The attackers chained PHP2Shell and Fragnesia exploits and hacked two servers of a US government-affiliated organization.
The post China-Linked Hackers Exploit PHP2Shell to Root Firewalls appeared first on SecurityWeek.
CISA added the Brotli flaw to its KEV catalog, and two honeypot operators logged attempts, including one that used a broken exploit.
The post CISA Warns of Node2Shell Exploitation as Honeypots Log Attack Attempts appeared first on SecurityWeek.
Siemens, Schneider Electric, ABB and others have confirmed that some of their products are affected by the PHP2Shell vulnerabilities.
The post Industrial Vendors Check Products for PHP2Shell Vulnerabilities appeared first on SecurityWeek.
Attackers successfully exploited the PHP2Shell flaws against honeypots, launching 35 shells from two IP addresses on October 24.
The post PHP2Shell Exploitation Moves From Probes to Working Shells appeared first on SecurityWeek.
An out-of-bounds write in Google’s Brotli decoder affects Node.js, .NET, PowerShell, and Python packages, and can lead to code execution.
The post Node2Shell: Brotli Flaw Triggers Patching Across Microsoft, Node.js, Python Packages appeared first on SecurityWeek.
Say you want to copy a file to another folder on your Windows PC, but not for backup purposes. If you just want to have the same file appear in multiple folders, you don’t have to copy it the usual way, where each copy takes up the full amount of storage space. What you can do instead is hard link it, which makes the same file show up in another folder, indistinguishable from the original, with the benefit of this “copy” not using any extra storage.
See what you missed in Daily Tech Insider from Oct. 19–23.
The post This Week in Tech: AI Agents Clock In as Apple Buyers Wait and IT Scrambles appeared first on TechRepublic.
See what you missed in Daily Tech Insider from Oct. 19–23.
The post This Week in Tech: AI Agents Clock In as Apple Buyers Wait and IT Scrambles appeared first on TechRepublic.
It’s no longer a proper month without Microsoft breaking its own record for security fixes, and October’s Patch Tuesday was no exception. Brian Krebs brings the roundup: more than 1,400 vulnerabilities fixed in a single batch, dwarfing September’s record of nearly 1,000, which itself was about ten times the normal monthly load. According to Tenable, Microsoft has now passed 4,000 CVEs for the year with two months still to go.
Only one of the fixes is for a vulnerability already being exploited in the wild: CVE-2026-96951, a security feature bypass in the Windows Shell affecting Windows 10, 11, and some Server versions. A .NET Framework bypass, CVE-2026-108398, was publicly disclosed before the patch, giving attackers a head start, and with modern AI tooling, it seems like not much of a head start is needed. At least 78 of the bugs are rated critical, and most of those allow remote code execution with little or no user interaction. Windows 10 holdouts can relax a little: Microsoft quietly extended free updates through October 2027. Given the pace of exploitation, this is probably the only way to prevent an Internet-scale meltdown.
Microsoft credits LLM-driven bug hunting for the volume, which leaves the poor admins who have to test and deploy all of this in an unenviable spot. Fortra’s analysis shows that only 26 Microsoft vulnerabilities have landed in the CISA KEV catalog of actively exploited bugs so far this year, so start there. For the rest, the SANS Internet Storm Center and Cisco Talos have the usual breakdowns by severity. Or, you know, just patch everything and hope for the best, which is roughly what everyone does anyhow.
Originally I was calling this the “big one” for the week, but this week that just keeps on giving. The private keys for eight eMudhra intermediate certificates have been compromised, and the way they were compromised is going to be a security talk punchline for years. Remember the Debian SSL and SSH key debacle? Of that scale.
Some background first. When your browser connects to a website over HTTPS, the site presents a certificate saying “I am example.com”, signed by a Certificate Authority (CA). Your browser and OS ship with a list of trusted root CAs, but roots are too valuable to use day to day, so they sign intermediate certificates, and the intermediates sign the actual website certificates. Whoever holds an intermediate’s private key can mint a certificate for any website, and every client that trusts the root will believe it. The whole system depends on those keys staying secret, and on them being generated properly in the first place.
eMudhra, an Indian CA which sells certificates under the emSign brand, had six TLS intermediates and two code-signing intermediates chaining to the emSign ECC Root CA – G3, which is trusted by Chrome and Apple, and Mozilla. A researcher identified only as Wayne proved the keys were compromised by signing the message “We have a problem here – Wayne” with each of them and sending it to the root programs.
How did Wayne get the keys? Flüpke posted one on Mastodon, and the secret value for the “EM OV TLS CA – G3C” key is… 4. Not four followed by 380 bits of randomness: the integer four. A reply quickly brute-forced the rest, and they’re all equally tiny: 56, 230, 237, 115, 155, 156, and 66. The keys were “incorrectly generated by the CA”, and anyone could recover them from the public certificates, which has been true since they were created in April 2025.
The browsers moved fast. According to The Hacker News, Chrome pushed a block within two hours of the report, and Mozilla blocked the certificates in under three, pulled the root from NSS, and shipped Firefox updates (CVE-2026-113470) for anyone with automatic updates disabled. There are no Certificate Transparency logs of rogue certificates, so modern browsers were never at risk. Everything that isn’t a browser is going to be the real problem and the extremely long tail of this fault: plenty of software never checks for revoked certificates and keeps trusting these keys until its bundled root list is updated.
Go hard-coded the eight bad keys into its standard library (CVE-2026-111943), but as Penligent points out, that only protects Go programs once they’re rebuilt with the new release. Python, Rust, Java, Node.js, curl, and most Linux distributions have updated root bundles, and the we-have-a-problem.com site has a full list, a checker, and manual workarounds for macOS, whose built-in curl and git don’t check revocation. There are also fixes for Linux, Windows, and the BSDs. Update everything, then go rebuild everything you compiled yourself. And then wonder how you’re going to update appliances, IoT devices, cameras, and everything else that fetches code over HTTPS or SSL.
PHP, the language behind a significant percentage of the web had a rough week. WordPress, Drupal, Magento, phpMyAdmin, and just about every hosting control panel, major ecommerce sites, home project blogs, and even Hackaday itself was potentially impacted. Details of two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, leaked onto Hacker News a day ahead of the embargo, and Huntress covers the scramble that followed as PHP rushed its release out early. Now that patches are available, Ryan Austin of Calif has published the full writeup, demonstrating pre-authentication remote code execution against important apps on default configurations, in PHP versions back to 5.4.0. That’s over a decade of PHP.
The trick is an old one, first found by Stefan Esser back in 2004. PHP enforces a memory limit for each request, and when a request exceeds it, PHP stops immediately with a fatal error. If that happens in the middle of native code updating some internal structure, the structure is left half-built, and the cleanup code that runs afterward trusts it anyhow. That’s a classic “use-after-free” style bug, where the program uses memory that’s already been released or was never properly set up, and those are frequently exploitable. Calif found ways to reliably push a request over the memory limit at exactly the right moment (deeply nested empty file uploads turn out to balloon into hundreds of megabytes of internal tables, while staying under PHP’s upload size limits), and three different places where the interruption leaves a dangerous mess. Austin found the first bug with a generally available LLM, but only because he knew PHP’s twenty-year history of memory-limit bugs well enough to point it in the right direction.
Amazon reports that its honeypots caught a php2shell exploitation attempt on October 17th, four days before the embargo lifted, and that it’s now being broadly exploited. Their advice is worth repeating: for critical bugs on internet-facing systems, measure your patch window in hours, not weeks, and start investigating from the earliest exploitation date, not the disclosure date. If you can’t patch right now, Calif suggests disabling session.upload_progress and removing the memory limit, which comes with its own obvious problems.
One word of caution: alongside the legitimate writeups, there are many self-published “corrected findings” and “proof-of-concept” posts that can’t seem to decide whether their own exploit works, while offering a downloadable “weaponized” bundle. A leaked-bug panic is the perfect time to hand anxious admins a zip file. Read the real advisories, and don’t run random proof-of-concept bundles.
Quentin Kaiser has the long-form writeup of his Hexacon talk on a bug in Broadcom’s WiFi stack, present since at least 2010, which gives an attacker a root shell on a router from across the street. So called “parking lot” attacks that can happen from someone not even on your property have long been the boogeymen of WiFi security, and it’s been a little bit since we’ve gotten a new one.
The bug lives in WPS, WiFi Protected Setup: the “push the button on your router and then on your printer” pairing system that was supposed to save people from typing long WiFi passwords. WPS has a long and spotty security history, and this bug can be triggered over the air without knowing the network password, and without completing a WPS pairing. Kaiser’s demos show him pulling the WiFi password straight out of a router’s settings and sending it back over WiFi, and getting a fully interactive remote shell carried entirely over WiFi frames. No Internet connection required.
The really grim part is the patch history. Broadcom quietly released an incomplete fix in 2018, then suggested vendors switch to the open-source hostapd instead. For the older eCos-based chipsets that’s effectively never going to happen, which makes it a permanent “forever-day”. Broadcom refused to assign a CVE, and because Broadcom is its own CVE authority, CERT/CC closed Kaiser’s case the same day it was opened.
As of disclosure, the cable and DSL gateways he tested from three of Belgium’s four major ISPs were still vulnerable, and his napkin math puts it at over a million and a half devices in Belgium alone. Broadcom chips are, of course, sold everywhere. If you’re running ISP-provided hardware, there isn’t much you can do about the firmware. Turning off WPS can’t hurt if your router allows it, although Kaiser doesn’t say whether that blocks the attack. Disabling the gateway’s own WiFi and running your own access point that you can actually update is the safer bet.
GitLab has released fixes for CVE-2026-110264, a maximum-severity CVSS 10.0 bug allowing unauthenticated attackers to run code on self-hosted GitLab servers. The flaw is an integer overflow when compiling a specially crafted regular expression in Onigmo, the Ruby regex engine which GitLab bundles into its own packages, so it affects every version back to GitLab 7.0 in 2014.
This is the fourth regex engine code execution bug from the same researcher in about a month (after CVE-2026-97229, CVE-2026-93577, and CVE-2026-89078), and comes with a nasty gotcha: the new fixed versions are one release past the October 12th fix, so if you diligently patched nine days ago, you’re vulnerable again. GitLab hasn’t said what’s needed to trigger the bug, so there’s no configuration workaround. If you’re running GitLab at home or in the shop, patch, and budget for some downtime while the database migrations run.
Node.js shipped security updates for the 22, 24, and 26 branches, headlined by CVE-2026-111497, an out-of-bounds write in the bundled Brotli decompression library. Vercel’s advisory notes that researchers have demonstrated both memory leaks and command execution.
Node doesn’t decompress Brotli data on its own, but plenty of applications and libraries do, whether on incoming requests or on responses fetched from other servers. Vercel deployed firewall rules for traffic coming into its own platform, but no firewall can protect your code from a malicious response it goes and fetches itself. Node 20 is end-of-life and won’t be fixed. As a bonus, the same releases carry the eMudhra certificate distrust, so that’s two reasons to go update.
HTTP/3 is the newest version of the protocol behind the web, running over QUIC (a UDP-based transport) instead of TCP. To save bandwidth, it compresses request headers using a scheme called QPACK: common headers can be sent as a one-byte reference into a table instead of the full text. Compression is great for bandwidth, but any time a small input can turn into a big output, there’s a risk of a “decompression bomb”. Similar tricks resulted in “zip bombs” in the 2000s, and what’s old is new again.
FoxIO found exactly that in seven of the ten HTTP/3 implementations they tested. One approach packs about 160,000 unique short headers into a single 1MB request; another stores one 4KB header and then references it thousands of times, a 4000-to-1 amplification. The HTTP/3 spec already says how to limit the decoded size, but implementations got it wrong in every possible way: checking only the compressed size, decompressing everything before checking, ignoring the per-header overhead, or reading the limit setting and then never enforcing it.
Fixed so far are quic-go (CVE-2025-64702), which is used by Caddy, Traefik, and Cloudflare’s tunnels; Cloudflare’s quiche (CVE-2026-12523); lsquic 4.9.0; and even Wireshark (CVE-2025-13945), whose QPACK decoder crashed during testing. Bun, the hyperium h3 Rust crate, and aioquic/mitmproxy remain unpatched. Bun gets special mention for an integer overflow that turns a single 516KB request into a permanent 100% CPU infinite loop. The lesson applies to any compression format: limit the decompressed size as you go, not just the bytes on the wire.
Patrick Wardle of Objective-See digs into Heartbreaker, macOS ransomware written in Rust that has sat on VirusTotal since May 2025, undetected by every antivirus engine.
Most antivirus detection relies on signatures: a hash or byte pattern identifying a known-bad file. Metamorphic malware tries to dodge signatures by rewriting itself so every copy looks different while behaving the same. Heartbreaker takes a delightfully brute-force approach: it carries its own Rust source code inside the binary, and after running, it shuffles variable names, adds junk functions, installs a Rust compiler if one isn’t present, recompiles itself, and replaces itself with the new build. It is about as subtle as a brick through a window.
As ransomware it’s not very scary. It only encrypts the Downloads folder, and uses the same hard-coded key for every victim, so Wardle simply wrote a decryptor. The rebuilding also depends on a GitHub library which has since disappeared, so it mostly fails anyhow. Wardle uses it to demonstrate his free RansomWhere? tool, which ignores signatures completely and instead watches for an untrusted process rapidly writing files that look encrypted (using a bit of entropy math). The malware can change its hash all day long, but to ransom anything it still has to encrypt the files, and that’s much harder to disguise.
TeamUpdraft, the company behind the very popular UpdraftPlus WordPress backup plugin, disclosed a breach of their customer database over the weekend. Names, emails, addresses, hashed passwords, and two-factor authentication settings were taken, and more worryingly, the connection keys for UpdraftCentral, their cloud dashboard for managing many WordPress sites at once. UpdraftPlus previously made an appearance back in June, when a vulnerability in the plugin was used in the Awesome Motive supply chain attack.
Those UpdraftCentral keys can send commands to every connected site, which turns one vendor breach into a remote control for potentially thousands of customer websites. TeamUpdraft has released UpdraftPlus 1.26.12 and 2.26.12, which automatically disconnect the old keys. If you or anyone you know manages WordPress sites through UpdraftCentral, log in to each site directly, update the plugin, and check for unexpected admin accounts and plugins (including the easy-to-miss “Must-Use” plugins tab).
Citizen Lab has published research showing that the Israeli ad-tech company Discover-Tech helped deliver spyware through ordinary online ads, targeting at least 45 devices at the news outlet Al Jazeera in 2024 and 2025. Citizen Lab attributes the spyware to Candiru, a commercial spyware vendor.
When you load a web page with ads, the ad slot is typically auctioned off in real time to the highest bidder, based on a profile of who you seem to be. This “programmatic advertising” system is, by design, a mechanism for running third-party content on a very specific person’s device. It’s easy to see why that’s attractive to a spyware vendor. According to Citizen Lab, Discover-Tech’s platform could profile users and infect a device just by displaying an ad, no click required. CPJ reports that the company’s ads reached nearly 200,000 websites and apps, and researchers at Confiant found them on government networks including the US Department of Defense, NATO, and the UN.
Malicious ads are nothing new, but this is the first public evidence of an ad platform being used for targeted, zero-click spyware delivery. “Don’t click on ads” has always been good advice. An ad blocker isn’t just a quality-of-life improvement; it’s attack surface reduction.
Last week we covered a ransomware “recovery” CEO charged with secretly paying ransoms while billing customers for decryption. This week, Brian Krebs reports that investigators chasing ShinyHunters (the group behind the FBI hack) have identified executives at two ransomware negotiation firms with unusually friendly relationships with the gang. Chats seized when Dutch police arrested a suspected ShinyHunters member reportedly show negotiators who knew about new victims before the victims themselves did. One Canadian executive has already been arrested, and investigators believe an executive at an unnamed, prestigious US consulting firm helped run the gang’s extortion website.
It’s not the first time: the DOJ sentenced Florida negotiator Angelo Martino to 70 months in July for feeding his own clients’ negotiating positions to the BlackCat ransomware gang, and for helping deploy ransomware against even more victims. The government seized $10 million in assets from him, including a luxury fishing boat and, for reasons unknown, a food truck.
Part of the problem is structural. Some negotiation firms charge a percentage of the ransom paid, which gives the “negotiator” every incentive to pay, and pay big. Firms which refuse to facilitate payments often just get swapped out by the insurance company for ones that will. Meanwhile, ShinyHunters is reportedly furious with Coveware, an incident response firm, for telling victims not to pay, which is probably the best endorsement Coveware could ask for.
The Verge reports that security firm Norforge found an attacker using a swarm of mostly autonomous AI agents to break into more than 100 websites, including sites belonging to John Deere, SharkNinja, and Cummins. The agents ran on Cairn, an open-source “general-purpose problem-solving engine”: you give it a starting point and a goal, and the agents work toward it while documenting their progress. That documentation is how they were caught: the attacker’s Cairn instance was exposed to the Internet, along with about 20 others that appear malicious.
According to Reuters, the attacker described their preferred intrusion tactics in fewer than 100 Chinese characters, and each successful breach took about 23 hours. The victims say the impacted sites were standalone support pages, and Cairn’s author insists it was “never a ‘hacking tool'”. Many tools can be double-edged, but the effort balance here is hard to ignore: a short prompt and a day of waiting on one side, and defenders who have to close every hole on the other.
404 Media pieced together, from an unsealed search warrant, that a Chinese organized crime ring hacked Staples in 2023 and issued more than 15,000 gift cards worth over $5 million. Staples’ internal customer support system was supposed to be reachable only from inside the company, but wasn’t. The attackers requested “heap dumps”, a debugging feature which captures everything an application has in memory, and pulled out the active login sessions of customer service reps. With those, they simply logged in as the reps and issued gift cards. A similar trick was used in a hack of payment data from Target years ago, where attackers leveraged access through the air conditioner control network into the cash register network, and then dumped credit cards directly from RAM as they were processed.
If you’ve ever wondered why debugging endpoints left exposed in production show up in every penetration test report, this is why. The gift cards were then laundered the old-fashioned way: crews of shoppers hitting Target stores with phones full of gift cards, buying Apple and Bose gear by the cartload (about $141,000 across 85 Target stores in 18 states in two days), with the goods shipped back to China. The larger ring this fed into reportedly moved over $100 million in gift cards.
An extortion group calling itself FulcrumSec has posted a leak site claiming a massive breach of PingCAP, makers of the TiDB Cloud managed database service. The group claims it found cloud credentials committed to PingCAP’s own source code repositories, and used them to set up a replication feed of PingCAP’s production control database that re-exported everything to the attackers every six hours for 22 days, without being noticed.
The claims haven’t been independently verified, but they’re very specific: 10.6TB of data, 115,000 customer API keys stored in plaintext, 20 million customer SQL queries, four years of connection logs with customer IP addresses, and 413 private source repositories. The attackers quote a 2022 internal security ticket noting that any member of a customer organization, even a billing-only account, could reset the root password on every database in that organization. Perhaps most damaging, support engineers allegedly pasted live customer credentials into support tickets, including cloud keys with admin access to other companies’ storage. If you’re a TiDB Cloud customer, assume your API keys, connection strings, and anything ever pasted into a support ticket are burned, and rotate accordingly.
Android Authority found a fake WhatsApp app on Google Play with over half a million downloads, a week after a fake Chrome app racked up over 100,000. The fake copied the real listing’s screenshots and description word for word, and in some cases appeared as a sponsored result when searching for the real app.
The trick that let it linger is Google Play’s “Early Access” program, which disables public reviews. Normally a fake app gets buried in one-star “THIS IS A SCAM” reviews; in Early Access, nobody can see them. As of publication it was still available. “Only install from the official store” is still good advice for family members, but it’s a little less reassuring when the official store is selling ad placement to the fake.
Back in September, we covered a serious vulnerability in Muse, Meta’s extremely privileged AI agent. This week, Meta suspended Muse’s chat sharing feature after researchers at Claroc found they could find and read thousands of shared conversations.
Each shared chat got its own web address, with the conversation title as part of the hostname. Hostnames get looked up in DNS, and many DNS lookups are recorded by “passive DNS” services, essentially a giant searchable history of which names have been resolved. One search returned a ready-made table of contents of shared chats. Claroc found 6,800 of them, including a small business loan application, a bank fraud alert with partial account details, and internal company documents. “Secret URL” sharing only works if the URL stays secret, and putting the secret in a DNS hostname is roughly the opposite of that.
The UK Information Commissioner’s Office reprimanded IT provider Ogi Networks and the Welsh public sector data organization Data Cymru over a 2024 ransomware attack which exposed data on 3,300 people, most of them children. The way in? A test account named “Test2”, created in 2012, never reviewed, and protected with the password “Password1”. The local administrator accounts on three systems also shared a single password for the same twelve years.
There’s nothing exotic here, sadly. Old accounts nobody remembers, passwords that would fall to the first guess of any automated tool, and an outsourcing arrangement where each side assumed the other was handling security. None of it makes for exciting headlines, but these are the things that keep causing very real breaches.
As a follow-up to last week’s coverage of hardware implants in Ledger crypto wallets, Kim Zetter reports that Trezor’s claim of “not a single piece of evidence” that its devices were compromised doesn’t quite line up with reality. Joe Grand found implants in two Trezor wallets, bought through Facebook Marketplace and a TikTok shop, and reported them to Trezor in August.
The Trezor attack is different from the Ledger implant. Instead of adding a radio to spy on the screen, the attackers replaced the main microcontroller with one running modified (open source) firmware. The firmware “randomly” generates one of a dozen recovery phrases the attackers already know. To pass Trezor’s integrity checks, it presents a copy of the legitimate firmware for verification before switching to the malicious code. The takeaway hasn’t changed from last week: buy only directly from the vendor, and if you’re holding enough crypto to make this worth someone’s while, consider whether you can really trust any single device.
F5 has released out-of-band (meaning outside their normal patch schedule) updates for three critical vulnerabilities in NGINX, the web server and reverse proxy that sits in front of a huge chunk of the Internet, and quite possibly in front of the services on your home lab. The Cyber Security Agency of Singapore has a summary: all three are rated CVSS 9.2, can be triggered remotely without authentication, and can crash worker processes or, under the right conditions, allow remote code execution.
The bugs are CVE-2026-15176, a heap overflow in the “alias” and “rewrite” directives; CVE-2026-97205, a use-after-free in asynchronous file I/O combined with Server Side Includes; and CVE-2026-93479, a heap overflow in the “map” directive. Code execution requires the vulnerable configuration to be in use, and requires bypassing ASLR (the randomization of memory layout which makes exploits harder to aim). Affected versions include NGINX Open Source 1.30.5 and below and 1.31.6 and below, NGINX Plus R33 through R37, and a long list of F5’s NGINX-based products, including the Kubernetes Ingress Controller.
Back in May we covered “nginx-poolslip”, where the suggested mitigation was to avoid unnamed regex capture groups in rewrite rules. The mitigation for the “map” bug this time? Use named captures instead of unnamed captures. If you’ve been putting off cleaning up those “$1” references in your config, now’s the time. For the other two, avoid “alias” inside “location” blocks (and the “$request_filename” variable), or disable AIO or SSI, until you can update.
Normally, security bugs in the Linux kernel are reported privately to the kernel security team, which coordinates a fix before details go public. This is “coordinated disclosure”: the bug and fix are published together, ideally giving admins a chance to patch before attackers can start writing exploits. The Linux Kernel Mailing List (LKML), on the other hand, is about as public as it gets.
Phoronix reports that Trend Micro’s Zero Day Initiative, seemingly by accident, sent a batch of unpatched vulnerability reports straight to LKML. Greg Kroah-Hartman replied to each report asking about the choice of mailing list, which I can only imagine was done with remarkable restraint. The most serious two are both CVSS 9.0 remote code execution bugs in ksmbd, the kernel’s built-in SMB (Windows file sharing) server: an integer underflow in SMB Direct, and a race condition. The rest include local privilege escalation bugs in the networking code, the VMware graphics driver (an out-of-bounds write), and a stack overflow in search-domain TCP query handling, plus an information leak in the NVMe-over-fabrics target code.
Some of the bugs already have patches being tested or queued for future kernel releases, and those will presumably be expedited now. Most systems don’t run ksmbd (the userspace Samba server is far more common), but if you’ve enabled it on a NAS or a home server, it’s worth disabling until patched kernels land. As Phoronix puts it: “the bug and security reports keep on coming in the AI fueled world.”
Researchers tie PHP2Shell attempts to a Mirai botnet and show an ASLR bypass, but no successful compromise has been confirmed yet.
The post Mirai Botnet Operators Join PHP2Shell Attacks as ASLR Bypass Exploits Emerge appeared first on SecurityWeek.
Vendors are checking their products for PHP2Shell, security firms are shipping detections, and governments are urging immediate patching.
The post Tech and Security Companies Respond to PHP2Shell Vulnerabilities appeared first on SecurityWeek.
Initial attempts were observed on October 17, and mass activity began shortly after patches were released.
The post PHP2Shell Exploitation Started Days Before Patches appeared first on SecurityWeek.
Several cybersecurity companies saw exploitation attempts of CVE-2026-109618 and CVE-2026-109619 before PHP released the patches.
The post PHP2Shell Patches Land as First Exploitation Attempts Hit Sensors appeared first on SecurityWeek.
Completed another Hack The Box machine: Reactor, an Easy-difficulty Linux challenge.
The initial foothold came from enumerating the Next.js application running on port 3000. Version fingerprinting identified a vulnerable React canary release associated with CVE-2025-55182 (React2Shell). Further testing confirmed remote code execution through the React Server Components functionality, providing access as the node user.
From the application environment, the SQLite database exposed credentials for the engineer account. After recovering the password from the stored MD5 hash, SSH access provided the user-level foothold.
For privilege escalation, process enumeration revealed a root-owned Node.js service with the inspector exposed on localhost. The Node inspector provided a path to execute code within the root process and modify /bin/bash permissions, ultimately leading to a root shell.
I also explored an alternative approach using SSH local port forwarding and Chrome DevTools to access the remote Node inspector.
Another useful HTB machine for practicing web enumeration, version fingerprinting, application-layer exploitation, Linux enumeration, and Node.js debugging interfaces.
#HackTheBox #HTB #CyberSecurity #PenetrationTesting #RedTeam #OffensiveSecurity #WebSecurity #Linux #NextJS #React #NodeJS #CVE #PrivilegeEscalation #CTF #CyberSecurityLearning …
Learn MoreHack The Box: Reactor Machine Walkthrough – Easy Difficulty
The post Hack The Box: Reactor Machine Walkthrough – Easy Difficulty appeared first on Threatninja.net.
Welcome back, pentesters!
Some of you have probably heard about Group Policies and that you need to “check the GPOs” a few times without anyone actually explaining to you why. We’re going to fix that. Group Policy has been part of Active Directory for a long time and it’s still one of the first things pentesters should check. Mainly because it’s boring and boring things are often ignored by admins.
A GPO can hold a cleartext password. It may have a script with internal paths and usernames. It can also be edited by someone who left the team and never got their permissions pulled. These things don’t require any exploit, you just need to know where to look.
A Group Policy Object is actually two things stuck together. Often beginners only learn about one of them. The first half lives in Active Directory. It’s an object with a name, an owner, a list of who can edit it and a list of where it’s linked. This is the part that Group Policy Management Console (GPMC) shows you. The second half lives on a file share called SYSVOL (e.g. \\sekvoya.local\SYSVOL\sekvoya.local\Policies\{GUID}\). This folder holds the actual settings and has registry values, XML files, scripts and more.
Any domain user can usually read SYSVOL. So if something sensitive is dropped in there (a stored password or a script with internal server names) you can extract it.
We’re going to use GPOZaurr for most of this. It’s a legitimate PowerShell module made for GPO audit.
Here is how you set it up:
LoginPS > Add-WindowsCapability -Online -Name 'Rsat.ActiveDirectory.DS-LDS.Tools~~~~0.0.1.0'
PS > Add-WindowsCapability -Online -Name 'Rsat.GroupPolicy.Management.Tools~~~~0.0.1.0'
PS > Install-Module -Name GPOZaurr -AllowClobber -Force
PS > Import-Module GPOZaurrBefore we start hunting for anything, let’s see what GPOs exist in the domain. Later we will pull the secrets.
PS > Get-GPOZaurr | Format-Table DisplayName, DomainName, Empty, Linked, Enabled -AutoSizeFor every GPO it tells you whether it holds settings (Empty), whether anything actually links to it (Linked) and shows their status (Enabled).
As you can see, Map Network Drives – Finance is empty and not linked anywhere, someone started building a drive mapping policy and just never finished it. WSUS Settings – Old has a setting but isn’t linked to anything, so it does nothing to any computer. It just sits there. Remote Desktop – Vendors are linked but disabled. That can happen if we gave vendors RDP access at some point, then turned it off and never deleted the policy.
It’s important to understand that unlinked and disabled don’t mean safe. The object still exists. The SYSVOL folder behind it still exists. That’s where old Groups.xml files and forgotten scripts sit around waiting to be found. Stick for it.
Once you know that a GPO exists, you should look up what computers it affects. Only linked GPOs can affect computers. A link basically means that this GPO applies to this domain, this site or this OU.
PS > Get-GPOZaurrLink | Format-Table DisplayName, CanonicalName, Enabled, Enforced -AutoSizeEnabled here describes the link, not the GPO itself. It means the attachment is switched on. Enforced means this GPO wins even if a lower OU tries to block it. In our table nothing is enforced. Blocked inheritance is a setting on the OU itself that prevents handing policies from above unless they’re enforced.
Everything here lands on sekvoya.local/Workstations-Temp. That OU also blocks inheritance, because these are temp machines and nobody wants the domain-wide policy fighting with their imaging process.
You’ll also see Remote Desktop – Vendors that are Enabled, even though we said earlier the GPO itself is disabled. You can absolutely have a live link pointing at a dead GPO and it’ll still show up here.
The GPO linked to Workstations-Temp means every computer in that OU applies it. Always ask “linked where”. Domain root and the Domain Controllers OU are the highest value targets.
Let’s list what computers are in Workstations-Temp.
PS > Get-ADComputer -SearchBase "OU=Workstations-Temp,DC=sekvoya,DC=local" -Filter * | Select-Object Name, DistinguishedNameNow that we know which GPOs hit Workstations-Temp, we can find out what they actually do.
PS > Find-GPO -GPOName 'Local Administrator Password' -SingleObject
PS > Find-GPO -GPOName 'Logon Script - Standard User' -SingleObject
PS > Find-GPO -GPOName 'WSUS Settings - Old' -SingleObjectFind-GPO reads the GPT, which is just the SYSVOL content and prints it. But in our case, only WSUS was printed with a DNS name and a link. But “empty” doesn’t always mean empty. Get-GPOZaurr and Find-GPO mostly trust Active Directory. They look at the GPO’s version number and its extension attributes (gPCMachineExtensionNames and gPCUserExtensionNames). If a setting was pushed through GPMC properly, those fields get updated and the GPO shows up as not empty.
You might find an environment where that’s not the case. Files can be dropped straight onto SYSVOL by hand.
For the reason mentioned above, we won’t trust the output and list all the files ourselves.
PS > Get-GPOZaurrFiles | Format-Table GPOName, FullName, Length -AutoSizeHere we’re not querying Active Directory, that’s why we get the output. It’s showing us the actual Policies folder tree and listing what’s inside. We can open the same folders as any domain user in Explorer.
Our SYSVOL has Groups.xml with cpassword, logon.bat and office2013.adm, which is a legacy ADM template that tells you this domain hasn’t been cleaned up since 2013. Readme.txt has some notes. Take some time and look through your output.
Let’s take a look at Groups.xml and see its structure.
PS > findstr /s /i cpassword \\sekvoya.local\sysvol\*.xmlAbove you can see cpassword. It was introduced in Windows Server 2008 to let administrators manage domain-wide settings and deploy local administrator passwords. Microsoft encrypted the passwords using AES, but then made the private encryption key public. We can use NetExec to extract and decode the password stored there.
kali > nxc smb DC -u user -p password Reading SYSVOL can give you old leftover passwords. But we can also find out who can push something new into a GPO that’s still live.
PS > Get-GPOZaurrPermission | Where-Object { $_.DisplayName -eq 'Local Admins - Workstations' } | Format-Table DisplayName, PrincipalName, Permission, PrincipalSidType -AutoSizeThis pulls the ACL on the GPO object inside our AD, which tells you who can read it, who can make it apply to them, edit and change security settings. GpoRead and GpoApply mean you can see the GPO or have it apply to you, which is completely normal for Authenticated Users or Domain Computers. GpoEdit and GpoEditDeleteModifySecurity mean you can actually change settings or change who else is allowed to.
In our lab, jpatel has GpoEditDeleteModifySecurity on Local Admins – Workstations, and that GPO is linked to Workstations-Temp. Domain Users also have GpoApply on it, which is normal on the surface. Somebody got delegated edit rights on a GPO for some project or ticket (helpdesk). The ticket closed months ago, but nobody went back and pulled the permission. So not only can you read the leftover password, you can also edit rights on a linked GPO and write the next one. Those are two very different levels of access.
A low privileged user who can edit a linked GPO can add things like an Immediate Scheduled Task, a Restricted Groups entry or a startup script. These can turn into code execution on every machine that GPO touches. SharpGPOAbuse and pyGPOAbuse are built for that. GPOZaurr can only find things and fix them. The actual abuse is a separate topic.
An edit permission is one entry on a list. Ownership is stronger, because whoever owns the Active Directory object can usually reset the entire access list from scratch. When they own the SYSVOL folder, they can change the files directly, even if the AD permissions look locked down tight. Both of those owners are supposed to be Domain Admins or BUILTIN\Administrators. But this can drift over time, especially if a company is big.
PS > Get-GPOZaurrOwner -IncludeSysvol | Where-Object { $_.DisplayName -eq 'Printer Deployment - 3rd Floor' } | Format-Table DisplayName, Owner, OwnerType, SysvolOwner -AutoSizeIn our lab, Printer Deployment – 3rd Floor is owned by jpatel. That’s the same user who could edit the local admins GPO. So we have two separate mistakes, but one person behind both of them. At some point they deployed printers on the 3rd floor and picked up more access than they should have kept.
If you compromise jpatel, you own an entire GPO object outright. Their helpdesk account can be used to write policy for a whole OU.
We tried to simplify the concept of GPOs and how they work in Active Directory. As you can see, credentials can hide not only in LDAP user description and text files on the workstation, but also on the Domain Controller itself in SYSVOL that any domain user can read. Hackers often abuse GPOs and create their own policies affecting all computers and in the domain disabling Defender and booting them into Safe Mode to execute ransomware. This abuse has been reported several times.
There are a lot of different options for escalating your privileges in a misconfigured domain. The boring and complex things like GPOs and ADCS are often left vulnerable, simply because they are tedious to work with. But not for you!
Want to become a Powershell expert? Join our Powershell for Hackers training.
The post Pentesting: Group Policy for Hackers – Basics first appeared on Hackers Arise.
Welcome back, cyberwarriors!
In this part of the series, we’re looking at how PowerShell can cause serious damage when nothing is restricting it. We’ll show how it can slow systems down and knock them off completely. You’ll see how hardware interfaces can get disabled, license keys wiped and a blue screen forced with machines left unbootable.
All these techniques are destructive, but our goal here is to show you that you shouldn’t just monitor command execution in PowerShell, you should also experiment with Language Modes to limit the attack surface if a workstation gets compromised. If these scripts are misused in the wrong context, the results can be irreversible.
We’ll begin with the basics and then move toward the dangerous things.
The loadram.ps1 script works by aggressively consuming system memory. It allocates large arrays until nearly all available RAM is exhausted, leaving only a small buffer so the OS does not immediately collapse. The machine becomes unusable and applications stop responding.
This type of attack can be used as a DoS tactic to slow down a server, or it can act as a distraction, while other activity takes place.
PS > .\loadram.ps1The loadcpu.ps1 script applies the same principle to processor cores, pinning usage at 100% until the script is terminated. Just as with RAM exhaustion, this script can serve as a cover while hackers are doing something else.
PS > .\loadcpu.ps1The license.ps1 script clears Windows product keys by wiping out OEM, retail and volume license entries from the registry. The system becomes stripped of activation data. After restarting the Software Protection Service, Windows will be unlicensed and may refuse to validate against Microsoft servers.
PS > .\license.ps1Then you can check the product key:
PS > (Get-WmiObject -query 'select from SoftwareLicensingService').OA3xOriginalProductKeyThe result should be empty.
You can also kill network adapters and USB controllers using killer.ps1 script. Once you run it, the mouse and keyboard will stop working. There will be no way to transfer files, connect to the network or even plug in a recovery device without significant intervention.
PS > .\killer.ps1PowerSploit includes a module called Mayhem, which has two destructive PowerShell functions. These are Set-CriticalProcess and Set-MasterBootRecord. Both directly attack the operating system itself.
Windows protects smss.exe and csrss.exe by marking them as critical. If they are terminated, the system triggers a Blue Screen of Death. Set-CriticalProcess can tag any process with this critical status. Killing it immediately forces a system crash.
To use it, first copy the Mayhem module from the repository to:
C:\Program Files\WindowsPowerShell\Modules\Then you can run Set-CriticalProcess:
PS > Set-CriticalProcessConfirm with Y and expect the machine to blue screen in moments.
This is the most destructive of all. Unlike Set-CriticalProcess, this attack corrupts the Master Boot Record (MBR), which is the first sector of the hard drive. The MBR has the bootloader and partition table and without it Windows cannot load.
When it’s overwritten, the system may only display your custom message and will refuse to boot into the OS. Some malware does the same. The OS will work only if you fix the MBR, but chances are you will have to reinstall the OS.
In our article on Digital Forensics we were repairing a corrupted drive where the MBR had been overwritten.
PS > Set-MasterBootRecord -BootMessage 'Pwned by Cyber Cossacks!'You can also force the system to reboot right after:
PS > Set-MasterBootRecord -BootMessage 'Pwned by Cyber Cossacks!' -Force -RebootImmediatelyIt will no longer boot into Windows.
We showed how far PowerShell can be pushed when used as a weapon. That alone should be enough to convince you to restrict its use and work with Language Modes to help protect your system. By default, workstations and servers are pretty permissive, which makes them comfortable to use. The same permissiveness is just as accommodating for a hacker who has breached a system through phishing. Restricted Language Mode is a must on workstations where users don’t need PowerShell in the first place.
Want to become a Powershell expert? Join our Powershell for Hackers training.
The post PowerShell for Hackers, Part 5: How to Crash and Burn Windows first appeared on Hackers Arise.
