# Threat Intel Brief — October 27, 2026

TL;DR

  • Critical Brotli RCE flaws (CVE-2026-111497) trigger emergency patches across Node.js, .NET, and PHP ecosystems; active exploitation confirmed for PHP2Shell vulnerabilities (CVE-2026-109618, CVE-2026-109619).
  • North Korean operators conduct low-and-slow scanning campaign targeting 216 hosts globally; separate incident compromised European government agency within two hours.
  • AI-enabled threats escalate: South Korean arrests expose ARTEX AI framework abuse; malicious instruction files hijack AI coding agents; Gheist campaign steals GitHub secrets via automated workflow injection.
  • Microsoft 365 token replay attacks compromise 97 accounts across 79 organizations; Microsoft Teams external chat exploited for IT support impersonation and ransomware delivery.
  • Critical infrastructure vulnerabilities in ISC BIND 9 DNS and HPE Networking AOS require immediate patching per Belgian CERT advisories.

---

Critical Threats

PHP2Shell and Brotli RCE Vulnerabilities Under Active Exploitation

What happened:
Two critical remote code execution vulnerabilities—CVE-2026-109618 and CVE-2026-109619, collectively known as PHP2Shell—are confirmed exploited in the wild. Researchers documented successful RCE with memory disclosure against Apache mod_php running PHP 8.4.26. Amazon Threat Intelligence observed targeting four days before patches were released. Separately, a buffer overflow in the Brotli compression library (CVE-2026-111497, also called HTTP2Shell or Broccoli2Shell) affects Node.js, .NET, Python HTTP clients, and PHP Windows builds. The flaw allows remote attackers to crash processes, expose memory, and achieve code execution by serving malicious compressed HTTP responses. Proof-of-concept exploits are publicly available for both vulnerability sets.

Impact:
PHP powers approximately 70% of websites globally (~5.1 million exposed hosts). Successful exploitation enables full server compromise, data exfiltration, and lateral movement. The Brotli flaw affects web servers, HTTP clients, and any service decompressing attacker-controlled data. Microsoft issued emergency .NET patches citing privilege escalation risk. Updating system Brotli libraries does not fix bundled copies in Node.js or containerized applications—process restarts and container rebuilds are required. CISA has not yet added PHP2Shell to the Known Exploited Vulnerabilities catalog despite confirmed exploitation.

Recommendations:

  • Immediately patch all PHP installations to versions released October 21, 2026 or later; update Node.js to 22.23.4/24.22.1/26.12.1, .NET to 8.0.33/9.0.22/10.0.14/11 RC3, and Python Brotli to 1.2.1.
  • For CVE-2026-115560 (unpatched PHP RCE), set session.upload_progress.enabled=0 in php.ini until patches are available.
  • Deploy CISA's published SIGMA detection rule to identify PHP2Shell exploitation attempts in web server logs.
  • Restart all affected Node.js processes and rebuild container images after patching—system library updates alone are insufficient.
  • Monitor for PHP_SESSION_UPLOAD_PROGRESS markers (e.g., 'p2s-rider') and large cookie dumps (~800 KiB) in HTTP responses.

---

North Korean Scanning Campaign Targets Global Infrastructure

What happened:
North Korean threat actors, attributed with moderate confidence to the Lazarus Group ecosystem, are conducting a coordinated scanning campaign targeting 216 unpatched hosts across government, financial, logistics, aviation, and manufacturing sectors. The activity is coordinated via a closed I2P channel by Korean-speaking operators (handles Jeon Chang-hyuk 2 and Choi A-rin) using 21 compromised nodes for rotational, low-volume scanning to evade detection. One confirmed incident involved a European government agency where attackers achieved credential theft and Active Directory compromise within two hours. Palo Alto Networks Unit 42 initially attributed the incident to PHP2Shell exploitation but later clarified it involved a vulnerable PHP application. Post-compromise TTPs include credential harvesting, anonymous LDAP queries, NTLM relay tunneling, and privilege escalation attempts targeting Domain Admin.

Impact:
The campaign targets critical infrastructure in the U.S., Japan, South Korea, Thailand, Indonesia, Australia, Taiwan, India, Singapore, U.A.E., Saudi Arabia, and the European Union. The low-and-slow methodology with node rotation indicates deliberate target curation aligned with DPRK strategic priorities: government intelligence collection, financial institution compromise for revenue generation, and critical infrastructure reconnaissance. Attackers employ machine-parseable command delimiters (e.g., ==SHELLUSER==, ==PASSWD==) suggesting agentic AI-assisted operations.

Recommendations:

  • Immediately patch CVE-2026-109618 and CVE-2026-109619 on all PHP infrastructure; prioritize internet-facing web applications.
  • Monitor for anonymous LDAP queries to domain controllers and NTLM relay activity; restrict LDAP anonymous binds and enforce SMB signing.
  • Implement detection for machine-parseable command delimiters in command-line telemetry indicating AI-assisted post-exploitation.
  • Deploy behavioral analytics to detect low-and-slow scanning patterns with node rotation; supplement threshold-based alerting with anomaly detection.
  • Block known mass-exploit infrastructure including 204.76.203[.]7 and investigate I2P traffic for potential C2 channels.

---

Critical DNS and Networking Infrastructure Vulnerabilities

What happened:
CERT.BE issued critical warnings for two infrastructure vulnerabilities: a Remote Code Execution flaw in ISC BIND 9 DNS software (CVE not yet publicly assigned) and multiple critical vulnerabilities in HPE Networking AOS (CVE: see source). Both advisories urge immediate patching. ISC BIND is one of the most widely deployed DNS server implementations globally, used across government, enterprise, and service provider networks. HPE/Aruba switches are extensively deployed in enterprise environments for core networking.

Impact:
DNS infrastructure represents a foundational component of internet operations and is classified as critical infrastructure in most jurisdictions. RCE vulnerabilities in BIND enable attackers to potentially execute arbitrary code on DNS servers, allowing traffic interception, redirection, denial of service, or lateral movement. Critical vulnerabilities in network operating systems could enable unauthorized access, complete device compromise, or network-wide disruption. Specific CVE IDs and technical details for HPE AOS were not provided in source material.

Recommendations:

  • For BIND: Immediately identify all systems running ISC BIND 9; check ISC's official security advisories at https://www.isc.org/bind/ for CVE details and patches; prioritize internet-facing and recursive resolvers.
  • For HPE AOS: Check HPE Security Bulletin portal for AOS-Switch advisories; inventory all HPE Networking AOS devices and verify current firmware versions; apply available security patches according to vendor instructions.
  • Ensure management interfaces are restricted to trusted networks only and not exposed to internet until patching is complete.
  • Monitor DNS server and switch management logs for unusual query patterns, authentication attempts, or configuration changes during patching window.

---

Threat Actor Activity

Gheist Campaign Automates GitHub Secret Theft

An automated campaign tracked since September 15, 2026 leverages stolen GitHub tokens to inject malicious workflows into private repositories and GitHub Enterprise environments. The campaign has planted over 13,500 branches across more than 850 compromised accounts. Attackers create branches named "ci-sync-" with random characters, commit malicious workflow files, and exfiltrate secrets by printing them base32-encoded to bypass GitHub's log masking. A newer variant targets self-hosted runners to harvest 31 credential types including private keys, AWS instance role credentials, and Kubernetes service account tokens. The campaign deletes workflow runs within seconds to remove evidence. Token sources trace to the March 2026 Trivy vulnerability scanner supply-chain compromise and various infostealer log repositories.

Defensive actions:

  • Audit GitHub repositories for branches matching pattern 'ci-sync-' followed by six random characters; rotate all repository secrets and revoke associated tokens immediately.
  • Query GitHub audit logs for workflow runs on ci-sync-* branches deleted within one minute of completion, and for activity associated with the 'gheist' user agent string.
  • Implement branch protection rules requiring signed commits and enforce approval workflows for all branches, including private repositories and GitHub Enterprise Server.
  • Monitor self-hosted GitHub Actions runners for credential harvesting attempts; isolate runners with minimal necessary permissions.

---

Microsoft 365 Token Replay Attacks Bypass MFA

Huntress disclosed a campaign leveraging adversary-in-the-middle (AitM) relay attacks to capture and replay stolen authentication tokens, compromising 97 accounts across 79 organizations between July and September 2026. Attackers executed 497 successful sign-ins from 200,000+ attempts originating from 193.26.115.0/24 IP range. The campaign established persistence within three hours by adding rogue MFA methods (authenticator apps) and registering 48 fake devices in Entra ID. Hidden inbox rules deleted or moved emails containing payroll/financial keywords. Attack infrastructure linked to Romanian IP 193.26.115.221 and German hosting provider 1337 Services GmbH (associated with StarkRDP/rdp.sh virtual server rentals).

Defensive actions:

  • Immediately audit all Entra ID registered devices for unfamiliar entries and remove unauthorized devices from the directory.
  • Review MFA methods for all users—remove any authenticator apps or methods added without user knowledge, especially within three hours of suspicious sign-ins.
  • Check mailbox inbox rules for hidden or suspicious names (e.g., '.', 'sss', 'iT') that delete or move messages; delete unauthorized rules.
  • Implement Conditional Access Policies requiring MFA for all users, all cloud apps, and restrict device-code authentication workflow.
  • Block or monitor traffic from 193.26.115.0/24 IP range and review sign-in logs for login attempts from 1337 Services GmbH infrastructure.

---

AI Coding Agents Hijacked via Malicious Instruction Files

Researchers discovered malicious AGENTS.md markdown files placed in Downloads folders that trick AI coding agents (OpenAI Codex, Claude Code, Cursor CLI) into installing rogue npm packages. Forever Security detected a real attack on a customer machine attempting to install the malicious 'function-color' package (part of the MALFEX campaign). Proof-of-concept demonstrated 90% success rate against Codex and 50% success rate for OAuth token theft against Claude Code. Attack exploits intended browser and agent behavior—browsers allow silent file downloads to ~/Downloads, and AI agents read instruction files from working directories. Over 1,300 Claude Code sessions launched from ~/Downloads folders observed in researcher telemetry.

Defensive actions:

  • Configure AI coding agents to launch only from specific project directories, never from ~/Downloads or home directory.
  • Enable browser download prompts in Chrome, Edge, and Firefox to require user approval before saving files.
  • Audit existing ~/Downloads folders for unexpected .md files (AGENTS.md, CLAUDE.md) and remove any unrecognized instruction files.
  • Block npm package function-color and function-flag at package manager/proxy level; monitor for installation attempts as IOC.
  • Conduct user awareness training on AI agent security, particularly for developers using AI coding assistants.

---

Microsoft Teams External Chat Exploited for Ransomware Delivery

Unknown threat actors conduct a recurring social engineering campaign across hundreds of incidents, exploiting Microsoft Teams' external chat feature to impersonate IT support personnel. Attackers use throwaway Microsoft 365 tenants with IT-themed display names, preceded by email bombing to create urgency. Victims are convinced to install legitimate RMM tools (Quick Assist, AnyDesk, ScreenConnect, TeamViewer, Atera, Zoho Assist, NetSupport, LogMeIn). Attackers execute PowerShell commands to download MSI installers from Azure Blob Storage containing Python implants, conduct Active Directory reconnaissance via LDAP queries, establish persistence through multiple RMM tools, and deploy ransomware including Chaos variant. Activity shows overlap with STAC4749, a tracked cluster known for creating IT-themed cloud domains under the ".top" TLD.

Defensive actions:

  • Restrict Microsoft Teams external access to trusted domains only, or disable external chat feature if not business-critical.
  • Implement email filtering rules to detect and quarantine mail bombing patterns (high volume of subscription confirmations in short timeframe).
  • Deploy endpoint detection rules for legitimate RMM tool execution from unexpected processes or user contexts.
  • Monitor for PowerShell execution downloading content from cloud storage services, particularly Azure Blob Storage.
  • Detect LDAP queries enumerating all AD computer and user objects from non-administrative endpoints using Windows Event ID 4662.

---

uCreator Android Spyware Targets Telegram and WeChat

Security researcher Ovi exposed uCreator, a rentable Android spyware kit that hijacks Telegram and WeChat accounts by embedding malicious code within modified versions of these applications. The spyware can steal Telegram 2FA passwords through function hooking before hashing and clone WeChat accounts. Distribution occurs through unofficial channels, in-app ads leading to fake app store sites, and a custom container app "Onion Box" (洋葱盒子). The Telegram component matches Baohuo backdoor (reported by Doctor Web in October 2025), which infected over 58,000 devices. The kit supports approximately 20 applications including WhatsApp, LINE, Zalo, KakaoTalk, Viber, and mobile wallet apps GCash and MoMo. Victims are primarily in India (22.8%), Brazil (20.5%), and Indonesia (9.6%).

Defensive actions:

  • Block sideloading of applications from unofficial sources through mobile device management (MDM) policies.
  • Verify application digital signatures and package names before installation; legitimate apps will have official developer signatures.
  • Monitor for suspicious local server activity on mobile devices; uCreator runs command servers inside trojanized apps.
  • Review active Telegram sessions across all devices regularly; hidden attacker sessions may not appear in compromised apps but should be visible on clean clients.

---

Geopolitical Context

South Korean Arrests Expose AI-Enabled Cybercrime

South Korean police arrested seven suspects involved in breaching over 90 organizations using the ARTEX AI pentesting framework, resulting in theft of 8.2 million data records. The leader, a 32-year-old former penetration tester who worked at a cybersecurity company between 2019 and 2022, transitioned to AI-driven tools in late August 2026 to scale operations. The group targeted educational institutions, hospitals, large corporations, and golf courses, conducting extortion operations demanding approximately $270,000 across 38 incidents. This represents South Korea's first major arrest linked to generative AI-enabled cybercrime at scale. The ARTEX AI framework was previously observed in attacks against South Korean banks attributed to Chinese-speaking threat actors, illustrating rapid diffusion of advanced tooling across disparate threat actors.

---

European and North American Data Breaches

The University of Copenhagen confirmed a data breach affecting 525,000 people after hackers accessed a test environment containing personal data including national identity numbers (CPR), contact information, and physical access credentials. The breach represents nearly 9% of Denmark's population of approximately 5.9 million. DreamHost forced password resets for email and FTP/SFTP users following an ongoing incident that disrupted access to the File Manager interface, indicating potential unauthorized access or credential compromise. A Chinese national was extradited from the Netherlands and arraigned in California for his alleged role in a cryptocurrency investment scam that defrauded 174 U.S. victims of approximately $37 million, with operational infrastructure in Cambodia and the Bahamas.

---

Recommended Actions

Immediate (0-24 hours)

1. Patch critical RCE vulnerabilities: Deploy PHP (October 21+ releases), Node.js (22.23.4/24.22.1/26.12.1), .NET (8.0.33/9.0.22/10.0.14/11 RC3), and Python Brotli (1.2.1) updates; restart processes and rebuild containers.
2. Audit Microsoft 365 environments: Review Entra ID registered devices, MFA methods, and mailbox inbox rules for unauthorized modifications; revoke active sessions for affected accounts.
3. Scan GitHub repositories: Search for 'ci-sync-' branches and rotate all repository secrets if found; review audit logs for 'gheist' user agent activity.
4. Restrict AI coding agents: Configure agents to launch only from vetted project directories; scan ~/Downloads for unexpected .md instruction files.
5. Patch ISC BIND 9 and HPE AOS: Check vendor security advisories and apply available patches to DNS servers and network infrastructure.

Within 24-72 hours

1. Deploy detection rules: Implement CISA's SIGMA rule for PHP2Shell; configure monitoring for machine-parseable command delimiters, anonymous LDAP queries, and NTLM relay activity.
2. Review Microsoft Teams configuration: Restrict external access to trusted domains or disable external chat; implement email filtering for mail bombing patterns.
3. Audit RMM tool usage: Deploy endpoint detection for legitimate RMM tools (Quick Assist, AnyDesk, ScreenConnect, TeamViewer, Atera, Zoho Assist) executing from unexpected contexts.
4. Assess Tailscale deployments: Disable Tailscale SSH port forwarding in access control policies; review and tighten ACL rules to use least-privilege source-to-destination pairs.
5. Inventory Wasmtime usage: Update Wasmtime to fixed versions (36.0.19, 48.0.7, 49.0.4, or 50.0.0+); rebuild applications embedding Wasmtime as a library.

This week

1. Conduct security awareness training: Educate users on AI coding agent security, Microsoft Teams external chat warnings, and vishing tactics involving urgency creation.
2. Review Magento deployments: Audit cms_block and cms_page database tables for unexpected JavaScript references; apply Adobe security bulletin APSB26-73.
3. Implement Conditional Access Policies: Require MFA for all users and cloud apps; restrict device-code authentication workflow; enable Entra ID Protection risk-based policies.
4. Assess mobile device security: Block sideloading from unofficial sources through MDM policies; verify application digital signatures before installation.
5. Enhance GitHub security: Implement branch protection rules requiring signed commits; enforce approval workflows for all branches including private repositories.

---

Watch List

  • Wasmtime sandbox escape vulnerabilities (CVE-2026-115889, CVE-2026-115893): Critical flaws in WebAssembly runtime affecting multi-tenant platforms; patches available but require application rebuilds.
  • Unpatched Tailscale SSH vulnerabilities: Disclosed flaws enable root escalation via port forwarding; no patches available; disable port forwarding in access control policies.
  • 953 Magento stores compromised since July 2025: Long-running campaign injects scanner-evading JavaScript via CMS blocks; five C2 domains rotated over 15 months.
  • DreamHost ongoing incident: Forced password resets for email and FTP/SFTP users indicate potential credential compromise; monitor for additional disclosures.
  • North Korean PHP2Shell scanning: 216 hosts targeted globally across government, financial, and critical infrastructure sectors; low-and-slow methodology with node rotation.

---

Sources

  • BleepingComputer: PHP2Shell security flaws, Brotli vulnerabilities, University of Copenhagen breach, DreamHost incident, Chinese cryptocurrency scam extradition, AI coding agent hijacking, South Korean ARTEX AI arrests
  • The Hacker News: Magento campaign, PHP Windows Brotli flaw, Microsoft Teams IT support scams, Wasmtime vulnerabilities, uCreator Android spyware, Microsoft 365 token replay attacks, Gheist GitHub campaign, AI coding agent malware, Tailscale SSH flaws, North Korean PHP2Shell activity
  • CERT.BE (Belgium): ISC BIND 9 RCE vulnerability, HPE Networking AOS critical vulnerabilities