Intelligence Feed

1w ago · wiz

Wiz Research discovered critical remote code execution (RCE) and memory disclosure vulnerabilities in PHP's core engine, collectively dubbed 'PHP2Shell', affecting nearly all PHP versions released in the last decade, including PHP 5.4 and later. The vulnerabilities stem from memory-safety issues related to how PHP handles fatal errors during request processing, enabling unauthenticated attackers to achieve remote code execution or read sensitive process memory containing passwords, tokens, and API keys. Exploitation is application-agnostic and affects any PHP-based application, including WordPress, Drupal, and Joomla, even with secure application code. The vulnerabilities were responsibly disclosed and patched on October 21, 2026, with AI models playing a key role in both discovery and exploit development.

1w ago · step-security

On October 18, 2026, OpenCode disclosed a security breach resulting from a large-scale distillation attack. The incident affected 1.4% of OpenCode Console users who had linked external AI providers such as Anthropic, OpenAI, or Google. OpenCode notified impacted users via email and stated the incident is ongoing, with no root cause or data accessed details released. The primary risk involves potential exposure of linked API credentials, which could allow attackers to perform inference at the victim's expense or access data accessible via those keys.

1w ago · step-security

On October 21, 2026, the Python package litellm version 1.107.0 was compromised on PyPI, with all seven compiled wheels and official Docker images containing malicious payloads. The attack originated from a lookalike GitHub repository (Berri-AI/litellm) that was used to build the release, bypassing security controls. The malicious wheels install three files—cook.pth, cook.py, and sitecustomize.py—into the Python site-packages directory, which execute automatically on every Python interpreter start. These payloads include a credential stealer named 'privcollect' that exfiltrates sensitive data such as browser passwords, SSH and GPG keys, cloud credentials, and LiteLLM proxy database contents to the domain www.litellm.dev, and a remote code loader that polls a GitHub dead drop hourly for additional commands. The attacker gained access through stolen GitHub tokens exposed in logs and modified the release workflow using an organization owner's token, allowing the malicious artifacts to be signed and published through legitimate channels.

1w ago · unit42

A financially motivated threat actor operating under the handle BUGSTER leveraged AI-powered tools, specifically the Hermes Agent framework with DeepSeek V4 as the reasoning engine, to plan and execute multiple cybercrime activities. The actor conducted credential theft via WordPress brute-forcing, exfiltrated over 5,200 student and faculty records from an Indian university's MongoDB database, and engaged in VoIP fraud planning, Wi-Fi password cracking, and cryptocurrency reconnaissance. The actor used a US-based server for command-and-control operations and employed AI-generated scripts and reconnaissance reports to lower the skill barrier for executing diverse attacks.

1w ago · unit42

Unit 42 has identified two critical remote code execution (RCE) vulnerabilities in PHP, tracked as CVE-2026-109618 and CVE-2026-109619, both rated 9.2 on CVSS 4.0. CVE-2026-109618 allows attackers to achieve RCE by exploiting improper control flow during out-of-memory error handling via longjmp(), leaving request memory uninitialized. CVE-2026-109619 enables RCE by causing global memory to point to freed memory regions during fatal error handling, which can be later accessed or executed. Proof-of-concept exploits exist, and over 22.6 million internet-exposed PHP instances are potentially vulnerable, prompting urgent patching recommendations.

1w ago · unit42

Eight intermediate certificate authority (CA) private keys belonging to Indian CA eMudhra Limited were compromised due to a cryptographic defect during certificate generation, where insufficient randomness allowed attackers to derive private keys from public certificates. This enables threat actors to sign unauthorized TLS certificates and conduct man-in-the-middle (MitM) attacks, such as traffic interception, impersonation, or session hijacking. Major browser and OS vendors have taken action to revoke or untrust the affected intermediate CAs, and eMudhra has revoked the eight compromised certificates. Organizations are advised to audit PKI assets, reissue certificates, update trust stores, and monitor for MitM activity to mitigate risks.

1w ago · talos

Cisco Talos has identified two critical unauthenticated remote code execution (RCE) vulnerabilities in PHP core, tracked as CVE-2026-109618 and CVE-2026-109619, collectively dubbed 'php2shell'. These flaws affect all PHP versions since 5.4 and can be exploited via a plain HTTP request before any application code runs, making them highly dangerous. The vulnerabilities stem from improper handling of out-of-memory conditions and reuse of stale internal state after memory deallocation. While initial exploitation has been limited to scanning and basic payloads, Talos expects more sophisticated campaigns to emerge as threat actors integrate the vulnerabilities into their tooling.

1w ago · talos

Cisco Talos disclosed the compromise of eight intermediate certificates issued by eMudhra due to a flaw in their key generation process, which resulted in weak private keys with only 3–8 bits of entropy instead of the required 384 bits. This vulnerability allows attackers to recover private keys and impersonate legitimate websites or code-signing services. The affected certificates were used for TLS and code signing, with six TLS certificates already blocked by major browsers and two code-signing certificates blocked by Microsoft. The issue has been designated as CVE-2026-111943, and patches have been released in Go versions 1.27.3 and 1.26.10 to filter out certificate chains containing the compromised keys.

1w ago · hacker-news

A critical vulnerability in OpenCode versions 1.0.137 through 1.18.32 allows a malicious or compromised MCP (Model Context Protocol) server to execute arbitrary code on a developer's Windows or WSL machine during sign-in. The flaw arises because OpenCode passes an untrusted OAuth authorization endpoint URL from the MCP server to a browser helper without proper escaping, leading to command injection via PowerShell on Windows. The vulnerability was fixed in version 1.18.33, but no CVE was assigned, and it remains unflagged by vulnerability scanners. Although no active exploitation has been observed, the risk persists for unpatched installations connected to untrusted MCP servers.

1w ago · hacker-news

Railway, a Platform-as-a-Service provider, disclosed an incident where an unauthorized third party may have accessed encrypted customer environment variables and, in some cases, obtained decrypted contents. The breach potentially allowed attackers to extract sensitive data such as API keys, database credentials, and cryptocurrency wallet private keys, leading to at least one confirmed cryptocurrency theft. The company urges affected customers to rotate credentials and has taken internal measures including rotating bucket credentials and invalidating API tokens. The incident is suspected to be part of a broader campaign targeting cloud platforms to enable 'LLMjacking'—abusing AI inference resources at the victim's expense.

1w ago · hacker-news

Two critical remote code execution vulnerabilities (CVSS 9.0) in the Linux kernel's built-in KSMBD SMB server have been publicly disclosed via mailing lists before official fixes were available. The first, ZDI-CAN-33774, allows unauthenticated attackers to trigger a race condition in the protocol dispatch handler by sending a burst of SMB1 packets followed by an SMB2 packet, leading to out-of-bounds reads and potential code execution. The second, ZDI-CAN-33549, is an integer underflow in the SMB Direct path that can be exploited when an RDMA-capable interface and writable share are present, allowing memory corruption. Neither vulnerability has a patch in the mainline kernel or a CVE identifier yet, increasing the risk of exploitation in exposed systems running KSMBD on port 445.

1w ago · hacker-news

Arista has disclosed a critical SQL injection zero-day vulnerability, tracked as CVE-2026-114625, in its VeloCloud Orchestrator (VCO) that is actively being exploited. The flaw allows authenticated users with even read-only access to escalate privileges to operator-level control, enabling full access to the orchestrator and potential compromise of managed SD-WAN infrastructure. The vulnerability affects on-premises VCO instances running vulnerable versions, with exploitation requiring network access and valid credentials. Arista has released patches for affected release trains and identified two IP addresses associated with ongoing attacks.

1w ago · bleeping-computer

GitLab has disclosed and patched a maximum-severity vulnerability, CVE-2026-110264, in its Regular Expression Compiler that could allow unauthenticated remote attackers to execute arbitrary code on vulnerable servers via a specially crafted regular expression. The flaw stems from an integer overflow weakness and affects multiple versions of GitLab Community Edition (CE) and Enterprise Edition (EE). Users are urged to upgrade immediately, as the vulnerability could lead to full system compromise. This follows recent critical GitLab vulnerabilities, including CVE-2026-97229 and CVE-2026-85706, the latter of which was added to CISA's known exploited vulnerabilities list.

1w ago · bleeping-computer

Attackers began exploiting the critical PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) as early as October 17, 2026, four days before official patches were released. The vulnerabilities, which allow remote code execution, were actively targeted using proof-of-concept exploits from anonymized IP addresses shortly after disclosure. Amazon Threat Intelligence observed exploitation attempts originating from commercial anonymization networks, indicating possible advanced threat actors. While some pre-disclosure activity has been detected, it remains unclear how widespread successful compromises are, though the risk is high due to PHP's extensive use across the web.

1w ago · bleeping-computer

Arista Networks patched a critical zero-day vulnerability, CVE-2026-114625, in its on-premises VeloCloud Orchestrator (VCO) deployments that was actively exploited in attacks. The flaw is a SQL injection allowing authenticated attackers with basic privileges to escalate to operator-level access, enabling them to access internal functionality and compromise the confidentiality, integrity, and availability of the orchestrator and managed data. Arista identified two IP addresses involved in ongoing exploitation and recommends immediate patching and monitoring of access logs.

1w ago · bleeping-computer

The LiteLLM project's release pipeline was compromised on October 21, 2026, leading to the distribution of malicious PyPI wheels and Docker images for version 1.107.0. The attack injected a Python-based info-stealer into the installation packages, which executed at Python startup via malicious .pth and .py files to harvest cloud credentials, AI provider keys, developer secrets, browser data, and system information. The stolen data was exfiltrated to litellm[.]dev and a GitHub-hosted loader enabled remote code execution. The artifacts were quickly detected and removed, but recovery requires more than uninstalling the package due to persistent payloads.

1w ago · bleeping-computer

Railway, a cloud hosting platform for developers, detected suspicious activity indicating a potential breach of its systems storing customer environment variables. The investigation suggests that an unauthorized third party may have accessed encrypted environment variables and, in some cases, obtained decrypted contents containing sensitive secrets such as API keys and database credentials. As a precaution, Railway urges all users to rotate their secrets immediately, especially AI inference providers who were directly targeted. The company has paused deployments during the investigation, with partial restoration for Pro and Enterprise workspaces.

1w ago · bleeping-computer

The Cybersecurity and Infrastructure Security Agency (CISA) and partner agencies have identified SafePay, a private ransomware group active since August 2024, as responsible for breaching over 600 critical infrastructure organizations globally. The group gains initial access through credential exposure, brute force attacks, and exploitation of VPN vulnerabilities, particularly targeting Mullvad VPN IP addresses. SafePay employs double-extortion tactics, exfiltrating sensitive data before encryption and threatening to leak it if ransoms are unpaid. The group does not use affiliates and has increasingly filled the operational gap left by the decline of BlackCat and LockBit ransomware groups.

1w ago · bleeping-computer

Hackers breached the infrastructure of Onamae Desktop Cloud, a VPS service provided by GMO Internet, and installed malicious programs on up to 26,739 customer servers. The company detected the intrusion and began shutting down affected servers starting October 21, 2026. While no confirmed data misuse has been reported, customer data may have been exposed, and users are advised to rotate secrets. The attackers may also attempt follow-on phishing campaigns leveraging the incident.

1w ago · bleeping-computer

Hackers are actively exploiting a critical OS command-injection vulnerability, CVE-2026-106931, in the SiteGuard Server Edition web application firewall (WAF). The flaw exists in the statistics feature, which is enabled by default, and allows attackers to execute arbitrary commands with root or SYSTEM privileges on affected systems. The vulnerability impacts multiple versions of SiteGuard Server Edition for Apache httpd, Nginx, and IIS, excluding FreeBSD, prior to 8.00 Update 5, and FreeBSD versions before 7.00 Update 6. Exploitation in the wild has been confirmed, though details about the threat actors, victims, or attack scope remain undisclosed.

2w ago · unit42

Unit 42 uncovered a sophisticated network intrusion campaign tracked as CL-STA-0954, targeting a telecommunications organization via exploitation of CVE-2024-47575 (FortiJump) on a FortiManager appliance. Attackers exfiltrated configuration data, credentials, and cryptographic material for over 500 managed FortiGate firewalls. They later exploited CVE-2025-61624 to deploy PEERSTITCH, a novel memory-resident ARM64 malware that evades detection by patching running processes and establishing covert inter-process communication. The implant enables traffic interception, backdoor access, and privilege escalation without writing to disk or opening network ports.

2w ago · unit42

Unit 42 identified an AI-powered espionage campaign, tracked as CL-UNK-1211, targeting government entities and state-affiliated Linux infrastructure from October 2025 to April 2026. The attackers used AI-generated payloads, including malicious PHP scripts and custom malware such as SysGoRAT—a cross-platform Go-based remote access Trojan—to maintain persistence, conduct reconnaissance, and exfiltrate sensitive data like government mailboxes and databases. The campaign employed diverse techniques including web shells, credential harvesting via .bashrc hijacking and PHP loggers, reverse shells, and anti-forensics methods such as log tampering and timestomping to evade detection.

2w ago · hacker-news

A malicious npm package named 'imgdecode' is part of the MALFEX supply chain attack campaign targeting Windows systems. The package contains a compiled Node.js native addon that loads a malicious DLL, which downloads encrypted shellcode from a GitHub repository, decrypts it using a hardcoded key, and injects it into the dllhost.exe process. The campaign uses multiple interdependent packages and infrastructure, including GitHub repositories and a C2 server, to deliver payloads such as Overlord RAT and a Node.js stealer, while employing anti-analysis techniques and establishing persistence via registry and scheduled tasks.

1w ago · hacker-news

ConnectWise disabled seven of its application identities after discovering that threat actors had gained unauthorized access to them, enabling compromise of Microsoft 365 tenants. The attackers abused stolen application credentials to authenticate as legitimate ConnectWise applications and obtain access tokens via Microsoft Entra ID, potentially accessing mailboxes, SharePoint, Teams, and directory data. A second wave of targeted attacks from IP address 144.172.64[.]128 was observed on October 15, targeting 16 tenants in sensitive sectors, though no further activity has been confirmed. ConnectWise has suspended Cloud Backup and related services while investigation and remediation continue.

2w ago · bleeping-computer

BeyondTrust has patched a critical zero-day vulnerability, CVE-2026-102764, in its Remote Support (RS) and Privileged Remote Access (PRA) appliances that was exploited in attacks since August 2026. The flaw is an authentication bypass allowing unprivileged remote attackers to perform file operations on unpatched systems. The China-nexus espionage actor 'Armory Castle' (also known as UNC5221 or 'Warp Panda') exploited the vulnerability to gain initial access, escalate to root privileges, deploy Sawfly web shell and Bareclaw tunneler malware, and move laterally using stolen credentials. Organizations with internet-exposed appliances during the exploitation window should assume compromise.

2w ago · bleeping-computer

Hackers conducted a supply-chain attack by compromising ConnectWise's Cloud Backup service, leveraging stolen application identities to gain unauthorized access to Microsoft 365 tenants. The attackers used a single IP address (144.172.64[.]128) to authenticate as the backup application via its secret, bypassing MFA and exploiting broad permissions previously granted in customer tenants. Multiple cybersecurity firms observed malicious activity including reconnaissance, privilege escalation to Exchange and Global Administrator roles, and attempts to establish persistence by adding credentials to third-party tools. ConnectWise shut down customer access to the service, but existing tokens remain valid until expiration, requiring manual review and revocation by administrators.

2w ago · bleeping-computer

Drupal has patched two critical remote code execution (RCE) vulnerabilities, CVE-2026-108097 in the core Field UI module and CVE-2026-108099 in the contributed Entity List module. Both flaws could allow unauthenticated attackers to execute arbitrary code on affected servers, especially when combined with contributed or custom modules. The Drupal Security Team warns that exploits could emerge within hours or days of disclosure, urging immediate patching to versions 10.6.19, 11.3.19, 11.4.10, or Entity List 3.0.10.

2w ago · hacker-news

A sophisticated threat actor exploited CVE-2025-61624, a path traversal vulnerability in Fortinet FortiOS, to deploy a novel memory-resident ARM64 malware named PEERSTITCH. The malware operates entirely in memory, avoids opening network connections, and hijacks legitimate FortiOS processes (miglogd and iked) to create a covert inter-process communication channel for bypassing security checks on tagged VPN sessions. The attack enabled long-term persistence, credential theft, and lateral movement across managed firewalls, with evidence linking it to the CL-STA-0954 (UNC5820) intrusion campaign targeting a telecommunications managed service provider.

2w ago · hacker-news

Threat actors have compromised a Microsoft 365 credential used by ConnectWise Cloud Backup, enabling unauthorized access to 173 Microsoft 365 tenant environments. The attackers used the stolen credential to obtain Microsoft Graph tokens from IP address 144.172.64[.]128, moving systematically through tenants in sorted GUID order, indicating automated tooling. In at least one tenant, a malicious actor assigned the ConnectWise Cloud Management app Global Administrator privileges and added new client secrets to privileged applications, including an MSP management tool and the Huntress Security Platform, expanding access across customer environments. Organizations with the ConnectWise app installed remain at risk until credentials are rotated and the app is disabled.

2w ago · bleeping-computer

Candiru spyware was delivered via a zero-click attack technique dubbed AdFection, in which malicious JavaScript was embedded in targeted online advertisements served through Discover-Tech's Controlium platform. The attack targeted devices at Al Jazeera Media Network and others, with evidence showing that at least 45 devices were targeted between 2024 and 2025. The malicious ads contacted Discover-Tech's NOAS server, which selectively delivered exploit code to specific devices based on identifiers like IP address, leading to infections linked to Candiru command-and-control infrastructure. A DLL file recovered from a compromised Windows system was attributed to Candiru with high confidence.