Cyber Threat Intelligence 27 October 2026

NCSA_THAICERT

Industrial Sector

Industrial Vendors Check Products For PHP2Shell Vulnerabilities
"Industrial giants such as Siemens, Schneider Electric, ABB, Rockwell Automation and Johnson Controls have published advisories to inform customers about the impact of the recently disclosed PHP2Shell vulnerabilities on their products. Several of these companies have confirmed that some of their industrial and operational technology (OT) products are affected. Others are still assessing exposure or have determined that their products are not impacted. PHP2Shell is the name given to CVE-2026-109618 and CVE-2026-109619, two critical flaws in the PHP engine that can be exploited for unauthenticated remote code execution. PHP patched them on October 21 with versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35, after information leaked online ahead of the planned disclosure."
https://www.securityweek.com/industrial-vendors-check-products-for-php2shell-vulnerabilities/

New Tooling

Witness: Open-Source Framework For Verifying How Your Software Was Built
"Witness is an open-source command-line tool that records how software gets built, signs that record, and checks it against a policy before the software ships. TestifySec built Witness and donated it to the in-toto ecosystem within the Cloud Native Computing Foundation, and an open community now maintains it. A compiled binary doesn’t say which machine built it or what code went in. Witness lets a team check which command produced the file, which materials went into it, and whether a trusted key signed each step. When a check fails, witness verify exits with a non-zero status and states the reason, which gives a CI job something concrete to stop on."
https://www.helpnetsecurity.com/2026/10/26/witness-open-source-software-supply-chain-tool/
https://github.com/in-toto/witness
Introducing The Elephant-Goldfish Model Plugin: Scaling Design-Driven AI Software Development
"AI-powered velocity is transformative; however, it has silently introduced a potential reliability crisis by also increasing the velocity of “slop,” bugs, and session context collapse. Generative AI tools excel at increasing coding speed, but pure speed without structured guardrails means we are often auto-scaling our mistakes rather than simply writing code faster. We need a paradigm shift, aligning the human need for system comprehension with AI’s capacity for execution."
https://opensource.googleblog.com/2026/10/introducing-elephant-goldfish-model-plugin.html
https://github.com/google/elephant-goldfish-model
https://www.helpnetsecurity.com/2026/10/26/google-elephant-goldfish-model-plugin/

Vulnerabilities

Two Critical Wasmtime Flaws Could Let Malicious WebAssembly Modules Escape Sandboxes
"Two critical flaws in Wasmtime, a WebAssembly runtime that can be built into other software, could allow a malicious WebAssembly module to escape the sandbox intended to contain it, the project's maintainers say. An attacker would first need a vulnerable Wasmtime build to compile a module they control, and one of the flaws affects only ARM64 systems. Fixed versions were released on October 19 and 20, and the maintainers have not reported any attacks."
https://thehackernews.com/2026/10/two-critical-wasmtime-flaws-could-let.html
Microsoft Releases Emergency .NET Patches For Critical Brotli Flaw
"Microsoft released emergency .NET security updates to patch a critical vulnerability known as Broccoli2Shell, also tracked as Node2Shell and HTTP2Shell. Tracked as CVE-2026-111497, this critical-severity flaw stems from an out-of-bounds write in the Brotli decoder, which expands data compressed using Google's widely used Brotli lossless compression algorithm. HTTP2Shell impacts HTTP clients and servers, as well as other applications and tools that rely on vulnerable Brotli implementations."
https://www.bleepingcomputer.com/news/microsoft/microsoft-releases-emergency-net-patches-for-critical-brotli-flaw/
https://devblogs.microsoft.com/dotnet/dotnet-october-2026-oob-security-updates/
https://thehackernews.com/2026/10/php-issues-second-windows-security.html
https://www.infosecurity-magazine.com/news/microsoft-patch-update-net-flaw/
https://www.securityweek.com/node2shell-brotli-flaw-triggers-patching-across-microsoft-node-js-python-packages/
https://www.theregister.com/security/2026/10/26/microsoft-releases-emergency-net-security-fixes-for-google-brotli-bug/5305515
Detecting And Mitigating ZDI-CAN-33367 And Five Other Linux Flaws
"A working root exploit for a Linux kernel bug is now public, before it has a CVE or a merged fix. On October 20, 2026, Trend Micro’s Zero Day Initiative (ZDI) sent one report, a bug in the ConnMan network manager, to the public ConnMan mailing list. On October 21, ZDI sent five reports to the Linux kernel security team and copied public mailing lists on every one. The reports included reproduction details, showing that several had no patch attached and no fix in any released kernel. Two of the Linux flaws have been rated as CVSS 9.0."
https://www.sysdig.com/blog/detecting-and-mitigating-zdi-can-33367-and-five-other-linux-flaws
https://www.infosecurity-magazine.com/news/linux-flaws-exposed-before-fixes/
An Alignment Assessment Of The UK AISI Cybertesting Incident
"On August 4, 2026, the UK AI Security Institute (AISI) published a report that detailed some concerning behavior it observed from Claude Mythos 5 during its testing of the model’s cyber capabilities. In AISI’s evaluation, Mythos 5 was given a capture-the-flag (CTF) cybersecurity challenge, in which it was asked to retrieve a protected piece of data (the “flag”) from a simulated network. Internet access was deliberately enabled (this was standard for AISI’s cyber testing at the time, but is no longer). The cyber safeguards we deploy with general release models like Fable 5 were disabled. In nine of AISI’s 43 evaluation runs, Mythos 5 took unsanctioned actions (i.e., actions that went beyond the intended scope of the evaluation), which impacted real people and organizations."
https://www.anthropic.com/research/alignment-assessment-ukaisi
https://securityaffairs.com/201729/ai/anthropic-reveals-how-claude-mythos-5-crossed-security-testing-boundaries.html
CISA Adds Two Known Exploited Vulnerabilities To Catalog
"CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog and updated the PHP Alert, Critical Vulnerabilities in PHP Require Immediate Patching:
CVE-2026-109618 – PHP Memory Corruption Vulnerability
CVE-2026-109619 – PHP Stale Internal Request-State Vulnerability"
https://www.cisa.gov/news-events/alerts/2026/10/26/cisa-adds-two-known-exploited-vulnerabilities-catalog

Malware

Gheist: Attempted Scaled Abuse Of Stolen GitHub Tokens Stumbles
"Since September 15, 2026, Wiz Research has been tracking Gheist: a new campaign performing mass abuse of compromised GitHub tokens. The attack commits a workflow named sync-check to every repository to which each token has access. The workflow seeks to print the repository's secrets into its own workflow log. Then, the tool downloads the log through the GitHub API and deletes the run seconds later. The tool's API requests carry the user agent gheist, which gives the campaign its name. We have recovered more than 13,500 planted branches from more than 850 compromised accounts, ranging from personal projects to enterprise organizations' private repositories."
https://www.wiz.io/blog/gheist-attempted-scaled-abuse-of-stolen-github-tokens-stumbles
https://thehackernews.com/2026/10/gheist-uses-stolen-github-tokens-to.html
https://www.darkreading.com/cyberattacks-data-breaches/gheist-stolen-github-tokens-cloud-secrets
https://www.infosecurity-magazine.com/news/gheist-attackers-abuse-stolen/
Deepveindrilling[.]com: Magento CMS Block Loader Hits 953 Stores
"deepveindrilling[.]com is the newest web address of a criminal group that breaks into online stores. The group adds a small piece of code to the store's pages. When you visit, that code makes your browser ask the group's server what to do next. The server first checks whether you are a real shopper or a security scanner, so scanners get nothing. The group has done this to 953 stores since July 2025, mostly Magento shops. It moves to a new address every few months."
https://sansec.io/research/magento-cms-block-loader-deepveindrilling
https://thehackernews.com/2026/10/hackers-infect-953-online-stores-with.html
https://www.securityweek.com/953-online-stores-infected-in-long-lasting-malware-campaign/
https://securityaffairs.com/201795/malware/magento-campaign-infects-953-online-stores-across-five-domains.html
Beyond The Inbox: How Threat Actors Abuse Microsoft Teams External Chat For Initial Access
"Arctic Wolf Labs has observed a recurring social engineering pattern in hundreds of cases where threat actors have used Microsoft Teams’ external chat creation feature for impersonation scams, or to deliver malicious files. A consistent pattern of attacker behavior has emerged across these incidents: the use of the same throwaway tenants, the same “IT Support (Internal)” display names, the same remote-access tools, and increasingly, the same payload domains."
https://arcticwolf.com/resources/blog/threat-actors-abuse-microsoft-teams-external-chat-for-initial-access/
https://thehackernews.com/2026/10/attackers-use-microsoft-teams-it.html
uCreator: Virtualization-Based Android Spyware Platform Targeting WeChat, Telegram And Other Messaging Apps
"uCreater (the vendor's own name for the product is YingGai) is a commercial Android surveillance platform built around 群控 (“mass control”). Branded through packages in the com.ucreator.* namespace, it is not a single malware family but a productized framework: a VirtualApp/LSPatch engine, a library of per-application hook modules, a Redis and HTTP control plane, a cloud-phone farm for live screen control, and a Windows operator console. Customers can rent the platform and deploy its capabilities against different applications on a target device. Despite this breadth and multi year usage, I found little public threat reporting documenting the platform's architecture."
https://www.0x0v1.com/ucreator-virtualization-based-android-spyware-platform-targeting-wechat-telegram-and-other-messaging-apps/
https://thehackernews.com/2026/10/ucreator-android-spyware-can-steal.html
https://securityaffairs.com/201764/malware/researchers-uncover-rentable-android-spyware-ucreater-targeting-wechat-and-telegram.html
Ukraine Warns Hackers Are Exploiting Chinese-Made Dahua Surveillance Cameras
"Ukrainian government cybersecurity researchers have warned that hackers are gaining unauthorized access to surveillance cameras made by Chinese manufacturer Dahua, potentially exposing video feeds and allowing attackers to remotely control the devices. Ukraine's computer emergency response team, CERT-UA, said late last week that it had identified cases in which hackers compromised the internet-connected cameras and video recorders, changed their settings and created unauthorized user accounts. The agency did not say how many devices had been compromised, when the attacks occurred or who was responsible. Chinese-made surveillance equipment remains widely used in Ukraine, including by government institutions and military units."
https://therecord.media/ukraine-cert-ua-warning-chinese-dahua-cameras-hacked
Testmetest Npm Packages Carry a Miasma-Family Worm
"An operator is testing a Miasma-family npm worm in public. Between 19 and 25 October 2026, npm received 18 packages from the same operator. The accounts alexjoipamiba, testnewtestme and iobandamwer published seven of them. The malicious versions steal credentials, spread to other packages and repositories, and install a wiper that deletes the home directory when the victim revokes the stolen GitHub token."
https://safedep.io/testmetest-npm-worm-miasma-variant/
https://www.theregister.com/security/2026/10/26/worm-armed-42-github-repos-by-hiding-a-payload-too-big-to-fail/5305570
CYFIRMA Threat Advisory: Suspected DPRK Campaign Staging PHP2Shell Targeting Against Global PHP Infrastructure
"Early Warning – PHP2Shell (v3): Suspected DPRK Campaign Staging PHP2Shell Exploitation Against Global PHP Infrastructure. Korean-speaking operators have filtered a 216-host target set and are running low-and-slow PHP weakness checks from 21 compromised nodes against CVE-2026-109618 and CVE-2026-109619 (CVSS v4.0 9.2, unauthenticated RCE in PHP core). This update carries the full Version 1–2 assessment forward."
https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-global-php-infrastructure/
https://securityaffairs.com/201748/hacking/php2shell-suspected-north-korean-campaign-targets-216-vulnerable-php-hosts.html
Qilin And Japan: Attackers Probing Japanese Networks
"Japan is in an unusually intense run of cyber incidents, and Qilin is the ransomware group to watch. This report combines network analysis in KELA CONTROL with KELA’s monitoring of leak sites and cybercrime forums. It shows a Qilin affiliate server scanning Japanese VPN portals, sets out how Qilin became the most frequent ransomware claimant against Japan in KELA’s data, maps the affiliates and brokers behind it, and closes with recommendations and indicators of compromise."
https://www.kelacyber.com/resources/research/qilin-ransomware-japan/
Enter 666: Unmasking Beast Ransomware
"AttackIQ has released a new assessment that emulates the Tactics, Techniques, and Procedures (TTPs) associated with Beast Ransomware to help customers validate their security controls and their ability to defend against this threat. By using this emulation in the AttackIQ Adversarial Exposure Validation (AEV) Platform, security teams will be able to: Evaluate security control performance against baseline behaviors associated with Beast Ransomware. Assess their security posture against an opportunistic adversary. Continuously validate detection and prevention pipelines against a realistic playbook."
https://www.attackiq.com/2026/10/23/beast-ransomware/

Breaches/Hacks/Leaks

DreamHost Forces Password Resets In Ongoing "incident"
"DreamHost has forced password resets for email and FTP/SFTP users following an incident that disrupted connections to the File Manager interface. The latest update from the web hosting provider notes that all affected account owners have received recovery instructions. Users will be unable to log in until their account owner sets new credentials. DreamHost is a U.S. web hosting provider and domain registrar that offers WordPress hosting, business email, virtual private servers, dedicated servers, and cloud services."
https://www.bleepingcomputer.com/news/security/dreamhost-forces-email-ftp-sftp-password-resets-in-ongoing-incident/
University Of Copenhagen Data Breach Exposes Data Of 525,000 People
"The University of Copenhagen in Denmark confirmed that hackers accessed one of its test environments containing personal data belonging to 525,000 people. The educational organization detected the breach last Tuesday and disclosed it on Friday. In an update yesterday, the university added another 20,000 staff and students whose PIN codes were exposed. “The University of Copenhagen has confirmed a cyber attack in which hackers gained access to one of the university’s test environments,” the university says."
https://www.bleepingcomputer.com/news/security/university-of-copenhagen-data-breach-exposes-data-of-525-000-people/
Genesys Hack Exposes Customer Data From Internal Systems
"Customer experience company Genesys says it has contained a cyberattack that involved unauthorized access to data. Headquartered in Menlo Park, California, Genesys is a provider of customer experience and call center technology for mid-sized and large organizations. On October 19, the company announced that hackers had accessed internal business systems, including a learning management system (LMS) and a customer relationship management (CRM) environment."
https://www.securityweek.com/genesys-hack-exposes-customer-data-from-internal-systems/

General News

Former Pentester Used ARTEX AI To Steal 8.2 Million Data Records
"South Korean police identified seven suspects linked to a cybercrime operation that breached more than 90 organizations in the country, with ARTEX AI pentesting framework used in most of the attacks. According to local media citing the Seoul Metropolitan Police, the gang leader has a background in penetration testing and worked at a cybersecurity company between 2019 and 2022. In 38 of the incidents, the threat actor demanded ransom payments of 360 million won ($270,000), promising in exchange not to leak stolen data."
https://www.bleepingcomputer.com/news/security/former-pentester-used-artex-ai-to-steal-82-million-data-records/
Risks & Rewards: How AI Is Redefining The CISO's Role
"The CISO role is evolving around AI, with security leaders now expected to help the business gain a competitive edge with it while also using the technology to help manage cyber-risk. Doing both jobs at once means keeping up with technology that changes by the month, Mark Weatherford, Nvidia's head of cybersecurity policy and strategic engagement, said this week at the ISC2 Strategic Congress 2026."
https://www.darkreading.com/cybersecurity-careers/risks-rewards-ai-redefining-ciso-role
Security Pros Reckon The Biggest AI Risk Comes With An Employee Badge
"Employees pasting company data into AI tools worry security teams more than AI-powered attacks do. AI-generated phishing, the attack they run into most often, made the list of top concerns for only a quarter of the 209 security professionals O’Reilly surveyed in September. Mike Loukides, VP of content strategy at O’Reilly Media, believes the fear of AI wiping out humanity distracts from harm happening today. “We don’t need panic. We need an assessment of where we are: What are the threats? Where are the skills gaps? Where is the budget?” he wrote."
https://www.helpnetsecurity.com/2026/10/26/ai-tools-security-worry-survey/
AI Slop Is Piling Up Highest On The Biggest Open-Source Projects
"The maintainers of large open source projects are taking the worst of the AI slop. In a Linux Foundation survey of 234 open source contributors and maintainers, people running projects with more than 50 contributors estimated that close to a third of the code changes landing in their queue are low quality or AI-generated. Those maintainers now worry more about burning out than about the code itself. Across all projects, the estimate comes to about one in four. Each of those submissions, called a pull request, has to be read by a person before it gets merged or rejected. That person is a maintainer, and every piece of junk in the queue takes time away from the work that keeps the project running."
https://www.helpnetsecurity.com/2026/10/26/linux-foundation-open-source-ai-slop/
Forgotten AI Agents May Still Access Sensitive Company Data
"AI agents that have not run recently retain credentials and connections to company systems, according to Arrakis Security’s 2026 Autonomous Agents Threat Report. About 76% of enabled agents examined had not run in 60 days, leaving access available through inactive software. The analysis covered thousands of agents in customer production environments over a 12-week period. These programs can read and write data, call tools and start workflows, giving them the ability to perform tasks across business services."
https://www.helpnetsecurity.com/2026/10/26/arrakis-dormant-ai-agent-risks-report/
AI-Generated Fake Bank Calls And NFC App Enabled €380,000 Fraud, Dutch Police Say
"Rotterdam police have arrested two men over a new type of bank fraud that used AI-generated phone calls, a fake banking app, and NFC technology to steal bank card data. In just three weeks, the scheme allegedly cost 170 victims around €380,000. “Rotterdam police arrested two suspects accused of a new form of bank-helpdesk fraud. The operation allegedly caused around €380,000 in losses for 170 victims in just three weeks.” NL Times reports. “The suspects allegedly used AI-generated phone calls and a fake banking app to copy victims’ bank cards remotely, allowing accomplices to withdraw thousands of euros. Victims came from across the Netherlands and ranged in age; dozens were in their twenties and thirties.”"
https://securityaffairs.com/201786/cyber-crime/ai-generated-fake-bank-calls-and-nfc-app-enabled-e380000-fraud-dutch-police-say.html
https://www.securityweek.com/dutch-police-arrest-two-over-nfc-relay-attacks-that-drained-400000/

อ้างอิง
Electronic Transactions Development Agency (ETDA)