The Hot Drop

Oct 20

The Hot Drop for 10-20-2026

Is your BeyondTrust appliance already compromised by Armory Castle’s zero-day root access? Simultaneously, AI-driven Cairn panels leak secrets while a CVSS 10.0 BlockStrap RCE threatens Magento. And can WP2Shell’s chained SQL injection bypass WordPress defenses before F5 Labs confirms active exploitation?

Since the last show: 10 developing · 1 returning · 91% overlap with the previous show

Contents

  1. Armory Castle Exploits BeyondTrust Zero-Day for Espionage
  2. AI-driven Cairn panels exposed; critical BlockStrap RCE threatens Magento ecosystem
  3. WP2Shell: Unauthenticated RCE in WordPress via Chained REST API and SQL Injection Flaws
  4. PwnEscape: AI-assisted discovery of critical Linux kernel flaw enables guest-to-host KVM escape
  5. FBI Arrests Third ShinyHunters Suspect in Global Ransomware Crackdown
  6. Western agencies warn of Russian GRU campaign targeting NATO defense and logistics sectors
  7. GlassWorm hijacks OVHcloud CLI releases
  8. German police arrest Russian Qilin member in Japan over deadly Synnovis hack
  9. Drupal patches critical unauthenticated RCE flaws in Field UI and Entity List modules
  10. Siemens Software Center DLL Side-Loading Flaw Exploited in Romulus ClickFix Campaign
  11. SiteGuard WAF Exploited for Root Access; Patching May Erase Evidence

1. Armory Castle Exploits BeyondTrust Zero-Day for Espionage (Lead)

2 new indicator(s) observed

What changed

Armory Castle has exploited a critical zero-day in BeyondTrust Remote Support since late August. BeyondTrust disclosed the vulnerability on October 15 after detecting active exploitation on September 28. Mandiant attributed the attacks to a likely Chinese government-backed espionage group, previously tracked as UNC5221 and now called Armory Castle. Apply the BT26-05-RS patch or upgrade to version 24.3.1 immediately. CISA mandated forensic triage by October 19, which was yesterday. CISA added CVE-2026-102764 to its Known Exploited Vulnerabilities catalog on October 16, 2026, confirming active exploitation of BeyondTrust Remote Support. The vulnerability is tracked as CVE-2026-1731 with a CVSS score of 9.9, while the related defect CVE-2026-102764 scores 9.3 on CVSS 4.0. The first known instance of zero-day exploitation occurred on August 29, preceding BeyondTrust’s public disclosure by nearly two months. Mandiant tracked a campaign targeting CVE-2025-22457, a critical flaw in Ivanti Connect Secure. Ivanti Connect Secure, Policy Secure, and ZTA Gateways face a critical stack-based buffer overflow that allows remote code execution without authentication.

How it works

Mandiant reports that unauthenticated attackers can spoof message origins to bypass validation, allowing file operations that lead to host-level control and credential access. BeyondTrust detected this malicious activity after zero-days were confirmed exploited in another security vendor’s product on September 27. BeyondTrust Remote Support and Privileged Remote Access versions zero suffered a critical pre-authentication remote code execution flaw today. This authentication bypass lets attackers gain full privileges on the appliance without network access. The vulnerability affects Remote Support versions up to 26.2.3, requiring organizations to apply patches or upgrade to version 24.3.1 immediately.

What to do

Armory Castle used this specific vector in August 2026 to escalate privileges and establish persistent access, distinguishing it from other flaws in the event. Mandiant tracked a specific actor targeting this vulnerability, confirming it is part of an active exploitation campaign. Verify your appliance version immediately, since the Oct. 8 patch is now mandatory under the Oct. 16 KEV list. Apply the latest Ivanti patch and enable compiler hardening like FORTIFY_SOURCE to mitigate this critical flaw. Use fuzzing to detect this flaw and compile hardened environments to mitigate the risk.

Limits and watch

Mandiant researchers identified the actor as a likely Chinese government-backed espionage group, but this attribution remains a reported assessment rather than a confirmed fact. The scope of compromise is limited by the inability to audit the host file system, meaning the full extent of credential theft and backdoor deployment is not yet established. Watch for inbound network access to remote service ports that correlates with near-time instability in the target service, such as crashes or abnormal restarts, to detect lateral movement.

Vulnerabilities

  • CVE-2025-22457 — CVSS 9.8 (Critical) · CISA KEV · CWE-121 · Ivanti Connect Secure; Ivanti Policy Secure; Ivanti Neurons for ZTA gateways. A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.6, Ivanti Policy Secure before version 22.7R1.4, and Ivanti ZTA Gateways before version 22.8R2.2 allows a remote unauthenticated attacker to…
  • CVE-2026-102764 — CVSS 9.8 (Critical) · CISA KEV · CWE-290 · BeyondTrust Remote Support. The vulnerability exists within internal components of BeyondTrust’s Remote Support product.
  • CVE-2026-1731 — CVSS 9.8 (Critical) · CISA KEV · CWE-78 · BeyondTrust Remote Support(RS) & Privileged Remote Access(PRA). BeyondTrust Remote Support (RS) and certain older versions of Privileged Remote Access (PRA) contain a critical pre-authentication remote code execution vulnerability.

Techniques

  • T1078.002 Domain Accounts (Stealth)
  • T1087.002 Domain Account (Discovery)
  • T1102 Web Service (Command And Control)
  • T1136.002 Domain Account (Persistence)
  • T1210 Exploitation of Remote Services (Lateral Movement)
  • T1212 Exploitation for Credential Access (Credential Access)
  • T1505.003 Web Shell (Persistence)
  • T1556.006 Multi-Factor Authentication (Defense Impairment)
  • T1588.002 Tool (Resource Development)

Named actors and malware

  • Brickstorm (malware)

Indicators

  • 7 indicators on file

Coverage

2. AI-driven Cairn panels exposed; critical BlockStrap RCE threatens Magento ecosystem (Segment)

Event first seen in a show

What changed

Adobe published security advisory APSB26-153 on October 13 to address the BlockStrap vulnerability in its Commerce and Magento products. Simultaneously, Sansec and BleepingComputer are reporting on CVE-2026-103849, a CVSS ten remote code execution flaw in Magento and Adobe Commerce. This bug allows unauthenticated attackers to execute arbitrary PHP code. Sansec reproduced four distinct attack routes for the flaw within twenty-four hours of the patch release. Adobe Commerce and Magento Open Source face a critical template injection flaw listed in the CISA Known Exploited Vulnerabilities catalog. In one observed case, the system reported success in gaining a shell on an Australian e-commerce server. Adobe Commerce and Magento Open Source also face a stored XSS flaw, rated 9.3, affecting versions through 2.4.10-alpha1.

How it works

Attackers trigger arbitrary code execution on Adobe Commerce servers without user interaction by exploiting improper template neutralization in versions 2.4.8-2026-oct through 2.4.10-alpha1. The flaw stems from improper neutralization of special elements in the template engine, allowing remote attackers to run unauthorized code. This enables unauthorized code execution that changes the security scope. Attackers also inject malicious scripts into form fields, which execute in victims’ browsers to hijack sessions. Sansec notes that threat actors can reverse the complexity of the exploit path using AI agents in a short time. This flaw grants full integrity compromise under the current user’s context, matching the CVSS 10 severity rating for high-impact template injection. The vulnerability affects September versions of Adobe Commerce and Magento Open Source through 2.4.9, as well as Adobe Commerce B2B through 1.5.3. Mage-OS versions up to 3.5.0 are affected by BlockStrap, while version 3.6.0 contains the fix.

What to do

A severity-ten flaw allows unauthenticated remote access, granting full control over compromised accounts without requiring elevated access. Cairn panels appear completely unprotected, exposing full administrative functionality of the harness. No live exploitation of BlockStrap has been observed yet, but threat actors will likely reverse the exploit path to target the ten percent success rate seen in similar campaigns. The most useful investigation focus is scanning for unpatched Magento and Adobe Commerce instances running versions 2.4.9 and below, specifically checking whether administrators have applied both the BlockStrap and StyleSmuggler fixes, since a plain Composer install is insufficient to address the risk. Reportedly, apply the 2026-oct release or Adobe’s isolated patch immediately, as Sansec notes that a plain Composer install is insufficient to address the risk. Install the vendor’s hotfix for CVE-2026-7565 right away, because static analysis can detect the pattern but only patching stops the execution. Activate the template engine’s sandbox or restricted mode as the primary mitigation to prevent unauthorized command execution. Restrict template engine sandbox modes to limit expression power if the hotfix cannot be applied immediately. Verify that the applied patch addresses the specific CVE-2026-7565 vulnerability. Confirm that the isolated patch from Adobe is correctly deployed across all affected instances. Validate that the 2026-oct release includes the necessary security fixes for the template engine. Confirm that the patch prevents the execution of unauthorized commands. Verify that the isolated patch is compatible with the current version of the template engine. Ensure that the 2026-oct release is available for all supported platforms. Check that the vendor’s hotfix is correctly applied to all affected systems. Ensure that the restricted mode is properly configured to limit expression power.

Limits and watch

Sansec reportedly warned that Adobe’s ‘priority 2’ rating of the flaw does not reflect the danger and urgency in this case.

Vulnerabilities

  • CVE-2026-103849 — CVSS 10 (Critical) · CWE-1336 · Adobe Adobe Commerce; Adobe Adobe Commerce B2B; Adobe Magento Open Source. Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining…
  • CVE-2026-75650 — CVSS 10 (Critical) · CISA KEV · CWE-1336 · Adobe Adobe Commerce; Adobe Adobe Commerce B2B; Adobe Magento Open Source. Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in arbitrary code execution in the context of the current user.
  • CVE-2026-91013 — CVSS 9.3 (Critical) · CWE-79 · Adobe Adobe Commerce; Adobe Adobe Commerce B2B; Adobe Magento Open Source. Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields.

Techniques

  • T1203 Exploitation for Client Execution (Execution)
  • T1218.002 Control Panel (Stealth)
  • T1505.003 Web Shell (Persistence)
  • T1593.002 Search Engines (Reconnaissance)
  • T1657 Financial Theft (Impact)

Indicators

  • 3 indicators on file

Coverage

3. WP2Shell: Unauthenticated RCE in WordPress via Chained REST API and SQL Injection Flaws (Segment)

Event first seen in a show

This July 2026 disclosure confirms that unauthenticated attackers can achieve remote code execution on WordPress 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1. If you are running vulnerable versions, patch immediately to 6.8.6, 6.9.5, or 7.0.2. F5 Labs identified automated exploitation attempts originating from IP 185[.]242[.]3[.]238 targeting the WP2Shell exploit chain. The WP2Shell chain is verified to leverage CVE-2026-63030 and CVE-2026-60137 to transition from an unauthenticated state to arbitrary code execution. Evidence confirms that the REST API batch controller at /wp-json/batch/v1 is the specific surface affected by the route confusion flaw.

The WP2Shell chain exploits CVE-2026-63030 by targeting the /wp-json/batch/v1 endpoint to confuse route logic before chaining into SQL injection. The chain manipulates application state through object caching to bypass authentication before executing code. CVE-2026-60137 injects SQL through the author__not_in parameter of WP_Query when untrusted input hits the posts endpoint. Unauthenticated attackers can provision privileged accounts on default installations without valid credentials. A SQL injection on the posts endpoint grants high confidentiality impact without authentication, affecting versions like 6.8.0 and 7.0.0 where the REST API fails to sanitize input. The exposure is limited to versions 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1, which remain vulnerable until patched to 6.8.6, 6.9.5, or 7.0.2.

Defenders gain clarity that CVE-2026-63030 acts as the critical unauthenticated pivot point enabling the full WP2Shell compromise without requiring prior access. The WP2Shell chain converts an unauthenticated REST API request into arbitrary code execution on WordPress 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1. This exposure allows attackers to bypass authentication entirely by chaining the REST API route confusion in CVE-2026-63030 with the SQL injection in CVE-2026-60137. Update affected WordPress releases immediately to close the author_exclude parameter flaw, as no other mitigation exists for this known exploited vulnerability. Patch all WordPress instances to version 6.8.6, 6.9.5, or 7.0.2 to close the REST API and SQL injection vulnerabilities. Disable or remove the REST API batch controller feature if it is not required for business operations to reduce the attack surface.

The evidence does not confirm whether the observed exploitation attempts from IP 185[.]242[.]3[.]238 resulted in successful compromise of specific targets. Monitor

Vulnerabilities

  • CVE-2026-63030 — CVSS 9.8 (Critical) · CISA KEV · WordPress WordPress. WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the author__not_in WP_Query SQL Injection (CVE-2026-60137), could allow an attacker…
  • CVE-2026-60137 — CVSS 5.9 (Medium) · CISA KEV · WordPress WordPress. WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the author__not_in parameter of WP_Query, which could allow SQL Injection when a plugin or theme passes untrusted input…

Techniques

  • T1053.005 Scheduled Task (Execution)
  • T1190 Exploit Public-Facing Application (Initial Access)
  • T1203 Exploitation for Client Execution (Execution)
  • T1210 Exploitation of Remote Services (Lateral Movement)
  • T1505.003 Web Shell (Persistence)
  • T1595 Active Scanning (Reconnaissance)
  • T1595.002 Vulnerability Scanning (Reconnaissance)
  • T1659 Content Injection (Initial Access)

Indicators

  • 1 indicator on file

Coverage

4. PwnEscape: AI-assisted discovery of critical Linux kernel flaw enables guest-to-host KVM escape (Segment)

Event now covered by 3 outlets (was 2)

Vercel published a one-million-dollar sandbox research challenge on August 18, 2026, which led to the discovery of a Linux kernel vulnerability allowing guest-controlled checksum metadata to rewrite an IPv4 header. The host-kernel root cause was reported privately to the kernel security contact and networking maintainers on September 4, 2026, following the initial bounded host-memory disclosure report submitted on August 20, 2026. Researchers at pwn[.]ai identified a critical flaw in the Linux kernel’s IPv4 stack, tracked as CVE-2026-99999, which allows local attackers to corrupt network headers. The accepted patch, commit 6785011f8b16, adds an ip_check_csum_start() helper to reject invalid csum_start values, validating the checksum before completion to prevent network header corruption. Amazon Linux has released updated kernel packages that address the issue, confirming the vulnerability exists in the Linux networking stack where bad checksum metadata can corrupt the network header.

The vulnerability occurs when a packet with invalid checksum metadata enters the stack, causing the skb_checksum_help function to corrupt the network header before the checksum is completed. The flaw involves deferred checksum metadata in the Linux sk_buff structure, where a guest can control values through virtio to trigger skb_checksum_help corruption of the network header. According to pwn[.]ai, the flaw was found in three days using an AI-assisted research system with a cost under $700 in API tokens, and the vulnerability allows a 32-byte host-memory disclosure that can be escalated to a full guest-to-host escape. This issue affects Linux versions 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.57, 7.2.11, and 7.3, plus specific kernel commits. Self-managed virtual machines using virtio-net and KVM on unpatched hosts are affected, while AWS-managed services like EC2, Lambda, and Fargate are not. Possibly, consequences include arbitrary code execution on the host, system crashes causing denial of service, or disclosure of sensitive memory from restricted security domains.

Apply the updated kernel packages to host systems running self-managed virtual machines with virtio-net and KVM on Amazon Linux, then reboot to ensure the patch is active. Verify that your kernel version includes the changes from the patch merged into the mainline Linus’s tree on October 14, 2026, or the net[.]git branch on October 8, 2026.

The exact scope of exploitation remains under investigation. An attacker controlling a guest workload may potentially collect information from a security domain that the virtual machine should not be able to inspect, though the extent of this data exposure is not fully established. Watch for anomalous volume mount configurations like hostPath to root or proc, or unexpected privileged container launches, which signal container escape attempts. Correlate unusual system calls from containerized processes, such as unshare, keyctl, or mount, with subsequent host process creation to detect potential escapes via syscalls.

Vulnerabilities

  • CVE-2026-99999 — CVSS 9.3 (Critical) · Linux Linux; Linux Linux. In the Linux kernel, the following vulnerability has been resolved: ipv4: validate checksum_start before completing checksum If a packet with bad checksum metadata gets into the ipv4 stack, skb_checksum_help can corrupt…

Techniques

  • AML.T0105 Escape to Host (Privilege Escalation)
  • T1543.005 Container Service (Persistence)
  • T1611 Escape to Host (Privilege Escalation)

Indicators

  • 1 indicator on file

Coverage

5. FBI Arrests Third ShinyHunters Suspect in Global Ransomware Crackdown (Segment)

Event now covered by 18 outlets (was 17); Blast radius expanded: new product(s): salesforce; 9 new indicator(s) observed

A second vulnerability discovered by Anthropic’s Mythos model has been exploited in the wild. A cached listing on the extortion site targeted Intuitive Surgical, which had reported a March 2026 phishing incident. This marks the third major detention in the global crackdown on the ShinyHunters extortion group, following arrests in Jordan and the Netherlands. Dubrovsky, who previously worked at Cypfer, faces charges of conspiracy to threaten confidentiality and interference with commerce. The ShinyHunters group is believed to be responsible for the recent FBIjobs[.]gov incident. H&M is reportedly investigating claims that it was targeted by the ShinyHunters cybercrime group.

ShinyHunters exploited a third-party integration to access Rockstar Games’ internal Snowflake data warehouse. Ledger confirmed that one impacted device distributed by CryptoBilis was compromised with an unauthorized hardware implant potentially designed to drain user funds.

ShinyHunters exploited a second vulnerability found by Anthropic’s Mythos model, automating the full cyber kill chain from reconnaissance to exfiltration. This mirrors the arrest of Edward Dubrovsky and detentions in Jordan and the Netherlands, showing the group uses AI agents to cut human staffing. The lack of pre-compromise mitigations on cloud accounts lets attackers scan open ports and enumerate email addresses without triggering alerts. Prioritize monitoring anomalous activity on third-party integrations like Oracle PeopleSoft and Snowflake, rather than relying solely on traditional signature-based detection. Verify whether compromised cloud accounts established operational resources or exfiltrated data, as ShinyHunters allegedly breached over 140 organizations since last year. After using an alleged Oracle PeopleSoft zero-day on the FBI’s jobs site and pivoting to AWS GovCloud, audit account use policies to enforce inactivity timeouts and lockout mechanisms. Uncertainty remains regarding the extent of compromise at H&M or ASOS, but confirmed impact on TFG London’s Hobbs, Phase Eight, and Whistles brands demands immediate review of audit logs. Check for unauthorized changes to MFA configurations or tool modifications, as adversaries may modify AI agent behavior to remain covert. Verify that all third-party contractors, including those from Accenture, have patched the specific vulnerability exploited by Shiny Hunters to prevent further unauthorized access. Audit security product logs to confirm that deployed malware is being detected, as GTG-20006 agents modify their tools when detection occurs.

It remains possible that Shinyhunters accessed some of H&M Group’s data last week, though the extent of this compromise is not yet established. Attribution of the theft of personal data and backup court files from the Arizona Judicial Branch to criminal hackers or their bots is currently attributed but not fully confirmed. Watch for further arrests or cooperation from detained ShinyHunters members, such as the individual identified by the alias Rey in Jordan, who is working with the FBI to identify other group members. Watch for disclosures regarding the European Commission breach, where ShinyHunters stole approximately 340 GB of data via a Trivy supply chain attack, to assess potential lateral movement or further data leaks.

Techniques

  • AML.T0006 Active Scanning (Reconnaissance)
  • AML.T0108 AI Agent (Command And Control)
  • T1003.003 NTDS (Credential Access)
  • T1003.006 DCSync (Credential Access)
  • T1005 Data from Local System (Collection)
  • T1006 Direct Volume Access (Stealth)
  • T1016 System Network Configuration Discovery (Discovery)
  • T1018 Remote System Discovery (Discovery)
  • T1021.001 Remote Desktop Protocol (Lateral Movement)
  • T1021.004 SSH (Lateral Movement)
  • and 10 more

Named actors and malware

  • ShinyHunters (actor)
  • Cl0p (malware)
  • Scattered Spider (actor)
  • Clop (malware)
  • Lapsus$ (actor)
  • TeamPCP (actor)
  • ShinyHunters group (actor)

Indicators

  • 25 indicators on file

Coverage

6. Western agencies warn of Russian GRU campaign targeting NATO defense and logistics sectors (Segment)

Event first seen in a show

What changed

Eleven countries and twenty-one agencies have jointly accused Russia’s GRU of a massive espionage campaign. The campaign utilized macro-enabled documents to deploy a backdoor named Hookedge for credential theft and network reconnaissance. The first confirmed infection occurred on July 24, with related malicious activity detected as late as September 24. The breach targeted an unnamed organization with Ukraine-related expertise, traced to a neighboring business across the street.

How it works

Attackers exploited the Wi-Fi networks of neighboring businesses to breach the primary target, a technique identified as the Nearest Neighbor Attack. Once inside, the group compromised user credentials through password spray attacks against the victim’s public-facing services. The campaign reached logistics and tech firms, with the Hookedge backdoor used to steal credentials and map network infrastructure.

What to do

APT28’s prior exploitation of internet router vulnerabilities to redirect web traffic indicates that your edge devices are a direct vector for passive surveillance and traffic interception. Do this now.

Limits and watch

Attributing the attack to GruesomeLarch relies on the GooseEgg tool, which is not definitive proof of their involvement. The breach traced to Organization B across the street, but the exact initial access method from that location remains unconfirmed.

Techniques

  • T1001.001 Junk Data (Command And Control)
  • T1003 OS Credential Dumping (Credential Access)
  • T1003.001 LSASS Memory (Credential Access)
  • T1003.003 NTDS (Credential Access)
  • T1005 Data from Local System (Collection)
  • T1014 Rootkit (Stealth)
  • T1021.002 SMB/Windows Admin Shares (Lateral Movement)
  • T1021.007 Cloud Services (Lateral Movement)
  • T1025 Data from Removable Media (Collection)
  • T1027.013 Encrypted/Encoded File (Stealth)
  • and 10 more

Named actors and malware

  • Swallowtail (actor)
  • Fancy Bear (actor)
  • APT28 (actor)
  • GruesomeLarch (actor)

Indicators

  • 25 indicators on file

Coverage

7. GlassWorm hijacks OVHcloud CLI releases (Segment)

Event first seen in a show

What changed

Yesterday, an attacker compromised a contributor’s GitHub account to swap download archives for five CLI versions, from v0.11.0 through v0.15.0, with malware. If your team installed the CLI via Homebrew or go install, you are likely safe because those methods pinned original hashes or built from clean source tags. The Glassworm campaign has entered its third wave, adding 24 new malicious packages to the OpenVSX and Microsoft Visual Studio marketplaces. A researcher from Secure Annex reportedly identified this re-emergence of the malware targeting macOS systems. The security team confirmed unauthorized publishing access, revoked the associated tokens, and removed the malicious releases from the platforms. Also, look for unexpected LaunchAgent entries on macOS hosts that may indicate persistence.

How it works

Publishers push updates with malicious code and inflate download counts to establish legitimacy before activation. The malware establishes persistence on infected macOS systems via a LaunchAgent that enables execution at login. The attack focuses on stealing passwords, crypto-wallet data, and developer credentials and configurations from macOS systems. GlassWorm spreads itself using stolen account information to infect more extensions the victim can access.

What to do

The GlassWorm payload establishes persistence on macOS hosts via a LaunchAgent, enabling execution at login to maintain access. Infected machines are repurposed to route malicious traffic through a deployed SOCKS proxy, turning your endpoints into nodes for criminal infrastructure. Inspect macOS hosts for unexpected LaunchAgent entries to identify and remove the persistence mechanism installed by the malware.

Limits and watch

The campaign is in its third wave with 24 new packages added, but the full scope of compromised extensions beyond the identified 22,000 downloads remains uncertain. While the malware exfiltrates data to 45.32.150[.]251, the specific volume of data stolen from individual hosts is not established in the current evidence. Watch

Techniques

  • EMERGING-0028 ASCII smuggling
  • T1005 Data from Local System (Collection)
  • T1027.013 Encrypted/Encoded File (Stealth)
  • T1027.018 Invisible Unicode (Stealth)
  • T1059.009 Cloud API (Execution)
  • T1204.005 Malicious Library (Execution)
  • T1212 Exploitation for Credential Access (Credential Access)
  • T1564 Hide Artifacts (Stealth)

Named actors and malware

  • GlassWorm (malware)
  • Shai-Hulud (malware)

Indicators

  • 7 indicators on file

Coverage

8. German police arrest Russian Qilin member in Japan over deadly Synnovis hack (Segment)

Event first seen in a show

What changed

German police arrested a Russian national in Japan for his role in the 2024 ransomware attack on Synnovis. The Qilin group recently targeted Asahi Group Holdings in Japan, breaching data for over 1.7 million people and causing beverage sales to drop by up to forty percent in October. Vladimir K was wanted in Germany for hacking a logistics company in September 2024, encrypting data and extorting around $160,000 in cryptocurrency. He is accused of being a core member of the Qilin gang, which allegedly hacked over 4,000 organizations and extorted more than $140 million since 2024.

How it works

The Synnovis hack in 2024 disrupted more than 10,000 appointments and caused a critical shortage of O-type blood in London hospitals. This incident was the first cyber attack in history to be directly linked to a patient’s death caused by delayed blood test results.

What to do

The arrest of a suspected Qilin core member in Japan confirms the group’s cross-border operational footprint, linking the 2024 Synnovis attack to a broader network that has allegedly compromised over 4,000 organizations. After Qilin breached Asahi Group Holdings and caused up to forty percent sales drops, the group proves it can target critical healthcare infrastructure and major commercial logistics in the same region.

Limits and watch

The specific technical methods used to breach Asahi Group Holdings are not detailed in the available evidence, limiting the ability to map the attack to specific ATT&CK techniques or CWE weaknesses for that specific incident. While the Synnovis attack is confirmed to have caused a critical shortage of O-type blood, the precise extent of data exfiltration versus encryption in the Asahi breach remains unverified, as the company has not seen evidence of the stolen data being published online.

Techniques

  • T1589.002 Email Addresses (Reconnaissance)
  • T1593.001 Social Media (Reconnaissance)

Named actors and malware

  • Qilin ransomware group (malware)
  • Qilin (malware)

Coverage

9. Drupal patches critical unauthenticated RCE flaws in Field UI and Entity List modules (Segment)

Event now covered by 4 outlets (was 3)

What changed

Drupal released security updates for versions 10.6.19, 11.3.19, and 11.4.10 to fix a critical remote code execution flaw in the Field UI module. The advisory also covers a backported fix for Drupal 7 LTS, addressing a flaw that lets unauthenticated attackers compromise sites when specific contributed modules are present. Reports confirm the affected versions include Drupal 8.9.0 to before 10.6.19, 11.0.0 to before 11.3.19, and 11.4.0 to before 11.4.10. The mechanism involves Field UI overview tables no longer calling the region callback function set on a table row. The fix changes how Field UI overview tables assign rows to regions. Drupal core alone is not directly exploitable, but the security team confirmed that several serious attack paths exist when contributed modules are present.

How it works

Possibly, today, the Field UI module in affected systems was compromised by CVE-2026-108097, a critical remote code execution flaw that allows attackers to execute arbitrary code without prior authentication. CVE-2026-108099 is a flaw in Entity List, a contributed module for creating entity lists without Views, that could enable remote code execution, affecting sites that use this specific module. The vulnerability stems from a missing input validation in the Field UI component, enabling an attacker to inject malicious payloads directly into the user interface. Possibly, The flaw resides in the contributed module for creating entity lists without Views, allowing an unauthenticated remote actor to inject and execute arbitrary code. The Drupal Security Team warned that exploits might be developed within hours or days of the vulnerabilities’ disclosure, listing the exploit status as theoretical in its risk assessment.

What to do

Possibly, Attackers exploited CVE-2026-108099 in the Entity List module to achieve remote code execution without prior authentication. Sites running Drupal 8.9.0 through 11.4.0 remain exposed to remote code execution via contributed modules, even though Drupal core alone does not provide a direct exploitation path. The theoretical exploit status in Drupal’s risk assessment does not eliminate the need for immediate patching, as several serious attack paths exist when contributed modules are present. Update Drupal core to 10.6.19, 11.3.19, or 11.4.10 and Entity List to 3.0.10 to close remote code execution flaws. If immediate patching is not possible, uninstall the core Field UI module to mitigate the vulnerability while you prepare for the update.

Limits and watch

The exploit status for CVE-2026-108099 remains theoretical, meaning no confirmed attacks have been observed yet. Monitor for browser or office application crashes followed by unexpected child processes like powershell or curl opening network connections, which indicates potential exploitation for client execution. Watch for inbound network access to remote service ports correlating with service instability and suspicious child process creation, signaling potential lateral movement via exploitation of remote services.

Vulnerabilities

  • CVE-2026-108097 — CVSS 0 (Low)
  • CVE-2026-108099 — CVSS 0 (Low)

Techniques

  • T1203 Exploitation for Client Execution (Execution)
  • T1210 Exploitation of Remote Services (Lateral Movement)

Coverage

10. Siemens Software Center DLL Side-Loading Flaw Exploited in Romulus ClickFix Campaign (Hot)

Event first seen in a show

Siemens confirmed active exploitation of a high-severity flaw in its Software Center. Threat actors leverage the Romulus ClickFix campaign, tricking users into executing PowerShell or Win+R commands to deploy remote access trojans. Siemens released version 4[.]0[.]9[.]8 on October 17, 2026, to resolve the flaw originally reported by Huntress researcher Jose Oregon. The vendor confirmed no internal Siemens systems were breached during the campaign. Forescout identified ROMULUS as a reusable delivery backend hosting six IP addresses, including 96.62.218[.]59 and the domain wizardexpensive[.]com, which are active for payload hosting and command and control. Siemens validated active exploitation of CVE-2026-110936, a DLL side-loading flaw in Software Center versions below V4.0.9.8. The vulnerability allows attackers to side-load malicious DLLs using the legitimate application. It affects all versions prior to V4.0.9.8, including the previously latest release 3[.]5[.]8[.]7, which failed to validate helper files before loading them.

Siemens Software Center versions before V4.0.9.8 allow attackers to load malicious DLLs by exploiting its uncontrolled search path for dynamic libraries. The application loads DLLs from an uncontrolled search path, allowing an authenticated local attacker to place a malicious file in a directory the program checks first. The attack chain relies on the application’s uncontrolled search path, allowing an authenticated local attacker to place a specially crafted DLL in a directory the application searches, leading to arbitrary code execution with the privileges of the affected application. Siemens Software Center versions before V4.0.9.8 face arbitrary code execution with application privileges, rated CVSS 8.4 for high impact on confidentiality, integrity, and availability. Authenticated local users can bypass standard security boundaries to gain full control over the compromised system. Watch for network connections to 96.62.218[.]59, a domain linked to the Romulus backend for payload delivery and command and control.

Siemens Software Center versions prior to V4.0.9.8 remain exposed to CVE-2026-110936, allowing authenticated local attackers to execute arbitrary code with application privileges. Forescout attributed the active exploitation to the Romulus ClickFix platform, which reportedly delivers Legion Loader and other malware via DLL sideloading. Update all Siemens Software Center installations to version 4[.]0[.]9[.]8 or later, as existing versions will automatically update on the next startup. Harden the search path to known-safe directories and block external writes to prevent this DLL side-loading attack. Monitor for suspicious behavior rather than relying on file hashes, as Siemens advised detecting the Romulus campaign’s activity through behavioral indicators.

Siemens noted that version 3[.]5[.]8[.]7 did not validate helper files before loading them, even though the specific file AllMyBasic[.]msi has the SHA-256 hash f4d7c5321bb0d1bda439304a753bcf9b467b98ca53c7e9493b9c2c3451092e4a. The IP address 96.62.218[.]59 is active for payload hosting and command and control, but the full scope of compromised endpoints remains unconfirmed. Watch for Romulus ClickFix malware via DLL side-loading.

Vulnerabilities

  • CVE-2026-110936 — CVSS 8.4 (High) · CWE-427 · Siemens Siemens Software Center. A vulnerability has been identified in Siemens Software Center (All versions < V4.0.9.8).

Techniques

  • AML.T0011.001 Malicious Package (Execution)
  • EMERGING-0001 ClickFix
  • T1204.002 Malicious File (Execution)
  • T1684 Social Engineering (Stealth)

Named actors and malware

  • RAT (malware)

Indicators

  • 9 indicators on file

Coverage

11. SiteGuard WAF Exploited for Root Access; Patching May Erase Evidence (Hot)

Event now covered by 4 outlets (was 3); Blast radius expanded: new vendor(s): apache; new product(s): windows, siteguard, apache httpd

What changed

EG Secure Solutions issued an urgent alert for CVE-2026-106931, a critical OS command injection flaw in SiteGuard Server Edition versions 2.20 through 8.00 Update 5. Japan Vulnerability Notes published its advisory on October 14, confirming the flaw had been exploited in the wild. The vulnerability is tracked as CVE-2026-106931 and received a CVSS 4.0 score of 8.5 from the vendor and JVN. This bug allows execution of commands with root or SYSTEM privileges on affected servers. The vulnerability impacts versions 2.20 and later for Apache, Nginx, and IIS environments, excluding FreeBSD. While the vendor and Japan’s JPCERT/CC have confirmed active exploitation, they issued a critical warning: applying the patch immediately may erase forensic evidence of prior compromises. JPCERT/CC recommends disabling the statistics feature as an immediate mitigation if you cannot patch right now.

How it works

The flaw resides in the default-enabled statistics feature, where externally influenced input constructs OS commands without proper neutralization. Attackers inject special characters through multiple parser passes, bypassing validation layers to execute arbitrary root or SYSTEM commands. This enables arbitrary command execution on Apache, Nginx, or IIS hosts. This weakness lets adversaries execute arbitrary OS commands with SYSTEM privileges, enabling them to read files, modify data, or disable the product entirely. Successful exploitation grants attackers root or SYSTEM privileges, enabling them to read, modify, or disable data on the affected server. SiteGuard Server Edition versions 2.20 and later for Apache, Nginx, and IIS, excluding FreeBSD, remain exposed before the 8.00 Update 5 patch. Active exploitation of this vulnerability demands immediate upgrades to version 8.00 Update 5 or later to stop full system compromise and data theft.

What to do

Apply the vendor patch to close the OS command injection vulnerability. If the patch cannot be applied immediately, disable the statistics feature in SiteGuard Server Edition, as this feature is the vector for the exploit. Run automated static analysis tools to detect improper neutralization of special elements in command construction.

Limits and watch

The specific identities of the attackers and the full scope of victimized sites remain unknown, despite confirmation of active exploitation by the vendor and JPCERT/CC. Applying the patch immediately may erase forensic evidence of prior compromises, creating a tension between rapid remediation and incident investigation. Watch

Vulnerabilities

  • CVE-2026-106931 — CVSS 8.5 (High) · CWE-78 · EG Secure Solutions Inc. SiteGuard Server Edition for Apache httpd; EG Secure Solutions Inc. SiteGuard Server Edition for Nginx; EG Secure Solutions Inc. SiteGuard Server Edition for IIS. SiteGuard Server Edition contains an OS command injection vulnerability, which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product.

Techniques

  • AML.T0049 Exploit Public-Facing Application (Initial Access)
  • T1190 Exploit Public-Facing Application (Initial Access)
  • T1203 Exploitation for Client Execution (Execution)
  • T1210 Exploitation of Remote Services (Lateral Movement)

Indicators

  • 3 indicators on file

Coverage