Open Cyber Threat Intelligence

Attackers have developed an autonomous offensive agent named 'Skynet' that hijacks exposed large language model (LLM) endpoints to conduct self-directed cyberattacks. The agent leverages stolen or unsecured AI model access to perform internet-wide scanning, exploit web frameworks, steal credentials and databases, and deploy cryptocurrency miners without human intervention. It uses sophisticated jailbreak techniques to bypass commercial model safety controls by redefining malicious activities as routine development tasks. The activity represents a novel form of LLMjacking, where attackers shift computational costs to victims while maintaining anonymity and evading provider bans.

Two critical use-after-free vulnerabilities in PHP, tracked as CVE-2026-109618 and CVE-2026-109619 and collectively named PHP2Shell, enable unauthenticated remote code execution on affected servers. The flaws exist in the PHP runtime and can be exploited via crafted web requests, allowing attackers to take control of servers, execute arbitrary code, read sensitive memory, or establish persistence. Public proof-of-concept code emerged before patches were available, and exploitation attempts have been observed since October 17, 2026, with increased activity following disclosure. All PHP installations handling web requests are affected, especially those using Apache with mod_php, and immediate patching is strongly advised.

Two critical remote code execution (RCE) vulnerabilities, CVE-2026-109618 and CVE-2026-109619, were disclosed in PHP, affecting versions 5 through 8. The flaws, related to use-after-free and memory corruption in the handling of multipart/form-data with session.upload_progress, allow unauthenticated attackers to execute arbitrary code on vulnerable web servers. An exploit named PHP2Shell has been demonstrated in the wild against popular PHP applications including WordPress, MediaWiki, and Drupal. Exploitation is highly likely immediately after patch release, and mitigation requires immediate patching or temporary configuration changes such as disabling upload progress and blocking multipart requests.

In early 2026, the APT41 threat actor revived techniques from the BlackLotus UEFI bootkit to target diplomatic organizations in Central Asia, specifically in Tajikistan, Uzbekistan, and Turkmenistan. The attackers deployed a new bootkit dubbed BlackX, exploiting the Baton Drop vulnerability (CVE-2022-21894) to bypass Secure Boot by installing custom Machine Owner Keys (MOK). The attack involved a multi-stage payload, including a malicious kernel driver signed with a revoked certificate and user-mode implants such as a cloud-based RAT and a Rust-based C2 client communicating with www.archivetj.com.

Threat actors are conducting phishing campaigns via malicious Google Search ads to steal Google Cloud Platform (GCP) credentials and multi-factor authentication codes. Using compromised accounts, attackers gain access to GCP environments, disable organizational policy controls, and link external attacker-controlled projects to the victim's billing accounts. This allows them to abuse the victim's financial resources for large-scale, unauthorized Large Language Model (LLM) inference through Google's Gemini API, resulting in massive, undetected API charges. The attackers also employ geographic blending and demote legitimate administrators to evade detection and maintain persistence.

On October 20, 2026, Python's security team issued an advisory urging users to update Python packaging tools due to a compromise involving eMudhra/emSign CA intermediate certificates. The private keys for these intermediate CAs were generated with insufficient randomness, allowing potential attackers to forge certificates and impersonate HTTPS services during dependency downloads. This could enable man-in-the-middle attacks against tools like pip, uv, and conda that rely on certificate validation when fetching packages. Remediation requires updating to specific patched versions of certifi, pip, uv, conda, and other tools to ensure the affected certificate chains are no longer trusted.

Cisco Talos identified a growing trend where attackers abuse legitimate infrastructure, such as order notification systems from Staples and Dell, to deliver malicious content by injecting attacker-controlled phone numbers into transactional email fields. These messages leverage trusted domains and pass standard email authentication (DKIM, DMARC), making them appear legitimate while creating urgency around fake high-value purchases to prompt victims to call malicious helplines. The same abuse pattern extends to list bombing and bounce abuse, where malicious content is reflected through trusted platforms or embedded in delivery status notifications, bypassing traditional security controls by exploiting trust in legitimate services.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two critical vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog due to active exploitation. CVE-2026-110447 is a command injection flaw in Collabora Online’s Built-in CODE Server used within Nextcloud, allowing remote code execution via a proxy.php endpoint when the document server is offline. Threat actors have exploited this vulnerability to deploy web shells on Nextcloud servers for reconnaissance and credential harvesting. CVE-2026-114625 is a critical SQL injection vulnerability in on-premise Arista VeloCloud Orchestrator instances, exploitable by authenticated attackers with read-only access, enabling access to privileged internal functionality. Arista confirmed active exploitation and identified two malicious IP addresses linked to the attacks, both geolocated to Japan.

Between November 2025 and March 2026, Dutch security firm Eye Security conducted Operation IXIM, pushing over 2 million updates to disable a vulnerable updater in the abandoned Time4Popcorn application, which could have been exploited to create a large-scale botnet. The updater, running with SYSTEM/root privileges, fetched updates over unencrypted connections without authentication, making it susceptible to remote code execution. The vulnerability, tracked as CVE-2026-30612, affected Windows, Mac, and Android versions of the app and allowed any actor who registered abandoned domains to push malicious payloads. Eye Security mitigated the threat by registering the domains and pushing a disabling update, later transferring control to the Shadowserver Foundation.

An unrevoked master key from LiteLLM's Agent Platform, accidentally exposed in a public GitHub repository in May 2026, was exploited by an attacker on October 10, 2026, to gain access to the organization's GitHub CLI OAuth token with owner-level privileges. The attacker used this access to hijack the release pipeline, publish a malicious version of the LiteLLM Python package (1.107.0) to PyPI, and exfiltrate sensitive credentials via malicious GitHub Actions workflows. The compromised package executes automatically at Python startup, enabling credential theft and backdoor execution, even if LiteLLM is not explicitly imported.