Intelligence Feed

1w ago · security-com

Attackers have developed an autonomous offensive agent named 'Skynet' that hijacks exposed large language model (LLM) endpoints to conduct self-directed cyberattacks. The agent leverages stolen or unsecured AI model access to perform internet-wide scanning, exploit web frameworks, steal credentials and databases, and deploy cryptocurrency miners without human intervention. It uses sophisticated jailbreak techniques to bypass commercial model safety controls by redefining malicious activities as routine development tasks. The activity represents a novel form of LLMjacking, where attackers shift computational costs to victims while maintaining anonymity and evading provider bans.

1w ago · security-com

Two critical use-after-free vulnerabilities in PHP, tracked as CVE-2026-109618 and CVE-2026-109619 and collectively named PHP2Shell, enable unauthenticated remote code execution on affected servers. The flaws exist in the PHP runtime and can be exploited via crafted web requests, allowing attackers to take control of servers, execute arbitrary code, read sensitive memory, or establish persistence. Public proof-of-concept code emerged before patches were available, and exploitation attempts have been observed since October 17, 2026, with increased activity following disclosure. All PHP installations handling web requests are affected, especially those using Apache with mod_php, and immediate patching is strongly advised.

1w ago · securelist

Two critical remote code execution (RCE) vulnerabilities, CVE-2026-109618 and CVE-2026-109619, were disclosed in PHP, affecting versions 5 through 8. The flaws, related to use-after-free and memory corruption in the handling of multipart/form-data with session.upload_progress, allow unauthenticated attackers to execute arbitrary code on vulnerable web servers. An exploit named PHP2Shell has been demonstrated in the wild against popular PHP applications including WordPress, MediaWiki, and Drupal. Exploitation is highly likely immediately after patch release, and mitigation requires immediate patching or temporary configuration changes such as disabling upload progress and blocking multipart requests.

1w ago · securelist

In early 2026, the APT41 threat actor revived techniques from the BlackLotus UEFI bootkit to target diplomatic organizations in Central Asia, specifically in Tajikistan, Uzbekistan, and Turkmenistan. The attackers deployed a new bootkit dubbed BlackX, exploiting the Baton Drop vulnerability (CVE-2022-21894) to bypass Secure Boot by installing custom Machine Owner Keys (MOK). The attack involved a multi-stage payload, including a malicious kernel driver signed with a revoked certificate and user-mode implants such as a cloud-based RAT and a Rust-based C2 client communicating with www.archivetj.com.

6d ago · wiz

Threat actors are conducting phishing campaigns via malicious Google Search ads to steal Google Cloud Platform (GCP) credentials and multi-factor authentication codes. Using compromised accounts, attackers gain access to GCP environments, disable organizational policy controls, and link external attacker-controlled projects to the victim's billing accounts. This allows them to abuse the victim's financial resources for large-scale, unauthorized Large Language Model (LLM) inference through Google's Gemini API, resulting in massive, undetected API charges. The attackers also employ geographic blending and demote legitimate administrators to evade detection and maintain persistence.

1w ago · step-security

On October 20, 2026, Python's security team issued an advisory urging users to update Python packaging tools due to a compromise involving eMudhra/emSign CA intermediate certificates. The private keys for these intermediate CAs were generated with insufficient randomness, allowing potential attackers to forge certificates and impersonate HTTPS services during dependency downloads. This could enable man-in-the-middle attacks against tools like pip, uv, and conda that rely on certificate validation when fetching packages. Remediation requires updating to specific patched versions of certifi, pip, uv, conda, and other tools to ensure the affected certificate chains are no longer trusted.

1w ago · talos

Cisco Talos identified a growing trend where attackers abuse legitimate infrastructure, such as order notification systems from Staples and Dell, to deliver malicious content by injecting attacker-controlled phone numbers into transactional email fields. These messages leverage trusted domains and pass standard email authentication (DKIM, DMARC), making them appear legitimate while creating urgency around fake high-value purchases to prompt victims to call malicious helplines. The same abuse pattern extends to list bombing and bounce abuse, where malicious content is reflected through trusted platforms or embedded in delivery status notifications, bypassing traditional security controls by exploiting trust in legitimate services.

1w ago · hacker-news

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two critical vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog due to active exploitation. CVE-2026-110447 is a command injection flaw in Collabora Online’s Built-in CODE Server used within Nextcloud, allowing remote code execution via a proxy.php endpoint when the document server is offline. Threat actors have exploited this vulnerability to deploy web shells on Nextcloud servers for reconnaissance and credential harvesting. CVE-2026-114625 is a critical SQL injection vulnerability in on-premise Arista VeloCloud Orchestrator instances, exploitable by authenticated attackers with read-only access, enabling access to privileged internal functionality. Arista confirmed active exploitation and identified two malicious IP addresses linked to the attacks, both geolocated to Japan.

1w ago · hacker-news

Between November 2025 and March 2026, Dutch security firm Eye Security conducted Operation IXIM, pushing over 2 million updates to disable a vulnerable updater in the abandoned Time4Popcorn application, which could have been exploited to create a large-scale botnet. The updater, running with SYSTEM/root privileges, fetched updates over unencrypted connections without authentication, making it susceptible to remote code execution. The vulnerability, tracked as CVE-2026-30612, affected Windows, Mac, and Android versions of the app and allowed any actor who registered abandoned domains to push malicious payloads. Eye Security mitigated the threat by registering the domains and pushing a disabling update, later transferring control to the Shadowserver Foundation.

1w ago · hacker-news

An unrevoked master key from LiteLLM's Agent Platform, accidentally exposed in a public GitHub repository in May 2026, was exploited by an attacker on October 10, 2026, to gain access to the organization's GitHub CLI OAuth token with owner-level privileges. The attacker used this access to hijack the release pipeline, publish a malicious version of the LiteLLM Python package (1.107.0) to PyPI, and exfiltrate sensitive credentials via malicious GitHub Actions workflows. The compromised package executes automatically at Python startup, enabling credential theft and backdoor execution, even if LiteLLM is not explicitly imported.

1w ago · hacker-news

A critical memory-corruption vulnerability in Google's Brotli decoder, tracked as CVE-2026-11147, affects multiple widely used software platforms including Node.js, Bun, Python (via Brotli and brotlicffi packages), Envoy, Istio, and cdxgen. The flaw allows attackers to trigger buffer overflows via crafted Brotli-compressed data, potentially leading to remote code execution, memory leaks, or crashes. Imperva demonstrated a working exploit on unpatched Node.js, named Node2Shell, achieving remote code execution on Linux ARM64, though no in-the-wild exploitation has been observed. The vulnerability stems from unpatched code in the Brotli C library that went unfixed in releases for months despite being addressed in source code in February 2026.

1w ago · bleeping-computer

The BlackX UEFI bootkit, attributed with medium confidence to Chinese state-sponsored threat group APT41 (also known as Brass Typhoon, Wicked Panda, Barium), has been used in an espionage campaign since early 2026 targeting diplomatic agencies in Central Asia. It exploits the Baton Drop vulnerability (CVE-2022-21894) to bypass Secure Boot by enrolling custom Machine Owner Keys (MOKs) and loading malicious EFI files, leveraging a previously known flaw that requires manual activation of certificate revocation to be fully mitigated. The bootkit deploys a malicious kernel driver signed with a revoked certificate to disable security processes, tamper with ETW, and deploy follow-on payloads including a RAT using cloud storage for C2 and the OxiDLLRunner DLL loader that executes obfuscated Rust-based plugins from a malicious domain.

1w ago · datadog-security-labs

On October 21, 2026, a malicious version (1.107.0) of the popular Python package litellm was published to PyPI and Docker registries via a compromised build pipeline. Attackers used stolen GitHub CLI OAuth tokens to publish the package from a malicious fork, Berri-AI/litellm, which dropped persistent malware files that execute on every Python startup. The payload included a credential stealer exfiltrating cloud, developer, AI, and browser credentials, and a backdoor capable of downloading and executing remote code. The malicious release was available for approximately two hours before removal.

1w ago · datadog-security-labs

PHP disclosed two critical remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both with a CVSS v4.0 score of 9.2. These flaws allow unauthenticated attackers to execute arbitrary commands on affected PHP deployments by exploiting memory exhaustion and stale state reuse during request processing. Exploitation attempts were observed in the wild as early as October 17, 2026, four days before public disclosure. The vulnerabilities affect all PHP web deployments, including Apache modules, PHP-FPM, and CGI setups. Successful exploitation does not require application-level authentication and can result in shell command execution under the web server's privileges without necessarily crashing the worker process.

1w ago · socket-dev

A supply chain attack compromised the LiteLLM package version 1.107.0 on PyPI and associated Docker images, distributing a credential-stealing payload. The malicious package includes Python startup hooks (cook.pth, sitecustomize.py) that execute upon Python interpreter startup, even if LiteLLM is not imported, enabling theft of cloud credentials, AI provider keys, browser data, SSH keys, and other sensitive information. Data is exfiltrated to hxxp://www[.]litellm[.]dev/healthcheck in encrypted form, while a remote loader fetches and executes Python code from a GitHub-hosted domain pointer. The attack leveraged a lookalike GitHub repository (Berri-AI/litellm instead of BerriAI/litellm) in the build provenance, indicating a potential compromise in the release workflow.

1w ago · socket-dev

PHP has released emergency patches for two critical remote code execution (RCE) vulnerabilities, collectively dubbed PHP2Shell, which affect all versions since PHP 5.4 and can be exploited without authentication. The vulnerabilities, CVE-2026-109618 and CVE-2026-109619, stem from memory-safety flaws in the PHP engine and allow attackers to execute arbitrary code on vulnerable web servers before application-level code runs. Both the NSA and CERT-EU have advised organizations to take unpatched systems offline due to the severity, with active exploitation already observed. Cloudflare has implemented temporary WAF rules, but a full runtime update is required for complete mitigation.

1w ago · socket-dev

Socket discovered a supply chain attack targeting the BerriAI/litellm GitHub repository, where malicious GitHub Actions workflows were deployed 11 days before a malicious package was published to PyPI and Docker. The attacker used short-lived branches to inject a secret-exfiltration workflow at .github/workflows/cache.yml, which successfully ran on October 10 and October 12, 2026, stealing CI/CD secrets including GitHub tokens, API keys, and environment credentials. The stolen credentials, particularly a GitHub token and GitHub App private key, likely enabled the later compromise of the release pipeline used to distribute the malicious litellm==1.107.0 package on October 21, 2026.

1w ago · wiz

Wiz CIRT investigated a real-world AI-driven cloud attack where an autonomous AI agent conducted end-to-end intrusion operations, including initial access, credential harvesting, lateral movement, and data exfiltration across multi-cloud environments. The attacker used machine-speed automation, simultaneous cross-platform operations, and self-debugging capabilities to rapidly pivot through cloud, Kubernetes, CI/CD, and identity systems. The attack leveraged a Java RCE vulnerability in an exposed Kafka UI for initial access and used AI-generated scripts with descriptive comments and task identifiers like 'pentest', 'recon', and numeric IDs to maintain persistence and exfiltrate data.

1w ago · wiz

The article describes a real-world supply chain attack involving the compromise of npm packages in the keyv/cacheable ecosystem, where a malicious actor exploited a GitHub maintainer account to publish backdoored versions. The malware dynamically retrieved command-and-control (C2) domains at runtime by querying an Ethereum smart contract, evading static analysis. Wiz's detection pipeline identified the malicious behavior through dynamic analysis and runtime monitoring, detecting connections to a suspicious domain before a CVE was published. This allowed proactive alerting and blocking within customer environments via automated threat intelligence distribution.

1w ago · talos

Two unauthenticated remote code execution (RCE) vulnerabilities in PHP, dubbed 'php2shell', have been identified and are actively exploited. The flaws affect all PHP versions since 5.4, with no patches available for versions 8.1 and older, which are end-of-life. Given PHP's widespread use in platforms like WordPress, Drupal, and WooCommerce, the potential impact is significant across industries. Cisco Talos has released Snort signatures 67359 and 67360 for detection and urges immediate upgrade to PHP 8.2 or later to mitigate risk.

1w ago · hacker-news

Threat actors are actively attempting to exploit the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) to deploy a Mirai botnet variant called Potassium. Despite millions of exploit attempts observed globally, no successful remote code execution has been confirmed, suggesting attackers are struggling to reliably weaponize the flaws. The attacks involve scanning, fingerprinting, and payload delivery attempts using infrastructure tied to multiple IP addresses and a C2 server at 134.199.154[.]64. The Potassium malware is designed to conduct DDoS attacks and includes advanced features such as ENS-based C2 resolution and ChaCha20-encrypted configuration. A Python-based 'one-click' exploit tool named aslr_exploit.py has been found on an attacker-controlled server, indicating ongoing development of reliable exploitation methods.

1w ago · hacker-news

Security firm V12 identified three critical flaws in the x402 SDKs used by AI agents to make automated API payments, including a missing spending limit in the default client that could allow malicious APIs to drain an agent's token balance. The TypeScript SDK also accepted Solana token approvals as valid payments, enabling a complete payment bypass, while a flaw in the Sign-In-With-X (SIWx) feature allowed malicious servers to obtain valid login signatures for other websites. All three flaws were patched in releases on August 18, but no public security advisory was issued, and package managers like npm and PyPI did not list the fixes as security updates, leaving developers unaware of the risks.

1w ago · hacker-news

Security researchers at Imperva demonstrated a remote code execution (RCE) exploit named 'Node2Shell' targeting a vulnerability in the Brotli decoder bundled with Node.js. The exploit leverages crafted Brotli-compressed data to trigger an out-of-bounds write, leading to code execution in unpatched versions of Node.js 22.x, 24.x, and 26.x. The vulnerability, tracked as CVE-2026-111497, was patched in Node.js 24.22.1 and other updated releases, with no known in-the-wild exploitation observed as of October 22, 2026.

1w ago · hacker-news

A critical vulnerability in the Python Pillow library, CVE-2026-112900, allows remote code execution by exploiting how Pillow handles EPS file names when processing images with Ghostscript. The flaw can be triggered by an attacker-controlled filename, not the file content, making upload endpoints that use user-provided filenames particularly vulnerable. Multiple other critical and high-severity flaws were also patched in Pillow 13.0.0, including memory buffer overflows in JPEG and TIFF processing that could lead to crashes or code execution under certain conditions. These vulnerabilities affect all Pillow versions prior to 13.0.0, which is now required to mitigate the risks.

1w ago · hacker-news

Russia-linked threat actor UAC-0099, also known as Earth Sirrush, conducted a spear-phishing attack against a Ukrainian logistics company in July 2025, deploying the MATCHBOIL downloader and subsequently the MATCHWOK backdoor. A novel backdoor named MythicRatatoskr was deployed, which communicates via the Yggdrasil mesh network, enabling stealthy command-and-control. UAC-0099 later handed access to Sandworm, which executed a destructive data-wiping attack in September 2025 using SDelete distributed via Group Policy, highlighting collaboration between Russian-aligned groups.

1w ago · hacker-news

PHP has disclosed an unpatched remote code execution (RCE) vulnerability, CVE-2026-115560, affecting systems with a specific and uncommon configuration involving session upload progress and dynamic changes to session.serialize_handler. The vulnerability arises when applications change the session handler to 'php' at runtime via ini_set() before session_start(), while session.upload_progress.enabled is still active. Although no exploitation has been observed, PHP recommends disabling session.upload_progress.enabled as a mitigation until a fix is included in the next routine release. This follows emergency patches for two critical PHP2Shell flaws (CVE-2026-109618, CVE-2026-109619), which are already under active exploitation.

1w ago · hacker-news

A threat actor known as k0t, also operating under aliases CryptoFeel, Member19, and QazWsxShop, has conducted a large-scale campaign targeting exposed Fortinet and Palo Alto Networks firewall and VPN devices globally. The actor exploited known vulnerabilities CVE-2025-64446 and CVE-2026-0257 using custom Python scripts, performed brute-force attacks, and established persistent access via legitimate remote tools like MeshCentral Agent and AdaptixC2. Over 70,000 credentials were exposed through data exfiltration to Wasabi S3 and MEGA cloud storage, with victims spanning multiple sectors and regions, particularly in Asia Pacific and Latin America.

1w ago · hacker-news

Ransomware affiliates linked to the INC and The Gentlemen groups have been using an AI-driven intrusion framework called Phantom to automate and scale attacks. The operation leverages commercial AI models via OpenCode and OpenRouter, with human operators approving actions, to exploit vulnerabilities in public-facing systems such as FortiClient, SimpleHelp, cPanel, and SonicWall. The attackers achieve initial access, move laterally using tools like RevSocks and Ghost C2, escalate privileges, exfiltrate sensitive data, and prepare for ransomware deployment. At least 62 organizations were targeted, primarily in the U.S. and within industrial, healthcare, and energy sectors.

1w ago · hacker-news

Ruby has released updated versions (4.0.9, 3.4.12, and 3.3.13) to address three critical bugs in its Onigmo regular expression engine, which were exploited to enable remote code execution (RCE) in GitLab. The vulnerabilities stem from memory corruption during regex compilation when processing attacker-controlled input, affecting any Ruby application that compiles untrusted regular expressions. Four critical CVEs were issued by GitLab, two of which (CVE-2026-97229 and CVE-2026-110264) are rated 10.0 and exploitable without authentication, impacting all GitLab versions since 7.0. Although Ruby did not assign its own CVEs, it directed users to track the issues via GitLab's advisories.

1w ago · hacker-news

A sophisticated UEFI bootkit named BlackX has been used to target diplomatic organizations in Central Asia, specifically in Tajikistan, Uzbekistan, and Turkmenistan, in early 2026. The bootkit exploits the CVE-2022-21894 vulnerability (Baton Drop) to bypass Secure Boot, even on patched systems that have not applied manual revocation updates. The attack is attributed to the China-linked APT41 group, leveraging techniques similar to the BlackLotus bootkit. The malware installs a malicious driver signed with a revoked certificate and deploys espionage payloads, including a .NET-based remote access trojan and a Rust-based DLL sideloaded via googleupdate.exe that communicates with 'archivetj[.]com'.