Find what you’re looking for
Browse everything
6,838 results in Threat Reports
MythicRatatoskr: How UAC-0099 and Sandworm Used a Decentralized Mesh Network to Destroy a Ukrainian Logistics Firm
On July 16, 2025, Russia-aligned threat group UAC-0099 gained initial access to a Ukrainian grain logistics company via a spearphishing email delivering the MATCHWOK backdoor. Within 24 hours, a previously undocumented Go-based implant named MythicRatatoskr was deployed, routing its command-and-control traffic covertly through the Yggdrasil decentralized mesh network—the first documented abuse of this experimental peer-to-peer infrastructure by a state-aligned actor. UAC-0099 subsequently handed off access to Sandworm (GRU Unit 74455), which on September 17, 2025 executed a destructive data-wiping attack using the SDelete utility pushed via Active Directory Group Policy, permanently destroying data across the organization. This incident underscores a maturing pattern of operational collaboration among Russia-aligned APT groups, where specialized initial-access actors broker footholds to destructive-capability teams. The novel use of Yggdrasil for C2 concealment signals a broader adversarial trend toward experimental peer-to-peer and decentralized overlay networks to evade traditional perimeter and egress security controls, raising urgent detection and policy-enforcement challenges for defenders worldwide.
OAuth Under Siege: How Attackers Hijack Tokens, Bypass MFA, and Persist Inside Enterprise Environments
As enterprises broadly adopted multi-factor authentication, adversaries pivoted from stealing passwords to harvesting OAuth tokens—the short-lived but often misconfigured credentials that govern application-level access. Unit 42 researchers documented in October 2026 how three attack classes—account hijacking via device authorization flow abuse, permission hijacking through consent-screen impersonation, and malicious OAuth redirect weaponization—now enable attackers to bypass MFA entirely, survive password resets, and maintain durable access to enterprise environments. PhaaS toolkits, LLM-generated brand impersonations, and dynamic runtime evasion have industrialized these campaigns, lowering attacker skill requirements while dramatically raising organizational risk. OAuth token hijacking represents a structural shift in the identity threat landscape: attackers no longer need to defeat authentication controls because they operate entirely in the authorization layer. With OAuth adoption expanding into critical infrastructure platforms such as Cloudflare DNS and CDN routing, the blast radius of a single compromised consent event has grown substantially, making token governance and admin-only consent workflows urgent enterprise priorities.
eMudhra Intermediate CA Compromise: When Weak Entropy Breaks the Entire Chain of Trust
In October 2026, Palo Alto Networks Unit 42 disclosed that eight intermediate certificate authority (CA) private keys belonging to Indian CA eMudhra Limited were compromised due to a critical cryptographic defect introduced during certificate generation. Insufficient entropy during key generation allowed attackers to mathematically derive private keys directly from the corresponding public certificates. With access to these keys, adversaries could sign unauthorized TLS certificates, enabling meddler-in-the-middle (MitM) traffic interception, domain impersonation, and session hijacking across any domain protected by eMudhra-issued certificates. Major browser and OS vendors moved swiftly to revoke trust in the affected intermediates, and eMudhra revoked all eight certificates. This incident underscores the fragility of global PKI trust hierarchies and the cascading risk posed by a single CA's cryptographic failure. As certificate lifespans compress to 47 days and supply-chain attacks targeting cryptographic infrastructure grow more frequent, organizations must adopt automated certificate lifecycle management and continuous CT log monitoring to detect and respond to unauthorized certificate issuance before adversaries exploit it.
When the Lock Is Made of Paper: The eMudhra TLS Certificate Meltdown of 2026
In October 2026, Indian Certificate Authority eMudhra Limited was found to have issued eight TLS certificates bearing catastrophically weak private keys, ranging from just 3 to 8 bits of entropy instead of the standard 384 bits required for NIST P-384 elliptic curve cryptography. The defect, likely introduced through misconfigured or example key-generation code promoted to production, rendered the certificates trivially breakable by any adversary capable of mounting a man-in-the-middle position. VPN users, non-browser TLS clients, and any relying party that trusted eMudhra's root were immediately exposed to potential traffic interception and decryption. Certificate Transparency logs surfaced the anomaly, but only after issuance, underscoring the reactive nature of current PKI oversight mechanisms. This incident arrives amid a broader wave of PKI supply-chain failures and state-sponsored traffic-interception campaigns such as Salt Typhoon, highlighting that the integrity of encrypted communications depends entirely on the rigor of every CA in the trust store. Regulators and enterprises are now under pressure to enforce continuous CT-log monitoring, automate certificate validation pipelines, and adopt network-layer encryption that does not rely solely on TLS certificate trust.
GitLab's Max Severity RCE Flaw CVE-2026-110264: Why Your CI/CD Pipeline Is Now a Primary Attack Surface
In October 2026, GitLab disclosed CVE-2026-110264, a maximum-severity (CVSS 10.0) Remote Code Execution vulnerability rooted in an integer overflow flaw within GitLab's Regular Expression Compiler engine. An unauthenticated remote attacker could exploit this flaw by submitting a specially crafted regular expression, triggering arbitrary code execution on affected GitLab Community Edition and Enterprise Edition servers. GitLab patched the vulnerability across seven release versions and confirmed GitLab.com was already remediated. With over 2,700 internet-exposed CE instances tracked by Shadowserver and no authentication required, the attack surface is broad and the potential for supply chain compromise across GitLab's 30 million users is significant. This disclosure follows a pattern of cascading critical RCE and path traversal vulnerabilities in GitLab across 2026, one of which (CVE-2026-85706) was added to CISA's Known Exploited Vulnerabilities catalog within 24 hours of disclosure. The trend signals that DevSecOps platforms are increasingly targeted by threat actors seeking high-value footholds into software supply chains, CI/CD pipelines, and Fortune 100 development infrastructure.
PHP2Shell: How Attackers Exploited Critical RCE Flaws Four Days Before Emergency Patches Arrived
In October 2026, Amazon Threat Intelligence confirmed that active exploitation of two critical PHP remote code execution vulnerabilities—CVE-2026-109618 and CVE-2026-109619, collectively dubbed PHP2Shell—began four days before emergency patches were released on October 21. Attackers, operating from commercial VPN anonymization infrastructure, targeted honeypots as early as October 17, with multiple threat actors deploying proof-of-concept exploits hours after public disclosure. The PHP security team was forced to accelerate its coordinated release after CVE details and mitigation guidance leaked online two days prior. With PHP powering up to 80% of the internet, including WordPress, Drupal, and Joomla, over 3.8 million internet-exposed PHP hosts faced active risk during the zero-day window. This incident reinforces the growing reality of pre-patch exploitation windows, where threat actors acquire vulnerability intelligence through leaks or independent discovery before defenders can act. As zero-day and near-zero-day exploitation becomes standard attacker tradecraft, organizations must shift from patch-centric defense models toward runtime controls, network segmentation, and egress enforcement that limit blast radius independent of patch status.
When 15 Seconds Is All It Takes: Machine Speed Attacks Demand Autonomous Response
In 2026, Exaforce documented a surge of sub-15-minute identity-driven attacks across enterprise environments. Three distinct patterns emerged: dormant OAuth tokens stolen from developer laptops via poisoned npm packages or infostealers were later weaponized to exfiltrate GitHub repositories at machine speed; ClickFix lures impersonating AI tool installers (Claude Code) deployed macOS stealers that harvested browser cookies and cloud credentials; and vishing campaigns mimicking IT help desks manipulated employees into approving real MFA prompts, granting attackers full session access within minutes. In one GitHub token case, 472 of 638 repositories were exfiltrated in under 15 seconds before containment actions could be authorized. These incidents expose a structural gap in enterprise security: detection platforms and identity providers flag anomalies but rely on human approval for response actions, leaving a critical window attackers now routinely exploit. The convergence of AI-lure social engineering, long-lived OAuth tokens, and incomplete session revocation across SaaS ecosystems signals a new normal where autonomous, low-friction response automation is no longer optional.
CVE-2026-114625: How Attackers Are Exploiting Arista VeloCloud Orchestrator to Own Your SD-WAN
In October 2026, Arista Networks disclosed and patched CVE-2026-114625, a critical zero-day vulnerability in VeloCloud Orchestrator (VCO) On-Prem deployments that was already being actively exploited in the wild. The flaw allows any authenticated user with basic privileges and access to the VCO web interface to escalate to operator-level privileges via low-complexity SQL injection, effectively masquerading as a local superuser. Attackers leveraging IP addresses 74.82.197.86 and 38.54.50.151 were observed exploiting the flaw, threatening the confidentiality, integrity, and availability of SD-WAN infrastructure and all data managed by the orchestrator. This is the fourth actively exploited zero-day patched by Arista in 2026 alone. This incident underscores a persistent and accelerating pattern: management-plane and orchestration-layer vulnerabilities in SD-WAN and network infrastructure are prime targets for threat actors. As enterprises consolidate network control into centralized orchestrators, a single privilege escalation flaw can hand attackers keys to the entire wide-area network, making rapid patch cadence and layered runtime controls non-negotiable.
LiteLLM's Poisoned Pipeline: How Attackers Weaponized an AI Gateway to Steal Cloud and Developer Secrets
On October 21, 2026, attackers compromised the LiteLLM project's release pipeline and published malicious version 1.107.0 to PyPI and Docker Hub. The tampered package contained an info-stealer that harvested cloud credentials (AWS, Azure, GCP, Kubernetes), AI provider secrets, developer keys, browser data, and environment variables, encrypting the haul with AES-256-CBC under an RSA-4096 key before exfiltrating it to a threat-actor-controlled endpoint. All seven PyPI wheels and four Docker image tags were affected for roughly two hours before removal. Organizations running LiteLLM in production—including high-profile users such as NVIDIA, Netflix, AT&T, and Okta—were at risk of full secrets compromise across their AI infrastructure. This incident is the second supply-chain attack against LiteLLM within a single year, following the March 2026 TeamPCP campaign. It illustrates a rapidly maturing attacker playbook that targets AI gateway libraries to achieve broad, simultaneous credential theft across cloud, DevOps, and AI toolchains—a pattern that is accelerating as AI-integrated software becomes ubiquitous in enterprise environments.
KSMBD Zero-Day Alert: Two Unpatched CVSS 9.0 Linux RCE Flaws Exposed on Public Mailing Lists
In October 2026, Trend Micro's Zero Day Initiative publicly disclosed two critical remote code execution vulnerabilities in the Linux kernel's KSMBD SMB server module, each rated CVSS 9.0, before any mainline kernel patch was available. ZDI-CAN-33774 requires no authentication and affects any Linux server with KSMBD active on port 445, exploiting a race condition in SMB protocol dispatch. ZDI-CAN-33549 targets SMB Direct over RDMA via an integer underflow enabling heap overflow. Neither flaw has received a CVE or upstream fix, leaving exposed systems in a prolonged window of unmitigated risk across enterprise Linux file-serving environments. The premature public disclosure—driven by a policy that AI-discovered bugs are inherently public—highlights a growing tension between responsible disclosure norms and AI-accelerated vulnerability research. With no patch and no CVE assigned, defenders have limited tooling to prioritize or track remediation, increasing the urgency for network-layer controls such as segmentation, egress filtering, and inline IPS to compensate while kernel fixes work through distribution pipelines.
APT41's BlackX Bootkit: How a Cybercriminal Tool Became a Nation-State Weapon Against Diplomats
In early 2026, Kaspersky GReAT uncovered a sophisticated APT campaign attributed with medium confidence to APT41 (FishMonger), targeting diplomatic organizations in Tajikistan, Uzbekistan, and Turkmenistan. The attackers deployed a UEFI bootkit dubbed BlackX—a reverse-engineered or purchased derivative of the BlackLotus bootkit—exploiting the Baton Drop vulnerability (CVE-2022-21894) to bypass Secure Boot on fully patched machines. Post-exploitation payloads included a cloud-storage-based RAT communicating over Google Drive, OneDrive, and Yandex.Disk, and a Rust-based implant (OxiDLLRunner) for plugin-based command execution, enabling persistent kernel-level espionage against high-value diplomatic targets. This incident highlights a dangerous patch-activation gap: Microsoft's CVE-2022-21894 fix requires manual registry and scheduled-task steps most administrators never take. As APT groups increasingly borrow cybercriminal tooling and exploit dormant patch gaps, organizations running unactivated UEFI mitigations across hybrid and cloud-connected endpoints face heightened espionage risk in 2026 and beyond.
ThreatsDay October 2026: AI Secrets Leak, PingCAP Source Code Theft, Signal Hang-Up Flaw, Laravel Auth Bypass, and SafePay Ransomware's 600+ Victims
In the week of October 22, 2026, a sweeping multi-vector threat bulletin exposed simultaneous incidents across credential theft, supply-chain compromise, AI/GenAI abuse, ransomware, and critical vulnerability exploitation. PingCAP confirmed stolen service-account credentials enabled exfiltration of TiDB Cloud source code and customer records between September 9 and October 7, 2026. Zeabur announced shutdown after plaintext-credential abuse exposed 3.2 million environment variable records and 321,810 accounts. SafePay ransomware surpassed 600 victims since 2024 by chaining known edge-device CVEs with lateral movement and data exfiltration. A critical Laravel TokenGuard bypass (CVE-2026-114509, CVSS 9.2), a Signal RingRTC hang-up flaw (CVE-2026-113380, CVSS 9.3), and a NVIDIA AIStore Kubernetes host-takeover flaw (CVE-2026-65162, CVSS 10.0) compounded organizational risk across cloud, messaging, and container infrastructure. These incidents reflect a maturing attacker playbook: stolen credentials unlock supply-chain footholds, unpatched edge-device vulnerabilities feed ransomware pipelines, and AI-layer weaknesses — from biased code generation to prompt-injection via ChatGPT GitHub Connectors — are becoming primary attack surfaces. Regulatory and intelligence pressure is intensifying, with U.S. agencies banning DeepSeek from federal systems and releasing joint rogue-AI containment guidelines, signaling that AI governance is now a frontline security imperative.