A new round of the weekly Security Affairs newsletter has arrived! Every week, the best security articles from Security Affairs are free in your email box.

Enjoy a new round of the weekly SecurityAffairs newsletter, including international press.

International Press – Newsletter

Cybercrime

How hackers broke into four of Canada’s top law firms, stole client files and caused chaos

Polymarket Pauses Trading as Prediction Market Investigates Security Incident

From help desk impersonation to AD CS abuse: Investigating ESC1 and ESC8 intrusion paths

29 October Binance Security Incident: Initial Findings and Response Update     

“Black October” for AI Developer Platforms  

Canadian man extradited to the U.S. for his role in computer hacking scheme targeting universities  

ARTEX Exposed: Mapping the Infrastructure Behind the South Korean Bank Breaches

French bank Credit Mutuel Arkea says €100 million missing after cyberattack  

Malware

Shutting the Door on the XCPE Botnet  

Free the Model, Sell the Gateway: Prompt Adware hidden in Jailbreak Bundles  

Hackers hijack cPGuard autoupdate to deploy backdoor, steal data  

CWPdoor: The Invisible Backdoor Living Inside Control Web Panel  

Hacking

SMS of Death 

Chainalysis Security Incident Information  

Russia and Ukraine say emergency alert apps were hit by apparent cyber-attacks  

European supermarkets hit by new fridge cyber attack  

The Rise of LLMJacking: How Threat Actors Monetize Compromised Cloud and Model Resources

Securing Muse: More Than $1 Million in Bug Bounties Paid Out  

WorkOS October 30th, 2026 Data Security Incident  

A thousand fewer paths to root

ThisBash Escape: Claude Dispatch Flaw Enables Browser Extensions RCE on the OS 

Barracuda Networks is your new best friend (Barracuda Email Security Gateway Pre-Auth Remote Root RCE CVE-2026-116606 / CVE-2026-111560) 

Intelligence and Information Warfare  

North Korea Responsible for $6 Billion+ Binance Attack  

Russia funded Facebook and Twitter investments through Kushner investor

Unknown APT uses NetamLoader to attack a Win10 OS customized for governments in Asia

French blood banks hit alongside cyberattack on European supermarkets

UK and Germany to jointly develop military AI in 2027 

Apple threat notifications regarding Mercenary Spyware  

DarkBlinders: Inside an Active Espionage Campaign

Poisoned Source: APT29 watering holes target mobile devices with n-day exploits

Russian Federal State Statistics Service says it was hit by massive cyberattack — hackers steal 23TB of data, including Ukraine war casualty figures

The Google Whistleblower Taking on Big Tech Over Its Role in Gaza  

Weekly Wire #17: Hybrid war hits home  

Cybersecurity

Israeli startups raised at least $872 million in October, led by cybersecurity and AI 

Europe on alert after supermarket freezers hit by cyber-attacks in 10 countries  

Joint statement on cyber incidents in refrigeration systems across the EU  

GPT‑6 Cyber: Advancing the frontier of aligned cybersecurity agents

Residential Proxies Detected on White House Network  

European refrigerator controller redux: A new wave of refrigeration attacks

Hundreds of Mundane AI Apps Are Hiding Sexually Abusive Deepfake Features       

Japan announces emergency cybersecurity package following a wave of attacks   

ThisBash Escape: Claude Dispatch Flaw Enables Browser Extensions RCE on the OS  

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, newsletter)

Binance probes suspicious crypto transfers worth up to $5.8 billion as Tether and Circle freeze $1.79 billion in stablecoins linked to the activity.

Binance is investigating a potential security incident after billions of dollars in cryptocurrency moved from wallets linked to the exchange on October 29. The transfers raised concerns about a possible hack, while Tether and Circle moved to freeze stablecoins linked to the suspicious activity. The full scope of the incident remains unclear, and the reported outflows shouldn’t automatically be treated as confirmed losses.

According to The Block, blockchain analyst Spreek identified approximately $3.55 billion in incoming transfers to an initially unidentified wallet.

“Onchain data flagged by analyst Spreek shows about $3.55 billion in incoming transfers to the unlabeled wallet, with nearly $900 million subsequently moved across other wallets.” The Block reports. “Conor Grogan, a senior director and product leader at Coinbase, says the amount is up to $5.8 billion.”

Coinbase executive Conor Grogan estimated that the total value of the movements could reach $5.8 billion.

These figures come from blockchain tracking and different estimates, so they don’t necessarily represent the amount stolen.

Binance acknowledged the reports and said its security team was investigating. The company had not publicly confirmed a breach in the initial reports, making it important to distinguish between suspicious transactions and a verified compromise.

“We are aware of reports of a potential security issue and we are actively investigating.” He wrote in a post on X. “Our security teams are reviewing all relevant information with urgency, and we will provide updates through official Binance channels as soon as we have verified information. Users should remain cautious of scams and should not trust unofficial links, messages, or requests for account information.”

This statement, reported by The Block, reflects the company’s position at the time. Binance also urged users to be cautious of unofficial messages and links, a relevant warning whenever a major security incident attracts public attention.

Blockchain records showed large transfers from Binance-linked hot wallets to a wallet that wasn’t previously identified as belonging to the exchange. Hot wallets hold cryptocurrency in systems connected to the internet, allowing exchanges to process withdrawals and other transactions quickly. Their online availability also makes their security controls particularly important.

The transfers involved Ethereum, stablecoins and other cryptocurrencies. Some funds were later moved to additional wallets, making it harder to track all the transactions.

Investigators must determine who initiated the transfers, whether they were authorized and whether an attacker gained control of the wallets. They also need to establish whether the funds belonged to customers or Binance itself.

Large transfers alone don’t prove a hack. However, unusual movements involving large amounts of cryptocurrency require immediate investigation.

One of the most significant developments was the response from the companies behind two major stablecoins, USDT and USDC. According to The Block and Forbes, Tether and Circle froze approximately $1.79 billion in stablecoins associated with the suspicious transfers in the initial reports.

The figures subsequently changed as the investigation developed. Tether CEO Paolo Ardoino later said the company had frozen more than $1.567 billion in USDT linked to a potential Binance exchange hack. These amounts reflect reported actions at different points in time and shouldn’t be combined without checking whether they refer to distinct assets and addresses.

The freezes demonstrate an important feature of centralized stablecoins: their issuers can restrict transfers from addresses they control through their token contracts. This can help contain suspected theft, but it doesn’t provide the same control over assets such as Ether or Bitcoin. Nor does freezing a balance guarantee that every transferred asset can be recovered.

The incident also highlights a practical tension in crypto security. Stablecoins offer the convenience of blockchain transfers, but their centralized issuers retain powers that can make a difference during an investigation.

Binance maintained that customer funds were safe, while co-founder Changpeng Zhao, widely known as CZ, said the activity appeared to be a hack. Zhao no longer manages Binance’s platform, but said he expected customers’ funds to be fully covered.

The company said its user funds were “completely safe.”

“Our teams are aware of reports of a potential security issue and are actively investigating. User funds are completely safe. Our security teams are reviewing all relevant information with urgency, and we will provide updates through official Binance channels as soon as we have verified information.” the company states. “Users should remain cautious of scams and should not trust unofficial links, messages, or requests for account information.”

That assurance is important, but it doesn’t replace a technical explanation of how the transfers occurred or independent confirmation of the final impact.

A security investigation must establish more than whether an exchange can cover a potential loss. It should determine how the activity was authorized, whether credentials or signing mechanisms were compromised, which systems were involved and whether the attacker retained any access.

For customers, the immediate priority is to avoid becoming a secondary victim. Attackers often exploit uncertainty around a major incident to distribute fake announcements, impersonate support staff and direct users to fraudulent websites. Users should rely on official Binance communication channels, avoid unexpected links and never disclose passwords, authentication codes or wallet recovery phrases in response to unsolicited messages.

Security teams should also watch for phishing emails that use the incident to demand urgent account verification. Attackers may exploit the situation to launch a separate scam.

The key lesson is that blockchain transparency does not guarantee operational security. Public ledgers show transactions, but they don’t reveal who authorized them, how attackers may have gained access or whether an exchange’s internal security controls failed.

As the investigation continues, it’s important to distinguish between reported transfers, confirmed theft and funds that can be recovered. The figures may change as analysts trace more wallets and stablecoin issuers take further action.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Binance)

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Google Brotli and Adobe Commerce and Magento flaws to its Known Exploited Vulnerabilities catalog.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added Google Brotli and Adobe Commerce and Magento vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog:

Below are the flaws added to the catalog:

• CVE-2026-111497 (CVSS score: 9.2) – An unchecked return value vulnerability in Google Brotli that could allow a remote, unauthenticated attacker to corrupt decoder memory, expose sensitive information, cause a denial-of-service, or potentially execute arbitrary code by sending a specially crafted Brotli-compressed stream.
• CVE-2026-48356 (CVSS score: 9.3) – An unrestricted file upload vulnerability in Adobe Commerce and Magento that could allow an attacker to execute arbitrary code with the privileges of the current user, potentially gaining elevated access or taking control of the victim’s account or session.

Brotli is a data-compression algorithm developed by Google.It reduces the size of web content, such as HTML, CSS, JavaScript, and other text-based resources. Security researchers have observed exploitation attempts targeting CVE-2026-111497 (aka Node2Shell), a critical flaw in Google’s Brotli library. Previdian recorded one attempt by October 27, while ELLIO researchers recently detected traffic carrying a public exploit that could execute code on vulnerable systems. The activity may indicate attempts to exploit the flaw on a larger scale, but its scope remains unclear. An attacker can trigger the vulnerability to cause crashes, expose sensitive memory or remote code execution when applications decompress attacker-controlled Brotli data. Because Brotli is widely used, multiple projects and vendors have released security updates, including Node.js, PHP, Bun, and Microsoft .NET. Cybersecurity firm Wiz warned that 91% of cloud environments contain resources vulnerable to the flaw, while 82% have publicly exposed Node.js instances.

The second flaw added to the catalog is an unrestricted file upload vulnerability tracked as CVE-2026-48356, dubbed PolyShell. Recently WordPress security firm Sansec warned of attacks exploiting CVE-2026-48356 to infect at least 953 of online stores. The attackers reportedly used a Magento CMS block to insert a malicious loader capable of retrieving and executing a payload hosted under their control.

So far, researchers have not recovered the subsequent payload, leaving the campaign’s ultimate objectives unclear. The activity is believed to have been underway since at least July 2025 and remains ongoing.

According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.

Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure.

CISA orders federal agencies to fix the flaws by October 29, 2026.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, CISA)

Sansec tracks a Magento skimmer campaign that infected 953 stores, using five domains, bot filtering and malicious code hidden in CMS blocks.

A criminal group has infected 953 online stores since July 2025, mostly Magento shops, according to Sansec researchers. The attackers add a small piece of code to store pages. When someone visits a shop, their browser contacts the attackers’ server to get further instructions. The server checks whether the visitor is a real shopper or a security scanner. If it detects a scanner, it hides the malicious activity.

“deepveindrilling.com is the newest web address of a criminal group that breaks into online stores. The group adds a small piece of code to the store’s pages.” Sansec’s analysis states. “The group has done this to 953 stores since July 2025, mostly Magento shops. It moves to a new address every few months.”

The group’s latest domain is deepveindrilling.com. Sansec found it in the CMS blocks of 83 stores, almost all running Magento. CMS blocks are content sections that Magento adds to store pages. The domain was registered on October 6, 2026, and the first stores began loading it the following evening.

This is the fifth domain linked to a campaign that Sansec has tracked since July 2025 and reported in March as the PolyShell mass attack. Most stores using the latest domain had already been targeted. Of the 83 stores, 60 had previously loaded one of the group’s malicious scripts, and 34 had been doing so since October 2025.

The domain sits behind Cloudflare, and its front page returns a 404. It only answers script requests from visitors of infected stores. The loader code lives in the cms_block table, and Sansec’s scanner, eComscan, found it there on 148 server installs over the campaign, never in core_config_data or theme files.

eComscan first found the new loader at 21:54 UTC on October 7. By the end of October 8, Sansec’s crawler had found it on 74 stores, as two scripts. The first reads a value called fpCode from the visitor’s browser storage, and when the value is set, the script puts the stored code in an invisible div and clicks it. The browser then runs the code as an event handler, without using eval().

Nothing in the block writes fpCode, so the script from deepveindrilling.com has to set it. A visitor who received the payload once runs it again on every later page view, even when the domain is offline or blocked. The March version deleted its stored payload after one run.

On October 23 the operator rewrote the blocks again, and the loader appeared on 9 more stores. All 71 stores Sansec re-crawled by October 24 run the new version. It replaces the plain script tag with an inline loader that sends a browser fingerprint to https://deepveindrilling.com/?s=49b7ca5f&fp=.

The fingerprint flags automated browsers through navigator.webdriver, Selenium globals and ChromeDriver’s cdc_ properties. It also adds the GPU name from WebGL, CPU cores, memory, screen size, time zone, languages and client hints. The server picks its response from all of that.

The filter works. When urlscan.io loaded an infected store with an automated Chrome browser, it got HTTP 200, and Sansec found no added content in the page. Sansec hasn’t captured the final payload yet.

Older payloads give a hint of what real visitors get. Sansec Watch, the firm’s monitoring service for content security policies, shows what the earlier stage served. On December 12, 2025, a customer logged in to an infected store got a script from manulfie.click that loaded https://crypto-insider.top/ssl/ and, five minutes later, https://leqdger.click/ssl/.

On December 15 and 16, neswnsssn.click inserted the same leqdger.click script on two more stores. leqdger.click is a misspelling of the crypto wallet brand Ledger. It was registered on September 12, 2025 and has since expired.

Before October, the second script was the “Script (async)” integration of Keitaro, a commercial ad tracker that doubles as a traffic distribution system, a tool that sorts visitors. It sends the referrer, page title and query string to a base64 encoded URL such as https://additionalver.com/Mb2z8J?&se_referrer=, where the path is the Keitaro campaign alias. The system then decides per visitor whether to return a payload, a redirect or nothing.

“When Sansec requested the additionalver.com script as a Windows desktop visitor on October 24, it returned QWE=123;, a statement that does nothing, and set a cookie that marks the visitor for 24 hours. deepveindrilling.com drops Keitaro and moves the bot filtering into the loader.” continues the report.

Here are the five loader domains over 15 months:

Two other domains were found on a small number of stores: hdfdsi84j3h.top, registered three minutes after lanhd6549tdhse.top, and c85grt98sd.com.

Two older domains, neswnsssn.click and manulfie.click, expired and were registered again in May 2026. Both now use the nameservers of abovedomains.com, a domain parking service. Between August and October 2026, Sansec still found the manulfie.click loader on nine stores and the neswnsssn.click loader on six. When visitors open these stores, their browsers send information about the previous page and the current page title to the new domain owner. The browsers also run any script returned by that domain.

Sansec Watch received reports of visitors’ browsers connecting to all four earlier domains. One domain, additionalver.com, was linked to around 52,000 reports.

The October activity did not rely on a new vulnerability. Of the 83 affected stores, 60 had already been infected. Earlier attacks appear to have exploited file upload flaws in Magento. In March, the group injected its malicious code into 471 stores in just one hour by uploading webshells through PolyShell (CVE-2026-48356).

Some infected Magento stores had files uploaded through PolyShell or SessionReaper (CVE-2025-54236). In a separate group of 3,024 stores affected by another skimmer, the infection rate was 32%.

One Magento 2.4.7-p1 store contained PolyShell webshells disguised as PNG images, alongside malicious code in a CMS block. The code switched from additionalver.com to deepveindrilling.com on October 7. The store had not installed Adobe’s PolyShell fix, APSB26-73.

However, installing all patches does not guarantee a store is safe. Another store running Magento 2.4.7-p10 had no missing core patches but was infected on October 23. Earlier scans had already found a rogue admin account and a GSocket backdoor.

Sansec recommends checking CMS content for malicious code, including base64-encoded domains. Administrators should search both the cms_block and cms_page tables for suspicious patterns such as fpCode and se_referrer. They should also inspect uploaded files for webshells, check for unknown admin accounts, and look for suspicious processes. Removing the malicious scripts is not enough: store owners must also identify and fix the vulnerability or backdoor that allowed the attackers in.

After cleanup, change the database, admin and API integration passwords. Install APSB26-73 for PolyShell and APSB25-88 for SessionReaper. Sansec Shield blocks both attacks while you schedule the upgrade.

Sansec lists the indicators of compromise at the end of its report.

“If your store loads any domain from the indicators of compromise, the attacker can write to your database. Deleting the script does not remove that access. See How to check your store.” concludes the report.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Magento)

A new round of the weekly Security Affairs newsletter has arrived! Every week, the best security articles from Security Affairs are free in your email box.

Enjoy a new round of the weekly SecurityAffairs newsletter, including international press.

International Press – Newsletter

Cybercrime

U.K. Sanctions Cryptomus for RU Money Laundering

Anonymous hackers claim to leak 421,179 internal emails from Germany’s Russia-aligned AfD

Feds Suspect Ransom Negotiator Ran ShinyHunters Extortion Site

#StopRansomware: SafePay Ransomware     

Cybercrime crackdown in Africa nets 1,462 arrests, recovers over USD 105 million  

U.K. Sanctions Cryptomus for RU Money Laundering

Nigerian Man Sentenced To Eight Years For Hacking, Fraud, And Identity Theft Schemes  

1 Million Impacted by Capcom Data Breach  

Malware

Auditing the auditor: Unmasking Apex Accelerator

GhostAction Attack Escalates By Targeting GitHub Users      

Plex vulnerabilities being exploited in the wild to drop a cryptominer

ROMULUS: Analysis of a New Multi-Payload ClickFix Delivery Platform

Hackers Hijack Five OVHcloud CLI Releases to Distribute Secret-Stealing Malware

Hacking

ConnectWise (SkyKick) Vendor Credentials Abused in M365 Attacks  

One Parser, Two Bugs, Many Routers: Exploiting Broadcom WiFi Across eCos and Linux 

Plex2Shell Unauthenticated RCE in Plex Media Server  

Big Fish: Exploiting a 37-Year-Old Kernel Bug in OpenBSD 

Rapid Response: php2shell, Leaked Critical PHP Vulnerabilities (CVE-2026-109618 & CVE-2026-109619)

Making attacking agents pay  

LiteLLM Compromised in Supply Chain Attack Delivering Credential Stealer and Backdoor

Amazon Threat Intelligence identifies PHP2Shell exploitation prior to public disclosure in MadPot  

Proof-of-concept exploit released for PHP vulnerabilities (CVE-2026-109618, CVE-2026-109619)  

PHP2Shell Exploit Tooling Found on Exposed Attacker Server 

Intelligence and Information Warfare  

TAG-193’s Regional Espionage Operations

ATT&CK v20: Critical Infrastructure Campaigns, Adversary Use and Abuse of AI, & Iranian Cyber Espionage

No to Palantir – Five Times  

UK Election Watchdog Develops AI System to Flag Deepfakes Within 3 Hours  

Pegasus and Mercenary Spyware Attacks on Serbian Pro-Democracy Figures  

Russian satellite makes possibly unprecedented approach to another spacecraft without permission  

AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise  

Operation FlashHole: Lazarus breaks security, defies control

Pegasus spyware founder urges governments to trust his tech and ditch US AI   
  

Cybersecurity

Character.ai files for bankruptcy following lawsuits alleging ties to teen suicides  

Cybersecurity Jobs Report 235,786  

Agents are your newest insiders. Security must move at their speed  

Google Cloud services face outage in London, Revolut services down too  

Government websites go dark after AI-discovered flaw sparks security scramble  

Widespread PHP Flaw May Cause Many Site Outages Today

Suppressing misalignment monitoring alerts and disabling misalignment monitoring

AI Just Found a Bug That Puts up to 70% of the World’s Websites at Risk  

CVE-2026-113380 — RingRTC (Signal): Flooded Call Event Queue Blocks Local Hang-Up

Cellebrite’s Advanced Unlocks and the case of the missing iPhone 17  

Meta ordered to pay $25 billion penalty to New Mexico in data privacy case  

PHP Warns of Another Unpatched RCE Two Days After Emergency PHP2Shell Patches

Our latest defenses against evolving web scams  

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, newsletter)

AI companies need usage data to align pricing with costs, improve products, identify churn risks, and grow revenue through informed decisions.

The AI Paradox

There is a paradox: AI companies exist to extract intelligence from data, yet many have almost no visibility into how their own software is being used.

They design complex models, introduce their product, set a price, and then hope that customers renew their contracts. In a space as fast-paced as AI, such a strategy is no longer safe.

Without usage as a guide, price decisions are made on assumptions rather than facts. Product roadmaps are driven by story, not by usage. Customer success teams learn about customer churn when renewal dates are approaching.

In reality, usage intelligence has become one of the most important signals in an AI business, guiding everything from pricing strategy to product development and long-term monetization.

Why AI Changes the Stakes for Usage Data

AI changes the economics of software and, with it, the relevance of usage visibility. The economics of existing software products are linear in cost, whereas those of AI products are not. Compute, energy consumption, as well as third-party model licenses, can all be material variable costs.

If usage increases rapidly (through enterprise adoption, agents, or workflows), the cost can grow faster than the revenue generated if pricing is not aligned with consumption.

The opposite scenario is just as dangerous. If customers are not using key capabilities, churn may be approaching long before a renewal conversation begins.

Research shows the extent of this visibility gap. For AI vendors, visibility is important on the commercial side, too. They need to know how customers are using the AI capabilities they sell. IDC research found that 48% of software buyers want better visibility into their usage.

The pace of change is also a concern, with 70% ranking rapid change in the AI ecosystem among their top three AI-related security risks. Pricing, packaging, and business models must evolve at the same pace, and that requires reliable usage intelligence.

What Usage Intelligence Actually Looks Like

Of all the capabilities that make up a software monetization strategy, usage intelligence is the one most commonly treated as optional — and the one that most consistently separates companies that adapt from those that don’t. It is the feedback loop that connects real-world product consumption back to the decisions that shape pricing, packaging, and product direction.

At the instrumentation layer, usage intelligence starts with telemetry data. This includes activation events, entitlements consumed, feature-level data, daily and monthly active users, and time-to-value metrics that track how quickly customers get value from the product. Thales Sentinel can also collect usage data from on-premises, offline, and disconnected environments, so vendors are not limited to tracking always-connected software.

The operational layer is where all the telemetry data is made actionable. Usage dashboards in CRM systems enable account teams to see how customers use the software. Health scores can even detect reduced engagement well before any risk of renewal is seen.

The enforcement layer makes sure that usage is consistent with contract rights. This is particularly important for consumption-based or token-based pricing schemes. Tracking accuracy is essential for determining customer fairness and vendor revenue.

Finally, there is the feedback loop. The insights from usage need to flow back to those responsible for pricing, packaging, product development, and customer success. Without the feedback loop, the data is just more information.

Pricing specialists have long argued for incremental experimentation. Research from Simon-Kucher reveals that companies that make frequent, data-informed pricing adjustments tend to achieve stronger growth than those that depend on static pricing models.

Usage intelligence provides the evidence required to make those adjustments with confidence.

How Usage Data Enables Multiple Business Models

Business model agility is increasingly becoming a competitive advantage for AI companies, yet flexible business models cannot exist without trustworthy usage data beneath them.

Consumption-based pricing, outcome-based pricing, token models, and hybrid subscription structures all depend on accurate measurement of how customers use the product. There is demand for these models, too. IDC research found that 45% of software buyers prefer usage-based models.

In practice, most AI companies adopt a gradual sequence.

They begin with subscription licensing to establish predictable recurring revenue. As adoption grows, they instrument feature usage and engagement patterns. That data then enables the introduction of consumption or token-based layers tied to high-value AI capabilities.

One AI audio-recognition company did just that. It moved from perpetual licensing to several subscription tiers using Thales Sentinel. Its usage data showed which features customers used most, which helped the company decide how to structure those tiers without making changes to the core technology.

Another AI recognition vendor delivering SDKs for embedded systems took a different approach using Sentinel. Their trial licenses expire after a defined number of executions instead of after a fixed time period. This usage-based trial model demonstrates genuine customer interest, giving them a clearer indicator of product-market fit than a simple time-limited evaluation would.

Both examples show that usage intelligence transforms monetization strategies from guesswork into evidence-based decision-making.

From Data to Decision: Three Practical Applications

The real value of usage intelligence lies in informing concrete business decisions.

Preventing churn is one of the most immediate uses. Feature-level engagement metrics can detect declining usage several months before a renewal date. This enables customer success teams to step in and show the value or introduce underutilized features, preventing a customer from leaving.

Upsell and expansion opportunities can also show up in the usage data. Seat utilization may show that a team is close to capacity and needs more licenses. Feature usage can show when a customer is getting enough value from certain capabilities to justify moving to a higher tier or adding consumption-based features.

Usage data can also inform the product roadmap. Rather than relying on assumptions about what customers want, AI companies can see which features people use and which get little attention. This is key in a market full of similar AI capabilities. Companies need to know which parts of their product customers value and are willing to pay for.

There is also a need for the collection of usage intelligence to be privacy-conscious. For vendors operating under frameworks such as GDPR or the EU’s AI Act, it is necessary to design telemetry systems that prioritize aggregated data collection over personal data collection whenever possible.

The Organizational Challenge

However, technology alone is not enough to create usage intelligence. Businesses must also ensure that the intelligence is available to those who can act on it.

Usage intelligence only delivers value if it reaches the people who can act on it. Pricing teams need consumption data to make confident adjustments to their models. Product teams need feature engagement data to inform roadmap decisions rather than rely on assumptions. Sales teams need account-level signals to time their conversations correctly. Customer success teams need early warning indicators to intervene before disengagement becomes churn. Finance teams need usage trends to build credible revenue forecasts.

Getting that data to all of those functions consistently and in a usable form requires intentional data architecture and a shared organizational commitment to treating monetization as a cross-functional capability rather than a single team’s responsibility.

This becomes harder as companies add more AI products. If usage data is split across separate products, teams may struggle to see how a customer is using the wider portfolio. Bringing the data together can show where products are being heavily used, where adoption is low, and where there may be room to expand an account.

Building Systems Around Innovation

The AI companies that sustain long-term commercial success are the ones who built a system around it that can learn, adapt, and improve as markets shift and customer needs evolve.

Usage intelligence is what makes that system adaptive. Without it, pricing decisions are made on assumptions, packaging tiers are defined by intuition, and churn arrives without warning. With it, every commercial decision — what to charge, how to package, what to build next, which customers need attention — is grounded in evidence rather than expectation.

In an industry defined by rapid innovation, the AI companies that listen to their own usage data will be the ones best positioned to turn experimentation into sustainable growth.

About the Author: Kirsten Doyle has been in the technology journalism and editing space for nearly 24 years, during which time she has developed a great love for all aspects of technology, as well as words themselves. Her experience spans B2B tech, with a lot of focus on cybersecurity, cloud, enterprise, digital transformation, and data centre. Her specialties are in news, thought leadership, features, white papers, and PR writing, and she is an experienced editor for both print and online publications. She is also a regular writer at Bora.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, artificial intelligence)

PHP warns of a new, unlikely code execution flaw, CVE-2026-115560, and advises disabling session upload progress until a fix is released.

PHP has warned of a new code execution vulnerability, tracked as CVE-2026-115560, just two days after releasing emergency patches for the critical PHP2Shell flaws.

The vulnerability affects only a specific PHP configuration that PHP says is unlikely to be used in practice. An application must meet several conditions: it must configure session.serialize_handler as php_binary or php_serialize, change it to php at runtime using ini_set(), and make this change before calling session_start(). Session upload progress must also remain enabled.

In an advisory published on October 23, the project recommended disabling session upload progress until a fix becomes available in a regular release. The vulnerability is separate from PHP2Shell and is not fixed by the October 21 updates for PHP versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12.

“The issue can only occur under an unusual combination of configuration and application code. An application must set session.serialize_handler to php_binary or php_serialize in its configuration and then switch it to php at runtime with ini_set() before calling session_start(). Session upload progress must also still be enabled.” reads the advisory. “Applications that never change the serialize handler at runtime can keep the feature enabled. Since this setup is unlikely in practice, we are handling it in the regular release cycle and will publish a full advisory for CVE-2026-115560 with the next release.”

Applications that do not change the serialization handler while running are not exposed through this attack path, even if session upload progress is enabled.

PHP recommends a simple temporary fix: set session.upload_progress.enabled=0 until the next routine bugfix release. This is the same mitigation already recommended in the October 21 advisory for CVE-2026-109619. Administrators who applied this setting and have kept it in place do not need to take further action for this issue.

Session upload progress is enabled by default and allows applications to track the progress of file uploads. Disabling it reduces exposure to this specific vulnerability path.

PHP will fix CVE-2026-115560 through its regular release cycle because the vulnerable setup is uncommon. It plans to publish a full advisory with the next release. PHP has not yet identified affected versions, confirmed when the fix will arrive, assigned a severity score, or explained whether the flaw shares a root cause with CVE-2026-109619. No attacks targeting this new issue have been reported.

On October 21, PHP released emergency patches for two critical vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619 (CVSS score of 9.2), affecting every PHP version that handles web requests. The bug code dates back to PHP 5.4 from 2012, lives in the PHP engine itself rather than in any application, and allows unauthenticated remote code execution via crafted HTTP requests.

Cloudflare researchers observed tens of thousands of exploit attempts within 45 minutes of public disclosure, hundreds of thousands within two hours, and millions by October 22.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, PHP)

PHP2Shell attacks have surged into the millions, but no successful exploitation is confirmed. Patch it immediately.

On October 21, PHP released emergency patches for two critical vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619 (CVSS score of 9.2), affecting every PHP version that handles web requests. The bug code dates back to PHP 5.4 from 2012, lives in the PHP engine itself rather than in any application, and allows unauthenticated remote code execution via crafted HTTP requests.

Cloudflare researchers observed tens of thousands of exploit attempts within 45 minutes of public disclosure, hundreds of thousands within two hours, and millions by October 22.

As of October 23, Censys counts over 34.4 million PHP services still running vulnerable versions. Governments, hospitals, and schools across Asia, Europe, and North America have preemptively taken services offline rather than wait.

Below is an image showing the hosts potentially vulnerable to CVE-2026-109618 and/or CVE-2026-109619.

Security firms using honeypots report the same pattern: attackers are scanning many servers and trying to exploit the PHP flaws, but no successful remote code execution has been confirmed in real-world attacks. Sophos says this suggests that attackers are also struggling to exploit the vulnerabilities. Even its own security team needed more effort than expected, despite using AI, to develop a working exploit.

However, the risk is growing. VulnCheck researchers have developed an exploit that bypasses ASLR, a security feature that randomizes where code is stored in memory. By combining both vulnerabilities, they can use a memory leak to bypass this protection and run code on the target system. The exploit works, even though there is no evidence of widespread use yet.

The attempts that have been caught so far are mostly scanning, fingerprinting, and botnet delivery attempts. Cowrai’s analysis of PHP2Shell traffic in the wild found connections to a Mirai variant called Potassium, which contacts a C2 server, checks for an HTTP 200 response, then downloads a Linux executable as a follow-on payload.

“The payload, a likely Mirai botnet variant known as Potassium, was not delivered since the exploitation attempt was unsuccessful due to being blocked by Sophos countermeasures.” states the report published by Sophos. “However, analysis of the sample revealed that is an updated and significantly expanded version of the Mirai-derived botnet variant identified in early 2026.”

The malware can download additional files and disrupt networks. It contacts a hard-coded command-and-control server, checks that the server responds successfully, and downloads a file designed to run on Linux. If normal address lookup fails, it can use public DNS servers such as Google DNS and Cloudflare DNS. Like other Mirai malware, it can also launch distributed denial-of-service (DDoS) attacks.

Arctic Wolf found that both malware samples had Ethereum Name Service (ENS) resolution disabled, meaning the feature was available but not active.

“ENS resolution was disabled in both samples, indicating that the capability was present but inactive.” states Arctic Wolf. “If enabled in future variants, it could complicate disruption by reducing reliance on registrars and DNS providers, requiring defenders to block the ENS names, RPC infrastructure, and resolved command-and-control addresses.”

The botnet’s developers have already added the ability to use ENS to find command-and-control (C2) servers. This could help them keep their infrastructure online and make it harder for authorities to take down their domains, but the feature has not yet been enabled.

Sophos blocked the attempted Potassium delivery before it succeeded. But analysis of the sample itself showed it’s a significantly expanded version of the Mirai variant spotted earlier in 2026, with added DDoS capabilities and fallback DNS resolution using public servers like 8.8.8.8 and 1.1.1.1 hardcoded as backup.

PHP2Shell is being compared to Log4Shell because it affects a huge number of systems. The flaw is in PHP itself, so it can affect websites, content management systems and shared hosting services. Even a basic WordPress site with no extra plugins is at risk if it uses a vulnerable PHP version.

Fixes are available in PHP versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Older versions, including 7.4, 8.0 and 8.1, need fixes provided by their software distributors or an upgrade to a supported version.

Cisco Talos notes that scanning for flaws and using public exploit code is easier than building attacks into custom tools. Advanced attackers may still be developing those tools, so administrators should use this time to patch vulnerable systems.

“The true impact of this vulnerability will take time to evaluate.” concludes Talos. “These types of vulnerabilities that impact core technologies tend to cascade into other platforms and applications as they evaluate impact and provide associated patching, harkening back to the waves of exploitation that we saw after Log4J.”

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, PHP2Shell)

SafePay ransomware has hit 600+ organizations since 2024, using stolen credentials, VPN access and double extortion to pressure victims into paying.

CISA, the FBI, the US Secret Service, Germany’s Landeskriminalamt Rheinland-Pfalz, and two UK law enforcement agencies jointly published an advisory this week on SafePay, a ransomware group they describe as one of the most active operations currently running. The group has breached at least 600 organizations across critical infrastructure sectors since August 2024, spanning North America, South America, Europe, and Australia.

“Since August 2024, SafePay ransomware group’s operations have affected a wide range of businesses and critical infrastructure in North America, South America, Europe, and Australia. SafePay ransomware was among the most active ransomware groups in 2026. The SafePay threat actors have impacted at least 600 separate victims from multiple critical infrastructure sectors.” reads the joint advisory, “The authoring agencies encourage organizations to implement the recommendations in the Mitigations section of this advisory to reduce the likelihood and impact of SafePay ransomware incidents.”

SafePay appeared in mid-2024 as an independent ransomware group that operates without affiliates. This is unusual because many major ransomware groups work like franchises, allowing other criminals to use their tools and services. SafePay grew as groups such as BlackCat and LockBit declined, and its activity has continued. The advisory includes findings from FBI, US Secret Service, and German investigations through August 2026.

SafePay’s preferred entry points are exposed credentials, brute force password attacks, and VPN access.

“The FBI, USSS, and cybersecurity researchers observed SafePay threat actors obtaining initial access [TA0001] to organizations through various means, including credential exposure, implementing brute force password attacks [T1110], and exploiting virtual private network (VPN) access.” states the advisory. “SafePay threat actors use the IP addresses of the VPN provider “Mullvad” to attain initial access—specifically, SafePay threat actors use phished account profiles to access victim networks to exploit the following known Common Vulnerabilities and Exposures (CVEs) for edge device products”

Security teams should watch for unusual login attempts coming from Mullvad VPN IP addresses. SafePay also uses stolen account credentials and automated scripts to exploit known vulnerabilities in internet-facing devices. These include Cisco VPN flaws from 2020 and 2023, a Veeam vulnerability, and a SonicWall access control issue.

Once inside a network, the attackers rely on common tools rather than specialized malware. They use PsExec, WinRM, RDP, and PowerShell to move between systems. A PowerShell script called ShareFinder.ps1 helps them find shared folders and identify valuable data. Mimikatz is used to steal credentials, while AnyDesk and TeamViewer provide remote access. To steal data, the group uses tools such as FileZilla, RClone, WinSCP, and even OneDrive.

Encryption uses a ChaCha20 stream cipher combined with RSA for key exchange, with methods customized based on file type and size. Files get the .SafePay extension appended.

“Data encrypted with the SafePay ransomware variant (appended with .SafePay) cannot be recovered without the decryption key. SafePay threat actors hold the encrypted data for ransom and typically demand a subset of company revenue in cryptocurrency in exchange for decryption software.” states the advisory. “SafePay threat actors leave a ransom note on the victim’s system, typically on the desktop or root directory, advising them that SafePay locked their system and to reach out over a chat portal at a TOR .onion website link with a victim ID as the login. “

Paying the ransom remains the only path to decryption for encrypted files, and even that isn’t guaranteed to work.

The group runs a double-extortion model: steal first, encrypt second, threaten to post the stolen data publicly if the victim doesn’t pay. After encryption, SafePay sends victims to a Tor-based chat portal for negotiations. A representative also makes phone calls to apply pressure. If no payment comes, everything goes on the leak site. The group also deletes Volume Shadow Copies and resets network-attached backup devices to factory settings, which is the operational equivalent of cutting off every exit before the fire starts.

The advisory recommends several basic security measures. Keep internet-facing devices, especially VPNs and firewalls, up to date. Prioritize vulnerabilities listed in CISA’s Known Exploited Vulnerabilities catalog. Enable multi-factor authentication (MFA) for VPNs, webmail, and accounts that access critical systems.

Limit the number of accounts allowed to use administrative tools. SafePay relies on legitimate Windows tools to move through compromised networks, making its activity harder to detect. Organizations should also keep backups offline, encrypted, and immutable so attackers cannot access, change, or delete them.

CISA also recommends reviewing all accounts with admin privileges, setting time-limited access where possible, and disabling command-line tools for any account that doesn’t need them.

The advisory includes IOC files in STIX XML and JSON format, full MITRE ATT&CK mapping, and complete file and IP indicators.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, ransomware)

PHP will release emergency fixes for two critical RCE flaws rated 9.2, as researchers warn of potential risks to exposed and unsupported systems.

PHP is preparing an emergency security release for two critical vulnerabilities that could let attackers execute code remotely on affected servers. The update is scheduled for today, October 21 at 14:00 UTC, after details of the flaws leaked online ahead of their planned disclosure.

The PHP security team confirmed both vulnerabilities carry a CVSS v4.0 score of 9.2. It hasn’t yet published their technical details, confirmed the affected versions, or identified the releases that will fix them. The official PHP announcement says the full information will accompany the security updates.

“The PHP security team would like to give advance notice of an upcoming security release. It is scheduled for Wednesday, 21 October 2026 at 14:00 UTC. It addresses two critical vulnerabilities, both rated CVSS v4.0 9.2.” states the announcement.

“All PHP users are encouraged to prepare now so they can upgrade as soon as the release is available. We reserve the right to release earlier should details of either vulnerability become public, or should evidence of active exploitation appear in the wild. Full details, affected versions, and the fixed versions will be published with the release.”

Researchers dubbed the vulnerabilities as php2shell, using the identifiers CVE-2026-109618 and CVE-2026-109619. The identifiers and the claim that the flaws allow remote code execution come from reports outside PHP’s initial advisory, rather than from a published technical analysis by the project.

According to the Hacker News, the two critical PHP vulnerabilities would be disclosed on October 22. The post described them as remote code execution flaws with CVSS scores of 10.0 and said they affected versions dating back to PHP 5.

Researchers at watchTowr subsequently confirmed that the vulnerabilities were real and said the information had leaked before the agreed disclosure date. The company also reported that it had reproduced one of the flaws, CVE-2026-109618, but withheld technical details while patches remained unavailable.

PHP published its advance security notice later that day, setting the release for Wednesday, October 21, one day before the date reported in the leak. The team also reserved the right to release the fixes earlier if technical details became public or it found evidence of active exploitation.

The difference between the reported severity scores matters. The leaked information cited CVSS 10.0, while PHP officially rated both vulnerabilities 9.2 under CVSS version 4.0. Until the vendor publishes its technical advisory, the official score is the one administrators should use when describing PHP’s assessment.

The main concern is the possibility that the flaws affect a wide range of PHP installations. Reports have suggested that versions from PHP 5 onward could be vulnerable, but watchTowr’s FAQ explicitly notes that the scope hasn’t been confirmed by an official vendor advisory.

“The report claims the vulnerability affects every PHP version from PHP 5 onward, though this scope has not been confirmed by an official vendor advisory. No specific configuration or feature requirement has been described in the available report.” states watchTowr.

“Until PHP publishes an official advisory, security teams cannot determine which specific deployments face the greatest exposure; every organization running PHP in production should prepare to act quickly once a fix is confirmed.”

Administrators also don’t yet know which PHP components are involved or whether exploitation depends on a particular configuration or deployment mode. Those details will determine how attackers could reach the vulnerable code and which systems need the most urgent attention.

PHP’s supported versions policy adds another complication. The project currently supports four release branches, PHP 8.2 through 8.5, while older branches no longer receive security updates from the PHP project.

The anticipated fixes are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, according to tracking by Mallory. These version numbers were predictions ahead of the release, not confirmed package versions in PHP’s advance notice.

If the vulnerabilities affect older releases, organizations running PHP 8.1, 8.0, 7.x or 5.x may not receive an upstream fix. They may need to upgrade to a supported branch, apply any security updates provided by their operating system vendor, or restrict access to affected systems until they can remediate them.

Research by Mallory highlights the scale of the potential problem. Using Shodan data collected on October 20, the company identified about 884,000 internet-facing hosts reporting PHP 8.1 or an older version, representing roughly 59% of the 1.5 million hosts that disclosed a PHP version in their HTTP banners.

These figures don’t establish that every host is vulnerable. The count identifies systems running older PHP versions that may not receive a direct fix from the PHP project if the reported scope is confirmed. Another 740,000 hosts reported PHP without revealing a version, making it harder to assess the full exposure.

The numbers also count hosts, not individual websites or organizations. Shared hosting can place many websites on the same server, while software vendors and hosting providers may bundle PHP into products that administrators don’t recognize as PHP installations.

That makes asset discovery an important first step. Security teams should check web servers, Windows systems, vendor appliances, hosting control panels such as cPanel and Plesk, and applications that include their own PHP runtime.

PHP hasn’t published a workaround in its advance notice. Until the fixes become available, organizations should identify their PHP installations and prepare to install the correct update as soon as the vendor publishes it.

Internet-facing systems should take priority, particularly servers running business-critical applications or processing sensitive information. Administrators should also check with their Linux distribution and hosting provider, since vendors sometimes backport security fixes without changing the upstream version number in the way expected.

For installations running end-of-life PHP, the options are less comfortable. Organizations should plan an upgrade or reduce exposure by taking vulnerable services offline, restricting access through a VPN or IP allowlist, or placing them behind a web application firewall while a longer-term fix is prepared.

CERT-EU’s security advisory recommends considering the isolation of internet-facing applications from public networks when immediate patching isn’t possible.

“CERT-EU strongly recommends identifying PHP-based applications and preparing to patch as soon as fixed versions become available.”states CERT-EU. “Where immediate remediation is not feasible, organisations should consider isolating internet-facing applications from public networks until a fix can be applied.”

This is a precautionary measure, not a confirmed workaround for either PHP vulnerability.

Monitoring process activity can also help identify suspicious behavior. On Linux, security teams should investigate PHP-related processes such as php-fpm, php-cgi, httpd or apache2 launching unexpected shells, interpreters or download utilities, including sh, bash, python, curl and wget.

Florian Roth’s open-source process-watcher can log programs launched by PHP processes and record their command lines. It provides visibility into process activity, but it doesn’t block an exploit or prevent a malicious command from running.

If an investigation uncovers suspicious activity, teams should isolate the affected server, preserve PHP and web server logs, and check for newly created files in web roots, web shells, unexpected scheduled tasks, cron jobs and user accounts. Those steps can help determine whether an attacker has already gained access, rather than simply whether a server was exposed.

As of October 21, Huntress said it hadn’t observed exploitation in attacks against its partner environments and hadn’t developed or reproduced a proof of concept. watchTowr’s FAQ also listed no reported exploitation and no vendor patch at the time of its update.

That doesn’t mean administrators can safely wait to assess their exposure. Once technical details and fixes become public, attackers may be able to develop working exploits more quickly, particularly if the vulnerabilities affect widely deployed versions of PHP.

A previous PHP flaw illustrates how quickly the situation can change. When CVE-2024-4577, which affected PHP running in CGI mode on Windows, became public in June 2024, Akamai reported exploit attempts against its honeypot servers within 24 hours.

The scheduled release should answer the questions administrators still face: which versions are affected, which components contain the flaws, whether exploitation requires a particular configuration, and which updates fix each issue. Until then, the priority is straightforward: know where PHP runs, prepare the updates, and avoid leaving internet-facing systems on unsupported versions without additional protection.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, PHP)

OpenBSD flaws, including a 37-year-old BSD bug, enable local attackers to bypass security protections and gain root access. Patches are available.

Cybersecurity firm Calif published a full exploit and write-up this week for a local privilege escalation on OpenBSD 7.9 that chains two separate kernel flaws, one of them a 37-year-old integer overflow inherited from the original BSD sources. The exploit bypasses OpenBSD’s KARL address randomization and the SMAP and SMEP hardware protections without needing any information disclosure vulnerability at all.

OpenBSD already shipped patches for both issues in September: the integer overflow fix in errata 018 on September 14, and the related use-after-free fix in errata 026 on September 30. Both are available through syspatch and cover all architectures.

The shared memory attachment counter, shm_nattch, was defined as a signed 16-bit integer in BSD source code in 1988. It could hold a maximum value of 32,767. OpenBSD inherited this definition and never changed it. By mapping 127 shared memory segments and creating 259 processes through forking, an attacker can push the counter beyond its limit, causing it to wrap around to a negative value. This triggers a use-after-free vulnerability through a race condition. The corrupted counter makes the kernel free memory that other processes are still using.

The second flaw builds on the first. An out-of-bounds write overwrites multicast membership counters in the kernel. When the affected socket closes, the resulting counter updates modify page table entries, allowing user memory to be accessed with supervisor-level privileges. This bypasses SMAP and SMEP protections by exploiting errors in the kernel’s internal memory accounting, rather than directly attacking the hardware.

“One traced back roughly 37 years to the original BSD sources, where a shared memory attachment counter was defined as a signed 16-bit short. Repeatedly forking a process with shared memory attachment records could push that counter past its maximum value of 32,767, causing it to wrap to a negative value.” reads the Califs’ analysis. “This integer overflow could lead to a use-after-free via a race condition; combined with a separate out-of-bounds write in the kernel, it allowed local privilege escalation to root.”

OpenBSD’s KARL protection relinks the kernel at boot to randomize function and data addresses, which is real and meaningful hardening.

“While OpenBSD’s KARL relinks the kernel binary to randomize both function and data addresses, the kernel’s memory allocators remain deterministic. Both the boot-time allocator and the best-fit allocator lack base address randomization.” continues the analysis. “Consequently, early boot allocations consistently land at predictable locations across boots on the same hardware.”

Early boot allocations, including function pointers in network interface handlers, land at the same addresses across every reboot on the same hardware.

That predictability is what the exploit actually uses. It targets the lo0 and enc0 interface ioctl handlers, two structures the kernel always places at known addresses, overwriting one to gain code execution and using the other to cleanly restore the overwritten pointer afterward. No information disclosure needed, no guessing required.

The researchers used kernel memory allocation metrics available through sysctl to track live allocations and detect when new pages were being created, essentially doing heap layout analysis from userland. They aligned IP socket allocations and set a multicast TTL option to a non-default value to get a persistent 16-byte structure placed where they needed it. The race condition was won by using IPC_RMID in one process while a helper process running in parallel attached a size-confused shared memory segment.

Calif researchers note there’s no evidence of either flaw being exploited in the wild, and no CVE has been assigned to either issue as of publication.

The report does more than explain the exploit. Calif suggests four security improvements that could make this attack much harder or prevent it entirely.

First, safe-unlinking for kernel linked lists checks that data structures are valid before writing to memory. If something is wrong, the kernel stops. FreeBSD and NetBSD already use this protection, but OpenBSD does not.

Second, randomizing the page table’s self-referential mapping at boot would prevent attackers from predicting which memory location to target with the decrement operation.

Third, randomizing the kernel allocator’s base address at boot would make it harder to predict function pointer locations. The researchers say this protection would have almost no performance cost.

Finally, enabling array bounds checks in release builds would detect this type of out-of-bounds write. Calif also reported 21 issues to FreeBSD that the same protection could have caught, including flaws that could allow local privilege escalation.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, OpenBSD)

A Broadcom Wi-Fi flaw dating back to 2010 allows attackers within Wi-Fi range to execute code on vulnerable routers without authentication.

Researcher Quentin Kaiser presented a talk at Hexacon in Paris documenting a vulnerability in Broadcom’s proprietary 802.11 implementation that has been present in their SDK since at least 2010. The bug allows an attacker to get unauthenticated remote code execution on affected routers without knowing the WiFi password or going through the normal WPS setup process.

As of October 15, 2026, none of the affected devices in Belgium had received a patch.

“A vulnerability affecting Broadcom’s proprietary implementation of 802.11 has been present in their SDK since at least 2010. An incomplete patch was silently released in 2018, followed by Broadcom’s recommendation to move to hostapd instead, making it a definitive forever day on eCos-based platforms (BCM3380, BCM3383, BCM33834) and a potential forever day on Linux platforms (BCM3390, BCM65xx, BCM68xx) unless affected Original Equipment Manufacturers (OEMs) are willing to migrate.” states Kaiser. “The vulnerability can be triggered remotely over WiFi without knowledge of the network key or completion of a normal WPS enrollment. Exploitation provides controlled information disclosure and arbitrary code execution.”

The vulnerability affects the WPS EAP reassembly code, which handles part of the wireless setup process used by many consumer routers. An attacker within Wi-Fi range can exploit the flaw without knowing the Wi-Fi password, completing the setup process, or requiring any action from the user. The attack can expose information and allow the attacker to run code on the router. In his demonstration, Kaiser extracted the Wi-Fi password from the router’s memory and sent it over the wireless connection. He then used the password to connect to the network.

These attacks are not just theoretical. Kaiser demonstrated working exploits against two devices: the Orange Belgium ASKEY TCG3000 and the Proximus Sagemcom F@st/BBOX3V+. Both allowed an attacker to run code without authentication. In one demonstration, the attacker opened a reverse shell using only Wi-Fi frames, without needing a command server accessible over the internet. The attack can work from a distance. The close antenna placement shown in the video was only for the laboratory setup and is not a requirement for the attack.

In the video below, Kaiser exploited an Orange Belgium router (ASKEY TCG3000). The attack allowed him to run code on the device without authentication. The code retrieves the Wi-Fi password (PSK) from the router’s NVRAM and sends it back to the attacker over Wi-Fi. He then used the stolen password to connect to the network, confirming that the exploit works and that the password is correct.

Do not be misled by how close the antenna is in the video. The attack can work over much longer distances.

In the next video, the researcher exploited a Proximus router (BBOX3V+, also known as Sagemcom F@st). This attack also allows code execution without authentication. He used it to open a reverse shell over Wi-Fi frames, without needing a command-and-control (C2) server hosted in the cloud.

Broadcom quietly released an incomplete fix in 2018, then told customers to migrate to a different software stack entirely rather than shipping a complete patch for their own code. On eCos-based platforms, covering chipsets like BCM3380, BCM3383, and BCM33834, that makes this a permanent unfixable bug by design. On Linux-based platforms (BCM3390, BCM65xx, BCM68xx) the situation depends entirely on whether individual manufacturers decide to act.

Kaiser reported the bugs to Broadcom in July 2026. Broadcom said a patch was available and told him to ask the affected device manufacturers to contact Broadcom directly. The company refused to assign a CVE or share the notification it had sent through its customer portal. CERT/CC opened a case but closed it the same day after confirming that Broadcom could assign CVEs itself and had no intention of doing so. This was not a proper disclosure process. It was a dead end, with a paper trail.

Kaiser’s rough calculation, done with Belgian telecom market data, puts the affected device count at around 850,000 for Proximus, 500,000 for VOO’s legacy fleet, and 210,000 for Orange Belgium, totalling somewhere north of 1.5 million potentially exposed gateways in one small country. Telenet may also be affected through Sagemcom devices but Kaiser couldn’t confirm because he couldn’t get hold of one.

The affected manufacturers sell into markets well beyond Belgium. The chipsets in question appear in devices across dozens of vendors and hundreds of products worldwide. Kaiser is publishing a fingerprinting script and a YARA rule specifically to help map the full scope of affected deployments, because right now nobody has a complete picture.

A vulnerability introduced in 2010 and only partly fixed in 2018 still affects routers in use today. Kaiser says AI-assisted analysis helped him find the bugs in less than a week, instead of months. This can help defenders find vulnerabilities faster, but attackers can do the same.

The risk is greatest in targeted attacks where an attacker is within Wi-Fi range, such as hotel network attacks or surveillance of nearby targets. Compromised routers are difficult to monitor, and attackers can quietly intercept or collect network traffic. Most users and security teams rarely check the firmware on ISP-provided routers.

“Although I could have done this research by myself, it would have taken me months to get there. With AI frontier models it took me less than a week.” Kaiser concludes. “Which is a good thing because we can start looking into deeper and deeper layers of our technical infrastructure for a fraction of the cost.”

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Broadcom Wi-Fi)

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Atlassian flaw to its Known Exploited Vulnerabilities catalog.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added an Atlassian flaw, tracked as CVE-2026-21589 (CVSS score of 9.3), to its Known Exploited Vulnerabilities (KEV) catalog.

In early October, threat actors started exploiting CVE-2026-21589, a critical arbitrary file access flaw in Atlassian Data Center products. The vulnerability could allow attackers to access sensitive files under certain conditions. Affected products include Bitbucket, Confluence, Jira Service Management, Jira Software, Bamboo, Crowd, Crucible, and Fisheye.

“This Arbitrary File Access vulnerability allows an unauthenticated attacker to access specific files within the web application root directory in affected versions. Exploitation requires prior knowledge of the target file’s exact name and path; this vulnerability does not allow attackers to enumerate or list directory contents.” reads the advisory. “In some configurations, there may be some sensitive files that make this highly severe.”

Previdian telemetry has detected 15 exploitation attempts from three IP addresses in Japan and the U.S..

“Exploitation has now started to hit our honeypot network” Previdian Founder Ryan Dewhurst wrote on LinkedIn.

On October 6, watchTowr Labs published a technical analysis of CVE-2026-21589 after comparing vulnerable and patched Atlassian packages.

Researchers found a path traversal flaw where double-colon (::) sequences can be treated as path separators, allowing attackers to read files from the application web root.

“While semicolons (;) are very common in path traversal within Java applications, along with the everyday dots (.) and slashes (/), one item stood out: the matching of double colons (::).” reads the analysis. “This is uncommon syntax for this type of vulnerability, but grepping through the codebase we came across an all too familiar sight.”

In one Crowd deployment with Jira, researchers were able to read crowd.properties, which exposed application credentials. They then used those credentials to create a user and add it to the jira-administrators group. Crowd IP allowlisting can block this attack path.

Exploitation attempts against its honeypot network reportedly began two hours after watchTowr published additional technical details about the vulnerability.

According to watchTowr, the problem is in Atlassian’s web-resource handling. It can turn a string such as ..::..::..::..::WEB-INF::web.xml into ../../../../WEB-INF/web.xml, allowing attackers to move through directories and access files they should not be able to read.

Atlassian says all versions before the listed fixed versions are affected:

watchTowr has released a free tool on GitHub to help check if a server is vulnerable.

According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.

Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure.

CISA orders federal agencies to fix the flaw by October 18, 2026.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, CISA)

Silent Lynx, a group likely based in Kazakhstan, targets Russian energy and government entities in espionage campaigns across Central Asia.

Researchers from Cisco Talos and Recorded Future published a detailed paper on a threat actor they call Silent Lynx (aka UAT-6275, TAG-193), a Kazakhstan nexus group conducting espionage across Central Asia.

The targets include the Orsk Oil Refinery in southern Russia, about 25 kilometers from the Kazakhstan border, and the government of Nizhny Novgorod, a major city about 425 kilometers east of Moscow. The city lies where the Volga and Oka rivers meet, an important waterway system connected to the Caspian Sea. This target may be significant because Kazakhstan depends on the Caspian basin.

The group has been running targeted intrusion campaigns against government bodies, diplomatic missions and civil society organizations across Central Asia since at least 2024.

“Silent Lynx (overlapping with activity tracked as UAT-6275 by Cisco Talos and as TAG-193 by Recorded Future) is a persistent threat actor that has conducted targeted intrusion campaigns against government ministries, diplomatic missions and civil society organizations across Central Asia since at least 2024.” the paper states. “The group maintains a strong focus on high-value public sector organizations in the Commonwealth of Independent States (CIS), frequently leveraging spear-phishing campaigns conducted through compromised government email accounts and malware staging through trusted public services such as GitHub to increase credibility and infection success rates.”

The group overlaps significantly with clusters previously documented under names like YoroTrooper, ShadowSilk, and Hydra Saiga, all pointing at the same underlying activity.

The toolkit is deliberately lightweight: PowerShell-based reverse shells, proprietary shells written in C++, C#, and Go, commodity tunneling tools, and spear phishing emails sent through compromised government email accounts in Tajikistan and Kyrgyzstan to add credibility. GitHub, Telegram, and hijacked legitimate servers all serve as staging platforms. Nothing about it is technically flashy, which is part of why the group has stayed active for years without much public attention.

The researchers found links that go beyond technical evidence. In March 2026, a Tajik government agency contacted a Silent Lynx server, shortly after Kazakhstan’s lower house of parliament ratified a Treaty on Allied Relations with Tajikistan. In early April, a Belarusian government entity appeared on the same infrastructure, about a week before Kazakhstan’s president met with the Belarusian foreign minister in Astana. These links do not prove the reasons behind the activity, but the researchers highlight them in their paper, and they are difficult to ignore.

The connection to the Orsk refinery also has a clear context. A Ukrainian drone attack in August forced the refinery to shut down for months. Russia had already asked Kazakhstan to help make up for the resulting loss of refining capacity. If a Kazakhstan-linked actor was collecting intelligence on Russian energy infrastructure at that time, it could have been assessing the economic impact or trying to understand how the disruption might affect Kazakhstan’s own export pipelines. The researchers stress that they do not have enough evidence to identify a specific motive. However, they present the facts and let readers draw their own conclusions.

“A sample compiled in August 2025 was observed using a document titled Деловое предложение о сотрудничестве между ГК «Туркменнебит» и руководством Орского НПЗ (translated: Business proposal on cooperation between State Concern ‘Turkmennebit’ and the management of Orsk Refinery) (see Figure 11). We assess that this sample may be targeting Russia’s critical energy infrastructure, given the close integration of the Russian BREAK THE SILENCE: TRACKING SILENT LYNX THROUGH EXPOSED INFRASTRUCTURE SHEN & VÖGELE 10 VIRUS BULLETIN CONFERENCE OCTOBER 2026 and Kazakh energy sectors.” continues the report. “The document outlines proposals for developing mutually beneficial cooperation, with a particular focus on the exchange of expertise, technologies, and industry best practices. It is worth noting that the author of this PDF file is ‘pickle rick’ and the document was created just one hour after the payload was compiled. The name ‘pickle’ is aligned with the name ‘pickl’ we observed in the PickleShell PDB string3.”

What gave the group away wasn’t a sophisticated interception, it was their own operational sloppiness. They left open directories exposed on public servers containing live tooling, staged payloads, and one very incriminating shell command history showing keyboard input typed in Latin with a Russian keyboard layout active, so “whoami” came out as “црщфьш.” GitHub commit timestamps across 77 commits fit working hours in Astana, Kazakhstan, at 95 percent, compared to only 51 percent if you plot them against Moscow time. Administration connections to Silent Lynx servers came from ProtonVPN egress IPs geolocated to Kazakhstan, exclusively on weekdays between 7 AM and noon local time.

The group’s servers were also being reached from those VPN addresses, which Proton typically assigns based on geographic proximity. Two malware samples were uploaded to VirusTotal from Kazakhstan within minutes of compilation, which is classic anti-detection testing behavior and points to the operator location directly.

“We identified several additional indicators that strengthen the assessment of a Kazakhstan-based origin. The first derives from what appears to be malware detection-testing activity conducted through VirusTotal.” continues the report. “Two samples showed this pattern: an early Chvost sample12 was uploaded to VirusTotal only 86 seconds after compilation, while a second sample13 was uploaded approximately four minutes after compilation. Both samples were uploaded from Kazakhstan, and the same uploaders had submitted additional tools that were later observed in Silent Lynx campaigns.”

A researcher at Johns Hopkins School of Advanced International Studies told Reuters that the case highlights an important point: cyber espionage is no longer the domain of a few major powers. Smaller countries are also developing their capabilities and running long-term operations against neighboring states, often driven by serious geopolitical interests.

Silent Lynx is also becoming more technically advanced. In April 2026, the group used an exploit for the first time to deliver malware. It abused a WinRAR path traversal flaw (CVE-2025-8088) to place malicious files directly in the Windows Startup folder, without requiring victims to enable macros. The group also stored a public proof of concept for a FortiWeb authentication bypass vulnerability on its own command-and-control (C2) server. Researchers have also found signs of growing interest in Linux systems. After relying mainly on social engineering for two years, Silent Lynx appears to be building a more advanced set of attack tools.

Full joint Virus Bulletin paper with full indicators of compromise, malware hashes, and infrastructure details is available here.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, SILENT LYNX)

Canonical suffered its second DDoS attack this year, disrupting public websites for over four hours while Launchpad and the Snap Store remained online.

Ubuntu’s parent company Canonical spent part of last week fighting off a sustained distributed denial of service (DDoS) attack, the second one to hit its infrastructure this year. The company revealed the attack on October 8 through a post on the Ubuntu Discourse forum.

“Canonical’s websites are under a sustained distributed denial of service attack. Our team is working diligently to resolve the incident. Please refer to our status page for up-to-date information. Some services may be intermittently unavailable.” the company states.

At this time, no cybercrime or hacktivist group has claimed responsibility

The attack affected Canonical’s main public websites, including ubuntu.com, canonical.com, the Ubuntu blog, the developer portal, and the security advisory pages and API. Users may have been unable to access security advisories or read the blog during the attack.

“It was recently revealed that Canonical’s web infrastructure and the Ubuntu ecosystem suffered a massive and sustained distributed denial-of-service (DDoS) attack that caused its main portals and services to crash and be intermittent for more than four hours.” states the company blog. “Regarding the attack, it is mentioned that it directly affected the most visible institutional domains, including canonical.com and ubuntu.com, as well as the official blog, the developer portal, assets.ubuntu.com, academy.canonical.com and sites linked to enterprise technologies such as jaas.ai and maas.io.”

However, Launchpad and the Snap Store remained online throughout the incident. These services allow developers and system administrators to manage and install software.

Canonical acknowledged the outage on its status page and Ubuntu Discourse while engineers worked to limit the impact. The attack temporarily disrupted the Ubuntu Security API and Livepatch services, affecting tools used to check security advisories and apply kernel patches without restarting systems. However, Canonical’s distributed infrastructure helped contain the damage. Software repositories and mirror servers remained available, allowing users to install updates. Launchpad, the Snap Store, disk image servers and Ubuntu Single Sign-On also continued to work.

As a result, users could continue downloading and installing packages even while Canonical’s public websites were disrupted.

The overall outage lasted a little over four hours, causing real disruption.

This attack differs from the April one, which caused greater disruption by taking down Launchpad and the Snap Store and preventing some users from installing Ubuntu updates. At the time, a hacktivist group called The Islamic Cyber Resistance in Iraq, also known as 313 Team, claimed responsibility.

Canonical described the April incident as a sustained, cross-border attack, language that suggested distributed infrastructure spanning multiple countries. Whether this October attack is a continuation of the same campaign or a completely unrelated actor piling on is genuinely unclear.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, DDoS) 

Attackers are exploiting SonicWall SMA 1000 vulnerability, tracked as CVE-2026-102255 (CVSS score of 10.0), just days after its public disclosure.

Attackers have begun exploiting a critical flaw in SonicWall SMA 1000 appliances, tracked as CVE-2026-102255 (CVSS score of 10.0), just days after public disclosure. The vulnerability is a server-side request forgery (SSRF) flaw that requires no login. Attackers could abuse it to make the appliance send requests and access internal functions, allowing unauthorized actions.

“A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path.” reads the advisory. “By abusing this path, a remote unauthenticated attacker could potentially exploit this vulnerability to direct the appliance to issue requests on their behalf and reach internal functionality and perform unauthorized operations.”

The vendor said it has found no evidence of exploitation, but recommends applying the fixes.

The vulnerability affects the following product and versions:

The company pointed out that the flaws do not impact SSL-VPN running on SonicWall firewalls or the SMA 100 Series product line.

The hotfix is available through the MySonicWall portal, the vendor pointed out that there is no workaround.

Multiple researchers warn the vulnerability is now being actively exploited. Cybersecurity firm Defused has detected unauthenticated SSRF traffic targeting its SonicWall SMA decoys since October 8, 2026. Defused alerted subscribers through its Radar service.

Cybersecurity firm Previdian also announced that its sensors have detected exploitation attempts targeting SonicWall SMA 1000 appliances, consistent with CVE-2026-102255. The reported attacker IP is 146.70.143[.]142.

According to Previdian, researchers have recorded 135 attack attempts from two IP addresses in the United States. Researchers have recorded 135 attempts from two different IP addresses in the United States. SonicWall has not yet updated its security advisory to confirm that attackers are exploiting the flaw.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, SonicWall)

A new round of the weekly Security Affairs newsletter has arrived! Every week, the best security articles from Security Affairs are free in your email box.

Enjoy a new round of the weekly SecurityAffairs newsletter, including international press.

International Press – Newsletter

Cybercrime

ShinyHunters hacker in FBI data theft detained in Jordan, cooperating with bureau, sources say  

Iranian accused of hacking American universities extradited from Montenegro 

Hackers access data of 8.8 million people in Denmark in ‘extremely serious’ breach 

ClickFix Smuggles Payloads Through Browser Cache to Bypass Windows Run Limits

Apprehended Venezuelan Tren de Aragua Leader on FBI’s 10 Most Wanted Fugitives List Appears in Nebraska Court Following Homeland Security Task Force Investigation  

Behind the Connect Button: The Fake AI Ads Campaign

Wazza Phishkit Targets Banking, Government, and Manufacturing Across the US, EU, and Australia

Known Cybersecurity Expert and Owner of Florida Ransomware Remediation Company Charged with Defrauding Clients

Brazilian Access Broker Targeting Latin America: Mapping BraZetsu Infrastructure via TLS Certificates  

Justice Department and FBI Seize Vulnerability Scanning and Spear Phishing Tools Operated and Used by China-State Sponsored Hackers  

Germany arrests alleged core Qilin ransomware member after extradition 

Co-Creator of Dark Web Marketplace Sentenced to 40 Years in Federal Prison  

Can you really make more than $200M in six months without encrypting victims? It seems Silent Ransom Group can. (1)  

Friend of suspected FBI data thief says he warned ‘crazy’ teen not to hack bureau

ShinyHunters Extorted Boeing Spin-off Prior to Arrests     

Malware

ClingSTUN Linux Backdoor Abuses Public STUN Infrastructure  

MALFEX – A malicious npm postinstall no advisory has caught for fourteen months  

Canto incognito: tracking the PoeLLM malware

Never Deleted, Only Re-Pointed: Inside the 17,600-Repo FakeGit Fleet That Re-Arms Overnight

The phone was compromised before the user turned it on: the rise of Midnight Mimosa      

Hacking

New NetScaler Zero-Day Exploited in Targeted Attacks Can Knock SAML Deployments Offline

Horizon3’s Tales from the Trenches: Anthropic’s Mythos and Rejetto HFS

OpenAI “rogue” agent activities found on Wikimedia projects  

Request, Aggregate, Bypass: How Attackers Can Evade LLM Safety Classifiers

FortiBleed Operations Continue Targeting Exposed Systems Leading to Reports of Lockouts  

You Won’t Hear About These, Even In Myths (Atlassian Jira, Confluence (and more) Pre-Auth Arbitrary File Read CVE-2026-21589)  

Pwn2Own Ireland 2026 – Day Three Results & Master of Pwn  

Chrome’s Response to Recent ccTLD Registry Hijacks  

Vercel Confirms KVM Zero-Day VM Escape, Awards Researcher $50,000  

Unknown Threat Actor Uses AI-Driven ARTEX to Target South Korean Finance

Threat Actors Exploit Critical AhsayCBS Flaws to Drop Webshells and XMRig Cryptominer

Flax Typhoon Exploits Five Flaws as CISA Sets October 11 Deadline for Federal Agencies

Intelligence and Information Warfare  

MI5 issues Espionage Alert – CGTRI 中国通用技术研究院  

Hallucinating Credibility: China-Aligned TA419 Impersonates its Way into US AI Policy Circles  

Horizon3’s Tales from the Trenches: Anthropic’s Mythos and Rejetto HFS  

The Silent Electronic Battleground Shaping the Future of Warfare

UAC-0277: ClickFix on compromised websites to spread LUNEXSTEALER          

US Offers $10 Million Reward for Chinese Hacker Accused of State-Backed Cyberattacks

The Ministry of Foreign Affairs has fended off fresh attempts at cyber-attacks on its website and national infrastructure  

Investigating unintended model actions in our evaluations and internal use 

Ukraine takes aim at Russia’s AI data infrastructure  

Cybersecurity

South Korea probes bank breaches amid suspected AI-powered attacks

Accenture contractor removed from FBI following damaging data breach, sources say  

Introducing the Anthropic Cyber Mission  

Updates to Full Disk Access in macOS  

Launching an opt-in vulnerability-finding service for open-source software     

Quantum computing and cryptocurrencies 

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, newsletter)

Threat actors are exploiting CVE-2026-21589, a critical Atlassian flaw that can expose sensitive files across multiple Data Center products.

Threat actors have started exploiting CVE-2026-21589 (CVSS score of 9.3), a critical arbitrary file access flaw in Atlassian Data Center products. The vulnerability could allow attackers to access sensitive files under certain conditions. Affected products include Bitbucket, Confluence, Jira Service Management, Jira Software, Bamboo, Crowd, Crucible, and Fisheye.

“This Arbitrary File Access vulnerability allows an unauthenticated attacker to access specific files within the web application root directory in affected versions. Exploitation requires prior knowledge of the target file’s exact name and path; this vulnerability does not allow attackers to enumerate or list directory contents.” reads the advisory. “In some configurations, there may be some sensitive files that make this highly severe.”

Previdian telemetry has detected 15 exploitation attempts from three IP addresses in Japan and the U.S..

On October 6, watchTowr Labs published a technical analysis of CVE-2026-21589 after comparing vulnerable and patched Atlassian packages.

Researchers found a path traversal flaw where double-colon (::) sequences can be treated as path separators, allowing attackers to read files from the application web root.

“While semicolons (;) are very common in path traversal within Java applications, along with the everyday dots (.) and slashes (/), one item stood out: the matching of double colons (::).” reads the analysis. “This is uncommon syntax for this type of vulnerability, but grepping through the codebase we came across an all too familiar sight.”

In one Crowd deployment with Jira, researchers were able to read crowd.properties, which exposed application credentials. They then used those credentials to create a user and add it to the jira-administrators group. Crowd IP allowlisting can block this attack path.

Exploitation attempts against watchTowr’s honeypot network reportedly started about two hours after watchTowr published the analysis of the vulnerability.

Previdian also confirmed active exploitation of the issue.

“Exploitation has now started to hit our honeypot network” Previdian Founder Ryan Dewhurst wrote on LinkedIn.

The flaw allows unauthenticated attackers to read sensitive files in the webroot with a single request. This could expose tokens, credentials, keys, and other authentication data.

The exploitation activity targeting its honeypot network is said to have begun two hours after watchTowr released additional technical details of the vulnerability.

According to watchTowr, the problem is in Atlassian’s web-resource handling. It can turn a string such as ..::..::..::..::WEB-INF::web.xml into ../../../../WEB-INF/web.xml, allowing attackers to move through directories and access files they should not be able to read.

Atlassian says all versions before the listed fixed versions are affected:

As a temporary measure, Atlassian recommends removing affected instances from the public internet. Customers can also use a Web Application Firewall (WAF) rule to block malicious requests.

For Confluence, JSM, Jira, Bamboo, and Crowd, customers can block the requests using Tomcat’s RewriteValve. Bitbucket users can add a new rule to the urlrewrite.xml file.

watchTowr has released a free tool on GitHub to help check if a server is vulnerable.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Atlassian)

AI-assisted research uncovered a critical Rejetto HFS flaw that enables authentication bypass and remote code execution, now exploited in the wild.

A Rejetto HFS vulnerability, tracked as CVE-2026-61500 (CVSS score of 9.3), discovered with the help of the Anthropic Mythos AI model is now being exploited in the wild, turning an interesting security research experiment into a much more practical warning for defenders.

The vulnerability affects Rejetto HTTP File Server (HFS) 3.x. Attackers can exploit it to bypass authentication, obtain administrative access and ultimately execute arbitrary code on the server.

VulnCheck observed reconnaissance activity targeting vulnerable systems.

“Earlier today, VulnCheck‘s Canary Intelligence network started detecting probes for CVE-2026-61500, a session-forgery-via-weak-signing-key vulnerability in Rejetto HFS, an open-source file server.” VulnCheck warned. “The vulnerability was discovered by Horizon3.ai‘s Zach Hanley and published through the VulnCheck CNA on July 13, 2026.”

The story is interesting for two reasons. The first is the vulnerability itself. The second is how Horizon3 found it.

Rejetto HFS is an open-source application designed to make file hosting and sharing easy. Its earlier 2.x releases were written in Delphi, while the newer 3.x branch was rewritten in TypeScript. HFS had already appeared in CISA’s Known Exploited Vulnerabilities catalog because of CVE-2024-23692, an unauthenticated template injection that could lead to remote code execution.

Horizon3 analyzed the new code using a custom research setup and Anthropic’s Mythos model as part of Project Glasswing. Since joining the project in July 2026, the company says it has used Mythos to find serious vulnerabilities, focusing on flaws that attackers could realistically discover and exploit at scale.

That distinction matters. Finding a bug is one thing. Finding a bug that can be turned into a reliable attack is much harder.

Horizon3 researchers say Mythos performed particularly well in scientific tasks, computer science, operating system internals, math, and problems that require many steps. The HFS vulnerability is a good example. The model did not just spot a weak cryptographic design. It connected several different issues and worked out how they could be combined to achieve remote code execution.

The problem starts with authentication. HFS generates a value using JavaScript’s Math.random(). That value goes into Koa, the Node.js web framework used by HFS, and Koa uses it through Keygrip to sign session cookies. If an attacker can recover the value used as the signing key, the attacker can create valid session cookies.

“To fully explain the issue, first, we’ll detail how authentication works in HFS, and then how Mythos identified the issue.” states the report published by Horizon.

1. HFS generates a “random” value with Math.random()
2. The “random” value is passed to Koa, which is the Node.js web framework HFS is built on
3. Koa uses keygrip to sign all session cookies with that “random” value

If an attacker can derive what the session signing key is, they can forge valid session cookies. Typically, this should not be possible if using a secure pseudo random number generator (PRNG).”

Normally, this would be difficult. But HFS used V8’s Math.random(), which is based on the xorshift128+ pseudo-random number generator. It is not designed for security, and its output can be predicted if an attacker collects enough values.

The bigger problem was that HFS exposed values from the same random-number stream. During login, HFS put a Math.random() value into the session state, and the session cookie sent that value to the client. This meant an attacker could collect random values from the same generator that was used to create the signing key.

Mythos recognized the connection. It identified both the insecure random-number generator used to create the signing key and the separate code path that leaked values from that same generator. From there, it determined that the leaked values could provide enough information to reconstruct the generator’s internal state and work backwards to the values generated when the server started.

That requires mathematics, not just source-code pattern matching.

The xorshift128+ generator maintains an internal state made from two 64-bit values. Its operations are reversible, meaning that enough consecutive outputs can be used to reconstruct the state and then move backwards through previous outputs.

“In V8, Node.js’s JavaScript engine, when calling Math.random() the PRNG is generated with xorshift128+ algorithm. “We won’t dive into the algorithm itself, but critically the outputs of it are reversible. If you can observe other numbers generated by Math.random(), it is possible given enough observations to know the previous numbers that were generated.” continues the report. “This would allow an attacker to forge valid authentication cookies.”

Mythos proposed using Z3, Microsoft’s open-source satisfiability modulo theories solver, to solve the mathematical constraints. Horizon3’s researchers point out that they would normally have considered brute force first, and that they hadn’t previously seen an SMT solver used in this way to turn a cryptographic weakness in a real application into an authentication bypass.

The model also didn’t stop at the theoretical observation. It produced a working proof of concept, implemented the Z3 solver with the required constraints and demonstrated arbitrary command execution.

That distinction is important. Security teams have been discussing AI-assisted vulnerability discovery for a while, but there is a major difference between an AI system saying “this looks suspicious” and an agent figuring out how several weak points can be chained into a working attack.

The complete attack chain starts with user enumeration to establish whether the built-in administrator account exists. Horizon3 says Mythos also identified the user-enumeration weakness needed to complete the chain.

The attacker then collects leaked Math.random() outputs from an unauthenticated endpoint. Horizon3’s exploit samples the endpoint 12 times, feeds the observations into Z3, reconstructs the internal xorshift128+ state and walks that state backwards to recover the signing key created when the HFS process started.

With that key, the attacker can forge an administrator session cookie. HFS then accepts the forged session as authenticated, allowing the attacker to reach functionality that can execute code on the server.

The chain therefore moves from unauthenticated access to random-number leakage, from leakage to state recovery, from state recovery to cookie forgery, and from cookie forgery to administrative control and remote code execution.

There was no need for a spectacular memory corruption bug. No exotic kernel exploit was required. The attacker gets there by combining a weak source of randomness, information leakage and an application that trusts the resulting session state.

Horizon3’s researchers say this type of cryptographic weakness has often been abandoned during manual research because proving real impact can take too much time and requires mathematical expertise. Mythos changes that calculation because it can investigate the weakness, identify the missing link and solve the mathematical problem without requiring a researcher to manually direct every step.

“It did not require follow-on prompting to find the disparate PRNG leak that made this theoretical issue a demonstrable one.” Horizon continues. “It did not require instruction to go out and research approaches to “solve” a complex mathematical problem.”

Horizon3 argues that as AI systems become better at reasoning across code, mathematics and long sequences of operations, attackers may start weaponizing vulnerabilities that were previously considered too difficult or unreliable to exploit at scale. A vulnerability class doesn’t necessarily become more dangerous because the underlying bug changed. It can become more dangerous because the cost of turning that bug into an exploit has fallen.

A human researcher might spot that an application uses Math.random() for something security-sensitive and move on after deciding that exploiting it would take too much effort. An AI agent can keep going, inspect another code path, find the leaked values, connect the two observations, formulate the mathematical constraints and test whether the resulting attack actually works.

Horizon3 also makes an important qualification. Its researchers don’t argue that security researchers have become irrelevant. Their role changes because someone still has to decide which projects deserve deeper investigation, which libraries are important enough to justify specialized analysis, and where an automated scan is likely to find something useful.

The company also notes that models available in 2025 could already identify vulnerabilities, but researchers needed substantial software engineering around them to manage context, select relevant files and functions, and guide the analysis. Newer models and supporting libraries have reduced some of those limitations, making relatively simple instructions such as “find vulnerabilities” or “find a bypass” much more effective against projects that haven’t received extensive security review.

HFS was patched in version 3.2.1, released on July 13. Rejetto warned that multiple security vulnerabilities had affected previous versions and could allow attackers to obtain administrative access.

The fact that exploitation has now appeared makes the disclosure more than an interesting demonstration of AI capability. VulnCheck reported on October 2 that attackers had started targeting CVE-2026-61500 in small-scale reconnaissance activity originating from a China Telecom IP address, with observed attempts hitting canaries in Japan and the United States.

“Activity so far looks to be small-scale reconnaissance only, with a single China Telecom IP probing Canary deployments in Japan and the United States.” VulnCheck added. “CVE-2026-61500 affects Rejetto HFS file server versions 3.0.0–3.2.0 and allows for account takeover and remote code execution.”

For defenders, the practical lesson is uncomfortable but simple: a vulnerability that once looked too complicated to weaponize may no longer have that protection.

And AI doesn’t need to invent a new attack technique to change the equation. It can take a collection of ordinary weaknesses, do the tedious reasoning between them and produce the exploit that a human researcher might have decided wasn’t worth the time.

“The security research space has changed, is still changing, and expect that we’ll continue to have to adapt as it shifts.” concludes the report.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Rejetto HFS)

The researcher Chaotic Eclipse released BigDiskBuster, a PoC exploit for a Windows Defender Update DoS Zero-Day vulnerability.

Security researcher Chaotic Eclipse, also known as INFINITE NIGHTMARE, MSNightmare and Nightmare-Eclipse, released a new zero-day exploit targeting Microsoft Defender. The researcher named the exploit BigDiskBuster, it triggers a Denial of Service Vulnerability in Windows Defender Update.

The security researcher claims to have developed BigDiskBuster, a proof-of-concept that can block Microsoft Defender from receiving platform and signature updates.

“This proof of concept is similar to UnDefend, it prevents windows defender from performing platform/signature updates.” wrote the expert. “Seems to work on all supported windows versions but PoC is a bit buggy and needs some rewritting but you get the idea.”

Chaotic Eclipse says the technique works across supported Windows versions, although the current PoC is still buggy and needs further development.

In September, Chaotic Eclipse released multiple zero-day exploits targeting Nvidia (GreenSection) and Microsoft Defender (ShieldCrash).

Recently, Chaotic Eclipse also released exploits targeting other anti-malware and defense solutions. Chaotic Eclipse released a zero-day exploit targeting Kaspersky Endpoint Security he named HardBreacher, which triggers a privilege escalation flaw. The researcher pointed out that the PoC is unstable and may require repeated attempts, but when successful, it creates a DLL in System32 with full user permissions. The researcher also claims taking control of Kaspersky’s UI process can disrupt the antivirus and interfere with file-access controls, potentially leaving the system in an unstable state.

Nightmare Eclipse says the Kaspersky Endpoint Security zero-day allows privilege escalation on a fully patched Windows 11 25H2 system running Kaspersky Endpoint v14.0.0.504.

The researcher also released a zero-day exploit targeting GenDigital Avast Antivirus, named PrettyPrague. The exploit triggers a privilege escalation flaw.

The expert claims to have found another zero-day in an antimalware product, this time targeting Avast Antivirus. The PoC exploits a flaw in Avast Sandbox to dump the Windows SAM database and gain a SYSTEM-level shell. It reportedly works even on fully patched Avast Antivirus and Windows 11 25H2. The researcher also suspects the flaw may affect other Gen Digital products, including AVG and Norton.

Finally, Chaotic Eclipse released a new zero-day exploit targeting Crowdstrike Falcon cybersecurity platform. The researcher named the exploit FalconFlank, it triggers a privilege escalation flaw.

According to the researcher, FalconFlank abuses Falcon’s “Microsoft Office file malicious macro removal” feature. The function is part of Falcon’s remediation capabilities and operates with high privileges. The researcher claims that this behavior can be abused to escalate privileges from a low-privileged local user to a more powerful context.

Chaotic Eclipse is a researcher known for publicly releasing PoC exploits for zero-day vulnerabilities, often after criticizing vendors’ handling of vulnerability reports. His releases have mainly targeted Microsoft products, including Windows and Microsoft Defender, with some later exploited in the wild. Among the most notable are the Undefend and RedSun Defender zero-days.

His work has fueled debate over responsible disclosure and the risks of publishing working exploits.

Recently, Chaotic Eclipse revealed that he is Abdelhamid Naceri, a security researcher. Naceri previously worked with Microsoft in the UK and Germany. In a now-deleted X post, he described his departure from the company, claiming Microsoft terminated his employment without giving him a clear reason. He said Microsoft offered several financial settlements, but he rejected them because he wanted a formal explanation and help staying in Germany.

Naceri also said he challenged the dismissal in a German labor court. According to his account, Microsoft changed its arguments during the case, but the court ultimately upheld the termination. He said the long legal dispute left him with almost no compensation and caused serious financial and emotional problems, including treatment in a psychiatric hospital.

The researcher also admitted that an earlier claim that Microsoft had taken legal action against him was fabricated. The claim came during the controversy over Microsoft’s threats of legal action against security researchers who disclosed zero-day vulnerabilities.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, BigDiskBuster)