The Hot Drop

Oct 21

The Hot Drop for 10-21-2026

Qilin and INC hijacked VMware via GlobalProtect to steal ESXi credentials. Meanwhile, Nintendo went dark for PHP2Shell leaks and Vercel’s KVM escape was patched. What’s the one vulnerability that stopped production globally?

Since the last show: 1 new · 9 developing · 2 returning · 1 dropped · 69% overlap with the previous show

Contents

  1. Qilin and INC Exploit GlobalProtect Flaw to Target VMware
  2. PHP releases emergency patches for critical PHP2Shell RCE flaws after pre-disclosure leak
  3. PwnEscape: Critical KVM Escape Flaw Fixed in Linux Kernel
  4. GRU Campaign Targets NATO Defense Sectors
  5. GlassWorm malware campaign compromises OVHcloud CLI and VS Code extensions to steal developer secrets
  6. ESET Releases Detection Script for Ebury Malware Following 333 Tor Exit Node Compromise
  7. FBI arrests third ShinyHunters suspect in global crackdown
  8. Flare Clarifies Scattered Spider, LAPSUS$, and ShinyHunters as Distinct Clusters in The Com Ecosystem
  9. Horizon3[.]ai Releases Public PoC for Critical Unauthenticated RCE in Fortinet FortiSIEM
  10. Exposed AI Panels Breach Major Brands While Critical Magento Flaw Remains Unpatched
  11. Stolen UpdraftCentral keys used to install 99 backdoor plugins on WordPress sites
  12. F5 Labs Observes Automated WP2Shell Exploitation of WordPress Flaws

1. Qilin and INC Exploit GlobalProtect Flaw to Target VMware (Lead)

Event first seen in a show

What changed

Unit 42’s October 19 update confirms that two threat groups, Spikey Scorpius and Tarnished Scorpius, are actively exploiting CVE-2026-0257 to establish unauthorized VPN sessions. Rapid7 researchers observed successful exploitation of this vulnerability across multiple customer environments dating back to at least May 17. Since early June, these groups have exploited CVE-2026-0257 to create unauthorized VPN sessions. Also, monitor for exploitation of CVE-2023-27532 against Veeam backups, which Unit 42 notes is being used in tandem. Veeam patched a critical flaw in Backup and Recovery 12.1.2 on September 4, allowing unauthenticated remote code execution via deserialization. Unit 42 confirmed on October 19 that Qilin and Tarnished Scorpius actively exploit CVE-2026-0257 to bypass MFA. Akira ransomware operators weaponized CVE-2023-27532 to breach a Latin American airline, per BlackBerry. CISA added CVE-2026-0300 to its Known Exploited Vulnerabilities catalog, flagging a critical buffer overflow in Palo Alto Networks PAN-OS. The authentication bypass vulnerability, tracked as CVE-2026-0257, allows an attacker to establish unauthorized VPN connections to the remote-access product. ReliaQuest warned that because the threat activity originated from internal VPNs, it might appear to be a legitimate remote-access session and go undetected.

How it works

An unauthenticated attacker exploits a buffer overflow in Palo Alto Networks PAN-OS to execute root code via specially crafted packets. The flaw in PAN-OS GlobalProtect relies on unvalidated cookies, letting attackers forge sessions without credentials. The flaw in Veeam Backup & Replication allows unauthenticated access to encrypted credentials in the configuration database. The vulnerability, rated 9.8, lets attackers inject malicious payloads because the software unserializes data before validating it. An unauthenticated attacker can send crafted packets to the User-ID Authentication Portal, writing out-of-bounds memory to execute arbitrary code with root privileges. CWE-787 out-of-bounds writes corrupt memory, enabling code execution without requiring network access or prior compromise. After gaining access, operators perform internal reconnaissance using dual-use remote monitoring and management tools, move laterally through RDP and SMB, and deploy utilities for credential harvesting, data exfiltration, and ransomware deployment. CISA extended the patch deadline to November 7 for federal agencies, rating this critical flaw with a 9.8 CVSS score. This weakness causes memory corruption allowing code execution, affecting only PA-Series and VM-Series firewalls running versions 10.2.0 through 12.1.0. This critical vulnerability affects PAN-OS versions 10.2 through 12.1, granting unauthorized VPN access with a CVSS score of 9.1. Sophos reported that an attack in the same timeframe attempted to deploy Akira ransomware.

What to do

CISA listed this vulnerability in its Known Exploited Vulnerabilities catalog, requiring federal agencies to patch by November 7. The flaw impacts PA-Series and VM-Series firewalls running PAN-OS versions 10.2.0 through 12.1.0, while Prisma Access and Cloud NGFW remain unaffected. Attackers use this vector to gain direct access to backup infrastructure hosts, creating a critical pivot point for persistence. Threat groups combine this initial compromise with exploitation of CVE-2023-27532 to target Veeam backup infrastructure, extending the threat from remote access to critical data recovery systems. Apply the September 4 Veeam fix immediately to stop attackers from exploiting the object injection weakness. Restrict User-ID portal access to trusted internal IPs and use automated static analysis to detect the out-of-bounds write. ReliaQuest advises upgrading affected GlobalProtect deployments immediately, disabling authentication override cookies, and terminating all active sessions to cut off the unauthorized access vector. Hunt for lateral movement via RDP and SMB, as well as credential harvesting utilities, which follow the initial VPN compromise in the observed attack chain.

Limits and watch

The specific timeline of the threat actor’s discovery by Group-IB in early April 2024 remains an attributed fact, meaning the full historical scope of the campaign is not independently verified. Watch for abnormal LSASS memory access and replayed authentication attempts, which are key indicators of exploitation for credential access following the initial VPN breach. Also watch for unexpected crashes in authentication services or PAM modules, as these signals correlate with memory corruption and exploitation attempts targeting credential validation processes.

Vulnerabilities

  • CVE-2024-40711 — CVSS 9.8 (Critical) · CISA KEV · CWE-502 · Veeam Backup and Recovery. A deserialization of untrusted data vulnerability with a malicious payload can allow an unauthenticated remote code execution (RCE).
  • CVE-2026-0300 — CVSS 9.8 (Critical) · CISA KEV · CWE-787 · Palo Alto Networks Cloud NGFW; Palo Alto Networks PAN-OS; Palo Alto Networks Prisma Access. A buffer overflow vulnerability in the User-ID™ Authentication Portal (aka Captive Portal) service of Palo Alto Networks PAN-OS software allows an unauthenticated attacker to execute arbitrary code with root privileges…
  • CVE-2026-0257 — CVSS 9.1 (Critical) · CISA KEV · CWE-565 · Palo Alto Networks Cloud NGFW; Palo Alto Networks PAN-OS; Palo Alto Networks Prisma Access. Authentication bypass vulnerabilities in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS® software allows the attacker to bypass security restrictions and establish an unauthorized VPN connection.
  • CVE-2023-27532 — CVSS 7.5 (High) · CISA KEV · CWE-306 · n/a Veeam Backup & Replication. Vulnerability in Veeam Backup & Replication component allows encrypted credentials stored in the configuration database to be obtained.

Techniques

  • T1003.001 LSASS Memory (Credential Access)
  • T1003.002 Security Account Manager (Credential Access)
  • T1005 Data from Local System (Collection)
  • T1008 Fallback Channels (Command And Control)
  • T1018 Remote System Discovery (Discovery)
  • T1021.001 Remote Desktop Protocol (Lateral Movement)
  • T1021.004 SSH (Lateral Movement)
  • T1021.005 VNC (Lateral Movement)
  • T1027.001 Binary Padding (Stealth)
  • T1027.010 Command Obfuscation (Stealth)
  • and 10 more

Named actors and malware

  • Qilin (malware)
  • Cobalt Strike (malware)
  • Qilin ransomware (malware)
  • Inc (malware)
  • Akira (actor)
  • Cuba (malware)
  • FIN7 (actor)
  • Akira ransomware (actor)
  • Exbyte (malware)
  • StealBit (malware)

Indicators

  • 3 indicators on file

Coverage

2. PHP releases emergency patches for critical PHP2Shell RCE flaws after pre-disclosure leak (Segment)

CVE-2026-109619 CVSS increased from null to 9.2; Event now covered by 11 outlets (was 9); Blast radius expanded: new vendor(s): openai, github, google, virustotal, microsoft, intel; new product(s): apache, mod_php

What changed

PHP released emergency patches for two critical remote code execution flaws dubbed PHP2Shell, with the official security update targeted for today at 14:00 UTC. Cloudflare is reportedly seeing early attempts to exploit these vulnerabilities, whose details surfaced before the planned release. PHP maintainers issued an urgent notice for CVE-2026-109618, a critical flaw affecting versions 8.2 through 8.5. The Hacker News post reportedly identified the specific vulnerabilities as CVE-2026-109618 and CVE-2026-109619. PHP CGI versions before 5.3.12 and 5.4.2 fail to skip specific command-line options when query strings lack equals signs. PHP versions 8.1 through 8.3 on Windows are vulnerable to remote code execution via Apache and PHP-CGI. CVE-2024-4577 affects PHP 8.1 through 8.3 on Windows with Apache, where Windows Best-Fit character replacement lets attackers inject malicious options into the PHP binary. Possibly, There is no fix for PHP 8.1 or earlier, which are end-of-life. The lead sheet tracks the new indicators and the expanded blast radius affecting major vendors like GitHub and Microsoft.

How it works

Unit 42 confirmed today that PHP 8.2 through 8.5 allows remote code execution because longjmp() leaves global state pointing to freed memory. The bug occurs when longjmp handles out-of-memory errors, leaving request memory uninitialized before cleanup reads it. Today, Apache and PHP-CGI on Windows misinterpret command line characters due to Best-Fit behavior, allowing attackers to pass malicious options to the PHP binary. The Apache CGI module misinterprets Windows Best-Fit character replacements as PHP options, allowing attackers to execute arbitrary code or reveal source. This improper neutralization allows remote attackers to inject arbitrary code by placing command-line options directly in the query string. The weakness stems from improper neutralization of special elements in OS commands, allowing attackers to execute arbitrary PHP code. This OS command injection flaw relies on multiple input interpretation layers, where control characters bypass initial validation before being parsed as executable commands. A working exploit has demonstrated that a single unauthenticated request can trigger the attack before any application code runs. The PHP2Shell vulnerabilities allow unauthenticated attackers to execute code or expose sensitive process memory. Palo Alto Networks found over 22.6 million exposed instances today, enabling unauthenticated execution with web worker privileges without logging in. This unauthenticated remote code execution vulnerability carries a CVSS score of 9.2. Apache and PHP-CGI on Windows running versions 8.1 before 8.1.29, 8.2 before 8.2.20, or 8.3 before 8.3.8 face a 9.8 severity OS command injection risk. This critical flaw, rated 9.8, enables unauthorized code execution and is listed in the CISA Known Exploited Vulnerabilities catalog. With a CVSS score of 9.8 and CISA KEV listing, the vulnerability allows remote attackers to execute arbitrary code, exposing source files and compromising server integrity. The repository reportedly states that the vulnerabilities affect PHP versions 5.4.0 through 8.5.11. The vulnerabilities allow remote code execution on default configurations.

What to do

Cloudflare reports early exploitation attempts against two critical PHP vulnerabilities affecting versions 5.4.0 through 8.5.11. The core weakness is a use-after-free in PHP’s native multipart parser, specifically the session.upload_progress callback, which executes before application code. This allows an unauthenticated attacker to trigger memory corruption via a single crafted request, bypassing standard application-layer defenses. Because the flaw resides in the engine itself, it affects all PHP 5.4+ installations, including those running WordPress or Magento. Listed in the CISA Known Exploited Vulnerabilities catalog, this flaw carries a CVSS score of 7.5 for partial compromise. Attacker behavior currently involves using AI-vibrated proof-of-concept tools to scan for vulnerable endpoints. Observe for sudden spikes in failed or malformed upload requests targeting web servers, which signal automated scanning. The remaining uncertainty lies in the scope of successful compromises, as no confirmed indicators of compromise exist yet. Isolate unpatched PHP 8.1 systems from public networks immediately, since updating is the only safe remediation. Monitor for post-compromise persistence mechanisms, as a patched runtime does not remove existing access or credential exposure from prior successful attacks. Prioritize telemetry for anomalous multipart/form-data requests that result in process crashes or unexpected memory access patterns, as these indicate active exploitation attempts against the unpatched population. The primary investigation focus is identifying internet-facing hosts running PHP 8.1 or earlier, as these end-of-life versions have no official patch. Patch PHP versions immediately to stop unauthorized command execution, since static analysis tools detect the improper neutralization. Switch to library calls instead of external processes to mitigate the issue, following the architecture and design recommendation. Until an official patch arrives, block multipart/form-data requests in web servers or deploy Cloudflare’s WAF rules as a temporary fix. Prioritize patching PHP versions 8.2 and later, as only these versions will receive fixes for the vulnerabilities.

Limits and watch

Huntress has not built or reproduced a proof of concept for the vulnerabilities and is not aware of public exploit code as of the writing. The official PHP security release is targeted for today at 14:00 UTC, but early PoC exploits are available ahead of the patch becoming available. Monitor for mass exploitation beginning within 15 minutes of the scheduled fix release at 14:00 UTC, as Cloudflare reported early attacks on October 21 at 07:43 UTC. Watch for control characters being detected by filters repeatedly, which is an attack-pattern indicator for Exploiting Multiple Input Interpretation Layers.

Vulnerabilities

  • CVE-2024-4577 — CVSS 9.8 (Critical) · CISA KEV · CWE-78 · PHP Group PHP. In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, when using Apache and PHP-CGI on Windows, if the system is set up to use certain code pages, Windows may use “Best-Fit” behavior to replace…
  • CVE-2026-109618 — CVSS 9.2 (Critical) · CWE-416, CWE-755, CWE-824, CWE-1325, CWE-1419 · PHP Group PHP. PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request.
  • CVE-2026-109619 — CVSS 9.2 (Critical) · CWE-416, CWE-755, CWE-824, CWE-1325, CWE-1419 · PHP Group PHP. PHP has various global state that temporarily points into request memory.
  • CVE-2012-1823 — CVSS 7.5 (High) · CISA KEV · CWE-77 · n/a n/a. sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not properly handle query strings that lack an = (equals sign) character, which allows remote…

Techniques

  • AML.T0072 Reverse Shell (Command And Control)
  • T1053.005 Scheduled Task (Execution)
  • T1102 Web Service (Command And Control)
  • T1189 Drive-by Compromise (Initial Access)
  • T1190 Exploit Public-Facing Application (Initial Access)
  • T1203 Exploitation for Client Execution (Execution)
  • T1210 Exploitation of Remote Services (Lateral Movement)
  • T1218.002 Control Panel (Stealth)
  • T1583.006 Web Services (Resource Development)
  • T1584.006 Web Services (Resource Development)
  • and 2 more

Indicators

  • 25 indicators on file

Coverage

3. PwnEscape: Critical KVM Escape Flaw Fixed in Linux Kernel (Segment)

Blast radius expanded: new product(s): lambda, fargate, ec2

Vercel published a $1 million Sandbox research challenge on August 18, 2026, inviting researchers to break the isolation boundary of its product. The host-kernel root cause was reported privately to the kernel security contact and networking maintainers on September 4, 2026. The accepted patch, commit 6785011f8b16, adds an ip_check_csum_start() helper to reject invalid csum_start values. The commit message explicitly calls the fix a defense-in-depth measure.

Researchers at pwn[.]ai found that a packet with corrupted checksum metadata entering the Linux ipv4 stack lets skb_checksum_help corrupt the network header. The flaw involves deferred checksum metadata in the Linux sk_buff structure, where a guest controls values through virtio. The flaw, dubbed PwnEscape and assigned CVE-2026-99999, affects Linux kernels from version 2.6.27 through 7.3, including releases like 5.10.272 and 6.6.159. Customers who self-manage virtual machines using virtio-net and KVM on hosts running affected, unpatched Linux kernel versions are affected.

A local attacker can escalate privileges without prior system access, driven by a CVSS score of 9.3 and a Local Access, No Privileges exploitability rating. Administrators must deploy kernel updates on host systems, as updating only guest VMs does not fix the vulnerability, specifically for those self-managing virtual machines using virtio-net and KVM on Amazon Linux. Apply the updated kernel packages to host systems and reboot, as the patch was merged into the mainline Linus’s tree on October 14, 2026, and applied to net[.]git on October 8, 2026.

The impact may include arbitrary code execution on the host, a system crash resulting in Denial of Service, or information disclosure of sensitive memory, but the specific exploitation path remains a potential rather than a confirmed outcome. An attacker controlling a guest workload could potentially collect information from a security domain that the virtual machine should not be able to inspect, though this capability is not yet established as a standard exploit vector. Watch for anomalous volume mount configurations like hostPath to root or proc, or unexpected privileged container launches, which signal potential container escape attempts via bind mounts or privileged containers. Correlate unusual system calls from containerized processes, such as unshare, keyctl, or mount, with subsequent host process creation to detect Linux container escape attempts.

Vulnerabilities

  • CVE-2026-99999 — CVSS 9.3 (Critical) · Linux Linux; Linux Linux. In the Linux kernel, the following vulnerability has been resolved: ipv4: validate checksum_start before completing checksum If a packet with bad checksum metadata gets into the ipv4 stack, skb_checksum_help can corrupt…

Techniques

  • AML.T0105 Escape to Host (Privilege Escalation)
  • T1543.005 Container Service (Persistence)
  • T1611 Escape to Host (Privilege Escalation)

Indicators

  • 1 indicator on file

Coverage

4. GRU Campaign Targets NATO Defense Sectors (Segment)

Event now covered by 4 outlets (was 3); Blast radius expanded: new vendor(s): virustotal, adobe; new product(s): hookedge vbs launcher, outlook, webhook endpoint, microsoft edge browser, javascript; 12 new indicator(s) observed

What changed

Recorded Future confirmed that an employee opened a malicious Word document on July 24, initiating an intrusion attributed to the BlueDelta group. The campaign lasted at least two months, with activity detected as late as September 24th. Operators deployed a reflective loader called ld[.]exe and established persistent SSH tunnels to steal credentials. They placed an SSH private key on the host to connect to their server, confirming persistent access. The blast radius is expanding to include Adobe and VirusTotal products, so review your perimeter for these new vectors.

How it works

The Hookedge backdoor operates as a polling mechanism that opens Microsoft Edge to retrieve instructions from a staging endpoint. The attack is attributed to GruesomeLarch based on the use of a post-compromise tool called GooseEgg, indicating a specific operational signature.

What to do

The shipbuilder’s two-month exposure to credential theft indicates that standard perimeter defenses failed to stop persistent lateral movement via SSH tunnels. Because Hookedge is an evolution of the HEADLACE backdoor, existing detection rules for HEADLACE may not cover the new reflective loader behavior. Investigate unmonitored scheduled tasks and hidden local accounts that mask the reflective loader’s execution, specifically looking for activity against cloud services where federated identities allow adversaries to log in using valid accounts without triggering standard alerts. Hunt for the specific reflective loader ld[.]exe and associated SSH tunneling activity on hosts that received macro-enabled documents from Outlook. Review cloud service logs for valid account logins from atypical geolocations or user-agent strings that are followed by directory enumeration or infrastructure manipulation.

Limits and watch

The attribution of the shipbuilder intrusion to the Russian GRU’s 85th Main Special Service Center is based on a joint advisory, but the specific target remains unnamed as Organization A. While the malware uses a hidden Microsoft Edge browser for command-and-control, the exact staging endpoint used for the shipbuilder’s compromise is not specified in the available evidence. Watch for hidden scheduled tasks created through WMI or PowerShell that lack standard security descriptors, a sign of T1053.005 persistence. Track federated SSO logins to the cloud control plane immediately followed by permission enumeration, which signals T1021.007 lateral movement.

Techniques

  • T1001.001 Junk Data (Command And Control)
  • T1003 OS Credential Dumping (Credential Access)
  • T1003.001 LSASS Memory (Credential Access)
  • T1003.003 NTDS (Credential Access)
  • T1005 Data from Local System (Collection)
  • T1014 Rootkit (Stealth)
  • T1021.002 SMB/Windows Admin Shares (Lateral Movement)
  • T1021.007 Cloud Services (Lateral Movement)
  • T1025 Data from Removable Media (Collection)
  • T1027.013 Encrypted/Encoded File (Stealth)
  • and 10 more

Named actors and malware

  • APT28 (actor)
  • Swallowtail (actor)
  • Fancy Bear (actor)
  • GruesomeLarch (actor)

Indicators

  • 25 indicators on file

Coverage

5. GlassWorm malware campaign compromises OVHcloud CLI and VS Code extensions to steal developer secrets (Segment)

Event now covered by 5 outlets (was 4); Blast radius expanded: new vendor(s): crowdstrike; new product(s): windows, linux, npm, javascript, docker; 2 new indicator(s) observed

What changed

A compromised GitHub account pushed a secret-stealing binary into the OVHcloud CLI, exposing developers on macOS, Linux, and Windows. Users who installed via Homebrew or go install were safe because those methods pinned original hashes or built from clean source tags. The Glassworm campaign has entered its third wave, adding 24 new packages to OpenVSX and Microsoft Visual Studio marketplaces. The malware hides code using invisible Unicode characters to steal GitHub, npm, and crypto wallet credentials. It deploys a SOCKS proxy and an HVNC remote access client. The Glassworm botnet relies on the Solana blockchain for command-and-control. The security team confirmed unauthorized publishing access, revoked the associated tokens, and removed the malicious releases.

How it works

On macOS systems, GlassWorm establishes persistence via a LaunchAgent, enabling execution at login. The malware spreads itself using stolen account information to infect more extensions the victim can access.

What to do

The campaign has poisoned over 300 GitHub repositories using stolen developer credentials, creating a persistent supply chain risk that extends beyond the initial marketplace packages. Audit macOS endpoints for LaunchAgent persistence mechanisms that execute at login, specifically targeting the GlassWorm information stealer that harvests GitHub, npm, and crypto wallet credentials.

Limits and watch

The full scope of credential compromise is unclear, as the stolen developer credentials used to poison repositories were themselves harvested from earlier Glassworm infections, creating a recursive exposure chain. Open VSX reportedly plans to roll out automated pre-publishing safeguards in early Q1, but the current third wave of 24 new packages indicates that existing marketplace controls have not yet stopped the malicious updates. Watch for scripts packed with invisible Unicode characters that force runtime decoding, a signature of the GlassWorm payload slipping past static analysis. Track code repository access for unauthorized credential use, since the attacker uses stolen GitHub and npm tokens to push malicious updates to previously accepted packages.

Techniques

  • AML.T0011.001 Malicious Package (Execution)
  • AML.T0095.000 Code Repositories (Reconnaissance)
  • EMERGING-0028 ASCII smuggling
  • T1005 Data from Local System (Collection)
  • T1027.013 Encrypted/Encoded File (Stealth)
  • T1027.018 Invisible Unicode (Stealth)
  • T1059.009 Cloud API (Execution)
  • T1102 Web Service (Command And Control)
  • T1195 Supply Chain Compromise (Initial Access)
  • T1204.002 Malicious File (Execution)
  • and 7 more

Named actors and malware

  • GlassWorm (malware)
  • Shai-Hulud (malware)
  • Glassworm botnet (malware)

Indicators

  • 10 indicators on file

Coverage

6. ESET Releases Detection Script for Ebury Malware Following 333 Tor Exit Node Compromise (Segment)

Event now covered by 3 outlets (was 2); Mentioned in reporting, no attribution: malware Ebury gang; Mentioned in reporting, no attribution: actor threat group

What changed

ESET researchers reported that attackers hijacked 333 Tor exit relays in early October to intercept SSH connections and steal credentials. By modifying relay configurations, they redirected credentials to twelve malicious servers before the Tor Project flagged the nodes as BadExit on October 4. The new detection tool scans for specific abstract UNIX sockets unique to the malware, such as event-0YsOG9WSOE for version 1.8.3, to identify active instances and process IDs. Attackers hijacked three hundred and thirty-three Tor exit relays, roughly ten percent of the network, in a recent coordinated campaign. ESET researchers confirmed the payload is Ebury 1.8.3, an OpenSSH backdoor and credential stealer for Linux. The malware uses the UNIX socket event-0YsOG9WSOE for version 1.8.3, /run/systemd/journal/dlog for version 1.6.3, and /proc/udevd for version 1.5.x. Watch for any new Tor exit nodes flagged as BadExit, as that is the primary signal of active interception attempts. Detection engineering teams should integrate the ESET script into their Linux monitoring stack, specifically looking for the abstract sockets mentioned in the report.

How it works

Attackers rewrote torrc files on relays to enable port 22, intercepting SSH traffic and redirecting credentials to twelve malicious servers. They used Paramiko to execute commands and install Ebury malware on Linux systems before the Tor network health team notified operators. The compromised infrastructure accounted for approximately 10% of Tor’s roughly 3,000 exit relays, exposing users who authenticated to the interception servers. ESET researchers reported that the Ebury gang operates a botnet of over 400,000 compromised Linux servers, targeting more than 200 Bitcoin and Ethereum nodes for crypto theft.

What to do

The compromise of 333 Tor exit nodes, representing roughly ten percent of the network, created a direct exposure window where SSH credentials were intercepted and redirected to twelve malicious servers. Audit your Linux servers for the presence of the Ebury backdoor by checking for the specific socket addresses documented in the ESET malware-research repository.

Limits and watch

The script’s attempt to defuse a userland rootkit is only triggered if the Ebury PID is not found, leaving a gap in mitigation if the process is already active or hidden.

Techniques

  • EMERGING-0027 ARP spoofing

Named actors and malware

  • Ebury gang (malware)
  • threat group (actor)
  • Ebury malware (malware)
  • Ebury (malware)
  • kaba (malware)

Indicators

  • 7 indicators on file

Coverage

7. FBI arrests third ShinyHunters suspect in global crackdown (Segment)

No material change since last show

What changed

The FBI arrested Edward Dubrovsky, a Canadian cybersecurity executive, in Pennsylvania. This detention marks the third major arrest in the global crackdown on the ShinyHunters extortion group. H&M is reportedly investigating claims that it was targeted by the ShinyHunters cybercrime group.

How it works

ShinyHunters exploited a third-party integration to access Rockstar Games’ internal Snowflake data warehouse. Possibly, TFG London is still trying to establish whether any personal or sensitive information has been compromised.

What to do

Edward Dubrovsky’s arrest in Pennsylvania confirms ShinyHunters uses human negotiators to pressure victims after exploiting Oracle PeopleSoft zero-days and third-party integrations. This shift changes exposure from simple data theft to coordinated extortion, where attackers threaten confidentiality and interfere with commerce by leveraging human trust to bypass technical controls. Investigate whether current or former employees have connections to negotiation firms, and check systems where Accenture contractors or similar vendors recently worked on Oracle PeopleSoft or AWS GovCloud environments. While AI automates reconnaissance and credential theft, it remains uncertain if agents independently bypass account policies or audit logs without human intervention. Look for anomalies in automated tool modifications or unauthorized account usage, rather than assuming full automation, as the next move may rely on new AI capabilities or traditional social engineering. Verify that all third-party contractors, including those from Accenture, have patched the specific vulnerability exploited by Shiny Hunters to prevent recurrence of the access failure that led to the contractor’s removal. Audit your security product logs to confirm they successfully detect the specific malware variants deployed by GTG-20006, as their agents actively modify tools when detection is triggered.

Limits and watch

It remains unclear whether ShinyHunters were involved in the initial compromise of the European Commission’s cloud infrastructure or solely in the subsequent data extortion. Watch for further detentions of ShinyHunters members, starting with the suspected member alias Rey who was detained in Jordan and is now cooperating with the FBI to identify other group members. Track new disclosures about the exploitation of the second vulnerability found by Anthropic’s Mythos model, which is already being exploited in the wild. Keep an eye on these two specific signals as they develop.

Techniques

  • AML.T0006 Active Scanning (Reconnaissance)
  • AML.T0108 AI Agent (Command And Control)
  • T1003.003 NTDS (Credential Access)
  • T1003.006 DCSync (Credential Access)
  • T1005 Data from Local System (Collection)
  • T1006 Direct Volume Access (Stealth)
  • T1016 System Network Configuration Discovery (Discovery)
  • T1018 Remote System Discovery (Discovery)
  • T1021.001 Remote Desktop Protocol (Lateral Movement)
  • T1021.004 SSH (Lateral Movement)
  • and 10 more

Named actors and malware

  • ShinyHunters (actor)
  • Cl0p (malware)
  • Scattered Spider (actor)
  • Clop (malware)
  • Lapsus$ (actor)
  • TeamPCP (actor)
  • ShinyHunters group (actor)

Indicators

  • 25 indicators on file

Coverage

8. Flare Clarifies Scattered Spider, LAPSUS$, and ShinyHunters as Distinct Clusters in The Com Ecosystem (Segment)

Event first seen in a show

What changed

Flare’s latest analysis breaks the myth that Scattered Spider, LAPSUS$, and ShinyHunters are a single unified gang, identifying them instead as distinct clusters within the decentralized ‘The Com’ subculture. The report positions Scattered Spider as the active threat, documenting how the group turns routine account recovery processes into vectors for serious security breaches. Scattered Spider is tracked under multiple designations, including UNC3944, Octo Tempest, and Muddled Libra, while Microsoft separately tracked LAPSUS$ as DEV-0537. Microsoft’s Octo Tempest analysis documents DragonForce ransomware deployment against VMware environments, distinct from the data exfiltration and extortion model attributed to LAPSUS$.

How it works

Fluent English-speaking callers pose as CFOs or IT staff to persuade help-desk agents to reset multi-factor authentication tokens, a tactic that bypasses MFA by exploiting social engineering. SOSIntelligence analysts attribute the group’s operation primarily to acting as an Initial Access Broker, using the reset tokens to provide Evilginx with the final session cookie needed for lateral movement. Scattered Spider allegedly caused widespread IT disruption during the 2023 MGM Resorts attack. A joint CISA advisory documents the use of legitimate remote management software and data exfiltration, noting that access may lead to data theft, extortion, or ransomware deployment.

What to do

Scattered Spider actively leverages social engineering to bypass multi-factor authentication, while LAPSUS$ operates under a separate data exfiltration and extortion model. Implement phishing-resistant MFA using FIDO/WebAuthn or public-key-based methods to neutralize the social engineering tactics that Scattered Spider uses to bypass standard authentication. Audit user behaviors and system logs to detect anomalies in MFA configurations, ensuring that adversaries cannot disable or modify MFA mechanisms to maintain persistent access.

Limits and watch

Attributing the 2023 MGM Resorts attack to Scattered Spider is alleged, and their pivot into a full-scale, financially motivated threat group by mid-2025 remains a developing assessment. Microsoft documents DragonForce ransomware deployment by Octo Tempest, but the specific operational overlap between these distinct clusters and their shared infrastructure is not fully established. Watch for registry or Group Policy modifications that disable or weaken MFA, as well as anomalous login sessions that succeed without the expected MFA challenge. Monitor for suspicious inbound communications followed by rapid sensitive user actions, such as file sharing changes or OAuth consent, that deviate from historical relationships or normal approval patterns.

Techniques

  • AML.T0073 Impersonation (Defense Evasion)
  • T1003.003 NTDS (Credential Access)
  • T1003.006 DCSync (Credential Access)
  • T1005 Data from Local System (Collection)
  • T1006 Direct Volume Access (Stealth)
  • T1016 System Network Configuration Discovery (Discovery)
  • T1018 Remote System Discovery (Discovery)
  • T1021.001 Remote Desktop Protocol (Lateral Movement)
  • T1021.004 SSH (Lateral Movement)
  • T1021.007 Cloud Services (Lateral Movement)
  • and 10 more

Named actors and malware

  • Scattered Spider (actor)
  • LAPSUS$ (actor)
  • ShinyHunters (actor)

Indicators

  • 3 indicators on file

Coverage

9. Horizon3[.]ai Releases Public PoC for Critical Unauthenticated RCE in Fortinet FortiSIEM (Segment)

Event first seen in a show

Horizon3[.]ai released a public proof-of-concept exploit for CVE-2026-106173, a critical unauthenticated remote code execution vulnerability in Fortinet FortiSIEM. Fortinet issued advisory FG-IR-26-180 on October 13, 2026, recommending upgrades to version 7.5.1 or later to address the flaw. If you are on 7.5.0 or earlier, patch now. The phQueryMaster service is bound to TCP port 27918 and stands up the gRPC server that processes the exploit. The FortiSIEM gRPC QueryResultReq handler processes untrusted metadata without proper path validation, confirming the attack vector. Watch for unexpected modifications to the redishb[.]sh file or anomalous outbound traffic from the gRPC service.

An unauthenticated attacker abuses a gRPC service to write arbitrary files, bypassing directory restrictions through path traversal. This abuse enables unauthorized code execution via crafted packets. The attack turns these file writes into remote code execution by overwriting the Redis service health check script. Execution is blind, taking up to sixty seconds for the cron job to trigger the overwritten script. Fortinet confirmed FortiSIEM 7.6 is unaffected, limiting the flaw to versions 7.0.0 through 7.5.0. This network-accessible path traversal issue carries a CVSS score of 9.4, requiring no user interaction or prior authentication. Attackers can craft dot-dot-slash requests to bypass gRPC input validation, overwriting critical binaries and executable scripts without credentials. The vulnerability poses a severe risk to system integrity by allowing remote attackers to overwrite critical system files. The issue affects the gRPC communication service, enabling unauthorized code execution. Attackers need only network access to exploit this weakness. Fortinet stated that FortiSIEM 7.6 is not affected. This flaw enables full compromise of the SIEM infrastructure. This path traversal issue affects FortiSIEM versions 7.0.0 through 7.5.0.

Fortinet confirmed that version 7.6 is not affected, narrowing the exposure to systems running 7.5.0 or earlier. Upgrade FortiSIEM instances to version 7.5.1 or later to close the path traversal vulnerability in the gRPC service. Operators must immediately validate all gRPC path inputs against a strict allowlist to neutralize the high-severity remote code execution risk. Reject any request containing dot-dot-slash sequences or suspicious URL encoding. Run automated static analysis on the FortiSIEM codebase to identify other path traversal weaknesses, tuning results to filter out administrator-only valid behaviors. Reject non-conforming paths immediately, as static analysis alone may miss administrator-only exploitable issues.

The exploit execution is blind, so the attacker gets no immediate feedback, and a cron job delay of up to 60 seconds complicates real-time detection. Monitor for suspicious URLs in traffic filtering logs where invalid or denylisted characters remain after the first decoding process, indicating a potential bypass attempt. Watch for the gRPC service on port 27918 spawning shell processes or loading non-standard binaries following abnormal request patterns to the public endpoint.

Vulnerabilities

  • CVE-2026-106173 — CVSS 9.4 (Critical) · CWE-22 · Fortinet FortiSIEM. A improper limitation of a pathname to a restricted directory (‘path traversal’) vulnerability in Fortinet FortiSIEM 7.5.0 may allow attacker to execute unauthorized code or commands via specially crafted packets.

Techniques

  • T1053.005 Scheduled Task (Execution)
  • T1190 Exploit Public-Facing Application (Initial Access)
  • T1203 Exploitation for Client Execution (Execution)
  • T1210 Exploitation of Remote Services (Lateral Movement)

Indicators

  • 7 indicators on file

Coverage

10. Exposed AI Panels Breach Major Brands While Critical Magento Flaw Remains Unpatched (Segment)

Blast radius expanded: new product(s): trufflehog

What changed

Snorre Fagerland at NorForge identified unprotected interfaces that allowed automated agents to compromise more than one hundred organizations, including Deere, SharkNinja, and Cummins. Meanwhile, Sansec and BleepingComputer are warning about BlockStrap, a critical remote code execution flaw in Magento and Adobe Commerce. Adobe published security advisory APSB26-153 on October 13 to address the BlockStrap vulnerability, which Sansec reproduced through four distinct attack routes within 24 hours of the patch release. Sansec reports that a plain Composer install is insufficient to mitigate the risk, requiring administrators to apply the 2026-oct release or Adobe’s isolated patch. Adobe Commerce and Magento Open Source face a maximum-severity flaw allowing arbitrary PHP code execution without user interaction. Adobe’s October 13 bulletin confirms the flaw as an improper neutralization of special elements in the template engine that leads to arbitrary code execution. Adobe Commerce and Magento Open Source also face a stored XSS flaw, rated 9.3, affecting versions through 2.4.10-alpha1.

How it works

A worker directory now holds a proof-of-concept for StyleSmuggler, CVE-2026-75650, a critical Magento flaw. The BlockStrap flaw lets unauthenticated attackers run arbitrary PHP code by injecting malicious directives into the email template engine. Attackers inject scripts into form fields that execute in victims’ browsers to steal session control. Sansec notes that while no live exploitation has occurred, the low complexity allows AI agents to rapidly develop exploits. The vulnerability affects September versions of Adobe Commerce and Magento Open Source through 2.4.9, Adobe Commerce B2B through 1.5.3, and Mage-OS versions up to 3.5.0. With a CVSS score of ten, this Improper Neutralization weakness compromises the entire server, granting full control over victim accounts and sessions. Mage-OS version 3.6.0 contains the fix for this critical exposure.

What to do

This severity-10 weakness lets an attacker execute unauthorized PHP commands directly, bypassing standard authentication controls to seize full account or session control. This specific flaw allows unauthenticated remote access, distinguishing it from the other two CVEs in this event. Because the attack requires no user interaction and changes scope, it threatens full control over victim accounts and sessions across affected versions. With a CVSS score of ten and no privilege requirements, this distinct threat vector exposes store servers to full compromise, differing from the other two CVEs in this event set. Mage-OS versions up to 3.5.0 remain exposed to this template engine flaw, creating a critical window for exploitation before administrators apply the specific 3.6.0 fix or Adobe’s isolated patch. Apply the architecture and design mitigation by enabling the template engine’s sandbox mode immediately. Recompile affected codebases using the template engine’s sandbox mode to restrict function calls and prevent unauthorized code execution. Ensure the September VULN-39341 hotfix remains in place alongside the BlockStrap fix, since Sansec cautions that these are separate vulnerabilities requiring distinct remediation steps.

Limits and watch

Attacks leveraging BlockStrap have not yet been observed, but threat actors are expected to find a way to exploit it, leaving the specific data exfiltration impact unknown. The average success rate for observed AI-driven intrusion campaigns is hovering around ten percent, which may not reflect the urgency of this specific manual exploitation vector. Run automated static analysis on template engine code to identify data flow patterns that connect input sources to sinks, a method that can detect improper neutralization weaknesses without execution.

Vulnerabilities

  • CVE-2026-103849 — CVSS 10 (Critical) · CWE-1336 · Adobe Adobe Commerce; Adobe Adobe Commerce B2B; Adobe Magento Open Source. Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining…
  • CVE-2026-75650 — CVSS 10 (Critical) · CISA KEV · CWE-1336 · Adobe Adobe Commerce; Adobe Adobe Commerce B2B; Adobe Magento Open Source. Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in arbitrary code execution in the context of the current user.
  • CVE-2026-91013 — CVSS 9.3 (Critical) · CWE-79 · Adobe Adobe Commerce; Adobe Adobe Commerce B2B; Adobe Magento Open Source. Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields.

Techniques

  • AML.T0112 Machine Compromise (Impact)
  • T1203 Exploitation for Client Execution (Execution)
  • T1218.002 Control Panel (Stealth)
  • T1505.003 Web Shell (Persistence)
  • T1593.002 Search Engines (Reconnaissance)
  • T1657 Financial Theft (Impact)

Indicators

  • 3 indicators on file

Coverage

11. Stolen UpdraftCentral keys used to install 99 backdoor plugins on WordPress sites (Hot)

Event first seen in a show

Attackers exploited compromised UpdraftCentral connection keys to issue trusted remote-management commands that installed malicious plugins on WordPress sites. This incident relied on valid but exposed keys to bypass signature checks, allowing attackers to execute malicious PHP code or create elevated privilege accounts without exploiting the previously disclosed CVE-2026-10795 vulnerability. TeamUpdraft has revoked older connections in versions 1.26.13 and 2.26.13 and rotated credentials. In June 2026, the vendor patched CVE-2026-10795, a high-severity flaw in the UpdraftPlus WordPress plugin that allowed unauthenticated attackers to forge remote commands. These plugins create accounts with the Editor role but grant full administrator capabilities, bypassing two-factor authentication via persistent cookies. The threat actor reportedly accessed a customer database containing password hashes, two-factor authentication settings, and connection keys for UpdraftCentral, UpdraftVault, and UpdraftClone services.

Yesterday’s patch for UpdraftPlus 1.26.4 fixed a signature spoofing flaw where attackers forged remote commands without keys. The vulnerability stems from improper cryptographic signature verification, where unchecked decryption values collapse to a predictable zero key, enabling signature spoofing without valid credentials. Nethemba reports that three of its own WordPress websites were targeted through UpdraftCentral, with malicious plugins successfully installed on two of them. This weakness lets unauthenticated users execute admin code by bypassing cryptographic verification in the UpdraftPlus plugin. The flaw grants unauthenticated users full admin privileges to upload malicious plugins and execute arbitrary code on the target site. Attackers can execute arbitrary code as the connected administrator, resulting in full remote code execution with a CVSS score of 8.1. Researchers logged at least 99 malicious backdoor plugins disguised as WordPress maintenance and optimization tools, affecting sites connected to UpdraftCentral.

The latest UpdraftPlus releases, 1.26.11 and 2[.]26[.]11[.]26, are affected exactly like older versions, meaning current patching does not close the exposure. Update the UpdraftPlus WP Backup & Migration Plugin immediately to stop signature spoofing attacks, as the vendor fixed this unsigned message format issue in June 2026. Re-authorize remote storage connections and change storage access keys for all UpdraftCentral users, following TeamUpdraft’s advice to invalidate compromised credentials. Deploy Patchstack’s mitigation rules to block UpdraftCentral remote commands, specifically targeting the plugin.upload_plugin channel used to install malicious code.

The evidence points to the keys leaking from the UpdraftCentral Cloud environment, but the specific vector for the initial credential theft remains unconfirmed. While the June 2026 fix for CVE-2026-10795 addressed the unsigned message format, the current incident relies on valid but exposed keys, meaning the previous patch does not mitigate this specific threat. Monitor

Vulnerabilities

  • CVE-2026-10795 — CVSS 8.1 (High) · CWE-347 · davidanderson UpdraftPlus: WP Backup & Migration Plugin. The UpdraftPlus: WP Backup & Migration Plugin plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.26.4 via the UpdraftPlus_Remote_Communications_V2::wp_loaded function.

Techniques

  • T1021.007 Cloud Services (Lateral Movement)
  • T1552.004 Private Keys (Credential Access)
  • T1589.002 Email Addresses (Reconnaissance)

Indicators

  • 7 indicators on file

Coverage

12. F5 Labs Observes Automated WP2Shell Exploitation of WordPress Flaws (Hot)

No material change since last show

WordPress versions 6.9.0 through 6.9.4, and 7.0.0 through 7.0.1, are vulnerable. F5 Labs observed automated exploitation attempts from IP 185[.]242[.]3[.]238, indicating active scanning of vulnerable deployments. Seqrite’s initial analysis did not confirm widespread live compromise, but the presence of automated scanning means the window for exploitation is open. Patch immediately to version 6.8.6, 6.9.5, or 7.0.2.

Attackers exploit CVE-2026-63030 in WordPress 6.9.0 and 7.0.0 by abusing route confusion in the /wp-json/batch/v1 endpoint. This bypasses authentication, allowing access to CVE-2026-60137, an SQL injection flaw in the author__not_in parameter of WP_Query. The resulting injection triggers remote code execution with a CVSS score of 9.8. This SQL injection flaw in the posts endpoint lets remote actors bypass authentication without network access, yielding high confidentiality impact while leaving integrity and availability untouched. The vulnerability creates a direct path from an unauthenticated request to arbitrary code execution, targeting the batch-processing mechanism exposed on standard installations.

Seqrite analysts documented the WP2Shell chain, proving this route confusion lets public API traffic bypass authentication to execute malicious payloads. Targeting the REST API batch controller and posts endpoint, any default installation in those versions faces immediate remote code execution without user interaction. Upgrade WordPress immediately to versions 6.8.6, 6.9.5, or 7.0.2 to close the gap, as no other mitigation exists for this known exploited vulnerability in the current catalog. Disable or remove the REST API batch endpoint feature if it is not required for business operations, reducing the attack surface for the route confusion vulnerability.

It is possible that WP2Shell allows an attacker to create an administrator account and install a plugin-based web shell, but this specific post-exploitation behavior is not definitively confirmed in the initial analysis. Monitor for unexpected file creation in web directories followed by web server processes spawning command shells or script interpreters, which indicates web shell deployment via the T1505.003 technique.

Vulnerabilities

  • CVE-2026-63030 — CVSS 9.8 (Critical) · CISA KEV · WordPress WordPress. WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the author__not_in WP_Query SQL Injection (CVE-2026-60137), could allow an attacker…
  • CVE-2026-60137 — CVSS 5.9 (Medium) · CISA KEV · WordPress WordPress. WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the author__not_in parameter of WP_Query, which could allow SQL Injection when a plugin or theme passes untrusted input…

Techniques

  • T1053.005 Scheduled Task (Execution)
  • T1190 Exploit Public-Facing Application (Initial Access)
  • T1203 Exploitation for Client Execution (Execution)
  • T1210 Exploitation of Remote Services (Lateral Movement)
  • T1505.003 Web Shell (Persistence)
  • T1595 Active Scanning (Reconnaissance)
  • T1595.002 Vulnerability Scanning (Reconnaissance)
  • T1659 Content Injection (Initial Access)

Indicators

  • 1 indicator on file

Coverage