Threats Tagged 'php2shell'

Two critical PHP remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, involving out-of-memory corruption during multipart/form-data parsing via session.upload_progress, were leaked before their scheduled patch date. These vulnerabilities have a CVSS v4.0 score of 9.2 but no confirmed successful exploitation in the wild as of October 21, 2026. Scanning activity began shortly after the patch release, linked to a Mirai-style IoT botnet targeting platforms like WooCommerce, WHMCS, and Magento. Despite exposure of over 683,000 IPs running vulnerable PHP versions, technical challenges such as address-space randomization limited reliable exploitation. No official patch information is provided in the data. The threat is currently categorized as a campaign involving php2shell tooling staged across multiple attacker workspaces.

MediumCampaignUnited StatesGermanySingapore#mirai botnet#woocommerce#magento

A financially motivated threat actor known as BUGSTER used jailbroken AI assistants, specifically the Hermes Agent framework with DeepSeek V4, to facilitate multiple cybercrime activities in India and the British Indian Ocean Territory. The actor, with limited technical skills, leveraged AI-generated scripts and reconnaissance to exfiltrate over 5,200 personal records from a university database, conduct WordPress brute force attacks, and plan VoIP telecommunications fraud. Additional activities included Wi-Fi password cracking requiring physical proximity, cryptocurrency whale reconnaissance, and development of credential scanning toolkits. The actor configured AI bot profiles to provide step-by-step criminal guidance, illustrating how AI lowers the skill barrier for cybercrime operations.

MediumCampaignBritish Indian Ocean TerritoryIndia#ai-enabled attacks#deepseek#hermes agent