Find what you’re looking for

CVE-2026-80097: How a Zero-Permission Android App Could Steal Your Corporate Microsoft Tokens

In October 2026, security researcher Ofek Levin of Enclave disclosed CVE-2026-80097, an 8.6 CVSS-rated flaw in Microsoft Authenticator for Android that allowed any unprivileged app to impersonate trusted Microsoft applications such as Teams and harvest OAuth tokens for a victim's work account. The vulnerability resided in the publicly accessible AccountChooserActivity component, which accepted attacker-supplied identity claims and performed a flawed signature check that could be bypassed because the legitimate target app was genuinely installed on the device. Tokens returned in testing granted read/write access to corporate email, files, and calendars. Microsoft patched the flaw in Authenticator version 6.2606.4246 as part of September 2026 Patch Tuesday. This incident illustrates the continued risk of over-privileged mobile authentication brokers and weak inter-app trust validation. As enterprises expand mobile-first workforce strategies, OAuth token theft via mobile app impersonation is emerging as a high-value, low-noise vector that bypasses traditional perimeter defenses and directly compromises identity infrastructure.

PHP2Shell: Two Critical PHP Flaws Putting 75% of the Web at Risk

In October 2026, two critical remote code execution vulnerabilities in PHP—CVE-2026-109618 and CVE-2026-109619, collectively dubbed PHP2Shell—were publicly disclosed and rapidly weaponized. Discovered through AI-assisted vulnerability research, the flaws allow unauthenticated attackers to execute arbitrary code on unpatched web servers. With PHP powering an estimated 75% of all websites globally, the attack surface is enormous. Government agencies including CISA, CERT-EU, and the NCSC issued emergency advisories, while some organizations took servers offline as a precautionary measure. Active exploitation attempts were observed shortly after disclosure, underscoring the severity and urgency of the threat. PHP2Shell exemplifies the accelerating gap between vulnerability disclosure and mass exploitation. AI-assisted discovery is shortening the window defenders have to patch, while the sheer prevalence of PHP in web infrastructure means that even a moderate exploitation rate translates into thousands of compromised servers, amplifying supply-chain, ransomware, and data-exfiltration risks across every industry vertical.

When the Sensor Goes Dark: Warlock Ransomware and the Kill-Before-Encrypt Playbook

Between July and October 2025, the China-linked threat actor Storm-2603 deployed Warlock ransomware against at least four organizations—including a water utility, a telecom provider, a regional government body, and a university—across Portuguese- and Spanish-speaking countries in Europe, Africa, and Latin America. The attackers exploited unpatched on-premises Microsoft SharePoint vulnerabilities, including flaws disclosed and patched in July 2025, to plant web shells and spend nine days establishing persistence, mapping the domain, creating rogue service accounts, and staging lateral movement. In the final phase, a purpose-built tool disabled endpoint security software across roughly 40 hosts within two hours, after which Warlock ransomware was deployed via SYSVOL replication to at least 33 domain-joined hosts. This incident exposes a systemic assumption embedded in most security budgets: that detection and response tools will be operational when an attack arrives. Storm-2603's deliberate kill-before-encrypt playbook invalidates that assumption, demanding a shift toward network-layer and memory-resident controls that act before an adversary accumulates the privileges needed to silence sensors.

PHP2Shell Exploited in the Wild: What the CVE-2026-109618 & CVE-2026-109619 Attack Chain Means for Your Cloud Infrastructure

In late October 2026, two critical remote code execution vulnerabilities in PHP—CVE-2026-109618 and CVE-2026-109619, collectively dubbed PHP2Shell—were confirmed exploited in the wild against Apache mod_php installations running PHP 8.4.26. First patched on October 21, 2026, the flaws had been under active scanning and fingerprinting since at least four days before patches were released. Honeypot evidence gathered by researchers at Perplexity and independently verified by Expel's Marcus Hutchins confirmed a full exploitation chain: attackers leveraged memory disclosure to derive function addresses, then delivered execution payloads, achieving confirmed RCE. With PHP powering approximately 70% of all websites and over 5.1 million PHP hosts exposed online, the attack surface is extraordinarily broad. PHP2Shell underscores a persistent and accelerating pattern: critical web-application CVEs are weaponized within days of—or even before—public patch availability. The combination of widespread PHP deployment, delayed patching cycles, and leaked pre-disclosure exploit details created a narrow but catastrophically exposed window that threat actors successfully exploited, signaling heightened risk for any organization running unpatched PHP infrastructure.

Broccoli2Shell (CVE-2026-111497): What the Microsoft .NET Brotli RCE Means for Your Cloud Workloads

In October 2026, Microsoft issued emergency out-of-band security updates for .NET 8, 9, 10, and 11 RC3 to address CVE-2026-111497, a critical out-of-bounds write vulnerability in the Brotli decompression library dubbed Broccoli2Shell (also tracked as HTTP2Shell and Node2Shell). The flaw allows unauthenticated remote attackers to trigger crashes, memory leaks, or achieve remote code execution by sending maliciously crafted Brotli-compressed streams to any application using ASP.NET Core request decompression, HttpClient response decompression, or System.IO.Compression Brotli APIs. Proof-of-concept exploit code was publicly available on GitHub at time of disclosure, significantly lowering the bar for exploitation across enterprise cloud-hosted and on-premises .NET workloads. The public availability of PoC exploit code for a critical RCE vulnerability in a foundational compression library used across millions of .NET applications signals a narrow remediation window for security teams. Organizations with internet-facing APIs, microservices, or cloud-native applications built on .NET are at elevated risk, and the attack surface is amplified by the broad adoption of HTTP/2 and Brotli compression in modern cloud environments.

HTTP2Shell (CVE-2026-111497): How a Brotli Buffer Overflow Became a Cloud-Wide RCE Emergency

In October 2026, a critical memory-corruption vulnerability tracked as CVE-2026-111497, dubbed 'HTTP2Shell' (also 'Node2Shell' and 'Broccoli2Shell'), was publicly disclosed in the Brotli C decoder library bundled with Node.js and used across Python HTTP clients, .NET, and other ecosystems. The flaw, a buffer overflow triggered by a specially crafted Brotli-compressed stream, allows attackers to corrupt process memory, expose sensitive data, and achieve remote code execution (RCE) by serving malicious compressed responses or requests to any application that decompresses attacker-controlled Brotli data. Emergency patches were released by Google, Node.js, Microsoft, and PyPI maintainers between October 21–23, 2026, following publication of public proof-of-concept exploits. The breadth of affected software—spanning web servers, HTTP clients, containerized microservices, and cloud-native workloads—means organizations face supply-chain-level exposure. As PoC exploits circulate and patching of bundled libraries in containers requires image rebuilds and redeployments, the window for opportunistic exploitation remains open across multi-cloud and hybrid environments.

How a Former Pentester Used ARTEX AI to Steal 8.2 Million Records from 90+ Organizations

Between September 2025 and October 2026, a former penetration tester led a seven-person cybercrime gang that breached more than 90 South Korean organizations—including hospitals, universities, large corporations, and golf courses—stealing 8.2 million personal records. The gang leader, a self-taught 32-year-old with prior experience at a cybersecurity firm, initially used conventional tools before adopting the ARTEX AI autonomous pentesting framework in late August 2026 to dramatically scale attack velocity. In 38 incidents the group demanded ransom payments of approximately $270,000 USD each, threatening to leak stolen data. Seoul Metropolitan Police arrested all seven suspects in October 2026 after tracing server logs from breached entities. This incident highlights a dangerous inflection point: AI-assisted offensive tools like ARTEX AI are lowering the skill threshold for large-scale intrusions, enabling insider-threat actors with domain knowledge to weaponize automation at enterprise scale. As agentic AI tooling proliferates, organizations face breach volumes previously associated only with nation-state actors—driven now by individuals with moderate technical backgrounds.

Scanner-Evading JavaScript Skimmers Hit 953 Magento Stores: What E-Commerce Security Teams Must Do Now

Since July 2025, an unidentified threat actor has systematically compromised 953 Magento-based online stores by injecting scanner-evading JavaScript loaders into CMS database blocks. Attackers exploited two Adobe Commerce vulnerabilities—CVE-2026-48356 (PolyShell) and CVE-2025-54236 (SessionReaper)—to gain initial access, then embedded staged loaders that instruct visitor browsers to fetch attacker-controlled payloads. The campaign employs sophisticated bot-filtering and browser fingerprinting to serve malicious code exclusively to real shoppers while returning nothing to security scanners, enabling persistent credit-card skimming operations across hundreds of storefronts with minimal detection risk. This campaign reflects a maturing web skimming threat landscape where attackers layer evasion directly into the injection chain rather than solely in the payload. The use of localStorage persistence, Cloudflare-hosted C2 infrastructure, Keitaro traffic distribution, and rotating domains signals professional, long-horizon financial crime operations that outpace traditional signature-based defenses and unpatched merchant environments.

PHP's Second Emergency Patch in Five Days: Inside the Critical Brotli RCE Flaw Threatening Windows Deployments

In October 2026, PHP issued emergency Windows package rebuilds for versions 8.2 through 8.5 to address CVE-2026-111497, a critical memory-corruption remote code execution flaw in the bundled Brotli compression library (versions prior to 1.2.1). The vulnerability is reachable through PHP's cURL extension when automatic HTTP response decompression is enabled—a default behavior in the widely-used Guzzle HTTP client library. Rated 9.2 (Critical) on CVSS 4.0 by Google, the flaw allows a malicious server to deliver a crafted compressed response that corrupts process memory, potentially executing arbitrary code. The rebuilt packages arrive just five days after emergency patches for two separate PHP2Shell RCE flaws, underscoring a compounding supply-chain risk for Windows-hosted PHP environments. This incident illustrates the compounding risk of software supply chains where third-party compression libraries bundled inside language runtimes become silent attack surfaces. With Guzzle enabling automatic Brotli decompression by default and PHP shipping SBOMs only post-facto, organizations relying on PHP-based web applications—particularly in regulated industries—face renewed urgency around dependency visibility and patch velocity.

When IT Support Becomes the Threat: How Attackers Weaponized Microsoft Teams to Deploy Chaos Ransomware

Beginning in 2026, threat actors exploiting Microsoft Teams' external chat feature launched a sophisticated social engineering campaign impersonating IT support personnel to deliver malware and ransomware across hundreds of organizations. Attackers established fraudulent Microsoft 365 tenants using IT-themed onmicrosoft.com and paid top-level domains, preceded attacks with email bombing to create urgency, then used vishing to gain remote access via tools such as AnyDesk, Quick Assist, and Atera. Once inside, they conducted Active Directory reconnaissance via LDAP queries, deployed the GoGRPC backdoor, moved laterally to domain controllers, and dropped Chaos ransomware while exfiltrating sensitive data. This campaign underscores a critical shift in attacker tradecraft: rather than exploiting software vulnerabilities, adversaries are weaponizing trusted collaboration platforms and legitimate remote management tools. The STAC4749 threat cluster's repeated use of this pattern—across cloud tenants, RMM tooling, and ransomware payloads—signals a durable, scalable playbook that security teams must treat as an ongoing threat to enterprise communication infrastructure.

How 'Gheist' Turned Stolen GitHub Tokens Into a Cloud Secrets Vault Raid

In an ongoing supply-chain campaign first tracked September 15, 2026, a threat actor dubbed 'Gheist' leveraged stolen GitHub personal access tokens—sourced from infostealer malware and prior supply-chain breaches—to create malicious 'ci-sync-' branches across more than 850 compromised GitHub accounts and 13,500 repositories. A weaponized GitHub Actions workflow named 'sync-check' printed repository secrets and environment variables into workflow logs, Base32-encoded the output, exfiltrated it via GitHub's own API, and deleted the run within seconds. Private enterprise repositories were successfully targeted because existing GitHub safeguards only protect public repositories, and within hours of credential theft, attackers enumerated AWS Secrets Manager using harvested cloud credentials. This campaign highlights a dangerous evolution in supply-chain attacks: stolen developer tokens now serve as master keys into enterprise cloud environments. Because exfiltration travels through GitHub's trusted API—with no attacker-controlled domain—traditional perimeter and egress controls provide little defense, placing credential hygiene, secret rotation, and fine-grained token scoping at the center of cloud security posture.

Token Spraying: How Attackers Bypassed MFA and Compromised 97 Microsoft 365 Accounts Across 79 Organizations

Between July 14 and September 22, 2026, threat actors executed a large-scale adversary-in-the-middle (AitM) token-replay campaign against Microsoft 365, compromising 97 accounts across 79 organizations from more than 200,000 login attempts. Attackers deployed fake Microsoft sign-in pages to harvest session tokens and MFA codes in real time, then replayed those tokens within minutes from infrastructure tied to Romanian and German hosting provider 1337 Services GmbH. Post-access persistence was achieved by registering 48 rogue Entra devices, hijacking MFA methods, and planting hidden inbox rules to intercept payroll and finance-related emails—enabling business email compromise at scale. This campaign illustrates the accelerating shift away from password-based attacks toward token-based identity exploitation, where MFA alone provides insufficient protection. As AitM phishing kits become commoditized and token-spraying techniques proliferate, organizations relying solely on perimeter defenses and standard MFA face compounding exposure across cloud identity platforms.