Cloud & Business Apps
Cybersecurity
Data & AI
IoT & Connectivity
Industry
Health
Banking and Finance
Public Sector
Retail
Tourism and Leisure
Transport & Logistics
Energy & Utilities
Smart Cities
Cybersecurity Weekly Briefing, 24-30 October
An actor with alleged links to China chained together PHP2Shell and Fragnesia to compromise firewalls and a US government network
The Israeli firm Dream has documented an operation attributed to an actor with alleged Chinese links, in which the actor chained the PHP2Shell vulnerabilities – two remote code execution flaws without authentication (CVE-2026-109618, CVSSv3 9.8, and CVE-2026-109619, CVSSv4 9.2 according to PHP). It combined these with Fragnesia, the local Linux kernel privilege escalation vulnerability CVE-2026-46300 (CVSSv3 7.8), to gain root access on firewalls from a major, undisclosed manufacturer. The exploit is a proprietary, non-public development that abuses the `session.upload_progress` setting in PHP 8.0.30 on the team’s appweb management server.
The attacker identified approximately 19,000 firewalls with exposed management interfaces using FOFA and filtered 240 targets in the US, Japan, Taiwan and South Korea. They attacked these using an automated executor that planted a PHP webshell, thereby compromising 25 servers. Three of these belong to an environment affiliated with the US government, where the actor established a reverse SSH tunnel into the internal network. From there, they attacked Active Directory: they cracked the password for the LDAP service account, carried out password spraying and attempted to create backdoor accounts.
It is recommended that firewall management interfaces should not be exposed to the internet, that manufacturers’ patches should be applied, and that systems should be checked for the presence of webshells, outbound SSH tunnels and anomalous activity targeting Active Directory.
Volt Typhoon exploited zero-day vulnerabilities via the Silent Train access network
Lumen Black Lotus Labs attributes the now-dismantled covert access network ‘Silent Train’ to the Chinese group Volt Typhoon; the network had been active since late 2023 and consisted of rotating chains of compromised SOHO, IoT and enterprise devices. Through this network, the group exploited the Versa Director vulnerability CVE-2024-39717 (CVSSv3 7.2) as a 0-day, as well as the N-able N-central vulnerabilities CVE-2025-8875 and CVE-2025-8876 (both rated CVSSv4 9.4 according to the manufacturer), the Cisco Catalyst SD-WAN vulnerability CVE-2026-20127 (CVSSv3 10.0) and the Arista VeloCloud Orchestrator vulnerability CVE-2026-16812 (rated CVSSv4 10 according to the manufacturer).
Furthermore, it exploited a probable 0-day vulnerability in Quest KACE, which affected more than 30 victims. The sessions originated from VPSs located outside the US and passed through foreign SOHO and IoT nodes, such as Intelbras modems used solely as relays. They exited via US-based devices such as Netgear Orbi or FortiGate, lasted an average of around four hours and ended with the removal of all devices. From 2025 onwards, the network evolved into a hybrid model using reverse tunnels based on Chisel and FRP.
Hundreds of victims have been identified across telecoms operators, government, defence, satellite communications and critical infrastructure sectors including water, energy and transport.
Yoba: fake ChatGPT and Claude desktop apps load a loader that hides its C2 server in a photo on a Telegram channel
Check Point Research has documented the Yoba campaign. Since June, it has been distributing fake desktop clients for non-existent models such as GPT-5.6 Sol, GPT-6 Astra and Claude Opus via repositories and GitHub Pages that have been positioned using SEO poisoning. The ZIP files contain legitimate executables signed by OpenAI and Anthropic – whose infrastructures were not compromised – which use DLL sideloading to load a malicious winmm.dll (YobaDropper).
This dropper evades sandboxes, excludes systems with keyboards from CIS countries, and persists via a scheduled task running as SYSTEM that launches YobaLoader. The loader downloads the profile picture from the t[.]me/yoba_fanclub channel and derives a DGA domain on dedyn[.]io from its last 50 bytes. It then queries its TXT record via Google’s DNS-over-HTTPS and validates the commands using Ed25519, meaning that simply changing the photo is sufficient to rotate the C2. In this wave, the payload was XMRig delivered via Tor, but YobaLoader supports any PE file or PowerShell script. It is recommended to block unapproved AI clients and to be on the lookout for signed binaries that load DLLs from paths with write permissions, as well as for unusual DoH TXT queries.
Node2Shell: first real-world exploit and emergency patches for .NET, Python and other ecosystems that integrate Brotli
ELLIO has recorded the first real-world exploitation attempt of Node2Shell (CVE-2026-111497, CVSSv4 9.2 according to Google), also known as HTTP2Shell or Broccoli2Shell, on its honeypot. On 26 October, a single request with a 23 MB Brotli payload was directed at Node.js v24.22.0 running on x86-64. It reuses the publicly available exploit payload but incorporates an original ROP chain with three unpublished gadgets, which plants its own /bin/sh string and calls execvp. The source, 94.154.43.7, has a history of PHP2Shell exploitation, GlobalProtect and FortiOS VPN probing, and Kubernetes scanning – a profile typical of a mass exploitation operator. The scope extends beyond Node.js because the flaw lies in Google’s Brotli library (versions 1.0.3 to 1.2.0; fixed in 1.0.10, 1.1.1 and 1.2.1). Microsoft has released out-of-cycle patches for .NET 8, 9, 10 and 11 RC3, Visual Studio 2019–2026 and PowerShell 7.4–7.6. The vulnerability in .NET affects ASP.NET Core, HttpClient and System.IO.Compression only when Brotli decompression is enabled, which is not active by default. Also affected are the PyPI packages Brotli and brotlicffi, which are automatically used by urllib3, requests, httpx, aiohttp and Scrapy, as well as Bun versions prior to 1.4.4, Envoy, Istio, the Ruby gem and libbrotli on Debian and Alpine. DuckDB, Apache Arrow, p7zip and EDK II remain unpatched, and CISA has not yet included this in the KEV.
◾ This newsletter is one of the deliverables of our Operational and Strategic Intelligence service. If you are interested in knowing the rest of the Operational and Strategic Intelligence contents included in the service, please contact us →
