Cyber Skiv

Threat Intelligence Analyst

[Dark Web Intelligence @DailyDarkWeb]

⚠️ UPDATE: UNIT 42 CONFIRMS PHP2SHELL EXPLOITATION WITH AGENTIC AI POST-EX

Unit 42's Oct 23 threat-brief update confirms PHP2Shell (CVE-2026-109618 / CVE-2026-109619) is being exploited in the wild, with attackers using agentic AI platforms for post-exploitation. Both flaws are unauthenticated RCE, CVSS 9.2 (CVSS 4.0).

In one European government case, within ~2 hours of initial exploitation attackers:
• Accessed password hashes and MFA secrets
• Stood up an NTLM-relay tunnel into Active Directory
• Attempted Domain Admin privilege escalation

Commands were wrapped in machine-parseable delimiters such as ==SHELLUSER== and ==PASSWD== — strong agentic-attacker markers. Cortex Xpanse still sees ~22.6M exposed PHP instances potentially vulnerable.

Not framed as a mass outbreak, but confirmed live post-ex. Patch PHP immediately (8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 or vendor fixed builds) and hunt for post-exploitation activity.

https://t.co/EwSJFbLUA7
#DDW #PHP2Shell #PHP #Unit42 #CyberSecurity #ThreatIntelligence #Vulnerability

[Dark Web Intelligence @DailyDarkWeb]

Public Linux local-root exploit raises shared-hosting risk

ZDI-CAN-33367 targets skb_zerocopy() in the kernel networking stack, letting a local user alter read-only file data through the page cache and gain root.

* CloudLinux independently reproduced root access across multiple Linux distributions.
* Exploitation needs local access plus relevant namespace/network capabilities. This is not remote code execution.
* CloudLinux 7 hybrid and 8 kernel fixes reached beta/rollout channels on October 23, and a KernelCare livepatch is out for CloudLinux 10.

Public exploit code is not evidence of attacks in the wild. No CVE has been assigned yet. Check your distribution's current guidance rather than assuming every Linux system is equally exposed.

Original disclosure:
https://t.co/9S9LE9stsP
Current CloudLinux updates:
https://t.co/52PeFqjxat

#Linux #Cybersecurity

[Microsoft Threat Intelligence @MsftSecIntel]

A compromised LiteLLM 1.107.0 release added files that Python could execute during normal interpreter initialization. Applications did not need to import LiteLLM for the payload to run; starting Python in an affected environment could be enough. https://t.co/BLZ7sN3Umv

Microsoft analyzed two execution paths: a credential collector targeting authentication material across developer tools, cloud environments, browsers, and infrastructure, and a Unix-oriented loader capable of retrieving and executing additional Python code.

Endpoint observations on Windows and macOS matched the collector’s discovery, encryption, and outbound connection behavior. Starting Python in an affected environment could activate the payload, so investigators should avoid using Python or pip during evidence collection.

Read the Microsoft Security research for analysis of the startup mechanisms, credential exposure, Defender detections, hunting queries, indicators of compromise, and recovery guidance.

[The Hacker News @TheHackersNews]

🚨 Hackers breached enterprise firewalls and VPNs worldwide in a campaign linked to k0t.

Over 70,000 exposed credentials identified.

Fortinet and Palo Alto devices targeted. Persistent access established. Data exfiltrated.

Inside the attack chain and suspected ransomware links: https://t.co/j7v6zQ4ZTj

[BleepingComputer @BleepinComputer]

HPE patches eight max severity RCE and auth bypass AOS flaws
https://t.co/wy7BGCI1Zq

https://t.co/wy7BGCI1Zq

[The Hacker News @TheHackersNews]

‼️ BREAKING ‼️ PHP warns of another UNPATCHED REC vulnerability just 2 days after releasing emergency patches for critical PHP2Shell flaws.

New "CVE-2026-115560" affects only unusual session configurations. PHP has issued urgent mitigation guidance.

Full details → https://t.co/YQV0MCJqAp

[The Hacker News @TheHackersNews]

‼️ PHP2Shell exploit attempts hit millions as attackers try to deploy Mirai malware. Exposed attacker servers reveal RCE tooling.

No successful compromises confirmed so far.

Inside the payloads, exploit tools, and failed attempts → https://t.co/pxkF59xB3G

[Zscaler ThreatLabz @Threatlabz]

Zscaler ThreatLabz observed attackers exploiting Citrix CVE-2026-88771 to deliver a FreeBSD-based implant that we track as TimeSmuggler. @sansecio observed the same malware being distributed as part of the StyleSmuggler zero-day campaign. The backdoor is written in Rust and collects host information and supports the following commands:

- interval_check: Reconfigures the C2 polling interval
- system_check: Runs a system command
- dl_ex: Downloads and executes a binary file
- open_shell: Spawns an interactive reverse shell
- uninstall: Removes itself, including its persistence mechanisms

The interactive shell opens a direct WebSocket channel, but the main communication takes place using a NTP-like protocol over UDP port 123. The first 4 bytes of the communication are either an NTPv4 server or client header, depending on whether the malware is sending data or just polling the command-and-control server, but the rest of the package is sent as MessagePack chunks.

The malware adds a crontab entry to gain persistence and renames itself to resemble legitimate processes such as chronyd, kworker, fc-cache, and gvfsd-user.

In addition, TimeSmuggler includes string obfuscation. The obfuscation works by calculating a unique offset per string to locate the encoded string within the binary. Interestingly, the functions that calculate each string's offset have their control flow flattened (CFF). After the string's address is resolved, TimeSmuggler uses a set of inline decoding operations to obtain the final deobfuscated string. The decoding operations are different for each string, which makes the analysis more time consuming.

IOCs below:

SHA-256: 878bc868bdb23be276f1fab8a4418a35264439f3344ffaf9404414ab08744782

C2 NTP domain: ntp[.]reposync[.]to
C2 WSS domain: reposync[.]to
TimeSmuggler version number: 2.1.6

For more details on CVE-2026-88771, visit our blog: https://t.co/AstAEF1OJC

[Unit 42 @Unit42_Intel]

Phishing pages built on AI-based site builders often use modern JS frameworks for faster deployment of pixel-perfect clones. They also use chat app sinks for immediate credential access, fast deployment and survivability after being taken down. Details at https://t.co/qz2beKZlna

[BleepingComputer @BleepinComputer]

⚠️ Attackers stole data from 472 GitHub repositories before defenders could contain the breach, despite detecting the attack within minutes.

🔍 @exaforceAI explains why detection alone isn't fast enough.

➡️ https://t.co/EPVJpZmRmf
#cybersecurity #sponsored

[BleepingComputer @BleepinComputer]

Amazon says PHP2Shell exploitation began 4 days before patches
https://t.co/8icLpdErAv

https://t.co/8icLpdErAv

[TrendAI™ Research @trendai_RSRCH]

1/6 Two critical PHP flaws (CVE-2026-109618, CVE-2026-109619) enable unauthenticated remote code execution, and public exploit code already exists.

Learn more: https://t.co/hW6vvofTUQ

[BleepingComputer @BleepinComputer]

Nearly 11,000 cybercrime networks disrupted and over 1,400 arrests in Operation Serengeti III targeting business email compromise, ransomware, and online scams in Africa.
https://t.co/puaPJb4dKK

[The Hacker News @TheHackersNews]

🚨 Node.js patches 10 security flaws, including a high-severity Brotli decoder bug that could allow RCE when apps decompress attacker-controlled data.

Patches are out for versions 22.x, 24.x, and 26.x.

Update Now ↓ https://t.co/VS3IirtjAV

[BleepingComputer @BleepinComputer]

⚠️ Attackers are abusing ChatGPT and Claude to spread ClickFix malware, including a malicious custom GPT with over 10,000 conversations.

🔍 @PushSecurity examines how trusted AI platforms are being used to deliver malware.

➡️ https://t.co/j7HdOhPmvN
#cybersecurity #sponsored

[BleepingComputer @BleepinComputer]

PHP ships emergency patches for critical PHP2Shell flaws
https://t.co/QTZxrNIDgM

https://t.co/QTZxrNIDgM

[The Hacker News @TheHackersNews]

🛑 China-aligned threat group Bronze Sandcastle is targeting organizations in Asia and Africa, abusing Sandboxie DLL sideloading to deploy encrypted backdoors.

Sophos reveals its attack methods, payloads, and infrastructure.

Read more → https://t.co/T33kiFgiRb

[The Hacker News @TheHackersNews]

‼️ URGENT ‼️ Two CRITICAL, unpatched PHP flaws (CVSS 9.2 each) have triggered an emergency warning after alleged exploit details surfaced online.

Researchers report potential RCE.

CVE-2026-109618 and CVE-2026-109619.

Fixes scheduled for October 21, 14:00 UTC.

Details - https://t.co/jYegMlTtf2

[The Hacker News @TheHackersNews]

🚨 Ransomware groups are still exploiting a patched Palo Alto Networks flaw.

Qilin and INC are abusing CVE-2026-0257 to gain corporate network access and bypass MFA for VPN sessions.

In one case, attackers pivoted to VMware ESXi and dumped domain credentials.

Read - https://t.co/CY1WGoe0RE

[The Hacker News @TheHackersNews]

🚨 Russian-linked APT28 targeted organizations in two NATO countries using the HOOKEDGE backdoor and a previously undocumented malware loader.

At a naval shipbuilder, attackers stole credentials, established a persistent SSH tunnel into the internal network, and deployed the new loader.

Details: https://t.co/WEOqIrnjr9