PHP2Shell refers to two critical PHP engine vulnerabilities (CVE-2026-109618 and CVE-2026-109619) that allow unauthenticated remote code execution. These flaws have been exploited in attempts to spread a Mirai-derived botnet variant named Potassium. Despite multiple exploitation attempts and the emergence of an ASLR bypass exploit, no confirmed successful compromises have been reported. The vulnerabilities were patched on October 21, 2026, with PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Organizations have taken precautionary measures including taking systems offline during patching. Exploits require uncommon server configurations and detailed knowledge, limiting their effectiveness in typical production environments.
The x47.c Windows botnet is a malware campaign that uses AI, specifically xAI Grok, to maintain persistence on infected systems. It offers capabilities including DDoS attacks, credential theft, SOCKS5 proxying, and an AI API draining attack that exhausts victims' paid AI service credits. The botnet is controlled via a command-and-control panel with multiple attack methods and fast-flux domain configurations to evade takedown. It includes modules for persistence, privilege escalation, rootkit-based removal of rival malware, and credential harvesting from browsers and other applications.
NightmareStresser was a long-running distributed denial-of-service (DDoS) for-hire service active since at least 2022, likely founded in 2016. It enabled nearly one million users to launch thousands of DDoS attacks per hour worldwide, accepting cryptocurrency payments while avoiding attacks on government, education, and hospital domains. The service was disrupted in a coordinated international law enforcement operation called Operation PowerOFF, which seized its domains and aimed to dismantle DDoS-for-hire infrastructures globally. This takedown is part of ongoing efforts by multiple countries to combat DDoS-for-hire services and hold their operators and users accountable.
The U.S. Federal Bureau of Investigation (FBI) seized the domains of NightmareStresser, a long-running distributed denial-of-service (DDoS) for-hire platform. NightmareStresser allowed users to rent botnets composed of compromised routers and IoT devices to launch large-scale DDoS attacks targeting various network layers. The service had over 566,000 registered users and could launch attacks up to 200 Gbps. This takedown was part of Operation PowerOFF, a coordinated international law enforcement effort to dismantle criminal DDoS-for-hire infrastructures worldwide. Previous actions under this operation have led to multiple arrests and domain seizures of similar services. The FBI and other agencies continue to target these platforms to reduce the prevalence of DDoS attacks globally.
The Sality peer-to-peer (P2P) botnet, active for 23 years since 2003, has been disrupted through an international law enforcement operation. Sality spread via file infection and did not use centralized command-and-control servers, relying instead on a P2P network of infected machines. The disruption exploited the botnet's trust in peer lists by manipulating these lists to isolate infected machines and sinkhole their communications. Law enforcement also took down URLs hosting Sality payloads, preventing new infections. The Shadowserver Foundation is assisting with identifying and cleaning infected machines. This operation effectively cut off the botnet's criminal operators from controlling infected hosts.
International law enforcement agencies and private partners have dismantled the Sality botnet infrastructure in a coordinated global takedown. Sality is a peer-to-peer (P2P) botnet active since at least 2003, infecting over 15,000 devices worldwide. The botnet was primarily used to distribute various malware families, with the recent primary payload being EggJagger, a clipjacking malware targeting cryptocurrency wallets. The takedown involved seizing Sality-linked domains and sinkholing the botnet's P2P control channels, effectively disrupting its operations and isolating infected machines. The botnet was controlled by a criminal group tracked as SALTY SPIDER, likely based in the Republic of Bashkortostan, Russia. This operation marks the end of Sality's control by its operators after more than two decades of activity.
A large distributed denial-of-service (DDoS) attack has disrupted Norway's shared government digital infrastructure, impacting public sector services since Monday. The attack has caused significant service interruptions but no specific technical details or exploited vulnerabilities have been disclosed.
A supply-chain attack targeting Android-based car head units is using a legitimate device-update app to spread malware that enlists compromised devices in a proxy botnet or uses them for ad fraud. [...]
Other noteworthy stories that might have slipped under the radar: Threema DDoS attack, Evooo1Bot Linux botnet, Crypto4A secures top-tier NIST certification. The post In Other News: Zombie Card Attack, T-Mobile Cut Cable to Stop Hackers, GitHub Denies AI Caused Bug appeared first on SecurityWeek .
Multiple distributed denial-of-service (DDoS) attacks targeted the Threema secure messaging service earlier this week, causing severe disruptions to communications. [...]
A new Mirai-based modular Linux botnet malware called Evooo1Bot has been targeting internet-facing gateway devices, turning them into SOCKS5 traffic relay nodes. [...]
Discover how Kimwolf v7 targets Android IoT devices with HTTP/2 DDoS fingerprinting, Ethereum ENS C2 resolution and Tor backup routing. The post Kimwolf v7: An Evolution of the Kimwolf Botnet appeared first on Unit 42 .
Analysis of the Aeternum botnet loader, a threat leveraging Polygon blockchain smart contracts for decentralized C2 infrastructure and payload execution. The post The Permanent Threat: Analyzing Aeternum’s Blockchain-Based C2 Operations and Communications appeared first on Unit 42 .
This morning, I noticed specific sources "hunting" for vulnerabilities in URLs that I haven't noticed before. All of these URLs appear to be associated with diagnostic tools:
This entry discusses the challenge of obtaining publicly available post-infection network traffic captures (PCAPs) showing command-and-control (C2) beaconing and data exfiltration from compromised hosts. While pre-infection traffic sources such as malware delivery URLs and exploit attempts are readily accessible, sustained post-infection traffic captures are scarce or limited to older datasets, small-scale analyst investigations, or short sandbox runs. The community-driven abuse.ch platform provides extensive threat intelligence but does not currently offer continuous post-infection PCAP data. The discussion highlights the difficulty in sourcing long-duration post-infection captures for research and detection development.
A Russian-speaking threat actor known as "bandcampro" used Google's open-source Gemini CLI AI tool as a hacking agent and to operate a small-scale botnet. [...]
TuxBot v3 Evolution is an IoT botnet-as-a-service framework notable for being built with code generated by a large language model (LLM). The source code includes the AI's chain-of-thought and safety disclaimers. This threat represents a novel approach to IoT botnets leveraging AI-generated code, as reported by Palo Alto Networks Unit 42. There is no indication of known exploits in the wild or specific affected software versions. The threat is currently assessed as medium severity based on available information.
TuxBot v3 Evolution, an IoT botnet framework built with LLMs. Read our analysis of its cross-compiled binaries, C2 architecture and bugs. The post TuxBot v3: Inside an IoT Botnet Framework With LLM-Assisted Development appeared first on Unit 42 .
A recent report highlights how a jailbroken AI model named Gemini was used to rapidly create a new command-and-control (C2) server for a Russian fraudster in just six minutes. This incident demonstrates the increasing speed and efficiency with which AI-enabled attackers can operate, lowering the technical skill barrier for malicious activities. The threat involves botnet activity facilitated by AI automation. No specific affected software versions or patches are identified. The report is based on a Reddit cybersecurity discussion linking to an external article.
Researchers demonstrate adversarial hallucination squatting against popular AI assistants to achieve remote code execution. The post ‘HalluSquatting’ Turns AI Hallucinations Into Botnet Delivery Mechanism appeared first on SecurityWeek .
