name, a user ID named sa (system administrator) and a password that the attackers previously obtained Reads the SQL query provided in the command-line arguments by the group’s operators. This allows dynamic searching for tables and specific keywords Executes the provided query and returns the results that match the user’s search Exports results to a CSV file Closes the database connection The threat actor leveraged Windows Management Instrumentation (WMI) to execute the mssq.bat script on the remote SQL Server. Figure 3 shows that the command contains both the embedded script and the execution instructions. The threat actor used this method to search for documents of interest and information related to specific countries such as Afghanistan and Pakistan. In addition to Phantom Taurus’ shift to collecting data from databases, we observed the group using a new and undocumented malware suite in its recent operations. This new tool is a .NET malware suite designed to target Internet Information Services (IIS) web servers. We named the suite NET-STAR, based on the use of the string in the malware’s program database (PDB) paths: C:\Users\Administrator\Desktop\tmp\NETstarshard\ServerCore\obj\Release\ServerCore.pdb C:\Users\admin\Desktop\starshard\NETstarshard\ExecuteAssembly\obj\Debug\ExecuteAssembly.pdb The STAR string also appears as a delimiter in Base64-encoded data. The NET-STAR malware suite demonstrates Phantom Taurus’ advanced evasion techniques and a deep understanding of .NET architecture, representing a significant threat to internet-facing servers. The suite consists of three distinct web-based backdoors, each serving a specific role in the attack chain while maintaining persistence within the target’s IIS environment: IIServerCore: A fileless modular backdoor that supports in-memory execution of command-line arguments, arbitrary commands and payloads AssemblyExecuter V1: Loads and executes additional .NET payloads in memory AssemblyExecuter V2: An enhanced version of AssemblyExecuter V1 that is also equipped with Antimalware Scan Interface (AMSI) and Event Tracing for Windows (ETW) bypass capabilities IIServerCore is the main web-based backdoor component in the NET-STAR malware suite. After being loaded by the web shell loader component, the backdoor operates entirely in memory within the w3wp.exe IIS worker process. The IIServerCore backdoor has a unique modular, fileless execution flow that allows it to: Receive additional payloads and arguments Execute them in memory Send the results in an encrypted command and control (C2) communication channel Figure 4 shows the execution flow. The initial component of IIServerCore is an ASPX web shell named OutlookEN.aspx. This web shell contains an embedded Base64-compressed binary, the IIServerCore backdoor. When the web shell executes, it loads the backdoor into the memory of the w3wp.exe process and invokes the Run method, which is the main function of IIServerCore. Figure 5 shows the web shell. In an attempt to evade detection efforts, the threat actor timestomped the ASPX file to match the timestamp of another old ASPX file found on the operating system. The threat actor timestomped not only the web shell, but also the backdoors in the NET-STAR malware suite. The actor changed the compilation time to a random future date to hide the malware’s real compilation timestamp. IIServerCore also supports a command called changeLastModified. This suggests that the malware has active timestomping capabilities, designed to confuse security analysts and digital forensics tools. The IIServerCore backdoor consists of a class called ServerRun and 11 methods. This includes a main method named Run as well as several others that provide additional capabilities. The methods and their descriptions are listed in Appendix B. The main method, Run, receives the incoming communication and handles all malware operations. This method processes two types of requests: Initial handshake requests to establish a session with the C2 server Subsequent command execution requests to load and execute .NET assemblies dynamically Figure 6 shows the Run method. The Run method manages the session state using cookies. This behavior allows the method to track and maintain information about a user’s session across multiple web requests. It decrypts incoming commands and payloads, loads .NET code from Base64-encoded assemblies and supports data encryption. The backdoor supports various built-in commands that provide a wide range of functionalities, including: File system operations Database access, including running SQL commands Arbitrary code execution Web shell management to deploy and manage multiple web shells Antivirus evasion: AMSI bypass functionality Encrypted C2 communication, where all communications are AES encrypted Memory-only execution: payloads are loaded directly into memory The full list of commands is provided in Appendix C. The second component in the NET-STAR suite is another .NET IIS malware that we named AssemblyExecuter. During our investigation, we observed two versions of AssemblyExecuter: An older version (v1) that we believe the threat actors initially used around 2024 A newer version (v2) that we believe they used in 2025 The first AssemblyExecuter version is a .NET assembly designed for a single, specific purpose of executing other .NET assemblies directly in memory without writing them to disk. This component enables threat actors to dynamically load and execute additional functionality after a compromise. The backdoor accepts assembly bytecode as input parameters, loads it using the .NET Assembly.Load() method and invokes the assembly’s entry point along with specified command-line arguments. The component’s seemingly benign code structure results in minimal flagging by antivirus engines on VirusTotal, at the time of writing this article. This demonstrates a technique that threat actors can use to create tools that avoid overt code, which detection systems might interpret as malicious. The second AssemblyExecuter version maintains the same core purpose as its predecessor, executing arbitrary .NET assemblies directly in memory. This version has enhanced evasion capabilities to operate in more heavily monitored environments. While the fundamental assembly loading and execution logic remain unchanged, AssemblyExecuter v2 includes dedicated methods for bypassing two critical Windows security mechanisms, AMSI and ETW. The malware dynamically determines which bypass techniques to apply based on input parameters, allowing attackers to selectively disable security controls, depending on the target environment’s configuration. Figure 7 displays the input parameters that the attackers used to achieve bypass. This article details the maturation of activity cluster CL-STA-0043 to a formally designated threat actor, Phantom Taurus. We also provide a detailed technical analysis of NET-STAR, a previously undiscovered malware suite that represents a significant evolution in this actor's operational capabilities. The extensive evidence that we gathered provides crucial insights into adversary persistence, adaptability, evolution process and strategic intent that short-term analysis cannot always capture. The formal designation of Phantom Taurus demonstrates the value of sustained threat actor tracking. Our multi-year investigation exemplifies how long-term monitoring enables a comprehensive understanding of threat actor evolution and operational capabilities. Palo Alto Networks customers are better protected from the threats discussed above through the following products: The Advanced WildFire machine-learning models and analysis techniques have been reviewed and updated in light of the indicators shared in this research. Advanced Threat Prevention has an inbuilt machine learning-based detection that can detect exploits in real time. Cortex XDR and XSIAM. - The XDR agent is designed to protect against the initial NET-STAR malware loader, preventing the execution of the attack chain outlined in this article. - Figure 8 shows that the execution of the loader component was detected and prevented by the web shell protection module. If you think you may have been compromised or have an urgent matter, get in touch with the Unit 42 Incident Response team or call: North America: Toll Free: +1 (866) 486-4842 (866.4.UNIT42) UK: +44.20.3743.3660 Europe and Middle East: +31.20.299.3130 Asia: +65.6983.8730 Japan: +81.50.1790.0200 Australia: +61.2.4062.7950 India: 000 800 050 45107 Palo Alto Networks has shared these findings with our fellow Cyber Threat Alliance (CTA) members. CTA members use this intelligence to rapidly deploy protections to their customers and to systematically disrupt malicious cyber actors. Learn more about the Cyber Threat Alliance. SHA256 hash for IIServerCore (ServerCore.dll) eeed5530fa1cdeb69398dc058aaa01160eab15d4dcdcd6cb841240987db284dc SHA256 hash for AssemblyExecuter V1 (ExecuteAssembly.dll) 3e55bf8ecaeec65871e6fca4cb2d4ff2586f83a20c12977858348492d2d0dec4 SHA256 hash for AssemblyExecuter V2 (ExecuteAssembly.dll) afcb6289a4ef48bf23bab16c0266f765fab8353d5e1b673bd6e39b315f83676e b76e243cf1886bd0e2357cbc7e1d2812c2c0ecc5068e61d681e0d5cff5b8e038 UNMASKED: Inside a New Chinese Nexus APT – Webinar, Palo Alto Networks Operation Diplomatic Specter: An Active Chinese Cyberespionage Campaign Leverages Rare Tool Set to Target Governmental Entities in the Middle East, Africa and Asia – Unit 42, Palo Alto Networks Through the Cortex XDR Lens: Uncovering a New Activity Group Targeting Governments in the Middle East and Africa – Palo Alto Networks Blog New Tool Set Found Used Against Organizations in the Middle East, Africa and the US – Unit 42, Palo Alto Networks Table 1. Phantom Taurus main TTPs. Table 2. List of IIServerCore’s methods. The following commands are embedded in the IIServerCore backdoor: fileExist listDir createDir renameDir fileRead deleteFile Dictionary createFile changeLastModified code_self code_pid run_code addshell bypassPrecompiledApp listShell removeShell executeSQLQuery ExecuteNonQuery

On July 19–20, 2025, various security companies and national CERTs published alerts about active exploitation of on-premise SharePoint servers. According to the reports, observed attacks did not require authentication, allowed attackers to gain full control over the infected servers, and were performed using an exploit chain of two vulnerabilities: CVE-2025-49704 and CVE-2025-49706, publicly named “ToolShell”. Additionally, on the same dates, Microsoft released out-of-band security patches for the vulnerabilities CVE-2025-53770 and CVE-2025-53771, aimed at addressing the security bypasses of previously issued fixes for CVE-2025-49704 and CVE-2025-49706. The release of the new, “proper” updates has caused confusion about exactly which vulnerabilities attackers are exploiting and whether they are using zero-day exploits. Kaspersky products proactively detected and blocked malicious activity linked to these attacks, which allowed us to gather statistics about the timeframe and spread of this campaign. Our statistics show that widespread exploitation started on July 18, 2025, and attackers targeted servers across the world in Egypt, Jordan, Russia, Vietnam, and Zambia. Entities across multiple sectors were affected: government, finance, manufacturing, forestry, and agriculture. While analyzing all artifacts related to these attacks, which were detected by our products and public information provided by external researchers, we found a dump of a POST request that was claimed to contain the malicious payload used in these attacks. After performing our own analysis, we were able to confirm that this dump indeed contained the malicious payload detected by our technologies, and that sending this single request to an affected SharePoint installation was enough to execute the malicious payload there. Our analysis of the exploit showed that it did rely on vulnerabilities fixed under CVE-2025-49704 and CVE-2025-49706, but by changing just one byte in the request, we were able to bypass those fixes. In this post, we provide detailed information about CVE-2025-49704, CVE-2025-49706, CVE-2025-53770, CVE-2025-53771, and one related vulnerability. Since the exploit code is already published online, is very easy to use, and poses a significant risk, we encourage all organizations to install the necessary updates. The exploit Our research started with an analysis of a POST request dump associated with this wave of attacks on SharePoint servers. We can see that this POST request targets the “/_layouts/15/ToolPane.aspx” endpoint and embeds two parameters: “MSOtlPn_Uri” and “MSOtlPn_DWP”. Looking at the code of ToolPane.aspx, we can see that this file itself does not contain much functionality and most of its code is located in the ToolPane class of the Microsoft.SharePoint.WebPartPages namespace in Microsoft.SharePoint.dll. Looking at this class reveals the code that works with the two parameters present in the exploit. However, accessing this endpoint under normal conditions is not possible without bypassing authentication on the attacked SharePoint server. This is where the first Microsoft SharePoint Server Spoofing Vulnerability CVE-2025-49706 comes into play. CVE-2025-49706 This vulnerability is present in the method PostAuthenticateRequestHandler, in Microsoft.SharePoint.dll. SharePoint requires Internet Information Services (IIS) to be configured in integrated mode. In this mode, the IIS and ASP.NET authentication stages are unified. As a result, the outcome of IIS authentication is not determined until the PostAuthenticateRequest stage, at which point both the ASP.NET and IIS authentication methods have been completed. Therefore, the PostAuthenticateRequestHandler method utilizes a series of flags to track potential authentication violations. A logic bug in this method enables an authentication bypass if the “Referrer” header of the HTTP request is equal to “/_layouts/SignOut.aspx”, “/_layouts/14/SignOut.aspx”, or “/_layouts/15/SignOut.aspx” using case insensitive comparison. The code displayed in the image above handles the sign-out request and is also triggered when the sign-out page is specified as the referrer. When flag6 is set to false and flag7 is set to true, both conditional branches that could potentially throw an “Unauthorized Access” exception are bypassed. On July 8, 2025, Microsoft released an update that addressed this vulnerability by introducing additional checks to detect the usage of the “ToolPane.aspx” endpoint with the sign-out page specified as the referrer. The added check uses case insensitive comparison to verify if the requested path ends with “ToolPane.aspx”. Is it possible to bypass this check, say, by using a different endpoint? Our testing has shown that this check can be easily bypassed. CVE-2025-53771 We were able to successfully bypass the patch for vulnerability CVE-2025-49706 by adding just one byte to the exploit POST request. All that was required to bypass this patch was to add a “/” (slash) to the end of the requested “ToolPane.aspx” path. On July 20, 2025, Microsoft released an update that fixed this bypass as CVE-2025-53771. This fix replaces the “ToolPane.aspx” check to instead check whether the requested path is in the list of paths allowed for use with the sign-out page specified as the referrer. This allowlist includes the following paths: “/_layouts/15/SignOut.aspx”, “/_layouts/15/1033/initstrings.js”, “/_layouts/15/init.js”, “/_layouts/15/theming.js”, “/ScriptResource.axd”, “/_layouts/15/blank.js”, “/ScriptResource.axd”, “/WebResource.axd”, “/_layouts/15/1033/styles/corev15.css”, “/_layouts/15/1033/styles/error.css”, “/_layouts/15/images/favicon.ico”, “/_layouts/15/1033/strings.js”, “/_layouts/15/core.js”, and it can contain additional paths added by the administrator. While testing the CVE-2025-49706 bypass with the July 8, 2025 updates installed on our SharePoint debugging stand, we noticed some strange behavior. Not only did the bypass of CVE-2025-49706 work, but the entire exploit chain did! But wait! Didn’t the attackers use an additional Microsoft SharePoint Remote Code Execution Vulnerability CVE-2025-49704, which was supposed to be fixed in the same update? To understand why the entire exploit chain worked in our case, let’s take a look at the vulnerability CVE-2025-49704 and how it was fixed. CVE-2025-49704 CVE-2025-49704 is an untrusted data deserialization vulnerability that exists due to improper validation of XML content. Looking at the exploit POST request, we can see that it contains two URL encoded parameters: “MSOtlPn_Uri” and “MSOtlPn_DWP”. We can see how they are handled by examining the code of the method GetPartPreviewAndPropertiesFromMarkup in Microsoft.SharePoint.dll. A quick analysis reveals that “MSOtlPn_Uri” is a page URL that might be pointing to an any file in the CONTROLTEMPLATES folder and the parameter “MSOtlPn_DWP” contains something known as WebPart markup. This markup contains special directives that can be used to execute safe controls on a server and has a format very similar to XML. While this “XML” included in the “MSOtlPn_DWP” parameter does not itself contain a vulnerability, it allows attackers to instantiate the ExcelDataSet control from Microsoft.PerformancePoint.Scorecards.Client.dll with CompressedDataTable property set to malicious payload and trigger its processing using DataTable property getter. Looking at the code of the ExcelDataSet’s DataTable property getter in Microsoft.PerformancePoint.Scorecards.Client.dll, we find the method GetObjectFromCompressedBase64String, responsible for deserialization of CompressedDataTable property contents. The data provided as Base64 string is decoded, unzipped, and passed to the BinarySerialization.Deserialize method from Microsoft.SharePoint.dll. Attackers use this method to provide a malicious DataSet whose deserialized content is shown in the image above. It contains an XML with an element of dangerous type "System.Collections.Generic.List1[[System.Data.Services.Internal.ExpandedWrapper2[...], System.Data.Services, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]]", which allows attackers to execute arbitrary methods with the help of the well-known ExpandedWrapper technique aimed at exploitation of unsafe XML deserialization in applications based on the .NET framework. In fact, this shouldn’t be possible, since BinarySerialization.Deserialize in Microsoft.SharePoint.dll uses a special XmlValidator designed to protect against this technique by checking the types of all elements present in the provided XML and ensuring that they are on the list of allowed types. However, the exploit bypasses this check by placing the ExpandedWrapper object into the list. Now, to find out why the exploit worked on our SharePoint debugging stand with the July 8, 2025 updates installed, let’s take a look at how this vulnerability was fixed. In this patch, Microsoft did not really fix the vulnerability but only mitigated it by adding the new AddExcelDataSetToSafeControls class to the Microsoft.SharePoint.Upgrade namespace. This class contains new code that modifies the web.config file and marks the Microsoft.PerformancePoint.Scorecards.ExcelDataSet control as unsafe. Because SharePoint does not execute this code on its own after installing updates, the only way to achieve the security effect was to manually run a configuration upgrade using the SharePoint Products Configuration Wizard tool. Notably, the security guidance for CVE-2025-49704 does not mention the need for this step, which means at least some SharePoint administrators may skip it. Meanwhile, anyone who installed this update but did not manually perform a configuration upgrade remained vulnerable. CVE-2025-53770 On July 20, 2025, Microsoft released an update with a proper fix for the CVE-2025-49704 vulnerability. This patch introduces an updated XmlValidator that now properly validates element types in XML, preventing exploitation of this vulnerability without requiring a configuration upgrade and, more importantly, addressing the root cause and preventing exploitation of the same vulnerability through controls other than Microsoft.PerformancePoint.Scorecards.ExcelDataSet. CVE-2020-1147 Readers familiar with previous SharePoint exploits might feel that the vulnerability CVE-2025-49704/CVE-2025-53770 and the exploit used by the attackers looks very familiar and very similar to the older .NET Framework, SharePoint Server, and Visual Studio Remote Code Execution Vulnerability CVE-2020-1147. In fact, if we compare the exploit for CVE-2020-1147 and an exploit for CVE-2025-49704/CVE-2025-53770, we can see that they are almost identical. The only difference is that in the exploit for CVE-2025-49704/CVE-2025-53770, the dangerous ExpandedWrapper object is placed in the list. This makes CVE-2025-53770 an updated fix for CVE-2020-1147. Conclusions Despite the fact that patches for the ToolShell vulnerabilities are now available for deployment, we assess that this chain of exploits will continue being used by attackers for a long time. We have been observing the same situation with other notorious vulnerabilities, such as ProxyLogon, PrintNightmare, or EternalBlue. While they have been known for years, many threat actors still continue leveraging them in their attacks to compromise unpatched systems. We expect the ToolShell vulnerabilities to follow the same fate, as they can be exploited with extremely low effort and allow full control over the vulnerable server. To stay better protected against threats like ToolShell, we as a community should learn lessons from previous events in the industry related to critical vulnerabilities. Specifically, the speed of applying security patches nowadays is the most important factor when it comes to fighting such vulnerabilities. Since public exploits for these dangerous vulnerabilities appear very soon after vulnerability announcements, it is paramount to install patches as soon as possible, as a gap of even a few hours can make a critical difference. At the same time, it is important to protect enterprise networks against zero-day exploits, which can be leveraged when there is no available public patch for vulnerabilities. In this regard, it is critical to equip machines with reliable cybersecurity solutions that have proven effective in combatting ToolShell attacks before they were publicly disclosed. Kaspersky Next with its Behaviour detection component proactively protects against exploitation of these vulnerabilities. Additionally, it is able to detect exploitation and the subsequent malicious activity. Kaspersky products detect the exploits and malware used in these attacks with the following verdicts: UDS:DangerousObject.Multi.Generic PDM:Exploit.Win32.Generic PDM:Trojan.Win32.Generic HEUR:Trojan.MSIL.Agent.gen ASP.Agent.* PowerShell.Agent.*

On July 19–20, 2025, various security companies and national CERTs published alerts about active exploitation of on-premise SharePoint servers. According to the reports, observed attacks did not require authentication, allowed attackers to gain full control over the infected servers, and were performed using an exploit chain of two vulnerabilities: CVE-2025-49704 and CVE-2025-49706, publicly named “ToolShell”. Additionally, on the same dates, Microsoft released out-of-band security patches for the vulnerabilities CVE-2025-53770 and CVE-2025-53771, aimed at addressing the security bypasses of previously issued fixes for CVE-2025-49704 and CVE-2025-49706. The release of the new, “proper” updates has caused confusion about exactly which vulnerabilities attackers are exploiting and whether they are using zero-day exploits. Kaspersky products proactively detected and blocked malicious activity linked to these attacks, which allowed us to gather statistics about the timeframe and spread of this campaign. Our statistics show that widespread exploitation started on July 18, 2025, and attackers targeted servers across the world in Egypt, Jordan, Russia, Vietnam, and Zambia. Entities across multiple sectors were affected: government, finance, manufacturing, forestry, and agriculture. While analyzing all artifacts related to these attacks, which were detected by our products and public information provided by external researchers, we found a dump of a POST request that was claimed to contain the malicious payload used in these attacks. After performing our own analysis, we were able to confirm that this dump indeed contained the malicious payload detected by our technologies, and that sending this single request to an affected SharePoint installation was enough to execute the malicious payload there. Our analysis of the exploit showed that it did rely on vulnerabilities fixed under CVE-2025-49704 and CVE-2025-49706, but by changing just one byte in the request, we were able to bypass those fixes. In this post, we provide detailed information about CVE-2025-49704, CVE-2025-49706, CVE-2025-53770, CVE-2025-53771, and one related vulnerability. Since the exploit code is already published online, is very easy to use, and poses a significant risk, we encourage all organizations to install the necessary updates. The exploit Our research started with an analysis of a POST request dump associated with this wave of attacks on SharePoint servers. We can see that this POST request targets the “/_layouts/15/ToolPane.aspx” endpoint and embeds two parameters: “MSOtlPn_Uri” and “MSOtlPn_DWP”. Looking at the code of ToolPane.aspx, we can see that this file itself does not contain much functionality and most of its code is located in the ToolPane class of the Microsoft.SharePoint.WebPartPages namespace in Microsoft.SharePoint.dll. Looking at this class reveals the code that works with the two parameters present in the exploit. However, accessing this endpoint under normal conditions is not possible without bypassing authentication on the attacked SharePoint server. This is where the first Microsoft SharePoint Server Spoofing Vulnerability CVE-2025-49706 comes into play. CVE-2025-49706 This vulnerability is present in the method PostAuthenticateRequestHandler, in Microsoft.SharePoint.dll. SharePoint requires Internet Information Services (IIS) to be configured in integrated mode. In this mode, the IIS and ASP.NET authentication stages are unified. As a result, the outcome of IIS authentication is not determined until the PostAuthenticateRequest stage, at which point both the ASP.NET and IIS authentication methods have been completed. Therefore, the PostAuthenticateRequestHandler method utilizes a series of flags to track potential authentication violations. A logic bug in this method enables an authentication bypass if the “Referrer” header of the HTTP request is equal to “/_layouts/SignOut.aspx”, “/_layouts/14/SignOut.aspx”, or “/_layouts/15/SignOut.aspx” using case insensitive comparison. The code displayed in the image above handles the sign-out request and is also triggered when the sign-out page is specified as the referrer. When flag6 is set to false and flag7 is set to true, both conditional branches that could potentially throw an “Unauthorized Access” exception are bypassed. On July 8, 2025, Microsoft released an update that addressed this vulnerability by introducing additional checks to detect the usage of the “ToolPane.aspx” endpoint with the sign-out page specified as the referrer. The added check uses case insensitive comparison to verify if the requested path ends with “ToolPane.aspx”. Is it possible to bypass this check, say, by using a different endpoint? Our testing has shown that this check can be easily bypassed. CVE-2025-53771 We were able to successfully bypass the patch for vulnerability CVE-2025-49706 by adding just one byte to the exploit POST request. All that was required to bypass this patch was to add a “/” (slash) to the end of the requested “ToolPane.aspx” path. On July 20, 2025, Microsoft released an update that fixed this bypass as CVE-2025-53771. This fix replaces the “ToolPane.aspx” check to instead check whether the requested path is in the list of paths allowed for use with the sign-out page specified as the referrer. This allowlist includes the following paths: “/_layouts/15/SignOut.aspx”, “/_layouts/15/1033/initstrings.js”, “/_layouts/15/init.js”, “/_layouts/15/theming.js”, “/ScriptResource.axd”, “/_layouts/15/blank.js”, “/ScriptResource.axd”, “/WebResource.axd”, “/_layouts/15/1033/styles/corev15.css”, “/_layouts/15/1033/styles/error.css”, “/_layouts/15/images/favicon.ico”, “/_layouts/15/1033/strings.js”, “/_layouts/15/core.js”, and it can contain additional paths added by the administrator. While testing the CVE-2025-49706 bypass with the July 8, 2025 updates installed on our SharePoint debugging stand, we noticed some strange behavior. Not only did the bypass of CVE-2025-49706 work, but the entire exploit chain did! But wait! Didn’t the attackers use an additional Microsoft SharePoint Remote Code Execution Vulnerability CVE-2025-49704, which was supposed to be fixed in the same update? To understand why the entire exploit chain worked in our case, let’s take a look at the vulnerability CVE-2025-49704 and how it was fixed. CVE-2025-49704 CVE-2025-49704 is an untrusted data deserialization vulnerability that exists due to improper validation of XML content. Looking at the exploit POST request, we can see that it contains two URL encoded parameters: “MSOtlPn_Uri” and “MSOtlPn_DWP”. We can see how they are handled by examining the code of the method GetPartPreviewAndPropertiesFromMarkup in Microsoft.SharePoint.dll. A quick analysis reveals that “MSOtlPn_Uri” is a page URL that might be pointing to an any file in the CONTROLTEMPLATES folder and the parameter “MSOtlPn_DWP” contains something known as WebPart markup. This markup contains special directives that can be used to execute safe controls on a server and has a format very similar to XML. While this “XML” included in the “MSOtlPn_DWP” parameter does not itself contain a vulnerability, it allows attackers to instantiate the ExcelDataSet control from Microsoft.PerformancePoint.Scorecards.Client.dll with CompressedDataTable property set to malicious payload and trigger its processing using DataTable property getter. Looking at the code of the ExcelDataSet’s DataTable property getter in Microsoft.PerformancePoint.Scorecards.Client.dll, we find the method GetObjectFromCompressedBase64String, responsible for deserialization of CompressedDataTable property contents. The data provided as Base64 string is decoded, unzipped, and passed to the BinarySerialization.Deserialize method from Microsoft.SharePoint.dll. Attackers use this method to provide a malicious DataSet whose deserialized content is shown in the image above. It contains an XML with an element of dangerous type "System.Collections.Generic.List1[[System.Data.Services.Internal.ExpandedWrapper2[...], System.Data.Services, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]]", which allows attackers to execute arbitrary methods with the help of the well-known ExpandedWrapper technique aimed at exploitation of unsafe XML deserialization in applications based on the .NET framework. In fact, this shouldn’t be possible, since BinarySerialization.Deserialize in Microsoft.SharePoint.dll uses a special XmlValidator designed to protect against this technique by checking the types of all elements present in the provided XML and ensuring that they are on the list of allowed types. However, the exploit bypasses this check by placing the ExpandedWrapper object into the list. Now, to find out why the exploit worked on our SharePoint debugging stand with the July 8, 2025 updates installed, let’s take a look at how this vulnerability was fixed. In this patch, Microsoft did not really fix the vulnerability but only mitigated it by adding the new AddExcelDataSetToSafeControls class to the Microsoft.SharePoint.Upgrade namespace. This class contains new code that modifies the web.config file and marks the Microsoft.PerformancePoint.Scorecards.ExcelDataSet control as unsafe. Because SharePoint does not execute this code on its own after installing updates, the only way to achieve the security effect was to manually run a configuration upgrade using the SharePoint Products Configuration Wizard tool. Notably, the security guidance for CVE-2025-49704 does not mention the need for this step, which means at least some SharePoint administrators may skip it. Meanwhile, anyone who installed this update but did not manually perform a configuration upgrade remained vulnerable. CVE-2025-53770 On July 20, 2025, Microsoft released an update with a proper fix for the CVE-2025-49704 vulnerability. This patch introduces an updated XmlValidator that now properly validates element types in XML, preventing exploitation of this vulnerability without requiring a configuration upgrade and, more importantly, addressing the root cause and preventing exploitation of the same vulnerability through controls other than Microsoft.PerformancePoint.Scorecards.ExcelDataSet. CVE-2020-1147 Readers familiar with previous SharePoint exploits might feel that the vulnerability CVE-2025-49704/CVE-2025-53770 and the exploit used by the attackers looks very familiar and very similar to the older .NET Framework, SharePoint Server, and Visual Studio Remote Code Execution Vulnerability CVE-2020-1147. In fact, if we compare the exploit for CVE-2020-1147 and an exploit for CVE-2025-49704/CVE-2025-53770, we can see that they are almost identical. The only difference is that in the exploit for CVE-2025-49704/CVE-2025-53770, the dangerous ExpandedWrapper object is placed in the list. This makes CVE-2025-53770 an updated fix for CVE-2020-1147. Conclusions Despite the fact that patches for the ToolShell vulnerabilities are now available for deployment, we assess that this chain of exploits will continue being used by attackers for a long time. We have been observing the same situation with other notorious vulnerabilities, such as ProxyLogon, PrintNightmare, or EternalBlue. While they have been known for years, many threat actors still continue leveraging them in their attacks to compromise unpatched systems. We expect the ToolShell vulnerabilities to follow the same fate, as they can be exploited with extremely low effort and allow full control over the vulnerable server. To stay better protected against threats like ToolShell, we as a community should learn lessons from previous events in the industry related to critical vulnerabilities. Specifically, the speed of applying security patches nowadays is the most important factor when it comes to fighting such vulnerabilities. Since public exploits for these dangerous vulnerabilities appear very soon after vulnerability announcements, it is paramount to install patches as soon as possible, as a gap of even a few hours can make a critical difference. At the same time, it is important to protect enterprise networks against zero-day exploits, which can be leveraged when there is no available public patch for vulnerabilities. In this regard, it is critical to equip machines with reliable cybersecurity solutions that have proven effective in combatting ToolShell attacks before they were publicly disclosed. Kaspersky Next with its Behaviour detection component proactively protects against exploitation of these vulnerabilities. Additionally, it is able to detect exploitation and the subsequent malicious activity. Kaspersky products detect the exploits and malware used in these attacks with the following verdicts: UDS:DangerousObject.Multi.Generic PDM:Exploit.Win32.Generic PDM:Trojan.Win32.Generic HEUR:Trojan.MSIL.Agent.gen ASP.Agent.* PowerShell.Agent.*