Threats tagged 'iot botnet'

Two critical remote code execution vulnerabilities in PHP, collectively named PHP2Shell, were disclosed on October 21, 2026. CVE-2026-109618 involves out-of-memory handling corruption that can interrupt PHP while internal request data is partially initialized, leading to invalid data treatment. CVE-2026-109619 exploits stale global state where request-owned internal state survives after memory is freed. Both vulnerabilities can be exploited successfully on ARM64 systems and x86 systems without ASLR. Fixed versions include PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Over 2.6 million internet-facing hosts running PHP were identified as vulnerable, with 42% on end-of-life branches receiving no official patches. Early exploitation attempts were observed from multiple sources, including scanning activity and webshell deployment attempts targeting the upload-progress vulnerability path.

KEVMirageEPSS 99%Report on CVE-2026-109618CampaignPHP GroupCWE-416#mirai botnetUnited States+2

An exposed open directory on a Netherlands-hosted server revealed the complete operational toolkit of xlabs_v1, a Mirai-derived IoT botnet operated by an actor using the handle Tadashi. The operation provides DDoS-for-hire services specifically targeting game servers and Minecraft hosts through 21 distinct flood attack variants. The botnet exploits Android Debug Bridge (ADB) on TCP/5555 to compromise over 4 million potentially vulnerable IoT devices including Android TV boxes, smart TVs, and routers. The operation features bandwidth profiling to price-tier infected devices, ChaCha20 string encryption with cryptographic weaknesses, and competitor-eradication routines. Infrastructure analysis consolidated the entire operation within a single bulletproof /24 netblock in the Netherlands, with co-located cryptojacking infrastructure also identified.