boredchilada

Sliver deployed against Netscalers cyfar.ca/engagements/...

~Projectzero~ BigSleep found 45 vs. Fuzzilli’s 37 V8 vulnerabilities, showing AI and fuzzing remain complementary. - IOCs: (None identified) - #AI #Fuzzing #ThreatIntel

~Cisa~ CISA added exploited Adobe Commerce/Magento and Google Brotli flaws to its KEV Catalog. - IOCs: CVE-2026-48356, CVE-2026-111497 - #CVE-2026-111497 #CVE-2026-48356 #ThreatIntel

~Cybergcca~ Critical PHP RCE vulnerabilities CVE-2026-109618 and CVE-2026-109619 are in CISA KEV; update affected products. - IOCs: CVE-2026-109618, CVE-2026-109619, CVE-2026-111459 - #CVE #Cybersecurity #ThreatIntel

~Cofense~ Password-protected bid PDF redirects victims to fake OneDrive and Microsoft login pages. - IOCs: slotpastimaxwin50jt[.]online, mm-lasertechnik[.]lastingonlineexperiences[.]de, nbpn[.]lastingonlineexperiences[.]de - #CredentialTheft #Phishing #ThreatIntel

~Cisa~ EPICS Base <=7.0.10 flaws enable DoS, memory disclosure, corruption, or code execution; update to 7.0.11. - IOCs: CVE-2026-114595, CVE-2026-114596, CVE-2026-114597 - #CVE #ICS #ThreatIntel

~Cisa~ Critical flaws enable code execution, authentication bypass, and arbitrary operations; patch affected products. - IOCs: CVE-2023-4863, CVE-2026-16436, CVE-2026-16437 - #CVE #ICS #ThreatIntel

~Checkpoint~ Fake ChatGPT and Claude projects on GitHub deliver YobaLoader and an XMRig miner. - IOCs: t[.]me/yoba_fanclub, files[.]catbox[.]moe/z5zpy9[.]dat, 3zciedc3enu4muwc5adxciyk6u3juhvhvbv6bfrk2arawlvb7k7ovxad[.]onion:443 - #Malware #ThreatIntel #Yoba

~Anyrun~ SkyW4lker abuses device-code authentication to compromise Microsoft 365 accounts despite MFA. - IOCs: 162[.]243[.]64[.]121, 67[.]205[.]154[.]32, 5200m[.]com - #Microsoft365 #Phishing #ThreatIntel

~Kaspersky~ Chained cloud flaws enabled control-plane RCE and cross-tenant compromise. - IOCs: CVE-2026-25243 - #CloudSecurity #Kubernetes #ThreatIntel

~Cisa~ CISA urges immediate patching of two exploited PHP vulnerabilities. - IOCs: CVE-2026-109618, CVE-2026-109619 - #CVE-2026-109618 #CVE-2026-109619 #ThreatIntel

~Checkpoint~ Widespread exploitation targets critical PHP flaws, while supply-chain attacks and AI-enabled campaigns expand. - IOCs: CVE-2026-109618, CVE-2026-109619, CVE-2026-110264 - #RCE #ThreatIntel #Vulnerabilities

~Akamai~ Brotli flaw enables unauthenticated RCE; upgrade Node.js immediately. - IOCs: CVE-2026-111497 - #CVE2026111497 #NodeJS #ThreatIntel

~Infoblox~ Attackers hijacked school and government DNS to host gambling pages and boost SEO. - IOCs: mikale[.]me, d9d9t8dndf89z[.]cloudfront[.]net, 168[.]144[.]156[.]92 - #Cybercrime #DNS #ThreatIntel

~Cybergcca~ IBM, Siemens, Red Hat, Google and Craft CMS require security updates; Siemens reports an authentication bypass. - IOCs: (None identified) - #PatchNow #ThreatIntel #Vulnerabilities

~Malpedia~ Name-gated signed loader installs Zalmoxis, stealing browsers, wallets and enabling hidden remote control. - IOCs: cdn[.]simplynetworking[.]eu, 45[.]152[.]149[.]66:6969, nsw211u[.]com - #Malware #ThreatIntel #Zalmoxis

~Malpedia~ APT28 continues targeting Ukrainian military logistics with updated PixyNetLoader, evading prior detections and changing persistence. - IOCs: 125abe1a497067a61011eb6072b1b3d91d3f0b658ed20a99734f0341d9cbdd6a, {0a556d98-cfee-4d84-82a7-00377f939198} - #APT28 #Malware #ThreatIntel

~Malpedia~ Modular DarkVision RAT enables credential theft, persistence, process injection, UAC bypass and multi-channel C2. - IOCs: 103[.]20[.]235[.]24, 23[.]95[.]222[.]239, 107[.]172[.]13[.]211 - #Malware #RAT #ThreatIntel

~Checkpoint~ Aokigahara steals AI sessions, developer credentials, cloud secrets, browser data and wallets. - IOCs: 2[.]26[.]252[.]48:8080, dfwioeiofwr[.]info, gate[.]dfwioeiofwr[.]info - #Infostealer #Malware #ThreatIntel

@crowdstrike.com No in-the-wild exploitation observed; reliable RCE requires deployment-specific tuning. - IOCs: CVE-2026-109618, CVE-2026-109619 - #CVE2026109618 #PHP2Shell #ThreatIntel

~Cisa~ Active exploitation of a Collabora Online OS command injection flaw; prioritize patching. - IOCs: CVE-2026-110447 - #CVE2026110447 #KEV #ThreatIntel

What php2shell looks like in a request

~Cisa~ CISA added CVE-2026-114625 to its KEV Catalog after confirmed active exploitation. - IOCs: CVE-2026-114625 - #CVE2026114625 #ThreatIntel #Vulnerability

~Varonis~ Predictable GCS buckets enabled cross-tenant RCE and service-account theft; Google mitigated the flaw. - IOCs: metadata[.]google[.]internal - #CloudSecurity #RCE #ThreatIntel

@esetresearch.bsky.social UAC-0099 handed access to Sandworm, which used MythicRatatoskr over Yggdrasil before wiping Ukrainian systems. - IOCs: b479:2771:8df4:b5e, egyptanimals[.]com, uztickets[.]com - #Malware #Sandworm #ThreatIntel

~Cybergcca~ CVE-2026-106173 and CVE-2026-114625 are reportedly exploited in the wild; patch affected systems. - IOCs: CVE-2026-106173, CVE-2026-114625 - #Arista #CVE #Fortinet #ThreatIntel

@zscalerinc.bsky.social Fake Chocolatey and MAS sites deliver Armorsteal, stealing credentials, wallets, tokens and clipboard data. - IOCs: choclatey[.]org, massgravel[.]net, workerstats[.]net - #Malware #SEO poisoning #ThreatIntel

~Recordedfuture~ Reported attacks rose 48% in Q3 2026, targeting legacy systems, APIs, and exposed services. - IOCs: CVE-2026-72898, ARTEX, TAG-217 - #Japan #Ransomware #ThreatIntel

~Varonis~ Unauthenticated PHP flaws enable memory leaks and remote code execution; patch immediately. - IOCs: CVE-2026-109618, CVE-2026-109619 - #CVE #PHP2Shell #ThreatIntel

~Cisa~ 11 flaws in CROSSBOW <6.0 enable SQL injection, credential disclosure, privilege escalation and unauthorized operations; update to v6.0+. - IOCs: CVE-2026-89196, CVE-2026-89197, CVE-2026-89199 - #CVE #ICS #ThreatIntel

~Cisa~ Unauthenticated remote flaws enable memory disclosure or denial of service; update or segment affected controllers. - IOCs: CVE-2026-102073, CVE-2026-102074, CVE-2026-102075 - #CVE2026102073 #ICS #ThreatIntel

~Cisa~ Path traversal and password leakage affect Siemens S7 API; update to 3.3.62+. - IOCs: CVE-2026-85114, CVE-2026-85115 - #CVE202685114 #CVE202685115 #ICS #ThreatIntel

~Arcticwolf~ Unauthenticated RCE is under active exploitation; patch PHP immediately. - IOCs: 92[.]118[.]112[.]100, thunder[.]godofthunder[.]st, CVE-2026-109618 - #CVE2026109618 #PHP2Shell #ThreatIntel

~Akamai~ Critical PHP flaws enable RCE; patch immediately. - IOCs: CVE-2026-109619, CVE-2026-109618 - #CVE2026109618 #CVE2026109619 #PHP2Shell #ThreatIntel

~Akamai~ Attackers hijacked .gh, .sl, and .as registries to obtain 12 trusted certificates via DNS manipulation. - IOCs: google[.]com[.]gh, google[.]sl, google[.]as - #DNS #TLS #ThreatIntel

~Varonis~ Stadia revives StealC as a RAT with hidden VNC, credential theft, command execution and file access. - IOCs: 93[.]152[.]213[.]215, 91[.]92[.]43[.]45, 193[.]148[.]56[.]97 - #Malware #RAT #ThreatIntel

~Spiderlabs~ AI coding tools and agents introduce vulnerabilities, misconfigurations, and malicious dependencies across software supply chains. - IOCs: PromptMink, Famous Chollima, APT37 - #AI #SupplyChain #ThreatIntel

~Cisa~ CISA partners outline controls to prevent token exhaustion, denial-of-tokens, cost spikes, and service disruption. - IOCs: (None identified) - #AI #Resilience #ThreatIntel

~Asec~ AhnLab says 125,859 Korean PHP search results are not website or vulnerable-server counts; update PHP immediately. - IOCs: (None identified) - #PHP #ThreatIntel #Vulnerability

@zscalerinc.bsky.social AI-driven ARTEX attacks targeted global organizations to steal personal and financial data. - IOCs: 38[.]244[.]50[.]120, 23[.]248[.]226[.]250, xcai[.]pro - #AIHacking #ARTEX #ThreatIntel

@zscalerinc.bsky.social Two PHP flaws enable unauthenticated, automated RCE; patch immediately. - IOCs: CVE-2026-109618, CVE-2026-109619, PHP2Shell - #CVE #PHP2Shell #ThreatIntel

~Symantec~ Unauthenticated RCE affects PHP web servers; patch urgently. - IOCs: CVE-2026-109618, CVE-2026-109619, PHP2Shell - #CVE2026109618 #CVE2026109619 #ThreatIntel

~Spiderlabs~ Two PHP flaws enable unauthenticated RCE across most web servers; patch immediately. - IOCs: CVE-2026-109618, CVE-2026-109619 - #PHP #RCE #ThreatIntel

~Kaspersky~ APT41 used BlackX, a BlackLotus-like UEFI bootkit, against Central Asian diplomats. - IOCs: CVE-2022-21894, www[.]archivetj[.]com, AF8A983B9ADA07EAE1259BF2953ABD40 - #APT41 #BlackX #ThreatIntel

~Cybergcca~ Update GitLab CE/EE to patched versions to address vulnerabilities. - IOCs: (None identified) - #GitLab #Patch #ThreatIntel

~Certeu~ Unauthenticated attackers can execute arbitrary code; patch internet-facing GitLab and assess compromise. - IOCs: CVE-2026-110264 - #CVE2026110264 #GitLab #ThreatIntel

~Asec~ Unauthenticated PHP2Shell flaws enable remote code execution; patch PHP immediately. - IOCs: CVE-2026-109618, CVE-2026-109619 - #CVE-2026-109618 #CVE-2026-109619 #PHP #ThreatIntel

@talosintelligence.com Weak keys enabled certificate impersonation; update trust stores and affected software. - IOCs: CVE-2026-111943 - #PKI #TLS #ThreatIntel

~Recordedfuture~ Two critical PHP RCE flaws face active exploitation; patch immediately. - IOCs: CVE-2026-109618, CVE-2026-109619 - #CVE #PHP2Shell #ThreatIntel