Search: CVE-2026-109618

A critical remote code execution vulnerability (CVE-2026-109618) affects PHP versions prior to 8.3.36-1.oe2403sp3. The flaw arises from improper handling of out-of-memory errors using longjmp(), which can leave request memory uninitialized and lead to execution of arbitrary code. Additionally, related global state management issues (CVE-2026-109619) can cause stale pointers to freed memory, further enabling remote code execution. This vulnerability impacts PHP's mod_php module used with Apache HTTP Server. A security fix is available to address these issues.

Amazon Threat Intelligence detected exploitation attempts of the PHP2Shell vulnerability in MadPot honeypot telemetry on October 17, 2026, four days before the public disclosure of CVE-2026-109618 and CVE-2026-109619. The initial exploit originated from a commercial anonymization network, indicating threat actor activity during the embargo period. Multiple proof-of-concept exploits appeared on the disclosure date with diverse payloads and infrastructure, suggesting involvement of multiple actors. After the embargo lifted on October 21, 2026, exploitation rapidly became widespread. This incident demonstrates that coordinated vulnerability disclosure does not guarantee zero-day protection and that AI-assisted exploit development has significantly reduced the time from patch release to active exploitation.

Researchers uncovered an AI-driven intrusion ecosystem operated by affiliates of INC and The Gentlemen ransomware groups via seven exposed command-and-control servers. The operators integrated commercial AI models, exploited edge devices at scale, and compromised thousands of targets, primarily in the US industrial manufacturing and healthcare sectors. The infrastructure included multiple custom encryptor builds and evidence of active victim encryption. Operational security failures exposed source code, credentials, AI session logs, and victim data. The campaign demonstrates advanced ransomware-as-a-service operations leveraging AI and custom tooling.

Malware#simplehelp#phantom frameworkUnited States

A financially motivated threat actor named BUGSTER used jailbroken AI assistants, including the Hermes Agent framework with DeepSeek V4, to conduct multiple cybercrime activities primarily in India and the British Indian Ocean Territory. The actor exploited AI-generated scripts to exfiltrate over 5,200 personal records from a university database, perform WordPress brute force attacks, and plan VoIP telecommunications fraud. Additional malicious activities involved Wi-Fi password cracking requiring physical proximity, cryptocurrency whale reconnaissance, and credential scanning toolkit development. This campaign demonstrates how AI tools can lower the skill barrier for cybercriminal operations.

Campaign#ai-enabled attacks#deepseekBritish Indian Ocean Territory+1

A malware campaign used a sponsored Google search result to redirect victims to a spoofed Amazon login page on Google Sites. The page displayed a fake CAPTCHA (ClickFix) that tricked users into running a malicious command via the Windows finger utility, initiating a multi-stage infection. Payloads included IronPython, obfuscated Python scripts, Doina malware, Lumma Stealer via a Node.js package, and a pirated NetSupport Client RMM tool. The campaign used barbecue-themed domains for command and control and had alternate payloads for macOS. Attackers employed advanced obfuscation techniques such as Base64 with Cyrillic substitution, XOR, and RC4 encryption.