Find what you’re looking for
Browse everything
6,838 results in Threat Reports
When Your AI Coding Agent Becomes the Attacker: The MALFEX AGENTS.md Prompt Injection Campaign
In October 2026, security firm Forever Security uncovered a novel prompt-injection attack targeting AI coding agents such as OpenAI Codex and Anthropic Claude Code. A malicious AGENTS.md instruction file was discovered in a developer's Downloads folder, directing the AI agent to install the MALFEX-campaign npm package "function-color," which chains to a downloader and executes a Windows payload. Browsers can silently deposit files into Downloads without user interaction, meaning a single malicious webpage visit can plant attacker-controlled instructions that any subsequently launched coding agent will obey autonomously—achieving code execution or account takeover with no patch available from the AI vendors. This incident signals a rapidly maturing class of supply-chain threat that weaponizes the trust model of agentic AI tools. As developer adoption of autonomous coding agents accelerates, adversaries are actively mapping their implicit trust boundaries—instruction files, config stores, and API endpoints—turning the agent's own obedience into the attack surface.
Gheist: How Attackers Used Stolen GitHub Tokens to Silently Drain Enterprise Secrets via Actions Logs
Beginning September 15, 2026, an automated threat campaign tracked as Gheist began exploiting stolen GitHub personal access tokens to plant malicious GitHub Actions workflows inside private repositories and GitHub Enterprise environments. The attacker tool created ci-sync- branches, committed a workflow that printed all accessible secrets encoded in base32 to bypass GitHub's masking, downloaded the logs via API, and deleted the run within seconds—leaving no outbound connection to block. Wiz researchers recovered over 13,500 planted branches across more than 850 compromised accounts, ranging from personal projects to enterprise organizations, with post-compromise activity including AWS Secrets Manager enumeration and lateral credential reuse. Gheist exemplifies an accelerating class of CI/CD supply-chain attacks where the pipeline itself becomes the exfiltration channel. With tokens sourced from infostealer markets and prior supply-chain breaches, attackers require no vulnerability—only write access. As enterprises expand GitHub Actions usage for cloud deployments, the blast radius of a single stolen token now reaches production cloud credentials, making pipeline identity governance a board-level concern.
uCreator Spyware: The Rentable Android Kit That Hijacks Telegram 2FA and Clones WeChat Accounts
Beginning as early as mid-2024 and active through at least July 2026, a rentable Android spyware kit branded YingGai—marketed externally as uCreator—was distributed via sideloaded tampered copies of Telegram X and WeChat and through a proprietary container app called Onion Box. Attributed to operators linked to three companies in Hunan province, China, the kit intercepts Telegram's two-factor authentication passwords in plaintext before hashing, enables full account takeover including session hijacking and phone-number reassignment, and clones WeChat identities by exfiltrating login credentials and full account data. A leaked GitLab back end revealed a multi-tenant cloud console with roughly three dozen active developers, purpose-built scheduler logic to mimic human behavior, and support for approximately 20 messaging and mobile-wallet apps across Southeast Asia and China. Doctor Web estimated more than 58,000 infected devices as of October 2025 under the Baohuo campaign alone. The uCreator/YingGai disclosure is significant because it demonstrates the maturation of Spyware-as-a-Service on Android: a commercially structured operation with reseller tiers, per-customer command routing, and active developer maintenance—raising the bar beyond opportunistic malware into organized, scalable account-takeover infrastructure targeting financial and messaging platforms globally.
Everything's an RCE: PHP2Shell, LiteLLM Supply Chain, and Rogue AI Agents Define a Record-Breaking Threat Week
In the week of October 26, 2026, a convergence of critical remote code execution vulnerabilities, supply chain compromises, and AI-driven attacks created an unprecedented threat landscape. PHP2Shell (CVE-2026-109618/109619) triggered millions of exploitation attempts, while a leaked LiteLLM master key enabled a malicious Python package that harvested credentials across developer environments. Agentic AI platforms were weaponized by four newly identified threat actor groups using Claude Code to exfiltrate healthcare and government data. CISA added Plex2Shell flaws to its KEV catalog, and ransomware attacks surged 50% quarter-over-quarter, underscoring systemic exposure across web infrastructure, open-source dependencies, and AI tooling. This week's events reflect a structural acceleration in attacker capabilities: AI is now operationally embedded in offensive campaigns, the exploitation window for high-severity CVEs has shrunk to three days, and supply chain trust is being exploited through leaked keys and poisoned packages. Organizations relying on legacy patch cadences or perimeter-only defenses are increasingly unable to contain threats that propagate laterally through cloud and AI workloads before detection occurs.
Critical Wasmtime Sandbox Escapes: What Cloud and Edge Teams Must Do Now
In October 2026, the Bytecode Alliance disclosed two critical vulnerabilities in Wasmtime, a widely embedded WebAssembly runtime, both rated 9.9 CVSS. CVE-2026-115889 affects all processor architectures and stems from a 24-bit integer overflow in Cranelift's value-numbering logic that can cause type confusion and sandbox escape in large or crafted modules. CVE-2026-115893 affects ARM64 systems exclusively, exploiting a br_table branch-reach limitation present since 2020 that allows attacker-controlled modules to redirect execution to arbitrary code. Fixed releases (36.0.19, 48.0.7, 49.0.4, 50.0.0) were published October 19–20; unsupported lines received no patch. No active exploitation had been confirmed as of October 26, 2026. These vulnerabilities highlight a growing supply-chain risk: Wasmtime is embedded as a library inside platforms such as Fastly Compute, serverless frameworks like Spin, and countless Rust-based services. A single unpatched dependency can expose an entire multi-tenant infrastructure to sandbox escape, making dependency hygiene and runtime segmentation critical controls for cloud-native security teams heading into 2027.
PHP2Shell Zero-Day Meets Agentic AI: How Lazarus-Linked Actors Breached a Government in Under Two Hours
In October 2026, threat actors exploited critical PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 (collectively dubbed PHP2Shell) to compromise a European government entity. Within two hours of initial exploitation, attackers accessed password hashes, MFA secrets, and established an NTLM-relay tunnel into Active Directory, attempting Domain Admin privilege escalation. Behavioral markers—including structured shell output delimiters designed for machine parsing—strongly indicate the use of agentic AI tooling for post-exploitation automation. Concurrently, CYFIRMA attributed a parallel low-and-slow scanning campaign across 216 unpatched global hosts to a suspected Lazarus Group affiliate, coordinated via a covert I2P channel with Korean-language indicators consistent with North Korean operators. This incident represents a convergence of two accelerating threat trends: the mass exploitation of critical runtime vulnerabilities affecting tens of millions of internet-facing PHP systems, and the operational deployment of agentic AI by nation-state actors to accelerate post-breach reconnaissance and lateral movement. With nearly 37 million PHP-exposed systems globally and Cloudflare reporting millions of exploitation attempts post-disclosure, organizations across government, finance, and critical infrastructure face an elevated and time-sensitive attack surface.
Tailworm 2026: How One Hacked Device Can Root Your Entire Tailscale Mesh Network
In October 2026, security researcher Erica Windisch of Cyberdione Labs published the Tailworm report detailing critical unpatched vulnerabilities in Tailscale SSH (version 1.104.2) and headscale (version 0.29.5). The research demonstrated that a single compromised device within a Tailscale zero-trust mesh network could escalate privileges to root on any reachable server in under a second per hop, requiring no stolen credentials or user interaction. Three distinct exploitation paths were identified—Unix socket abuse, socket substitution, and a time-of-check/time-of-use race condition—enabling fleet-wide lateral movement. As of publication, no patch, CVE, or security bulletin had been issued by Tailscale. This incident underscores a dangerous assumption embedded in zero-trust architectures: that device-identity-based access implicitly prevents privilege escalation. As organizations accelerate adoption of mesh VPN and software-defined networking tools to replace perimeter security, unvalidated trust in lateral SSH paths creates wormable blast radii that traditional segmentation and firewall controls may not contain.
When Your AI Coding Agent Becomes the Attacker: The AGENTS.md Hijacking Threat
In October 2026, researchers at Forever Security discovered a novel AI agent hijacking technique exploiting markdown instruction files such as AGENTS.md and CLAUDE.md placed in a user's ~/Downloads folder. Attackers can silently drop a malicious instruction file via a web page download—without user interaction—targeting popular browsers like Chrome, Edge, and Firefox. When a developer launches an AI coding agent such as OpenAI Codex, Claude Code, or Cursor CLI from that directory, the agent automatically ingests and executes the malicious instructions. Demonstrated impacts include installation of rogue npm packages, OAuth token theft, and remote code execution, with success rates of up to 90% in controlled tests. This attack class represents a fundamentally new supply-chain risk for AI-augmented development pipelines. As agentic AI tools become standard in developer workflows, the attack surface expands well beyond traditional code and dependency vulnerabilities—any trusted file the agent reads becomes a potential attack vector, demanding new policies around working directory hygiene and egress control.
BlackX UEFI Bootkit: How APT41 Turned an Unfinished Patch Into a Nation-State Espionage Campaign
In early 2026, a Chinese state-sponsored threat actor attributed with medium confidence to APT41 (also known as Brass Typhoon) deployed a novel UEFI bootkit called BlackX against diplomatic agencies in Central Asia, specifically in Tajikistan, Uzbekistan, and Turkmenistan. BlackX exploited the long-known Baton Drop vulnerability (CVE-2022-21894) to bypass Secure Boot by enrolling custom Machine Owner Keys, then loaded a kernel driver signed with a revoked certificate to disable Kaspersky and Avast security processes, tamper with Event Tracing for Windows, and deploy a cloud-hosted RAT using Google Drive, OneDrive, and Yandex.Disk for command-and-control alongside the obfuscated OxiDLLRunner payload framework. BlackX highlights a persistent and dangerous gap in enterprise patching hygiene: Microsoft's fix for CVE-2022-21894 requires administrators to manually trigger Secure Boot revocations after patch installation—a step nearly universally skipped. With APT41 actively weaponizing firmware-level persistence and the October 2026 expiration of the Windows Production PCA 2011 certificate not automatically blocking vulnerable binaries, organizations face renewed urgency to audit bootloader revocation status across their fleets.
PHP2Shell: How Two Critical PHP RCE Bugs Sent the Security Industry Into Red-Alert Mode
In October 2026, two critical remote code execution vulnerabilities in PHP—CVE-2026-109618 and CVE-2026-109619, collectively dubbed 'PHP2Shell'—were disclosed with a CVSS v4.0 score of 9.2. Discovered by infosec firm Calif and analyzed by WatchTowr, both flaws allow unauthenticated attackers to execute arbitrary code on web servers simply by reaching them over the network. An embargo break led to early publication of a proof-of-concept tool, accelerating attacker reconnaissance while defenders scrambled to patch or mitigate across Apache mod_php, PHP-FPM, php-cgi, FrankenPHP, and LiteSpeed deployments. Active exploitation attempts were observed in the wild within hours of disclosure. The PHP2Shell incident echoes Log4Shell in scope and urgency, underscoring the fragility of open source supply chains and the disproportionate risk carried by under-resourced organizations—schools, municipalities, and nonprofits—that lack dedicated security staff but run PHP-based infrastructure extensively exposed to the internet.
PHP2Shell Exploitation Surge: What Security Teams Must Do Now About CVE-2026-109618 and CVE-2026-109619
In October 2026, two critical PHP remote code execution vulnerabilities—CVE-2026-109618 and CVE-2026-109619, collectively dubbed PHP2Shell—triggered a global exploitation wave within hours of public disclosure. Cloudflare observed thousands of exploit attempts in the 10 hours before announcement, escalating to millions within two hours post-disclosure. Check Point Research reported that 10% of organizations worldwide faced exploitation attempts within 24 hours. Complicating response efforts, over 99% of discoverable PHP instances had not patched within the first day, and roughly 73% ran unsupported PHP branches, leaving attackers a vast, largely undefended attack surface across web servers, storage appliances, cameras, and physical access-control systems. PHP2Shell underscores a persistent and worsening gap between attacker speed and enterprise patch velocity. As organizations increasingly rely on containerized, hybrid, and multi-cloud deployments, unpatched PHP surfaces embedded in firmware, legacy applications, and third-party software create systemic risk. The incident highlights why runtime network controls, east-west segmentation, and egress enforcement are essential complements to patching programs—especially when patches cannot be applied instantly or at all.
ARTEX Agentic AI Weaponized in ConnectWise Supply Chain Attack — And PHP2Shell Was Exploited Before a Patch Existed
During the week of October 13–21, 2026, a suspected Chinese state-aligned threat actor deployed ARTEX, a Go-based multi-agent LLM penetration testing framework, to execute an automated supply chain compromise against ConnectWise Cloud Backup, generating over 151,000 failed logon events and breaching hundreds of global organizations across aerospace, defense, energy, and financial services in under three hours per target. Simultaneously, the PHP security team issued emergency patches for CVE-2026-109618 and CVE-2026-109619 — dubbed PHP2Shell — rated CVSS 9.2, after exploitation probes hit honeypots four days before coordinated disclosure, exposing enterprises running Apache mod_php, PHP-FPM, and LiteSpeed to unauthenticated remote code execution. These incidents mark a pivotal escalation: agentic AI is no longer a theoretical offensive capability but an operationalized weapon enabling machine-speed cloud identity compromise, while pre-patch exploitation of embargoed vulnerabilities signals an intelligence pipeline that outpaces traditional disclosure timelines, compressing enterprise response windows to days or hours.