The Hot Drop

Oct 19

The Hot Drop for 10-19-2026

Armory Castle already exploited a BeyondTrust zero-day for espionage. Now PEERSTITCH implants FortiGate firewalls. Can you stop AI-assisted KVM escapes before they steal your entire cloud?

Contents

  1. CISA adds BeyondTrust zero-day to KEV as Armory Castle exploitation confirmed
  2. PwnEscape: AI-assisted discovery of critical Linux kernel flaw enables guest-to-host KVM escape
  3. CISA Adds PEERSTITCH Exploit to KEV Catalog After FortiManager Breach
  4. Active Exploitation of SiteGuard WAF Flaw Grants Root Access
  5. CVE-2026-110447: Active Exploitation of Nextcloud Collabora App
  6. FBI Arrests Third ShinyHunters Suspect in Philadelphia
  7. WhatsApp-delivered Windows RAT and Android banking trojans expand threat surface
  8. Ivanti Zero-Day CVE-2025-0282 Actively Exploited
  9. Drupal patches critical RCE flaws in Field UI and Entity List

1. CISA adds BeyondTrust zero-day to KEV as Armory Castle exploitation confirmed (Lead)

CVE-2026-102764 added to CISA KEV catalog; CVE-2026-102764 CVSS increased from 9.3 to 9.8; Event now covered by 6 outlets (was 3)

What changed

CISA added CVE-2026-102764 to its Known Exploited Vulnerabilities catalog, confirming that BeyondTrust Remote Support is under active attack. This is the critical zero-day that Armory Castle, a China-linked group, has been exploiting since August 29th. Mandiant researchers attributed the exploitation to a likely Chinese government-backed espionage group previously tracked as UNC5221 and now called Armory Castle. BeyondTrust Remote Support and older Privileged Remote Access versions face a critical pre-authentication flaw, rated 9.8, that allows unauthenticated remote code execution. Ivanti Connect Secure versions before 22.7R2.6 contain a critical stack-based buffer overflow that CISA has listed in its Known Exploited Vulnerabilities catalog. The first known instance of zero-day exploitation occurred on August 29, 2026, with BeyondTrust detecting the malicious activity after zero-days were confirmed in another vendor’s product on September 27. Armory Castle reportedly deployed Sawfly, an obfuscated PHP webshell that implements bidirectional encrypted command and control communication on the compromised appliances.

How it works

BeyondTrust patched the exploited defect for self-hosted customers on October 8, 2026, covering Remote Support versions up to 26.2.3. The flaw lets unauthenticated attackers spoof message origins to bypass validation and perform file operations on the appliance, scoring 9.3 on CVSS v4. Mandiant linked this remote unauthenticated code execution risk to a specific threat actor campaign. An OS command injection weakness allows crafted requests to execute commands as the site user, bypassing input validation. A stack-based buffer overflow enables remote attackers to execute code without authentication, crashing the service or consuming memory. Mandiant tracked an actor exploiting CVE-2025-22457 in Ivanti Connect Secure before version 22.7R2.6. The unauthenticated remote code execution allows attackers to modify memory or execute unauthorized commands. This specific CVE was leveraged in ransomware attacks in February 2026, distinguishing it from the other two vulnerabilities in this event cluster. Armory Castle exploited this in August 2026 to escalate privileges and establish persistent access, a critical risk given the 9.8 CVSS score. Armory Castle compromised the appliance’s underlying secret storage, extracting every credential stored on the affected BeyondTrust appliance.

What to do

A CVSS score of 9.8 demands immediate patching to prevent total compromise of network edge infrastructure. Armory Castle deployed Sawfly and Bareclaw malware to target credential vaults and establish long-term persistence. Patches exist for supported versions, but older systems require upgrades first. Reportedly, The attacker added a passwordless sudo rule and wiped local logs, complicating forensic analysis. Investigate by conducting network and memory forensics on suspect appliances while snapshotting them before reboot. Customers cannot audit the host file system, and the attacker may have already extracted every stored credential. Enable compiler hardening like StackGuard and deploy fuzzing to detect the buffer overflow.

Limits and watch

The full scope of historical compromise is unclear because BeyondTrust only detected the malicious activity after zero-days were confirmed in another vendor’s product on September 27, meaning earlier exploitation may have gone unnoticed. While the threat actor used this flaw to gain persistent access, no other CVEs in the current event set have been observed to require the same specific Bluetooth impersonation prerequisites. This event also includes CVE-2026-102764 and CVE-2026-1731 as related findings. Track inbound network access to remote service ports that matches near-time instability in the target service, such as crashes or abnormal restarts, to detect potential lateral movement via Exploitation of Remote Services. Watch for the creation of web shells on web servers, as adversaries may use these scripts to establish persistent access and execute commands on the compromised host.

Vulnerabilities

  • CVE-2025-22457 — CVSS 9.8 (Critical) · CISA KEV · CWE-121 · Ivanti Connect Secure; Ivanti Policy Secure; Ivanti Neurons for ZTA gateways. A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.6, Ivanti Policy Secure before version 22.7R1.4, and Ivanti ZTA Gateways before version 22.8R2.2 allows a remote unauthenticated attacker to…
  • CVE-2026-102764 — CVSS 9.8 (Critical) · CISA KEV · CWE-290 · BeyondTrust Remote Support. The vulnerability exists within internal components of BeyondTrust’s Remote Support product.
  • CVE-2026-1731 — CVSS 9.8 (Critical) · CISA KEV · CWE-78 · BeyondTrust Remote Support(RS) & Privileged Remote Access(PRA). BeyondTrust Remote Support (RS) and certain older versions of Privileged Remote Access (PRA) contain a critical pre-authentication remote code execution vulnerability.

Techniques

  • T1078.002 Domain Accounts (Stealth)
  • T1087.002 Domain Account (Discovery)
  • T1102 Web Service (Command And Control)
  • T1136.002 Domain Account (Persistence)
  • T1210 Exploitation of Remote Services (Lateral Movement)
  • T1212 Exploitation for Credential Access (Credential Access)
  • T1505.003 Web Shell (Persistence)
  • T1556.006 Multi-Factor Authentication (Defense Impairment)
  • T1588.002 Tool (Resource Development)

Named actors and malware

  • Brickstorm (malware)

Indicators

  • 5 indicators on file

Coverage

2. PwnEscape: AI-assisted discovery of critical Linux kernel flaw enables guest-to-host KVM escape (Segment)

Event first seen in a show

Reports confirm the flaw affects major distributions like Debian, RHEL, and Ubuntu, as well as virtualization products such as Nutanix and Proxmox. While AWS and Google Cloud state their managed services are unaffected, self-managed KVM-based hypervisors remain at risk if running unpatched kernels. Researchers disclosed a Linux kernel vulnerability that allows guest-controlled checksum metadata to rewrite IPv4 headers, a flaw privately reported to maintainers on September 4, 2026. Amazon Linux released updated kernel packages to address the issue, following Vercel’s publication of a $1 million Sandbox research challenge on August 18, 2026. The accepted patch, commit 6785011f8b16, adds an ip_check_csum_start() helper to reject invalid csum_start values in the kernel. An initial bounded host-memory disclosure report was submitted on August 20, 2026, confirming the flaw’s potential to expose sensitive memory from a security domain the virtual machine should not inspect.

Today, researchers at pwn[.]ai discovered that a packet with corrupted checksum metadata could corrupt the IPv4 network header if the kernel allowed it past the initial validation stage. The weakness occurs because the ipv4 stack validates the checksum start value only after skb_checksum_help has already potentially corrupted the header, creating a window where bad metadata slips through. This flaw affects Linux kernel versions ranging from 2.6.27 through 7.3-rc7, including critical releases like 5.10.272 and 6.6.159, with a CVSS score of 9.3 indicating high severity across all affected systems. The vulnerability exists in the Linux sk_buff structure where deferred checksum metadata allows a guest to control values through virtio, enabling a 32-byte host-memory disclosure that can be escalated to a full guest-to-host escape. pwn[.]ai reportedly found the flaw in three days using its AI-assisted research system, with the cost put at under $700 in API tokens. Customers who self-manage virtual machines using virtio-net and KVM on hosts running affected, unpatched Linux kernel versions are affected by this issue in the Linux kernel virtio-net/TAP networking path. AWS-managed compute and container services, including Amazon EC2 instances, AWS Lambda, and AWS Fargate, are not affected by the issue.

Possibly, researchers expect exploits for default hypervisor configurations to be available within a month, which shifts the defender’s decision from monitoring to immediate remediation. The attacker behavior involves sending specially crafted network packets that trigger the vulnerability, so the remaining uncertainty lies in whether untrusted guests are currently sending such traffic. To observe this, look for anomalous network activity from guest VMs targeting host kernel memory, particularly on systems using virtio-net. The specific signal to watch for is any host kernel crash or memory disclosure event correlated with guest network traffic. This helps distinguish normal noise from active exploitation attempts before the public exploit code arrives. This vulnerability may allow arbitrary code execution on the host, a system crash, or information disclosure of sensitive memory, exposing self-managed KVM-based hypervisors to significant risk. Apply the updated kernel packages to host systems running virtio-net and KVM on Amazon Linux, then reboot to ensure the patch is active.

The potential for an attacker to collect information from a security domain that the virtual machine should not be able to inspect remains a possible but unconfirmed outcome of the exploit. Watch for anomalous volume mount configurations, such as hostPath to / or /proc, which indicate potential container escape attempts via bind mounts. Correlate unusual system calls like unshare, keyctl, or mount from containerized processes with subsequent process creation on the host to detect escape attempts.

Vulnerabilities

  • CVE-2026-99999 — CVSS 9.3 (Critical) · Linux Linux; Linux Linux. In the Linux kernel, the following vulnerability has been resolved: ipv4: validate checksum_start before completing checksum If a packet with bad checksum metadata gets into the ipv4 stack, skb_checksum_help can corrupt…

Techniques

  • AML.T0105 Escape to Host (Privilege Escalation)
  • T1543.005 Container Service (Persistence)
  • T1611 Escape to Host (Privilege Escalation)

Indicators

  • 1 indicator on file

Coverage

3. CISA Adds PEERSTITCH Exploit to KEV Catalog After FortiManager Breach (Segment)

CVE-2025-61624 added to CISA KEV catalog; Event now covered by 3 outlets (was 2); Blast radius expanded: new vendor(s): palo alto networks, apache

Mandiant attributed the exploitation of this flaw to a threat actor tracked as UNC5820. Mandiant identified a threat cluster called UNC5820 actively exploiting CVE-2024-47575, a critical zero-day in Fortinet FortiManager. According to Mandiant, the UNC5820 cluster has been exploiting CVE-2024-47575 since at least June 27, 2024. Unit 42 reports that the attackers also exploited a second flaw, CVE-2025-61624, via FortiOS’s system[.]auto-script feature. One report suggests the campaign has been active since June 2024, affecting over fifty FortiManager appliances, though this broader timeline is currently single-sourced.

The flaw is a missing authentication check that lets unauthenticated attackers execute arbitrary code via specially crafted requests. Attackers use unpublished interfaces to bypass FortiManager 7.4.0 through 7.2.0 checks, leveraging the CWE-306 flaw to assume administrative identity. The primary attack vector involves unauthenticated remote attackers executing arbitrary code on FortiManager systems through CVE-2024-47575. This initial access enables the exfiltration of sensitive configuration data from FortiGate devices managed by the compromised FortiManager. A path traversal flaw in the CLI auto-script engine lets an authenticated admin with read-write permissions overwrite critical system files. With a CVSS score of 9.8, this vulnerability affects multiple FortiManager versions and is listed in the CISA Known Exploited Vulnerabilities catalog. The campaign has targeted over 50 FortiManager appliances across various industries, including a telecommunications managed service provider. PEERSTITCH malware exploited the FortiManager to expose more than 500 firewalls to further compromise.

Mandiant’s UNC5820 cluster confirms attackers used FortiJump to bypass missing authentication in FortiManager 7.6.0, granting arbitrary code execution. Unit 42 confirmed the implant PEERSTITCH was planted directly in firewall memory using this weakness, enabling remote code execution. The operational shift today, October 19, 2026, is that attackers now use CVE-2025-61624 not merely to steal data but to write PEERSTITCH malware directly into firewall memory via a path traversal flaw in the auto-script engine. Because this technique allows an authenticated admin to write files outside their allowed path with root privileges, it bypasses the isolation that normally protects the FortiOS daemons, enabling the malware to inject itself into the logging and VPN processes without leaving persistent binaries or listening ports. This changes the investigation focus from simple credential theft to hunting for PEERSTITCH artifacts in the memory of compromised FortiGate devices, specifically looking for the malware’s presence in the two legitimate daemons it targets, as the attack chain now relies on file system manipulation to maintain stealthy access rather than traditional network persistence. Isolate FortiManager 7.4.0 through 7.4.4 and 7.2.0 through 7.2.7 from untrusted networks until patching completes. Pull FortiManager 7.6.0 off the network now, because manual analysis is required to detect this unauthenticated access. Patch FortiOS 7.6.0 through 7.6.4 and older versions immediately, as the advisory FG-IR-26-122 from April 14, 2026, confirms the fix. Apply the Fortinet patches for CVE-2024-47575 immediately to all affected FortiManager versions, or implement the vendor-recommended workarounds if patching is not feasible. Isolate compromised FortiManager systems and rotate all credentials and trust material, as the UNC5820 campaign has been observed stealing configurations from over 500 managed FortiGate firewalls.

Manual analysis remains the only reliable detection method since automated scanners cannot verify the absence of authentication tokens. The claim that the campaign has targeted over 50 FortiManager appliances is currently single-sourced to Mandiant, so the full scope of affected devices remains unverified by independent telemetry. While specific IP addresses like 45[.]32[.]41[.]202 are associated with malicious activity, the evidence does not confirm whether these indicators represent the full set of UNC5820 infrastructure or only a subset of the campaign’s command-and-control nodes. Watch for abnormal LSASS memory access or replayed authentication attempts, which signal exploitation of credential validation processes under T1212. Prioritize manual penetration testing of custom authentication mechanisms, as automated tools may miss missing authentication flaws that allow unauthorized access to critical functions.

Vulnerabilities

  • CVE-2024-47575 — CVSS 9.8 (Critical) · CISA KEV · CWE-306 · Fortinet FortiManager. A missing authentication for critical function in FortiManager 7.6.0, FortiManager 7.4.0 through 7.4.4, FortiManager 7.2.0 through 7.2.7, FortiManager 7.0.0 through 7.0.12, FortiManager 6.4.0 through 6.4.14…
  • CVE-2025-61624 — CVSS 6.5 (Medium) · CISA KEV · CWE-22 · Fortinet FortiOS; Fortinet FortiProxy; Fortinet FortiSwitchManager. An Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’) [CWE-22] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2 all versions, FortiOS 7.0 all…

Techniques

  • AML.T0072 Reverse Shell (Command And Control)
  • T1003.007 Proc Filesystem (Credential Access)
  • T1098.005 Device Registration (Persistence)
  • T1190 Exploit Public-Facing Application (Initial Access)
  • T1210 Exploitation of Remote Services (Lateral Movement)
  • T1212 Exploitation for Credential Access (Credential Access)
  • T1552.004 Private Keys (Credential Access)
  • T1556.006 Multi-Factor Authentication (Defense Impairment)

Indicators

  • 19 indicators on file

Coverage

4. Active Exploitation of SiteGuard WAF Flaw Grants Root Access (Segment)

Event first seen in a show

Hackers are actively exploiting a critical flaw in SiteGuard Server Edition to seize root control of web servers. The vulnerability affects the default-enabled statistics feature in SiteGuard Server Edition for Apache, Nginx, and IIS, excluding FreeBSD versions. The flaw is rated CVSS 8.5, but it is not a remote login-free attack; it requires initial system compromise and low-level privileges to escalate to root or SYSTEM. Coverage from BleepingComputer, Security Affairs, and others confirms the active exploitation status, though specific attacker identities remain unknown. EG Secure Solutions issued an urgent alert for CVE-2026-106931, an OS command injection flaw in SiteGuard Server Edition versions 2.20 through 8.00 Update 5.

The flaw is an OS command injection under CWE-78, where the product constructs OS commands using externally-influenced input without proper neutralization. Attackers exploit improper neutralization of special elements during multiple parser passes to execute arbitrary root or SYSTEM commands. This bug allows malicious input to bypass validation layers, enabling arbitrary command execution with root or SYSTEM privileges on Apache, Nginx, or IIS hosts. Active exploitation of this critical vulnerability, rated 8.5, threatens full system compromise across roughly 500,000 sites running SiteGuard Server Edition 2.20 or later on Apache, Nginx, and IIS. Attackers use injected commands to disable the product, steal or modify data, and hide their activities on the compromised host.

This risk affects versions 2.20 and later that have not been patched to 8.00 Update 5, leaving the statistics feature vulnerable to privilege escalation on non-FreeBSD platforms. Update SiteGuard instances on Windows, Linux, and FreeBSD to version 8.00 Update 5 or later to stop unauthorized code execution. Isolate affected Apache, Nginx, and IIS instances and apply sandboxing or jail environments until a patch arrives. Prioritize remediation for SiteGuard versions 2.20 through 8.00 Update 4, as these builds are confirmed vulnerable to the active exploitation campaign.

The specific identities of the attackers and the exact list of victim organizations remain unknown, despite confirmation of active exploitation by the vendor and Japan’s CERT agency. While the vendor claims to protect over 1.5 million websites, the actual attack surface is estimated at 500,000 sites based on WordPress[.]org statistics, creating uncertainty about the precise scope of unpatched deployments. Watch for repeated detection of control characters by input filters, as this specific indicator signals the multi-layer parsing bypass used to exploit the SiteGuard statistics feature.

Vulnerabilities

  • CVE-2026-106931 — CVSS 8.5 (High) · CWE-78 · EG Secure Solutions Inc. SiteGuard Server Edition for Apache httpd; EG Secure Solutions Inc. SiteGuard Server Edition for Nginx; EG Secure Solutions Inc. SiteGuard Server Edition for IIS. SiteGuard Server Edition contains an OS command injection vulnerability, which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product.

Techniques

  • AML.T0049 Exploit Public-Facing Application (Initial Access)
  • T1190 Exploit Public-Facing Application (Initial Access)
  • T1203 Exploitation for Client Execution (Execution)
  • T1210 Exploitation of Remote Services (Lateral Movement)

Indicators

  • 3 indicators on file

Coverage

5. CVE-2026-110447: Active Exploitation of Nextcloud Collabora App (Segment)

Mentioned in reporting, no attribution: actor threat group

Collabora Online maintainers published advisory GHSA-g3vx-3m76-fghh on October 14, 2026, disclosing that attackers had been exploiting CVE-2026-110447 since September 10. The vulnerability is an unauthenticated command injection bug in the proxy[.]php endpoint. The fix was committed on September 9 and released in version 26.4.303 on September 11, creating a gap of more than four weeks before the public disclosure. Reports confirm that standalone Collabora servers are unaffected; the risk is specific to Nextcloud instances using the built-in app. If you are running end-of-life Nextcloud versions, you must upgrade the platform or remove the application entirely. Hackers are actively backdooring Nextcloud servers by exploiting a critical flaw in the Collabora CODE app. Collabora Online versions before 25.04.702 contain a critical remote code execution flaw in the richdocumentscode proxy. Reportedly, The attacker planted PHP webshells and used them to search for password databases, password manager artifacts, and cryptocurrency wallets.

Attackers exploited CVE-2026-110447 in Collabora Online versions before 26.4.303 to run OS commands via proxy[.]php when the CODE server was offline. The flaw allows unauthenticated attackers to inject OS commands via proxy[.]php, bypassing validation through multiple input interpretation layers. This stems from improper neutralization of special elements, enabling command injection through multiple parsing layers. This potentially executes unauthorized code on the host system. A remote code execution flaw, classified as CWE-78, allows unauthenticated users to execute commands on the Nextcloud app without logging in. This vulnerability affects the richdocumentscode app before version 26.4.303 and carries a CVSS v4 score of 9.2. System administrators impacted by malicious activity reported attacks against multiple endpoints dating back to September 10.

Attackers targeting Nextcloud users can exploit CVE-2025-66208 in Collabora Online versions before 25.04.702 via proxy[.]php to execute OS commands. Nextcloud instances running the Collabora Online - Built-in CODE Server app prior to version 26.4.303 face unauthenticated remote code execution via the proxy[.]php endpoint, a flaw distinct from CVE-2025-66208. This specific vulnerability is distinct from CVE-2026-110447, meaning the fix for one does not secure the other code path. This exposure is specific to the built-in app deployment, as standalone Collabora servers are not affected by this particular command injection vulnerability. The attacker behavior of deploying web shells to maintain persistent access aligns with the framework mitigation of application isolation and exploit protection, which restricts code execution to controlled environments or detects exploitation attempts. For defenders, the specific action is to verify that exploit protection features are enabled on the web server and to audit user account management policies to ensure no unauthorized accounts exist with web server privileges. The remaining uncertainty is that while the framework relationship supports reasoning about containment, the evidence does not confirm whether specific exploit protection features are currently active on the compromised instances, so verification of the actual mitigation status is required before declaring the threat neutralized. Upgrade the richdocumentscode app to version 26.4.303 or later, as disabling the application is insufficient to mitigate the risk. Defenders must verify their CollaboraOnline online version is 25.04.702 or higher immediately, as the prior fix for a different code path does not stop this specific injection. Defenders must patch richdocumentscode immediately, as this specific Nextcloud deployment remains the only target among the two related CVEs. Defenders must update Collabora Online immediately and verify their reverse proxy chains do not pass unvalidated input through multiple parsing layers.

Automated static analysis can flag improper neutralization of special elements, but false positives remain possible without manual review of specific input validation layers. The full scope of data exfiltration remains unconfirmed. The four-week gap between the September 11 fix release and the October 14 CVE publication means some administrators may have missed the initial remediation window. Watch for web server processes spawning shell interpreters or writing webshells following suspicious requests to public endpoints, as indicated by multi-signal correlation for Exploit Public-Facing Application. Monitor for repeated detection of control characters by filters, which signals an attempt to exploit multiple input interpretation layers.

Vulnerabilities

  • CVE-2025-66208 — CVSS 9.8 (Critical) · CWE-78 · CollaboraOnline online. Collabora Online - Built-in CODE Server (richdocumentscode) provides a built-in server with all of the document editing features of Collabora Online.
  • CVE-2026-110447 — CVSS 9.2 (Critical) · CWE-78 · Collabora Collabora Online - Built-in CODE Server. Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in the wild in September and October 2026, a different vulnerability than…

Techniques

  • T1190 Exploit Public-Facing Application (Initial Access)
  • T1210 Exploitation of Remote Services (Lateral Movement)
  • T1505.003 Web Shell (Persistence)

Named actors and malware

  • threat group (actor)

Indicators

  • 6 indicators on file

Coverage

6. FBI Arrests Third ShinyHunters Suspect in Philadelphia (Segment)

Event now covered by 17 outlets (was 16)

On October 8, the FBI arrested Edward Dubrovsky in Philadelphia, marking the third major takedown in the ongoing ShinyHunters investigation. The incident led to the termination of an Accenture contractor responsible for the missed patch. A second vulnerability discovered by Anthropic’s Mythos model has been exploited in the wild, with GTG-20006 agents monitoring security product detections to modify their deployed malware. Reportedly, ShinyHunters breached FBI systems in the recent FBIjobs[.]gov incident. H&M is investigating claims that ShinyHunters targeted it.

ShinyHunters exploited a third-party integration to access Rockstar Games’ internal Snowflake data warehouse. Ledger confirmed that one impacted device distributed by CryptoBilis was compromised with an unauthorized hardware implant potentially designed to drain user funds.

This confirms the group’s sustained operational capacity despite law enforcement pressure. ShinyHunters allegedly extorted seventy million dollars in the last year, keeping high-value judicial and corporate data as a critical exposure. The group uses AI agents to automate reconnaissance and exfiltration, having breached over one hundred forty organizations.

It remains unclear whether personal or sensitive information was compromised in the TFG London incident, as the organization is still investigating the scope of the breach. The full extent of ShinyHunters’ data theft from the Arizona Judicial Branch is not yet established, with reports attributing the theft of personal data and backup court files to criminal hackers or their bots. Watch for further arrests or detentions of ShinyHunters members, such as the recent detention of a suspected member in Jordan who is cooperating with the FBI to identify other group members. Also watch for new disclosures regarding the exploitation of the second vulnerability discovered by Anthropic’s Mythos model, which has been exploited in the wild and raises questions about the future relevance of human hacking crews.

Techniques

  • AML.T0006 Active Scanning (Reconnaissance)
  • AML.T0108 AI Agent (Command And Control)
  • T1003.003 NTDS (Credential Access)
  • T1003.006 DCSync (Credential Access)
  • T1005 Data from Local System (Collection)
  • T1006 Direct Volume Access (Stealth)
  • T1016 System Network Configuration Discovery (Discovery)
  • T1018 Remote System Discovery (Discovery)
  • T1021.001 Remote Desktop Protocol (Lateral Movement)
  • T1021.004 SSH (Lateral Movement)
  • and 10 more

Named actors and malware

  • ShinyHunters (actor)
  • Cl0p (malware)
  • Scattered Spider (actor)
  • Clop (malware)
  • Lapsus$ (actor)
  • TeamPCP (actor)
  • ShinyHunters group (actor)

Indicators

  • 25 indicators on file

Coverage

7. WhatsApp-delivered Windows RAT and Android banking trojans expand threat surface (Segment)

Event now covered by 5 outlets (was 4); Blast radius expanded: new product(s): android, app, apk

Netskope reports that the XWorm RAT has evolved into a surveillance platform by adding new plugins, including Maps for GPS tracking, Microphone for live audio streaming, and HBrowser to hijack authenticated browser sessions without bypassing MFA. Since the release of its builder and source code in mid-2025, the threat has remained highly active, with over 1,200 incidents observed across 100 organizations as developers increased supported plugins from 35 to 46. The downloader sends an HTTP POST request to 61[.]18[.]208[.]27:8888, validates a custom response header, and retrieves an in-memory deployment bundle.

The malware uses PoolParty Variant 7, a process-injection technique that inserts a malicious TP_DIRECT callback into a target process’s Windows thread pool through an I/O completion queue. The malware bypasses local privilege escalation by leveraging the SYSTEM authority of the Task Scheduler service to deploy a signed kernel driver. This driver terminates Baidu security processes and establishes a WebSocket connection to command-and-control infrastructure. The campaign also creates a scheduled task that restarts the RAT with SYSTEM privileges after a reboot.

The attacker exploited local Administrators group membership to schedule tasks at startup, injecting code into the Task Scheduler service running with LocalSystem authority. This weak access control allows malware to execute payloads with SYSTEM privileges without triggering a local privilege escalation event. Audit the local Administrators group and review the Windows Task Scheduler for hidden or recently modified tasks, specifically checking security descriptor registry values for anomalies. Hirudo uninstalls genuine banking applications and installs modified copies to disable security checks, creating a persistent integrity gap in financial endpoints. Audit Windows Task Scheduler for tasks created via WMI or PowerShell that execute from svchost[.]exe or taskeng[.]exe under the SYSTEM context, as this matches the observed injection path.

The dropper reportedly creates a broken VPN connection to cut off internet access during installation, a behavior that may weaken online reputation checks but has not been confirmed across all observed variants. Watch for suspicious parent processes calling screen capture APIs like CopyFromScreen or undocumented APIs, which signals active HBrowser plugin use for session hijacking. Track scheduled tasks created via the WMI class PS_ScheduledTask that lack visible Security Descriptor registry values, indicating hidden persistence mechanisms.

Techniques

  • EMERGING-0006 PyLangGhost RAT
  • EMERGING-0011 Hooking
  • T1053.002 At (Execution)
  • T1053.005 Scheduled Task (Execution)
  • T1078.003 Local Accounts (Stealth)
  • T1087.001 Local Account (Discovery)
  • T1113 Screen Capture (Collection)
  • T1115 Clipboard Data (Collection)
  • T1136.001 Local Account (Persistence)
  • T1204.002 Malicious File (Execution)
  • and 5 more

Named actors and malware

  • RAT (malware)

Indicators

  • 7 indicators on file

Coverage

8. Ivanti Zero-Day CVE-2025-0282 Actively Exploited (Segment)

Event now covered by 4 outlets (was 3); Blast radius expanded: new vendor(s): google; Mentioned in reporting, no attribution: malware DRYHOOK

What changed

Ivanti confirmed threat actors are exploiting CVE-2025-0282, a critical remote code execution flaw in Connect Secure appliances, to install malware. Google’s Mandiant and Microsoft’s MSTIC discovered the issue, which has been exploited since mid-December 2024. CISA added the vulnerability to the Known Exploited Vulnerabilities catalog, mandating federal fixes by January 15, 2025. Patches for Policy Secure and Neurons for ZTA gateways are scheduled for January 21, 2025. Reportedly, Ivanti Connect Secure appliances are under active attack via a zero-day flaw, CVE-2025-0282. Reportedly, Ivanti confirmed that attackers exploited CVE-2025-0282, a zero-day stack-based buffer overflow, to install malware on Connect Secure appliances. The blast radius is significant, with Censys data showing over thirty-three thousand exposed instances globally. Ivanti released fixes for a stack-based buffer overflow in Connect Secure, Policy Secure, and Neurons for ZTA gateways. The use of SPAWN malware has been attributed to a China-nexus threat actor dubbed UNC5337, which is assessed to be a part of UNC5221 with medium confidence.

How it works

Hackers exploited a stack overflow in Ivanti Connect Secure before version 22.7R2.5 to run remote code without authentication. This flaw allows remote, unauthenticated attackers to execute code on Ivanti Connect Secure, Policy Secure, and Neurons for ZTA gateways running versions prior to the specified patches. The weakness is a classic stack overflow where an authenticated user overwrites memory to execute unauthorized code. A local authenticated attacker can exploit this flaw to escalate privileges, potentially executing unauthorized code on the device. A second vulnerability, CVE-2025-0283, is a stack-based buffer overflow that allows local authenticated attackers to escalate their privileges on the device. Fuzzing detects this crash, while compiler hardening like /GS mitigates the memory corruption that causes the DoS or unauthorized code execution. Hackers exploited a remote unauthenticated flaw to install malware on Connect Secure appliances, causing crashes or resource consumption that disrupts availability. The vulnerability carries a CVSS score of seven, indicating high impact to confidentiality, integrity, and availability.

What to do

This vulnerability is distinct from CVE-2025-0282, requiring separate patching of versions prior to 22.7R2.5 or 22.7R1.2. Operators must verify ZTA gateways and Policy Secure versions to block the privilege escalation paired with CVE-2025-0282. CISA’s KEV listing mandates federal remediation for the unauthenticated remote code execution flaw by January 15, 2025. Apply the latest Ivanti patch immediately to prevent crashes or unauthorized execution. Upgrade Ivanti Connect Secure appliances to version 22.7R2.5 or later, performing a factory reset before applying the update as directed by the vendor. Deploy compiler hardening like StackGuard or ProPolice to detect buffer overflows, while fuzzing remains the primary method for identifying such stack vulnerabilities. Harden compilation environments using compiler extensions like StackGuard to detect this overflow condition.

Limits and watch

Reportedly, attribution of the SPAWN malware to the China-nexus actor UNC5337 carries only medium confidence, leaving the specific threat actor identity uncertain. The full extent of compromised devices remains unknown because Ivanti acknowledged only a limited number of affected customers without providing a total count. Watch for web server processes creating unexpected files in web directories and then spawning command shells or script interpreters, a key indicator of web shell deployment.

Vulnerabilities

  • CVE-2025-0282 — CVSS 9 (Critical) · CISA KEV · CWE-121 · Ivanti Connect Secure; Ivanti Policy Secure; Ivanti Neurons for ZTA gateways. A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti Neurons for ZTA gateways before version 22.7R2.3 allows a remote unauthenticated…
  • CVE-2025-0283 — CVSS 7 (High) · CWE-121 · Ivanti Connect Secure; Ivanti Policy Secure; Ivanti Neurons for ZTA gateways. A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti Neurons for ZTA gateways before version 22.7R2.3 allows a local authenticated…

Techniques

  • T1021.007 Cloud Services (Lateral Movement)
  • T1505.003 Web Shell (Persistence)

Named actors and malware

  • DRYHOOK (malware)
  • PHASEJAM (malware)

Coverage

9. Drupal patches critical RCE flaws in Field UI and Entity List (Segment)

Event first seen in a show

What changed

Drupal released security updates on October 14, 2026, addressing two critical remote code execution vulnerabilities identified as CVE-2026-108097 and CVE-2026-108099. The patches target the Field UI and Entity List modules, with specific version updates required for Drupal 10, 11, and the legacy Drupal 7 Long-Term Support release. While Drupal core is not directly exploitable on its own, three independent outlets confirm that unauthenticated attackers can compromise sites if specific contributed modules or custom code are present. For legacy users, Pantheon has released Drupal seven point one zero seven under its Long-Term Support program, though you must review custom code using the region callback after applying it. The risk is rated nineteen out of twenty-five, and the fix specifically removes the vulnerable callback function that previously allowed Field UI to assign rows to regions.

How it works

Attackers can trigger this critical flaw in the Field UI module by sending specially crafted requests that bypass standard input validation. The weakness allows attackers to bypass standard view restrictions by exploiting the contributed module’s logic error directly. The vulnerability exists because Field UI overview tables previously called the #region_callback function set on a table row, a path that contributed modules or custom code could leverage to execute arbitrary code. While the Drupal Security Team warned that exploits might be developed within hours or days of disclosure, the official exploit status remains theoretical as no confirmed attacks have been observed. CVE-2026-108099 is a flaw in the Entity List contributed module that may enable remote code execution, affecting sites that use this module to create entity lists without Views. The affected versions span Drupal 8.9.0 through specific pre-release builds of Drupal 12, requiring updates to 10.6.19, 11.3.19, or 11.4.10 depending on the release branch.

What to do

Possibly, The Field UI module released a critical remote code execution fix for CVE-2026-108097 today. Possibly, yesterday, the Entity List module flaw CVE-2026-108099 enabled remote code execution without requiring prior View access, unlike CVE-2026-108097. Sites running Drupal 8.9.0 through 11.4.0 are in the affected range. Your exposure depends on whether Field UI or Entity List is active, as Drupal core alone is not directly exploitable. Operators must apply the backported patch immediately to prevent unauthorized code execution, as no other mitigation exists for this specific weakness. Operators must isolate the Entity List module immediately because its remote execution capability creates a higher-risk attack surface than the View-dependent flaw. Update Drupal core to 10.6.19, 11.3.19, or 11.4.10 and Entity List to 3.0.10 to close the vulnerability. If you cannot patch immediately, uninstall the core Field UI module to mitigate the risk while you prepare the update.

Limits and watch

The exploit status is currently theoretical, meaning no confirmed attacks have been observed yet, but the risk rating remains high at nineteen out of twenty-five. The fix changes how Field UI assigns rows to regions by removing the vulnerable callback, but you must review custom code using #region_callback after applying the patch. Watch for browser or office application crashes followed by unexpected child processes like curl or bash opening network connections, which indicates potential exploitation of client execution. Correlate inbound network access to remote service ports with near-time service instability and suspicious child process creation to detect lateral movement exploitation.

Vulnerabilities

  • CVE-2026-108097 — CVSS 0 (Low)
  • CVE-2026-108099 — CVSS 0 (Low)

Techniques

  • T1203 Exploitation for Client Execution (Execution)
  • T1210 Exploitation of Remote Services (Lateral Movement)

Coverage