Bohan Zhang

Threat Intelligence Researcher @esthreat 🚀🚀| Blue Teamer

[Bohan Zhang @bohansec]

Today marks my first day to work as a SOC analyst. Perhaps one thing I have learned over the years is to be persistent, never stop grinding, and chasing down your dream. Here is my timeline for me to achieve my dream.

[International Cyber Digest @IntCyberDigest]

❗️ A Chinese spyware kit called uCreator hides in repackaged Telegram, WeChat and GCash apps.

In Telegram it can read chats and grab the 2FA password in cleartext, researcher Ovi found.

Its makers left their backend and the names of ~3 dozen developers on an open GitLab server.

[JFrog Security @JFrogSecurity]

🚨 Brotli2Shell goes beyond HTTP2Shell.

CVE-2026-111497 is a CVSS 9.2 out-of-bounds write in Google’s Brotli decoder that has been exploited for RCE and impacts far beyond HTTP.

JFrog reproduced RIP control in FFmpeg via a crafted JPEG XL file and identified additional attack paths in ClickHouse, .NET, and Apache Arrow, where some fixes were still unavailable at the time of writing.

We’ve also released an open-source scanner to uncover potential exposure beyond vulnerable package versions.

Full research and technical details in our blog 👇

[Squiblydoo @SquiblydooBlog]

Signed "Lway Firmware" - 7th unique cert serial for them 🫥
h/t @malwrhunterteam

Microsoft teams lure -> BabaDeda loader -> CNCMachineRMS RAT

C2: wizardexpensive[.]com:
96.62.218[.]59

https://t.co/fs2qVYQHsh

[Andy Piazza @klrgrz]

Sorry folks, we have a confirmed PHP compromise with post-exploit activity. Still not the widespread outbreak we all braced for, but it’s actively exploited in the wild. Updated threat brief:

https://t.co/43WCYmouIE

[Aikido @AikidoSecurity]

Evolving threat 🚨 CVE-2026-111497, previously known to affect Node.js (node2shell) and Python has evolved into “HTTP2Shell.”

A significant blast radius.

This vulnerability leaves many libraries and applications using HTTP vulnerable to pre-auth RCE via Brotli decompression.

Please be aware. Fixes not yet available for all affected services. Look for Brotli (1.2.1) dependency upgrades when they become available.

[Eric Zimmerman @EricRZimmerman]

1/ EZ Tools 2026.10 is out, all on .NET 10 (LTS)

✅ More accurate: 331K more event log records, hive logs replayed as Windows does, every test hive loads
⚡ Faster: up to 9x; EvtxECmd and Registry 2x
📉 Less memory: up to 82% less

Update with Get-ZimmermanTools 🧵 #DFIR

[The Hacker News @TheHackersNews]

‼️ PHP2Shell exploit attempts hit millions as attackers try to deploy Mirai malware. Exposed attacker servers reveal RCE tooling.

No successful compromises confirmed so far.

Inside the payloads, exploit tools, and failed attempts → https://t.co/pxkF59xB3G

[Bohan Zhang @bohansec]

@ReliaQuestTR The link is broken

[Crocodyli @crocodylii]

Nice :)

http.component:"php"
"X-Powered-By: PHP"
http.component:"php" country:"xx"
"X-Powered-By: PHP/7.4.33"
"X-Powered-By: PHP/7.4"
"X-Powered-By: PHP/8."
http.component:"php" http.component_version:"7.4"
"X-Powered-By: PHP/8.1" country:"xx"

https://t.co/nVHvu7eBRk

[Ayush Anand @Securityinbits]

My lab runs MDE and Elastic side by side, so I gave Claude Code a skill for each:
- mde-hunt: KQL on MDE + my ADX archive
- elastic-hunt: ES|QL on Elastic

One question, both stacks searched, one table back.

Most SOCs run one of these. Whichever is yours, want the skill? I can share it on GitHub.

[International Cyber Digest @IntCyberDigest]

🚨 BREAKING: Microsoft says China state-aligned hackers used AI agents in the ConnectWise supply-chain hack.

Storm-0940 used the AI pentest tool ARTEX to reach 2,250+ Microsoft 365 tenants at 2,900 attempts a minute.

Some attacks reached privileged cloud access within 3 hours.

[Horizon3.ai @Horizon3ai]

“We don’t use PHP” doesn’t settle your PHP2Shell exposure.

Third-party products, containers, and hosted apps may carry the runtime. Finding it starts the investigation; exploitability and impact depend on the environment.

Read our analysis to understand what PHP2Shell means and why you should be paying attention 👇
https://t.co/i3X1vKoAik

[Sherwood @shcallaway]

Today we're launching https://t.co/8QjczrYPGX 🚨

Yesterday was a rough day for security. php2shell, LiteLLM, Railway... How are we supposed to stay on top of all of this?

https://t.co/8QjczrYPGX aggregates 4 vulnerability sources into one free feed and uses AI to explain each one in plain English. No login.

https://t.co/uUKISkHX1e

[Florian Roth ⚡️ @cyb3rops]

Let’s not forget about this certificate clusterfuck while everyone is busy with the PHP RCE news.

Almost at the same time, another serious security incident became public.

Eight intermediate CA certificates from eMudhra were found to use ridiculously weak private keys. We’re talking about P-384 keys where one private key was literally the number 4. FOUR!

Six of these were TLS CAs, allowing anyone to recover their private keys and potentially issue trusted certificates for arbitrary domains.

Major browsers have already blocked the affected CAs. But what about API clients, backend services, embedded devices, containers, and systems with outdated trust stores?

Many don’t enforce Certificate Transparency or check revocation. Some could remain vulnerable for years.

These weak keys have existed since April 2025. No confirmed malicious exploitation so far, but the implications are serious.

Don’t overlook this one while focusing on PHP.

Technical details and test endpoints:
https://t.co/6NiX0zsfNm

[International Cyber Digest @IntCyberDigest]

🚨 The AI gateway library LiteLLM was hijacked again in a supply chain attack.

It hid malware that runs whenever Python starts and steals SSH keys, cloud secrets and Claude Code configs.

It also raids LiteLLM's own database for every AI provider key stored.

[Mehmet Ergene @Cyb3rMonk]

Sharing a broad hunting query for the upcoming PHP vulnerability. Focuses only on PHP processes.

You should already have detections for Web Shell activites.

CVE-2026-109618
CVE-2026-109619
#ThreatHunting

[shubs @infosec_au]

Just published our high fidelity scanner for php2shell: https://t.co/KV6QWffa0h

See our detection logic here: https://t.co/nj6p3qhWfa

We've taken care in our detection logic and hope it helps defenders. Congrats to @calif_io and @lcfr_hax for the discovery.

[Florian Roth ⚡️ @cyb3rops]

This week has been quite a shitshow already, and there are still 2 days to go

Here’s a quick recap of the security mess we’ve seen in just the last few days:

1. PHP Core RCE (CVSS 9.2)

Two critical vulnerabilities (CVE-2026-109618/109619) allowing unauthenticated RCE. A huge number of PHP installations potentially affected, and there are already reports of reliable exploitation against patched versions. Great…

Useful links:

Official PHP advisory and patches:
https://t.co/XOos2fsRoy

Practical hardening and mitigation guide by Vincent Schmalbach. nginx/Apache configurations, PHP settings, patch verification and compromise checks:
https://t.co/30YfHmqIcR

Huntress analysis. What to monitor, suspicious child processes, webshells and post-exploitation activity:
https://t.co/XLx8za50cZ

Wiz technical deep dive. Exploit mechanics, memory disclosure, affected applications and the role of AI:
https://t.co/5HdgI3aM0f

Corelight’s open-source Zeek and Suricata detection rules:
https://t.co/eQdkc3vIpM

2. GitLab RCE (CVSS 10.0)

CVE-2026-110264. An integer overflow in the regex compiler leading to unauthenticated RCE. Apparently affects around 12 years(!) of GitLab releases.

https://t.co/APW5ihIOZ0

3. Node.js / Brotli RCE

CVE-2026-111497. An out-of-bounds write in the Brotli decoder that can lead to RCE when processing malicious compressed data. Node.js 22, 24 and 26 affected.

https://t.co/RUFjjKtfPE

4. DNS-over-QUIC DoS

CVE-2026-97206. A use-after-free in Unbound’s DNS-over-QUIC implementation. Remote attackers can crash affected multi-threaded DNS resolvers.

https://t.co/DxaIsMF2ZP

5. eMudhra CA disaster

And then there’s this absolute PKI clusterfuck. Eight intermediate CA private keys turned out to be ridiculously easy to reconstruct.

Browser vendors have started blocking the affected CAs, but outdated clients and applications with their own trust stores could keep accepting certificates from them. Cleaning up this mess is a lot harder than just patching a server.

Google’s analysis and response:
https://t.co/gvfGdOBibg

Mozilla’s public incident investigation, including the technical findings, timeline and eMudhra’s explanations:
https://t.co/K2wxEOneGJ

—
And I can’t help wondering how much of this sudden wave of discoveries has to do with the latest AI models getting better at code review and vulnerability research.

We now have models that can dig through massive codebases and potentially find bugs that have been sitting there for years.

I’m not saying these particular vulnerabilities were discovered using AI. I haven’t seen evidence for that. But I do wonder whether we’re starting to see some of the effects.

The eMudhra case is obviously a different story. That’s a spectacular failure of key management and quality control.

Anyway, quite a week. And it’s only Thursday…

[Aikido @AikidoSecurity]

❗️LiteLLM was compromised (Again). The latest version 1.107.0 contains an infostealer and RAT.

All 7 compiled wheels are backdoored. Anyone who ran pip install litellm==1.107.0 on any platform should assume credentials are compromised.

More details soon!

[Dark Web Informer @DarkWebInformer]

🚨 High-severity Node.js flaw could allow remote code execution; CVE-2026-111497

Node.js has patched an out-of-bounds write vulnerability in its bundled Brotli decoder.
⠀
An attacker able to supply malicious Brotli-compressed data to an application could potentially corrupt memory and execute code on the underlying server.
⠀
Affected:

• Node.js 22.x
• Node.js 24.x
• Node.js 26.x

Fixed:

• Node.js 22.23.4
• Node.js 24.22.1
• Node.js 26.12.1
⠀
End-of-life Node.js versions may also be vulnerable and will not receive upstream security updates.

Administrators should upgrade and restart affected services.

Source:
https://t.co/KZjGB05A1j