Find what you’re looking for
Browse everything
6,838 results in Threat Reports
Inside the Vasilek Operation: How Cyber Partisans Hid a Backdoor in VMware Tools for Two Years
Between early 2024 and December 2025, a Belarus-aligned threat group known as Partisan Zmiy (Cyber Partisans) conducted a covert, nearly two-year espionage campaign inside a Russian healthcare organization's network. The attackers deployed the Vasilek backdoor (v1.5.8) by masquerading malicious executables as VMware Tools components—planting a rogue loader service ('vmauad') and replacing the legitimate 'vmtools.dll' with a malicious version. Vasilek leveraged Telegram for command-and-control and data exfiltration, activated GOST tunnels on a tight weekly schedule, and employed extensive operational security measures including timestomping, log clearing via 'Evlx,' and hostname binding. The group refrained from deploying its known Pryanik wiper, preserving access to exploit trusted relationships with subsidiary medical institutions. This incident exemplifies a maturing shift among hacktivist-aligned threat actors toward long-duration, low-noise espionage over destructive operations. The abuse of trusted virtualization infrastructure—specifically VMware Tools directories—to conceal persistent backdoors underscores the growing risk of supply-chain-adjacent persistence techniques in healthcare and critical infrastructure environments.
SBI Dark Web Leak 2026: How 375,000 Rows of KYC Data Slipped Past India's Largest Bank
On October 21, 2026, India's largest state-owned bank, State Bank of India (SBI), disclosed via a stock-exchange filing that approximately 3,897 customer records—drawn from a set of roughly 375,000 rows allegedly posted on BreachForums by a threat actor identified as 'Siriusim'—contained personally identifiable information including names, mobile numbers, dates of birth, email and residential addresses, branch identifiers, CIF numbers, and loan-related metadata. The bank was alerted on October 16 by CERT-In and India's Defense Cyber Agency. SBI activated incident response procedures and engaged an independent forensic firm to assess the alleged compromise. The true source—whether SBI's own systems, a subsidiary, or a third-party loan-processing provider—remains unconfirmed, and customer notification status was not disclosed in the filing. This incident reflects a broadening pattern in which financially regulated institutions in emerging markets are targeted through supply-chain and third-party data aggregators, where egress controls and data-in-transit protections are inconsistently enforced. The BreachForums listing, combining CSV records with 2,722 KYC PDF documents, signals a shift toward high-fidelity social-engineering datasets that enable impersonation fraud at scale.
UpdraftCentral Key Theft Turned Every Connected WordPress Site Into a Backdoor Target
Over the weekend of October 17–18, 2026, unknown threat actors breached the TeamUpdraft website and exfiltrated customer records including connection keys for UpdraftCentral, UpdraftVault, and UpdraftClone. Armed with valid dashboard keys, attackers issued signed plugin.upload_plugin commands through UpdraftCentral's remote procedure call channel across an 18-hour window on October 18–19, silently installing backdoor plugins on connected WordPress sites. The rogue plugins created privileged ghost accounts with Editor and administrator-level capabilities, established persistent access, and left secondary backdoor credentials that survived plugin removal. Over 99 distinct backdoor plugin variants were observed, affecting any site actively connected to TeamUpdraft's cloud-hosted UpdraftCentral service. This incident underscores an accelerating pattern of supply-chain attacks targeting WordPress ecosystem management tools. It follows CVE-2026-10795 patched only five months prior and coincides with a simultaneous supply-chain compromise of the Rank Math PRO plugin and the disclosure of critical PHP2Shell vulnerabilities, signaling coordinated or opportunistic exploitation of the broader WordPress infrastructure layer at scale.
PHP2Shell: Two CVSS 9.2 RCE Zero-Days Put 884,000 Legacy PHP Hosts at Immediate Risk
On October 21, 2026, PHP's security team issued an emergency out-of-cycle patch for two critical remote code execution vulnerabilities—CVE-2026-109618 and CVE-2026-109619—collectively dubbed 'PHP2Shell' by the research community. Rated CVSS 9.2 under v4.0, the flaws affect all four actively supported PHP branches (8.2–8.5) and were leaked prematurely via a Hacker News post before the coordinated disclosure date. Security firm watchTowr confirmed the flaws were real and under embargo. Roughly 884,000 internet-facing hosts were identified running PHP 8.1 or older—end-of-life versions that will receive no vendor patch—placing a significant portion of the global PHP ecosystem at sustained risk of unauthenticated remote compromise. This incident underscores the compounding risk of premature vulnerability disclosure combined with a massive legacy software footprint. With PHP powering a large share of the web, the window between public knowledge and active exploitation is shrinking, and organizations running unpatched or end-of-life PHP versions face an elevated and immediate threat of web shell deployment and lateral movement across their environments.
How Attackers Hijacked 333 Tor Exit Relays and Stole SSH Credentials at Scale Using Ebury
Between October 1–5, 2026, threat actors compromised over 333 Tor exit relays across 59 operators, rewriting torrc configuration files to redirect SSH traffic through 12 interception servers. At peak, the attacker-controlled relays represented 7.46% of Tor's total exit capacity. The campaign leveraged Ebury v1.8.3, a long-running OpenSSH backdoor and credential stealer active since 2009, to silently capture SSH passwords and establish persistent access. Users who accepted a spoofed host key and authenticated with a password had credentials stolen and sessions monitored in real time. The Tor Project's network health team identified and flagged all affected relays by October 5, removing them from the consensus directory. This incident underscores the resurgence of Ebury-class supply-chain implants targeting infrastructure operators and the persistent danger of SSH password authentication on internet-facing hosts. With over 400,000 servers historically infected by Ebury and confirmed v1.8.3 variants active since at least June 2026, security teams must treat credential-based SSH access as a high-risk vector, particularly within anonymization networks and shared hosting environments.
PHP2Shell (CVE-2026-109618/109619): The Network Controls That Actually Limit Your Exposure Before 14:00 UTC
On October 21, 2026, PHP disclosed two critical Remote Code Execution vulnerabilities—CVE-2026-109618 and CVE-2026-109619, collectively dubbed PHP2Shell—rated 9.2/10 in severity, with an emergency patch scheduled for 14:00 UTC the same day. Prior to the patch, no vendor-confirmed workaround existed: a widely circulated mitigation involving disabling session.upload_progress was publicly walked back by its originator, GMO Flatt Security, and rejected by PHP core developers. Cloudflare observed early exploitation attempts and deployed emergency WAF rules as a stopgap. No confirmed breach was reported at disclosure, but the attack surface covered all PHP-based web applications, including WordPress and Laravel deployments, across supported branches 8.2 through 8.5. PHP2Shell underscores a recurring and dangerous pattern: high-severity zero-days in ubiquitous server-side runtimes create narrow but critical windows where unpatched internet-facing infrastructure is exposed. The incident highlights the inadequacy of configuration-level mitigations as substitutes for runtime patching, and reinforces the need for network-level controls—egress restriction, east-west segmentation, and anomaly detection—to limit blast radius during patch-gap windows.
CISA KEV Alert: Six Actively Exploited Vulnerabilities Across Plex, Siemens, and EG Secure Demand Immediate Action
In October 2026, CISA added six actively exploited vulnerabilities to its Known Exploited Vulnerabilities Catalog, spanning Plex Media Server (four CVEs covering SSRF, URI scheme injection, and path traversal), EG Secure Solutions SiteGuard Server Edition (OS command injection), and Siemens Software Center (uncontrolled search path element). These vulnerabilities collectively enable attackers to achieve initial access, remote code execution, and full system control. Federal agencies operating under BOD 26-04 face mandatory remediation timelines, while CISA urges all organizations to prioritize patching these high-risk flaws across publicly exposed assets before threat actors can leverage pre-patch compromise windows. This catalog addition reflects a sustained attacker focus on commercial media platforms, enterprise security gateways, and industrial software distribution infrastructure. The breadth of affected vendors—consumer-grade to OT-adjacent—signals that ransomware groups and nation-state actors are actively scanning for unpatched instances, making rapid remediation and network segmentation critical defensive priorities across all sectors.
When Every Email Looks Legitimate: How Generative AI Is Defeating Behavioral Detection
In October 2026, Proofpoint revealed at its Protect 2026 conference that generative AI has fundamentally eroded the behavioral signals email security tools have relied upon for years. Attackers now produce fluent, hyper-personalized, and structurally unique messages at machine speed, eliminating the template reuse, language artifacts, and infrastructure patterns that traditional filters detect. A documented campaign targeted more than 30 real estate agents at a single firm with individually tailored property enquiries, each from a distinct mailbox, before pivoting to a weaponized video-meeting invitation. The FBI's 2025 Internet Crime Report recorded 24,768 BEC complaints totaling approximately $3.05 billion in losses, underscoring the financial scale of the threat. This report marks a structural inflection point: behavior-based email detection is no longer sufficient as a primary defense layer. Proofpoint's introduction of intent-based, multi-tier AI reasoning—anchored in its Nexus Intent-Based Detection Model—signals an industry-wide shift toward evaluating what a message is trying to accomplish rather than how it looks, a paradigm that will pressure every enterprise email security program to reassess its detection architecture.
Bronze Sandcastle: How China's Newest APT Turns Trusted Apps Into Backdoor Loaders
Between August 2025 and August 2026, a previously undocumented China-aligned threat cluster tracked as Bronze Sandcastle conducted cyber-espionage campaigns against organizations in the Philippines, Taiwan, Afghanistan, Namibia, and South Korea. The group's signature technique is DLL sideloading via legitimate Sandboxie executables, where a malicious sbiedll.dll is planted alongside trusted, digitally signed binaries to execute attacker-controlled code in memory. Encrypted config.ini payloads deploy a full-featured backdoor capable of keylogging, screenshot capture, network enumeration, and C2 communication over public file-sharing services and GitHub repositories, minimizing static detection and leaving minimal disk artifacts. Bronze Sandcastle exemplifies a maturing pattern among China-nexus APTs: abusing trusted application ecosystems and living-off-the-land techniques to bypass endpoint defenses. As DLL sideloading variants proliferate across APT41, Mustang Panda, and now Bronze Sandcastle, defenders face mounting pressure to shift from file-based detection toward behavioral monitoring of in-memory execution chains and anomalous outbound traffic.
SafePay Ransomware: How 600+ Organizations Were Compromised Through Unpatched VPNs and Flat Networks
Since August 2024, the SafePay ransomware group has compromised at least 600 victims across critical infrastructure sectors in North America, South America, Europe, and Australia. Threat actors gain initial access by exploiting unpatched VPN and edge-device vulnerabilities—including CVE-2020-3259, CVE-2023-20269, CVE-2023-27532, CVE-2024-40711, and CVE-2024-40766—and through brute-force credential attacks using Mullvad VPN exit nodes. Once inside, actors employ living-off-the-land binaries (PsExec, WinRM, RDP), disable security tooling, escalate privileges via UAC bypass and token impersonation, and exfiltrate data with FileZilla, RClone, WinSCP, and Backblaze B2 before encrypting files with a hybrid ChaCha20/RSA scheme and demanding cryptocurrency ransoms. SafePay ranked among the most active ransomware groups in 2026, demonstrating that double-extortion operations targeting unpatched edge devices and flat, under-segmented networks remain highly effective. The group's systematic abuse of legitimate administrative tools underscores a growing industry-wide challenge: distinguishing malicious LOTL activity from routine IT operations without robust east-west visibility and zero-trust segmentation controls.
PHP2Shell: How Two Critical RCE Flaws in the PHP Runtime Expose Every Cloud Workload Running PHP
In October 2026, the PHP project issued emergency patches for two critical remote code execution vulnerabilities—CVE-2026-109618 and CVE-2026-109619, collectively dubbed PHP2Shell—rated 9.2 on the CVSS v4.0 scale. Discovered by researchers at Wiz, Calif, and OpenAI's Codex Security team, the flaws reside in the PHP runtime engine itself, meaning every web application running on a vulnerable PHP version is exposed regardless of application-level security. Attackers can execute arbitrary code without authentication, with Apache mod_php servers at highest risk. Early exploit attempts were observed by Cloudflare before patches shipped, and organizations including BambooHR and Dutch government portals took services offline as a precaution. Fixed versions are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. This incident underscores a growing trend of AI-assisted vulnerability research accelerating exploit development timelines from months to days. The PHP2Shell flaws affect an estimated 77% of all websites using server-side languages, making this one of the broadest-impact web infrastructure vulnerabilities in recent years and raising urgent questions about runtime-layer security hygiene.
PHP's Worst Day in Years: CVE-2026-109618 & CVE-2026-109619 Put Every Web Server at Risk
On October 21, 2026, the PHP project released emergency patches for two critical vulnerabilities—CVE-2026-109618 and CVE-2026-109619—affecting all PHP versions from PHP 5 through the latest releases, with a combined CVSS score of 9.4. CVE-2026-109618 enables remote code execution through out-of-memory corruption via malformed multipart MIME requests that bypass post_max_size controls, while CVE-2026-109619 exploits a use-after-free condition triggered by improper global state resets between worker requests. Proof-of-concept exploits were publicly released before the patch, and Cloudflare confirmed active in-the-wild exploitation within hours of disclosure. Organizations running PHP-based web applications—covering an estimated 77% of all server-side web infrastructure—faced immediate, widespread exposure. This incident underscores the systemic risk of pre-patch PoC availability colliding with mass-deployed open-source runtimes. The combination of unauthenticated remote code execution, a massive attack surface, and rapid weaponization mirrors the Log4Shell pattern, reinforcing the urgency of runtime traffic inspection and egress controls as compensating measures when patch cycles lag exploit availability.