# Threat Intel Brief — October 28, 2026

TL;DR

  • Critical supply chain attacks: LiteLLM v1.107.0 compromised; Convertr analytics script hijacked for payment card skimming; eMudhra CA keys compromised prompting Microsoft certificate distrust.
  • Active exploitation: VMware VeloCloud Orchestrator, PHP2Shell RCE flaws (CVE-2026-109618, CVE-2026-109619), and ISC BIND 9 under attack; emergency Brotli patches issued for Node.js, .NET, and PHP.
  • AI-augmented threats: CyberStrikeAI deploys 44 AI agents against Japanese targets; ARTEX AI framework used in South Korean breach of 90+ organizations; AI-generated phishing pages bypass MFA via session hijacking.
  • Healthcare under siege: University of New Mexico Health ransomware disrupts trauma center operations; new Byod group claims 36,000 systems compromised.
  • State-aligned activity: Lazarus Group targets South Korean critical infrastructure with post-quantum encrypted malware; Dahua IP cameras in Ukraine exploited for surveillance.

---

Critical Threats

LiteLLM v1.107.0 Supply Chain Compromise

What happened: CERT.BE issued an urgent warning that LiteLLM release v1.107.0, an open-source library for managing large language model API calls, has been compromised with malicious code. Organizations that installed or upgraded to this specific version have potentially hostile code in production AI infrastructure.

Impact: Threat actors may have established persistence, exfiltrated API keys for OpenAI/Anthropic/Azure OpenAI services, or compromised credentials accessible to LiteLLM processes. The scope depends on deployment context and permissions granted to affected systems. Supply chain attacks targeting AI tooling represent an emerging threat vector where security practices remain immature.

Recommendations:

  • Immediately identify all systems running LiteLLM v1.107.0 via package managers or container scans
  • Isolate or shut down affected instances until remediation is complete
  • Roll back to v1.106.x or upgrade to a verified clean release
  • Rotate all API keys, credentials, and secrets accessible to LiteLLM processes
  • Review logs for unusual outbound connections or unauthorized API calls between installation and remediation

---

PHP2Shell and Brotli RCE Flaws Under Active Exploitation

What happened: Multiple critical remote code execution vulnerabilities in Brotli compression libraries are being actively exploited. PHP2Shell flaws (CVE-2026-109618, CVE-2026-109619) affect PHP installations; CVE-2026-111497 impacts Node.js, .NET, and Python HTTP clients. Successful RCE demonstrated against Apache mod_php; proof-of-concept exploits publicly available.

Impact: Attackers achieve remote code execution enabling full system compromise, data exfiltration, and lateral movement. Approximately 70% of websites use PHP; millions of hosts exposed online. Exploitation does not require authentication. System-level library updates do not protect applications with bundled Brotli copies.

Recommendations (0-24h):

  • Update immediately: Node.js to 22.23.4/24.22.1/26.12.1; .NET to 8.0.33/9.0.22/10.0.14/11 RC3; PHP Windows builds to 8.2.35-1/8.3.36-1/8.4.27-1/8.5.12-1
  • Restart all affected processes and rebuild container images after patching
  • Deploy CISA's published SIGMA detection rule for PHP2Shell exploitation attempts
  • If immediate patching impossible, block inbound Brotli-compressed requests (Content-Encoding: br) at proxy/firewall
  • Monitor for suspicious PHP process execution, large cookie dumps (800+ KiB), and memory corruption indicators

---

VMware VeloCloud Orchestrator Under Active Exploit

What happened: CERT.BE warns of active exploitation of a vulnerability in VMware VeloCloud Orchestrator (VCO), the SD-WAN management platform used by enterprises and service providers. CVE identifier not yet published; specific affected versions undisclosed.

Impact: Critical risk to SD-WAN infrastructure. Successful exploitation could allow attackers to compromise VeloCloud Orchestrator instances, potentially leading to control over SD-WAN edge devices, network traffic manipulation, data exfiltration, or complete network compromise. Active exploitation significantly increases urgency.

Recommendations (immediate):

  • Check VMware security advisories for VeloCloud Orchestrator patches and apply without delay
  • Identify all VCO instances and verify patch status
  • Review VCO access logs for suspicious authentication attempts, unusual API calls, or unauthorized configuration changes
  • Restrict network access to VCO management interfaces to trusted IP ranges only
  • Monitor VMware and CERT.BE channels for CVE assignment and additional technical details

---

Apple CoreGraphics Zero-Day Exploited in Targeted Attacks

What happened: Apple backported fixes for CVE-2026-86950, a high-severity out-of-bounds write vulnerability in CoreGraphics, to older iPhones and iPads. The flaw (CVSS 8.8) enables arbitrary code execution when processing malicious files and has been exploited in extremely sophisticated targeted attacks against specific individuals on iOS versions before iOS 27.

Impact: Exploitation enables attackers to crash programs, corrupt data, or achieve remote code execution. While attacks are highly targeted, the vulnerability affects widely deployed older iPhone and iPad models still in enterprise use. Organizations with legacy iOS devices face elevated risk until patches are applied.

Recommendations (0-24h):

  • Deploy October 2026 security updates to all affected iPhone XS/XR/XS Max and iPad 7th/9th gen, Air 4th gen, mini 6th gen devices
  • Verify iOS 26.7.1 and iPadOS 26.7.1 patches from September are deployed on newer devices
  • Review MDM logs to identify unpatched legacy iOS/iPadOS devices
  • Implement file scanning and email attachment filtering to detect malicious files
  • Monitor for unusual application crashes or memory corruption events on iOS devices

---

Microsoft Authenticator Android Token Theft Vulnerability

What happened: Microsoft patched CVE-2026-80097, a critical flaw in Authenticator for Android allowing malicious apps without permissions to impersonate trusted Microsoft applications and steal work account sign-in tokens. Patched in version 6.2606.4246 (September 2026).

Impact: A malicious Android app could obtain OAuth tokens for work accounts, granting access to email, files, and calendars via Microsoft Graph. Requires victim to have Authenticator installed with a signed-in work account. Unclear if existing stolen tokens are revoked upon patching.

Recommendations (0-24h):

  • Update Microsoft Authenticator for Android to version 6.2606.4246 or later on all corporate devices
  • Push minimum version requirement via MDM platforms
  • Review Azure AD/Entra ID sign-in logs for anomalous token issuance or Graph API access from Android devices
  • Educate users to avoid sideloading apps or installing from untrusted sources on devices with work accounts
  • Consider revoking and reissuing tokens for high-privilege accounts that used Authenticator on Android prior to patching

---

Threat Actor Activity

Lazarus Group: Operation FlashHole Targets South Korea

Lazarus Group, a North Korean state-sponsored APT, has been attributed to Operation FlashHole, a cyber espionage campaign targeting at least three South Korean organizations in construction, software, and wire-communication equipment manufacturing sectors since July 2025. The campaign abuses mandatory South Korean financial security software (Initech's INISAFE CrossWeb EX) to deploy malware using post-quantum encryption. The attack chain leverages DLL side-loading, memory-only execution, and AI-generated social engineering content. This represents a continuation of Lazarus's sustained focus on South Korean critical infrastructure, following Operations DeathNote (2021), SyncHole (2024-2025), and Double Barrel (2026).

Defensive priorities: Monitor for DLL side-loading via legitimate Windows binaries (fsquirt.exe, SyncHost.exe); patch mandatory financial security software immediately; scrutinize spear-phishing emails containing links to external portfolio or recruitment sites.

---

CyberStrikeAI: AI-Automated Attacks on Japan

An unidentified threat actor group employing the CyberStrikeAI open-source penetration testing tool has conducted three distinct campaigns targeting organizations in Japan, Taiwan, Hong Kong, and South Korea. The group deploys 44 specialized AI agents to automate reconnaissance, exploitation, C2, persistence, data exfiltration, and reporting. At least 19 Japanese organizations were subjected to validation activity in October 2026. Targets include Fortinet FortiGate appliances, VPN devices, WebLogic servers, and GIS servers with default credentials. The use of AI-generated Japanese-language forms and fake login pages indicates deliberate localization for Japanese targets.

Defensive priorities: Eliminate default credentials on all internet-facing infrastructure; implement behavioral analytics to detect AI-driven attack patterns (24/7 activity without fatigue indicators); accelerate patch management cycles to reduce exposure windows below 24 hours.

---

Gheist Campaign: GitHub Token Theft and Secret Exfiltration

An automated campaign tracked since September 15, 2026, has compromised over 850 GitHub accounts to inject malicious workflows into private repositories and GitHub Enterprise environments. The campaign extracts secrets from GitHub Actions logs using base32 encoding to bypass secret masking, then deletes workflow runs within seconds to remove evidence. Over 13,500 malicious branches planted across affected accounts. Later variants target self-hosted runners to harvest 31 types of credentials including AWS instance roles, private keys, and Kubernetes service account tokens.

Defensive priorities: Audit repositories for branches matching pattern 'ci-sync-[6 chars]'; rotate all repository secrets and revoke associated tokens; enforce branch protection rules requiring signed commits and pull request reviews; monitor for rapid workflow run creation and deletion patterns.

---

Brazilian Skimming Group: Convertr Supply Chain Attack

A Brazilian credit card skimming group compromised Convertr, a Brazilian e-commerce platform handling R$2 billion ($370M) in sales, by exploiting CVE-2026-8467 in the platform's outdated Plausible Community Edition analytics installation. The attackers injected malicious JavaScript into the legitimate analytics tracker file, enabling credit card skimming across dozens of major fashion brands using Convertr's checkout system. The skimmer evolved from generic payment-field patterns to Convertr-specific API field names by October 26, demonstrating active development during ongoing operations.

Defensive priorities: Monitor for unauthorized modifications to third-party analytics scripts; implement Content Security Policy (CSP) headers with strict script-src directives; deploy client-side security solutions that detect payment form data exfiltration; conduct supply chain risk assessments of third-party scripts loaded on payment pages.

---

Geopolitical Context

North Korea: Lazarus Group Escalates South Korean Targeting

Operation FlashHole represents Lazarus Group's continued strategic focus on South Korean critical infrastructure, technology sectors, and telecommunications. The campaign's abuse of mandatory financial security software (INISAFE CrossWeb EX) ensures broad potential victim coverage across organizations required to use these solutions for banking and government services. The use of post-quantum encryption in malware deployment suggests North Korean investment in cryptographic resilience against future defensive capabilities. This activity aligns with broader North Korean intelligence collection priorities targeting South Korean economic and technological assets.

---

Japan: AI-Augmented Reconnaissance at Scale

The CyberStrikeAI campaigns targeting Japan demonstrate how AI automation enables lower-tier actors to conduct operations previously requiring significant human expertise. The concentration of activity in August–October 2026, combined with targeting of critical infrastructure sectors (GIS, VPN appliances, enterprise servers), is consistent with both espionage and pre-positioning for future operations. The fact that at least 19 organizations were subjected to validation activity in a compressed timeframe suggests industrial-scale reconnaissance. Japan's position as a key U.S. ally and technology hub makes it an attractive target for both state-sponsored and financially motivated threat actors.

---

Ukraine: Surveillance Infrastructure Exploitation

CERT-UA's alert regarding systematic exploitation of Dahua surveillance devices in Ukraine reflects broader patterns of digital reconnaissance consistent with ongoing conflict dynamics. Dutch intelligence services (AIVD/MIVD) assessed in July 2026 that Russian-linked actors have been systematically compromising IP cameras across EU, NATO states, and Ukraine for military intelligence collection, including automated image recognition to identify military vehicles, cargo, and transport routes. The exploitation of commercial off-the-shelf surveillance equipment creates a persistent counterintelligence challenge for European security services and NATO supply chain security.

---

Australia: Offensive Cyber Operations Against Amadey Botnet

The Australian Signals Directorate's (ASD) offensive cyber operation against Amadey malware infrastructure represents a notable exercise of sovereign cyber capabilities beyond traditional defensive mandates. ASD gained access to the criminal backend and disconnected approximately 180,000 infected computers worldwide. This action, requiring explicit government approval, demonstrates Australia's willingness to conduct disruptive operations against transnational cybercrime infrastructure hosted overseas. The operation aligns with broader Western efforts to impose costs on cybercriminal ecosystems through active disruption rather than passive defense.

---

Recommended Actions

Immediate (0-24 hours)

1. Patch critical RCE vulnerabilities: Deploy emergency updates for Node.js, .NET, PHP (Brotli/PHP2Shell flaws); update VMware VeloCloud Orchestrator; patch ISC BIND 9
2. Remediate supply chain compromises: Identify and isolate LiteLLM v1.107.0 installations; rotate all API keys and credentials accessible to affected systems
3. Update mobile devices: Deploy iOS 18.7.11/iPadOS 18.7.11 to older iPhones/iPads (CVE-2026-86950); update Microsoft Authenticator for Android to 6.2606.4246+ (CVE-2026-80097)
4. Audit GitHub repositories: Search for malicious branches matching 'ci-sync-[6 chars]' pattern; rotate repository secrets if Gheist indicators found
5. Review Microsoft 365 sign-ins: Check for token replay attacks from 193.26.115.0/24 IP range; audit Entra ID registered devices for rogue entries

Within 24-72 hours

6. Harden SD-WAN infrastructure: Restrict VeloCloud Orchestrator access to trusted IPs; review access logs for suspicious activity
7. Secure financial security software: Patch INISAFE CrossWeb EX and similar mandatory South Korean financial applications; monitor for DLL side-loading attempts
8. Eliminate default credentials: Remove default passwords from all internet-facing infrastructure, especially VPN devices, FortiGate appliances, WebLogic servers, and IP cameras
9. Deploy detection rules: Implement CISA's SIGMA rule for PHP2Shell; monitor for Brotli exploitation indicators; detect AI-driven attack patterns
10. Certificate infrastructure: Apply Microsoft out-of-band updates to distrust eMudhra certificates; inventory and replace affected certificates

This week

11. Supply chain security: Conduct risk assessments of third-party scripts on payment pages; implement Subresource Integrity (SRI) hashes; review analytics platform security
12. GitHub security hardening: Enforce branch protection rules requiring signed commits; implement mandatory approval workflows; restrict token scopes to minimum required permissions
13. AI coding agent security: Never launch AI coding agents in ~/Downloads or web-writable folders; audit agent configuration files for unauthorized modifications
14. Tailscale SSH: Prepare to deploy patches (expected EOD October 27); set TS_SSH_DISABLE_FORWARDING=1 as temporary mitigation; review SSH access policies
15. Incident response planning: Establish procedures for phishing reports including immediate session revocation; prepare for potential secondary attacks using stolen credentials from Amadey, ARTEX AI, or Gheist campaigns

---

Watch List

  • Wasmtime sandbox escape vulnerabilities (CVE-2026-115889, CVE-2026-115893): Update to 36.0.19, 48.0.7, 49.0.4, or 50.0.0; rebuild applications embedding Wasmtime as library
  • GoAhead embedded web server TLS flaws (CVE-2026-115881): Certificate revocation bypass in mTLS configurations; contact device manufacturers for firmware updates
  • HPE Networking AOS critical vulnerabilities: CERT.BE warning; consult HPE Security Bulletin portal for CVE details and affected versions
  • Tailscale SSH vulnerabilities: Root privilege escalation, credential theft, server crashes; patches expected October 27
  • DreamHost incident: Forced password resets for email and FTP/SFTP users; monitor for additional details on scope and impact
  • Keystone hardware wallet breach: Device verification key stolen; counterfeit devices may pass verification checks; verify wallet authenticity before use
  • Warp development environment breach: Agent decision logs and user telemetry exposed via third-party vendor compromise
  • University of New Mexico Health ransomware: Byod group claims 36,000 systems compromised; monitor for data leak and follow-on targeting

---

Sources

  • BleepingComputer
  • The Hacker News
  • CERT.BE (Belgium)
  • CERT-UA (Ukraine)
  • Kaspersky
  • Huntress
  • Wiz Research
  • Imperva
  • Enclave Security
  • Xint
  • FoxIO
  • Forever Security
  • Ovi (security researcher)

---

*This report covers threat intelligence from October 21-28, 2026. Organizations should prioritize patching actively exploited vulnerabilities and remediating supply chain compromises within the next 24 hours. The convergence of AI-augmented attacks, supply chain compromises, and state-aligned espionage campaigns requires heightened vigilance across all sectors.*