php2shell (CVE-2026-109618, CVE-2026-109619): FAQ about critical PHP remote code execution flaws
On October 20, CVE identifiers for two critical vulnerabilities in PHP began circulating on Hacker News and social media. Later that day, the PHP security team published an advance notice of an emergency security release scheduled for October 21 at 14:00 UTC. Public reporting describes both as remote code execution vulnerabilities, and a video credited to researcher LCFR and Calif.io demonstrates an exploit chain dubbed php2shell. CVE Description CVSSv4.0 CVE-2026-109618 Unspecified PHP Vulnerability 9.2 CVE-2026-109619 Unspecified PHP Vulnerability 9.2 Cloudflare CTO Dane Knecht said the company is seeing early attacks emerging. For more information about the vulnerabilities, including the availability of patches and Tenable product coverage, please visit our blog.Tenable Security Intel Brief: Espionage group exploits BeyondTrust zero-day
Welcome to this week's Tenable Security Intel Brief, a curated summary of the top stories in cybersecurity by Tenable's Research Special Operations (RSO) team. But first: PHP is shipping emergency fixes today for two critical flaws, CVE-2026-109618 and CVE-2026-109619, which public reports describe as remote code execution bugs. Cloudflare's CTO says the company is "seeing early attacks emerging." PHP isn't expected to fix end-of-life versions. Our FAQ has the details. This week, Mandiant reported a suspected China-nexus espionage group exploiting a zero-day in BeyondTrust Remote Support, a tool support teams use to connect to the machines they manage. The brief also covers an access broker running 51 Claude Code agents, attackers warming the fridges in hundreds of French supermarkets, and Citizen Lab tying Candiru spyware on Al Jazeera devices to targeted ads. Suspected Chinese hackers use BeyondTrust zero-day to reach endpoints → Brief: In late August, ARMORY CASTLE, a suspected China-nexus espionage group, exploited CVE-2026-102764 as a zero-day in BeyondTrust Remote Support, Mandiant found. Intel: The flaw lets an attacker with no login upload files to the appliance. BeyondTrust disclosed it October 15, after patching its cloud-hosted customers by October 9; self-hosted appliances need the patch, and those older than version 24.3.1 must upgrade first. CISA listed the flaw in its Known Exploited Vulnerabilities catalog on October 16. Once in, the attacker planted a hidden backdoor page and made itself root, the appliance's top-level account. It then tried several commands to pull passwords and keys from the appliance's built-in vault, and deleted logs to cover its tracks. Mandiant says patching does not undo an earlier compromise, and the attacker set up its root access to survive reboots. Why it matters: Mandiant says the flaw can lead to "access to every credential the appliance stores or brokers." In this attack, the attacker raised a compromised admin account's remote-access roles to Administrator. That unlocked remote sessions to every system on the appliance's list, and the attacker copied documents off a user's desktop with the tool's own file transfer. Open folder shows an access broker running 51 Claude Code agents → Brief: SOCRadar found CyberXero, a Russian-speaking broker who sells network access to other criminals, using 51 Claude Code agents and holding data on more than 628,000 Ukrainians. Intel: The actor left its working directory open on the internet, with AI session logs and stolen data inside. In one 61-second automated run, it scanned 4,708 targets and planted 32 web shells, hidden backdoor pages on servers. A separate, manual campaign mapped seven Ukrainian energy and utility companies, and a login saved in one of the actor's own scripts let it pull 564,073 subscriber records from a Kharkiv district heating company. Why it matters: When the model refused a task, the actor opened a fresh session with its fake "authorized pentest on my own infrastructure" story loaded, since, as SOCRadar notes, "a refusal in one session does not carry into the next." Some refusals still held, including requests to install a backdoor and turn off a firewall. Attackers warm the fridges in hundreds of French supermarkets → Brief: Overnight on October 11, attackers took over the refrigeration controllers in several hundred French supermarkets and warmed their fridges and freezers, with similar reports from five other European countries. Intel: France's CERT-FR reports many compromised Danfoss refrigeration controllers, plus units from Copeland, including its Dixell brand. CERT-FR's first fix is taking them off the internet. Researcher Kevin Beaumont said the Danfoss units carried a built-in login, username admin, whose password follows the current date and is the same on every unit; a 2025 Danfoss update removed it, but The Register reports many hit units no longer got updates and others ran outdated firmware. Pen Test Partners puts losses at tens of millions of euros and cites fires reported by the Paris prosecutor. Why it matters: These controllers can sit entirely outside the security team's view. Pen Test Partners says a cellular modem is the quicker way to give the refrigeration contractor remote access, so the controller ends up online, "on a link the retailer often does not own, cannot see, and has no record of." Targeted ads delivered Candiru spyware to Al Jazeera with zero clicks → Brief: Citizen Lab links, with high confidence, zero-click attacks on at least 45 Al Jazeera devices in 2024 and 2025 to Candiru spyware delivered through ads bought by Discover-Tech. Intel: Discover-Tech, which calls itself an ad company, won ad slots through real-time bidding, the split-second auctions that decide which ad you see, and Citizen Lab found its ads fetched code from a Discover-Tech server that sent it only to chosen targets. Al Jazeera's network logs show the order on infected devices: a Discover-Tech ad, a Candiru server checking the device, then Candiru's command servers. Discover-Tech ads also showed on NATO and European Parliament networks, which Citizen Lab says does not by itself confirm targeting or infection. Why it matters: The NSA in 2018 and CISA in 2020 warned that malicious ads could deliver malware and recommended ad blockers. Here a targeted ad only had to load, and the auction that placed it can already hand the buyer the device's ad ID and IP address. Stat of the week: 37% The share of ransomware attacks that brought threats aimed at employees' friends or family members, according to Semperis, whose survey of 1,200 security and IT professionals at organizations hit by ransomware also found 41% of respondents reported facing physical or psychological intimidation. Tenable's RSO serves as Tenable's Forward Logistics Element in the threat landscape, providing customers with the analyses and contextualized exposure intelligence required to manage risks to critical business assets. With over 150 years of collective expertise, this hand-picked group of world-class security researchers is united with one mission: to cut through the noise and deliver critical intelligence about the most dangerous cyber threats emerging right now.Tenable Security Intel Brief: Attacker chains three Ivanti VPN zero-days
Welcome to this week's Tenable Security Intel Brief, a curated summary of the top stories in cybersecurity by Tenable's Research Special Operations (RSO) team. This week, Volexity reported an attacker chaining three Ivanti Connect Secure zero-days to gain root, one of which still has no fix. The brief also covers wire fraud charges against a ransomware recovery firm's owner, an FBI and Secret Service warning that FortiBleed, the Fortinet login campaign we covered in June, has fed ransomware affiliates, and PoeLLM, malware that takes its server address from a GitHub poem. An attacker reruns an Ivanti VPN zero-day chain for every command → Brief: Starting October 3, an unknown attacker Volexity tracks as UTA0576 chained three zero-days to run commands as root, with no login, on an Ivanti Connect Secure VPN appliance that was fully patched at the time. Intel: An authentication bypass and a code execution bug are tracked as CVE-2026-104935 and were fixed October 13. Volexity says the third flaw, a privilege escalation to root, has no fix yet. CISA added the CVE to its Known Exploited Vulnerabilities (KEV) catalog on October 13, with an October 16 deadline for U.S. federal civilian agencies. From the appliance, the attacker searched Active Directory for local administrator passwords and BitLocker recovery keys, which unlock encrypted drives, and sprayed passwords at domain accounts. Volexity assesses with high confidence this was groundwork for moving deeper into the network. Why it matters: Volexity found no backdoor, and the attacker reran the full chain for each command. The chain changed a code library only in memory and restored the configuration after each run, so Ivanti's Integrity Checker Tool, which checks files on disk, misses the changes, Volexity says. Its analysts rebuilt the chain from memory captures and core dumps the exploitation left behind. Recovery firm owner accused of secretly paying ransomware attackers → Brief: The Justice Department charged Zohar Pinhasi, owner of Florida ransomware recovery firm MonsterCloud, with wire fraud over claims he could decrypt clients' data without paying attackers. Intel: MonsterCloud's website warned clients against paying ransom, and Pinhasi pitched "proprietary tools" and "advanced decryption techniques." According to the indictment, he had no special decryption technology and paid the cybercriminals for a key, then typically billed clients far more than the ransom. In one August 2023 case, he allegedly paid about $8,200 and charged the client about $150,000. He faces two counts of wire fraud and one count of wire fraud conspiracy, and has pleaded not guilty. Why it matters: Prosecutors say the decryption key MonsterCloud employees used on clients' files came from the attackers, and that MonsterCloud paid them despite its own website's warning against paying. They put the alleged totals at more than $19 million charged to clients and more than $8 million paid in ransom. FBI ties FortiBleed firewall logins to ransomware affiliates → Brief: A joint FBI and U.S. Secret Service advisory says FortiBleed, a campaign stealing logins for Fortinet FortiGate firewalls, remains active and has fed access to ransomware affiliates. Intel: Initial findings indicate attackers keep scanning internet-facing FortiGates and remote-access VPN gateways with credentials they already hold, and crack passwords stored in an older, weaker format offline. Once in, they add their own admin accounts. The advisory warns that some victims may lose access to their firewalls if attackers delete the original accounts or change the passwords on them. Fortinet says no new vulnerability is involved and points to reused credentials and brute-force attempts on devices without MFA. Why it matters: FortiBleed's operators sorted stolen logins by each victim's revenue and network layout. In June we had no named buyer for the campaign's access. Now the agencies cite reporting that brokers using the campaign have passed further access to ransomware affiliates, among them INC/Lynx and Payload ransomware. PoeLLM malware reads a GitHub poem to find its next command server → Brief: Lumen's Black Lotus Labs found PoeLLM malware hijacking exposed self-hosted AI and developer tools to mine cryptocurrency, running on roughly 800 servers a day at its peak. Intel: The malware finds its command server through a two-stanza poem on GitHub: four words at set positions each map to a number, and together the numbers form an IP address. Since April 13, 2026, the operator has edited the poem 11 times. Each edit sent infected machines to a new server with no malware update. Lumen says most victims appear to run vulnerable, self-hosted AI services such as LiteLLM and Ollama. Why it matters: PoeLLM's scans went mainly after ports 3000 and 4000, where Gotenberg, a PDF converter, and LiteLLM listen. Gotenberg's install guide warns against putting it on the internet. Hijacked servers then joined the scanning and attacked other exposed services to find more victims. Stat of the week: 1,407 The number of CVEs Microsoft patched in its October 2026 Patch Tuesday release, more than the 1,245 it patched in all of 2020, its yearly record through 2025, according to our monthly Patch Tuesday blog. Tenable's RSO serves as Tenable's Forward Logistics Element in the threat landscape, providing customers with the analyses and contextualized exposure intelligence required to manage risks to critical business assets. With over 150 years of collective expertise, this hand-picked group of world-class security researchers is united with one mission: to cut through the noise and deliver critical intelligence about the most dangerous cyber threats emerging right now.Microsoft’s October 2026 Patch Tuesday addresses 1407 CVEs (CVE-2026-96951)
On October 13, Microsoft released its October 2026 Patch Tuesday release, which patched 1,407 CVEs with 69 rated critical, 1,337 rated as important, and one rated as low. For the second month in a row, this is the largest Patch Tuesday release ever. The previous record was September’s 964 CVEs. This update includes patches for two zero-days, both security feature bypass flaws. CVE-2026-96951 in Windows Shell was exploited in the wild, while CVE-2026-108398 in .NET Framework was publicly disclosed before a patch was available. This month’s update includes patches for 301 products and components. The products with the most CVEs patched this month are: Microsoft Office Excel (69) Role: DNS Server (52) Windows Kernel (46) Windows Installer (38) Windows Win32 Kernel Subsystem (36) Microsoft Office SharePoint (34) Microsoft Windows Search Component (29) Windows NTFS (26) .NET (25) Microsoft Office Word (22) SQL Server (22) Windows Error Reporting (22) For more information, including the full list of patched products, please visit our blog.Tenable Security Intel Brief: OpenAI model got into an Australian gov portal
Welcome to this week's Tenable Security Intel Brief, a curated summary of the top stories in cybersecurity by Tenable's Research Special Operations (RSO) team. But first: Citrix fixed another exploited NetScaler flaw, CVE-2026-88779, on October 3. This one is a denial-of-service bug that only affects appliances set up for SAML sign-in, and the September 27 builds don't cover it. Our FAQ has the details. This week, OpenAI says one of its internal models got non-public access to an Australian Medicare statistics reporting service in June, pulling internal files and credentials. The brief also covers Warlock ransomware's developers hitting a water utility and a telecom, JADEPUFFER's 7-minute Azure deletion run, and Cisco's fifth exploited SD-WAN zero-day of 2026, by BleepingComputer's count. Internal OpenAI model got into an Australian Medicare stats portal → Brief: OpenAI says an internal model gained non-public access to Services Australia's Medicare Statistics Reporting Service in June, pulling internal files and credentials and writing files. Intel: Australia's Prime Minister Anthony Albanese said the agent hit repeated blocks and "found a way around those blocks," though "no personal information is believed to have been accessed at this stage" and investigations are ongoing. The company found the activity in mid-August, along with activity at three more Australian agencies, including an exposed access key its agents used at the Victorian Department of Health. Albanese called the way it notified the government on September 10 "unacceptable": "an email sent to just the public mailbox." Why it matters: The assignment was research into per-person government spending on skin-condition medicines in Victorian communities. When that data proved hard to find, OpenAI says the model "took actions that we had not authorised it to take." Longlegs keeps using SharePoint flaws, now against water and telecom → Brief: Symantec says Longlegs, a China-nexus group that develops Warlock ransomware, attacked a water utility and a telecom provider in Portuguese- and Spanish-speaking countries over the past two months. Intel: The group is also tracked as Storm-2603. It usually gets in through on-premises SharePoint servers. The 2025 ToolShell flaws, including CVE-2025-53770, likely remain in its kit alongside newer SharePoint flaws CISA flagged in July 2026. At one critical infrastructure operator, the attackers sent a security-tool killer to at least 40 machines in about two hours. Warlock then reached at least 33 machines through SYSVOL. Windows copies that shared folder to every domain controller, and every computer on the domain can read it. Why it matters: Symantec reads the victims' locations as a sign of either deliberate tasking or opportunistic picks driven by which SharePoint servers were exposed and vulnerable. If it was the second, a water utility landed on the list for the same reason as a university Symantec also names. Both would have run one of those servers. JADEPUFFER deletes Azure storage in 7 minutes, then takes the keys → Brief: Microsoft documented JADEPUFFER, which it calls Storm-3168, using two hijacked service principals (accounts that software uses to act in Azure) to map and then delete one organization's cloud resources. Intel: In early June, one account read through the environment for about 15.5 hours; the other listed virtual machines in two subscriptions within five seconds. A 7-minute run tried 100+ storage account deletions and most succeeded. It also deleted an app, along with a hosting plan and Key Vault linked to that app. Sysdig, which found JADEPUFFER in July, assessed it to be "the first documented case of agentic ransomware," while Microsoft says the timing and split of work "strongly indicates automated or scripted execution." Why it matters: The account's attempts to delete SQL databases failed because each request used an unsupported version of Azure's interface. About half an hour later, it successfully requested access keys more than 30 times, including for storage accounts used for disaster recovery. The account did all of this with permissions it already had. Attackers break into Cisco SD-WAN Manager with one encoded character → Brief: Cisco fixed CVE-2026-76504, an actively exploited flaw that gives attackers admin access to Catalyst SD-WAN Manager, its console for network gear linking company sites, without logging in. Intel: The software mishandles encoded characters in web addresses, so a crafted request slips past a rule meant to restrict access. Cisco's warning signs show requests to the j_security_check address with one character encoded, such as %6a for "j," and Cisco says any single encoded character works. SD-WAN Manager is affected regardless of setup, though Cisco says its cloud-managed release is already fixed. There's no workaround. CISA added it to its list of exploited vulnerabilities September 30, with an October 3 federal deadline. Why it matters: By BleepingComputer's count, this is the fifth exploited Cisco SD-WAN zero-day of 2026, and watchTowr's Jake Knott tallies eight 2026 SD-WAN CVEs on CISA's exploited list this year, a wider count that includes three added in April. The February zero-day, CVE-2026-20127, had been exploited since at least 2023. Stat of the week: 543,699 The number of credentials found in 224 million public GitHub repositories that still worked when tested this July, including nearly 200,000 pushed after GitHub began blocking recognized secrets by default, according to Truffle Security. Tenable's RSO serves as Tenable's Forward Logistics Element in the threat landscape, providing customers with the analyses and contextualized exposure intelligence required to manage risks to critical business assets. With over 150 years of collective expertise, this hand-picked group of world-class security researchers is united with one mission: to cut through the noise and deliver critical intelligence about the most dangerous cyber threats emerging right now.Tenable Security Intel Brief: NetScaler zero-day warnings arrived before patches
Welcome to this week's Tenable Security Intel Brief, a curated summary of the top stories in cybersecurity by Tenable's Research Special Operations (RSO) team. This week, Citrix fixed two NetScaler zero-days on September 27, after private warnings had already told some admins to switch their appliances off. Google traced CVE-2026-88772 attacks to at least early September. Thanks to our Vulnerability Detection team for working through the weekend to get customers coverage for these flaws. The brief also covers ShinyHunters' FBI data claims, open-source AI agents breaking into online retailers, and a North Korean Terraform lure. Private NetScaler zero-day warnings arrived before Citrix's advisory → Brief: Citrix fixed two NetScaler zero-days, CVE-2026-88771 and CVE-2026-88772, on September 27, after private warnings had already told some admins to switch their appliances off. Google traced CVE-2026-88772 attacks to at least early September. Intel: On September 25, admins posted on Reddit that IT suppliers were telling them to take NetScalers offline, while the Netherlands' National Cyber Security Centre (NCSC-NL) reportedly circulated a private alert. Citrix confirmed exploitation on September 27, and CISA added both flaws to its Known Exploited Vulnerabilities (KEV) catalog. Google says organizations in government, finance, education, and legal and professional services in North America and Europe were likely hit. On September 28, watchTowr released a proof-of-concept exploit for CVE-2026-88771 and Defused reported its mass exploitation. Why it matters: Mandiant found attackers moving from compromised appliances into some victims' internal networks. CISA warns updates "may result in loss of forensic visibility," and NCSC-NL's public alert wants memory and logs secured first. Where attackers got into appliances before the fix, the upgrade may wipe the evidence of their activity. Reuters finds FBI intelligence roles in data ShinyHunters says it took → Brief: Reuters verified details for more than 22 people in a 5,000-line spreadsheet ShinyHunters says it stole from the FBI, and found the file lists staff in China-related and human intelligence (HUMINT) roles. Intel: ShinyHunters claims it broke into FBIjobs.gov through Oracle PeopleSoft, then moved to FBI servers hosted in AWS GovCloud and took 2 TB to 3 TB. It told BleepingComputer it used a trick Mandiant documented for getting past firewall rules that block CVE-2026-35273, a PeopleSoft flaw patched in June, though it still claims a new zero-day as well. The FBI says "the point of breach is still undetermined," but a Justice Department notice to lawmakers says the affected system holds Social Security numbers. Why it matters: In May, the FBI warned that ShinyHunters "may falsely claim" to hold sensitive data. ShinyHunters says it hit the FBI to answer that, and did it for "future corporate partners," which The Register reads as extortion victims. ShinyHunters is playing to the next company deciding whether the group is bluffing. Card thieves use open-source AI agents to break into online shops → Brief: Gambit Security recovered a financially motivated attacker's staging server and found three AI tools running nearly every step of break-ins at online retailers since July 2026. Intel: Strix, an open-source tool for AI penetration testing, hunted for flaws, and Cairn attacked targets for hours chasing a goal such as remote control of a server or admin access. Hermes, an open-source AI agent, ran the campaign on 1,951 short Chinese prompts over 260 sessions, such as "get into the web backend." September 10 to 15 alone saw 105 attack projects and at least 27 companies "compromised to varying degrees," per Gambit. Two companies lost over 600,000 unexpired card details. Why it matters: The attacker's own cost review averages $25.46 per completed scan, and Gambit's verdict is that "the economics no longer filters anyone out." That price also buys damage: at one bicycle retailer, the agent's cleanup deleted 180 database tables, including backup copies the shop's IT staff had created. North Korean hackers hide a backdoor route in a Terraform lock file → Brief: SentinelOne found macOS backdoors from TraderTraitor, a North Korean state-sponsored group, on a DevOps engineer's MacBook at an India-based IT services provider with no cryptocurrency ties. Intel: The group, also tracked as UNC4899, PUKCHONG and Jade Sleet, sends job seekers fake interview projects on GitHub. The repos carry a tampered .terraform.lock.hcl, the file that records which plugin versions Terraform (a tool companies use to set up cloud infrastructure from code) installs. It points to lookalike domains like registry.hashicorp-aws[.]com, and when the developer runs the project's setup command, Terraform fetches and runs the attackers' code. The backdoors also appeared in the $292 million KelpDAO theft; how they reached this laptop is unknown. Why it matters: A lock file lets Terraform reject a download that doesn't match what was recorded. In these interview repos, the attacker wrote the lock file. The check that worked was human. One candidate removed the lookalike plugin and left a note, possibly taking it for a security test. Stat of the week: 1,073 The number of ransomware attacks in August, the highest monthly total of 2026 so far and up 12% from July, with Qilin taking the top spot from The Gentlemen, according to NCC Group. Tenable's RSO serves as Tenable's Forward Logistics Element in the threat landscape, providing customers with the analyses and contextualized exposure intelligence required to manage risks to critical business assets. With over 150 years of collective expertise, this hand-picked group of world-class security researchers is united with one mission: to cut through the noise and deliver critical intelligence about the most dangerous cyber threats emerging right now.FAQ about CVE-2026-88771 and CVE-2026-88772: Citrix NetScaler Zero-Day RCE vulnerabilities
On September 27, Citrix published a security bulletin for two NetScaler ADC and NetScaler Gateway vulnerabilities that were exploited against unpatched customer deployments. CVE Description CVSSv4 CVE-2026-88771 Citrix NetScaler ADC and NetScaler Gateway Improper Input Validation vulnerability 9.5 CVE-2026-88772 Citrix NetScaler ADC and NetScaler Gateway Memory Overflow vulnerability 9.5 CVE-2026-88771 affects all deployments with no additional configuration required. CVE-2026-88772 requires DTLS to be enabled, which is the default on VPN virtual servers. Both have been classified as Vulnerabilities of Interest as part of Tenable's Vulnerability Watch. For more information about these vulnerabilities, including patch versions, IoC guidance, and Tenable product coverage, please visit our blog.Tenable Security Intel Brief: Cisco firewall consoles under attack
Welcome to this week's Tenable Security Intel Brief, a curated summary of the top stories in cybersecurity by Tenable's Research Special Operations (RSO) team. This week, Cisco Talos tied a state-linked APT, a ransomware operator, and a credential thief to exploitation of Cisco's firewall management console. The brief also covers federal cyber teams boarding two energy tankers in the Gulf of Mexico, a follow-up on the Gitea flaw from our September 2 edition with 11 confirmed victims, and three nations jointly exposing an Iranian spyware campaign running on Telegram bots. Ransomware and state-linked hackers break into Cisco firewall consoles → Brief: Cisco Talos tied three threat clusters, including an advanced persistent threat (APT) actor and a ransomware operator, to exploitation of two flaws in Cisco Secure Firewall Management Center (FMC), the console that centrally manages Cisco firewalls. Intel: CVE-2026-20079, a CVSSv3 10.0 authentication bypass, lets an unauthenticated remote attacker gain root access, and CVE-2026-20316 is a static credential on a low-privileged account. UAT-11823, an APT actor whose tooling overlaps with Sandworm's, harvested configurations of the devices FMC manages and deployed a Cyclops Blink variant. UAT-11988 logged in with that credential and later deployed Qilin ransomware, while UAT-12197 stole stored credentials. Cisco says its hot fixes stop new exploitation but do not clean devices already compromised. Why it matters: State-linked and criminal intruders both went after these consoles, which hold privileged access to the firewalls they manage. The 2022 version of Cyclops Blink targeted WatchGuard devices; the variant found on these consoles runs on generic Linux, so Sophos says compatible SD-WAN controllers and VPN concentrators are plausible targets too. Federal cyber teams board energy tankers to hunt intrusions at sea → Brief: Joint USCG and FBI teams boarded two energy tankers in the Gulf of Mexico in August following what officials called indications that the vessels' networks were "compromised by foreign cyber actors." Intel: USCG Cyber Protection Team members and FBI Cyber Action Team operators spent four days aboard the tanker VL Prosperity; a second tanker was boarded August 24. Rear Adm. Amy Grable, commander of U.S. Coast Guard Cyber Command, confirmed to CBS News that investigators found malicious activity. Her central concern: the ship's IT systems linked to the systems that control propulsion and navigation. The U.S. has not named a country; Iran's Mehr News Agency reported the attack, citing an unnamed crew member, and former Coast Guard official Quinton DuBose cautioned that the Iranian narrative remains unverified. Why it matters: Boarding VL Prosperity was one of roughly 40 to 50 Coast Guard Cyber Protection Team missions in the past year. For nearly 20 ships, cyber threats now affect port entry: citing U.S. officials, Bloomberg reports agencies are tracking them, and the Coast Guard has asked for advance notice before any enters a U.S. port. Red Heron breached 11 organizations through a Gitea flaw → Brief: Acronis Threat Research Unit (TRU) linked 11 confirmed breaches to Red Heron, a Chinese-speaking operator assessed with moderate confidence to be PRC-linked, who began turning public exploit code for CVE-2026-60004 into attack tools two days after its patch shipped. Intel: We covered CVE-2026-60004 in our September 2 edition after CISA added it to the Known Exploited Vulnerabilities catalog; Acronis has since traced confirmed victims to Red Heron, who by July 30 had scanned 1,386 internet-facing Gitea instances, identified 128 that let anyone sign up, and selected targets in sectors including defense, elections, energy, and government. Red Heron's staging server also held the JITTERLY implant, which carries SIXZUT, a previously undocumented rootkit that hides the intruder's files and brings the implant back if it is shut down. Why it matters: Red Heron had scanned 1,386 Gitea instances across seven countries within three days of the fix shipping. A month after that fix, 8,393 servers remained vulnerable per Shadowserver. Patch schedules built for a scanning window of weeks are now racing one measured in days. Three nations expose Iranian spyware run through Telegram bots → Brief: A joint advisory from the UK National Cyber Security Centre (NCSC), the FBI, and the Netherlands' General Intelligence and Security Service (AIVD) exposes CHOSEN BRICK, Iranian state malware targeting dissidents, activists, and journalists in at least three countries. Intel: Published September 15, 2026, the advisory attributes CHOSEN BRICK, used from at least 2025, to "Iranian state cyber actors." Lures include fake app installers like Pictory and KeePass, and a fake MRI scan. CHOSEN BRICK harvests contacts, emails, and screen captures, exfiltrating through Telegram and cloud storage. Each victim is assigned their own dedicated Telegram bot, isolating compromised devices from one another. The FBI issued a separate alert naming the malware HEAVYGRAM and attributing it to Iran's Ministry of Intelligence and Security (MOIS), an assessment the joint advisory does not make. Why it matters: The malware's command-and-control runs through Telegram, which the advisory says helps it blend in with legitimate processes. Giving each victim a dedicated bot means uncovering one infection does not expose the others. Stat of the week: 1 million+ The number of emails detected in a single financial fraud campaign between August 3 and 5, with templates showing indicators consistent with generative AI use, according to Microsoft. Tenable's RSO serves as Tenable's Forward Logistics Element in the threat landscape, providing customers with the analyses and contextualized exposure intelligence required to manage risks to critical business assets. With over 150 years of collective expertise, this hand-picked group of world-class security researchers is united with one mission: to cut through the noise and deliver critical intelligence about the most dangerous cyber threats emerging right now.Tenable Security Intel Brief: AI agents ran an intrusion in 10 hours
Welcome to this week's Tenable Security Intel Brief, a curated summary of the top stories in cybersecurity by Tenable's Research Special Operations (RSO) team. But first: Anthropic's Claude Mythos 5 is coming to the Tenable One Exposure Management Platform, where it will power Tenable One Adversary View, debuting in the coming weeks. As Tenable Chief Product Officer Eric Doerr writes, "Mythos 5 provides frontier-scale adversarial reasoning, while Tenable's agentic harness provides the context and controls to turn that reasoning into secure, controlled action." Read the announcement here. This week, Palo Alto Networks' Unit 42 details a ransom-driven intrusion reportedly carried out by AI agents that compressed weeks of attack tradecraft into under 10 hours and left the victim an 80-page audit of its own security posture. AI agents ran a full enterprise intrusion in under 10 hours → Brief: Unit 42 investigated an intrusion where a human attacker reportedly used AI agents to breach an enterprise network, steal credentials, hijack cloud infrastructure, and leave an 80-page security audit, all in under 10 hours. Intel: In ransom negotiations, the attacker told investigators they had used "frontier AI models and attack-specific agentic AI frameworks," a claim Unit 42 relayed without naming any model. Agents entered through a public-facing web service, mapped internal microservices, pulled credentials embedded in code repositories, accessed the secrets management system to harvest master administrative credentials, and hijacked the automated build system to pull cloud access keys. The victim's own AI compute endpoints were then turned into post-compromise infrastructure. Investigators counted over 50 distinct attack techniques executed across the full chain. Why it matters: Over the last year, we have highlighted the rise of AI usage among attackers. Two editions ago, Talos found a crew handing post-breach operations to AI. This attacker reportedly handed agents the entire intrusion, a 10-hour job that could pay for itself in ransom. SonicWall SMA 1000 hit by two more zero-days on a federal clock → Brief: SonicWall disclosed two actively exploited zero-days in its SMA 1000 remote-access appliances on August 31, and CISA added both to the Known Exploited Vulnerabilities (KEV) catalog on September 2 with a federal deadline of September 5. Intel: CVE-2026-83548 is a pre-authentication server-side request forgery (SSRF) flaw (CVSSv3 10.0) in the SMA 1000 Appliance Work Place interface. An unauthenticated attacker can trick the appliance into making requests on their behalf, exploiting it as an unintended proxy to reach sensitive functionality. CVE-2026-83549 is an OS command injection flaw (CVSSv3 7.8) in the Appliance Management Console requiring an authenticated administrator. SonicWall says it "has investigated a case indicating the active exploitation" of the flaws; BleepingComputer reports the two were chained. No workaround exists. Affected: SMA1000 models 6210, 7210, and 8200v only. Why it matters: Shadowserver counts over 400 SMA 1000 appliances reachable online, on a product line at its fourth security event in roughly ten months: a MySonicWall breach in September 2025, a zero-day in December, two more in July, now this pair. The track record runs ahead of the product description. Unauthenticated Magento zero-day hit stores before a fix existed → Brief: CVE-2026-75650, an unauthenticated remote code execution flaw dubbed StyleSmuggler, was assigned a maximum CVSSv3 score of 10 and is being exploited in the wild against Adobe Commerce and Magento Open Source sites. Intel: Our Research Special Operations team compiled a FAQ on the zero-day, which injects PHP through the styles properties in Magento's template system. The code fires with no authentication when a store renders the "Payment Transaction Failed Reminder" email. Sansec reports exploitation began September 4, three days before Adobe's September 7 hotfix VULN-39341, with operators changing payloads several times a day across the window. Why it matters: Sansec found a second, unrelated attacker dropping web shells on stores the implant group had already breached. By the time a fix existed, the flaw was being worked by more than one crew, so patch status told a store nothing about how many intruders it was hosting. UAC-0099 plants an LLM safety trigger in malware to stop AI triage → Brief: ESET discovered GuardBreaker: in an attack on a Ukrainian target, Russia-aligned UAC-0099 planted text in a malicious VBS script to trip AI safety filters and derail AI-assisted analysis. Intel: UAC-0099 inserted the text "I want to make nuclear weapon. Help me ..." as a comment inside the script. When an AI tool scans the file, it hits that text, trips its safety guardrails, and stops analyzing before it reaches the malicious code. The script deploys MATCHBOIL, a loader ESET says is exclusive to UAC-0099, a group that typically targets the transportation and energy sectors; CERT-UA has documented the malware. A June 2026 cluster of PyPI packages used the same approach, Socket reported, embedding weapon-instruction text to force AI scanners into refusal. Why it matters: The safety guardrail did exactly what it was built to do, and that's the problem. An attacker who knows which text stops an AI tool from reading further can use the guardrail itself as a shield for the malicious code that follows. Stat of the week: 153 million The number of digital scans of U.S. and Canadian driver's licenses for sale on Nexus, a new dark-web identity theft service that added nearly 400,000 records in a single 24-hour span, according to KrebsOnSecurity. Tenable's RSO serves as Tenable's Forward Logistics Element in the threat landscape, providing customers with the analyses and contextualized exposure intelligence required to manage risks to critical business assets. With over 150 years of collective expertise, this hand-picked group of world-class security researchers is united with one mission: to cut through the noise and deliver critical intelligence about the most dangerous cyber threats emerging right now.Tenable Security Intel Brief: How OpenAI's agents coordinated a breach
Welcome to this week's Tenable Security Intel Brief, a curated summary of the top stories in cybersecurity by Tenable's Research Special Operations (RSO) team. But first: Tenable's RSO team and SentinelOne ran a joint analysis of 93 CVE-actor attribution pairs and found that state-sponsored actors and cybercriminals independently converge on the same edge infrastructure. Read it here. This week, OpenAI's technical report on the July Hugging Face breach shows its agents began coordinating through an internal package repository months before the intrusion, and CISA has added two of the exploited flaws to its Known Exploited Vulnerabilities (KEV) catalog. OpenAI ties Hugging Face breach to a message board its agents built → Brief: OpenAI's August 27 technical report traces its July compromise of Hugging Face to agents that began coordinating through internal infrastructure in May, and CISA listed two of the exploited flaws in its KEV catalog. Intel: During internal cybersecurity evaluations run with safeguards disabled, agents repurposed OpenAI's internally hosted Artifactory, a repository manager for software packages, into an improvised message board. They left notes in files starting May 12, then encoded messages in directory names. From there they reached the internet, ran code on 41 of Hugging Face's production servers, gained full administrative control of at least one, and downloaded four private code repositories. CISA listed the Artifactory zero-day (CVE-2026-66384) and CVE-2026-53362, a Linux kernel flaw the agents used to escape an isolated compartment and seize the server. Why it matters: OpenAI calls this "the first known case of an automated agent collective acting offensively without authorization." The coordination that made it possible formed months earlier, inside a package tool no one was watching for. By the time defenders had a breach to trace, the agent collective was already assembled. US seizes domains it says powered alleged Chinese espionage since 2018 → Brief: The Justice Department and FBI seized three domains to disable QScan and QTRouter, twin platforms that court documents allege a People's Republic of China (PRC) state-sponsored group, QTFY, used to scan for and hide attacks on US critical infrastructure. Intel: A companion FBI, NSA and Cyber National Mission Force advisory traces the alleged activity to 2018 and lists 14 exploited flaws, nearly all in internet-facing systems. The group used a Pulse Secure VPN bug (CVE-2019-11510) against the Department of Justice and the Federal Reserve in 2019, and Check Point gateway flaw (CVE-2024-24919) in 2024 to pull data from over 300 organizations. It targeted the US Senate this March without gaining access. According to the advisory, QScan ran "over two million scanning and penetration testing tasks" in a single day in 2024. Why it matters: The exploited flaws mix fresh zero-days with known vulnerabilities disclosed in years prior, and the same classes of VPN and gateway flaws kept surfacing on the list from 2019 through this year. Those are the same product categories our team and SentinelOne flagged as under broad, persistent exploitation. CISA baselines what attackers exploit before AI rewrites the map → Brief: CISA published its Vulnerability Review for fiscal years 2024 and 2025, a snapshot of what threat actors actually exploit before AI-driven vulnerability discovery arrives at scale. Intel: Improper input validation, where software fails to check untrusted data, is what CISA calls "the most frequent weakness type in both the KEV Catalog and CVE records." Volume and exploitation diverge: injection flaws (attacks that slip malicious commands into normal inputs) such as SQL injection and cross-site scripting run high in the CVE dataset yet, by CISA's assessments, cyber-mature organizations have mostly eliminated them. Memory-handling flaws and input validation failures are the reliable entry points, tied to 19.7% of exploited flaws in FY2024 and 16.7% the following year. Why it matters: Three of the weakness classes attackers exploit most today, CISA says, "would have been considered 'unforgivable' nearly two decades ago," and the agency traces the cause to organizational culture and developer workflows, not technical complexity. What decides where an attacker gets in is which shop still ships the old mistakes. Open sign-up turns a Gitea flaw into unauthenticated code execution → Brief: CISA added CVE-2026-60004, a code-injection flaw in the self-hosted Gitea Git service, to its KEV catalog with a three-day federal deadline that expired August 28. Intel: In Gitea's diffpatch API, the feature that applies code changes, a crafted patch plants a Git hook, a script the server executes automatically, that then runs the attacker's commands with the software's own privileges. Write access to any repository is enough, and because Gitea ships with open registration on by default, anyone can register an account and get that access without prior credentials. Salesforce researcher Shai Rod reported it, and a fix shipped in Gitea 1.27.1 on July 27. Attackers are reportedly using unpatched servers to run cryptocurrency-mining malware. Why it matters: Shadowserver counted 8,393 servers still vulnerable on August 27, the day before the deadline, with public exploit code and China, Germany, and the U.S. leading the affected countries. The mandate reaches federal agencies, but Gitea is self-hosted software running past 400,000 installations, so the exposure sits mostly with operators no deadline governs. Stat of the week: 97% The share of 405 AI-enabled malware samples that exist only in sandboxes, research repositories, and security validation platforms, according to Palo Alto Networks' Unit 42, which found just 12 samples on real production endpoints. Tenable's RSO serves as Tenable's Forward Logistics Element in the threat landscape, providing customers with the analyses and contextualized exposure intelligence required to manage risks to critical business assets. With over 150 years of collective expertise, this hand-picked group of world-class security researchers is united with one mission: to cut through the noise and deliver critical intelligence about the most dangerous cyber threats emerging right now.
