Open Cyber Threat Intelligence

Drupal has patched two critical remote code execution (RCE) vulnerabilities, CVE-2026-108097 in the core Field UI module and CVE-2026-108099 in the contributed Entity List module. Both flaws could allow unauthenticated attackers to execute arbitrary code on affected servers, especially when combined with contributed or custom modules. The Drupal Security Team warns that exploits could emerge within hours or days of disclosure, urging immediate patching to versions 10.6.19, 11.3.19, 11.4.10, or Entity List 3.0.10.

A sophisticated threat actor exploited CVE-2025-61624, a path traversal vulnerability in Fortinet FortiOS, to deploy a novel memory-resident ARM64 malware named PEERSTITCH. The malware operates entirely in memory, avoids opening network connections, and hijacks legitimate FortiOS processes (miglogd and iked) to create a covert inter-process communication channel for bypassing security checks on tagged VPN sessions. The attack enabled long-term persistence, credential theft, and lateral movement across managed firewalls, with evidence linking it to the CL-STA-0954 (UNC5820) intrusion campaign targeting a telecommunications managed service provider.

Threat actors have compromised a Microsoft 365 credential used by ConnectWise Cloud Backup, enabling unauthorized access to 173 Microsoft 365 tenant environments. The attackers used the stolen credential to obtain Microsoft Graph tokens from IP address 144.172.64[.]128, moving systematically through tenants in sorted GUID order, indicating automated tooling. In at least one tenant, a malicious actor assigned the ConnectWise Cloud Management app Global Administrator privileges and added new client secrets to privileged applications, including an MSP management tool and the Huntress Security Platform, expanding access across customer environments. Organizations with the ConnectWise app installed remain at risk until credentials are rotated and the app is disabled.

Candiru spyware was delivered via a zero-click attack technique dubbed AdFection, in which malicious JavaScript was embedded in targeted online advertisements served through Discover-Tech's Controlium platform. The attack targeted devices at Al Jazeera Media Network and others, with evidence showing that at least 45 devices were targeted between 2024 and 2025. The malicious ads contacted Discover-Tech's NOAS server, which selectively delivered exploit code to specific devices based on identifiers like IP address, leading to infections linked to Candiru command-and-control infrastructure. A DLL file recovered from a compromised Windows system was attributed to Candiru with high confidence.

Researchers demonstrated a novel attack technique called 'counterfeit policy' that manipulates TypeSafe AI's Jev model, a structured decision-making classifier used for security controls, by injecting a maliciously crafted policy into untrusted input. This technique successfully steers Jev's classification to bypass security checks, such as LangChain's tool-risk gating, by redefining risk criteria within attacker-controlled content. The attack significantly reduces detection rates, dropping recall from 82.90% to 3.88% in prompt injection detection, and enables unauthorized actions to be misclassified as low-risk, demonstrating a critical vulnerability in using such models as security judges without proper input sanitization.

The China-linked cyber espionage group Armory Castle (UNC5221/Warp Panda) exploited a zero-day vulnerability, CVE-2026-102764, in BeyondTrust Remote Support appliances to gain unauthorized file access and compromise self-hosted servers. The flaw, an improper origin validation in an internal messaging component, was exploited starting August 29, 2026, on a single appliance. Following compromise, the actor deployed a PHP web shell named SAWFLY, established persistence via a custom SOCKS5 proxy (BARECLAW), escalated privileges, stole credentials using proprietary tools, and conducted lateral movement across downstream systems, while also obfuscating activity by deleting logs.

Attackers temporarily compromised AOMEI Backupper's update servers between May and July 2026, altering update files for brief windows of 5–10 minutes to deliver a backdoor. The malicious update fetched a downloader named CROSSROAD, which deployed a signed Radmin executable and an attacker-controlled DLL to load the SHINYROAD implant, enabling remote code execution. The attackers also used a WebDAV-based pop-up to harvest NetNTLMv2 authentication tokens without executing code. The campaign, tracked by Google Threat Intelligence Group (GTIG) as UNC7017, targeted organizations across 11 countries opportunistically, affecting systems that happened to check for updates during the tampering windows.

Researchers from security firm Calif demonstrated a local privilege escalation exploit against OpenBSD 7.9 that chains two kernel vulnerabilities: a 37-year-old integer overflow in the shmat(4) system call and a reference-counting use-after-free flaw. The exploit bypasses OpenBSD's KARL kernel-address randomization as well as SMAP and SMEP hardware protections by leveraging predictable kernel memory allocators. Full proof-of-concept code was published alongside a detailed writeup after OpenBSD released patches in September. There is no evidence of prior exploitation in the wild.

A critical vulnerability dubbed BlockStrap (CVE-2026-103849) affects Magento and Adobe Commerce platforms, allowing remote attackers to execute arbitrary PHP code on server systems through a second-pass template injection in email templates. The flaw exists due to improper neutralization of special elements in the template engine, enabling attacker-controlled content to be re-processed at root level, executing malicious {{block}} directives. Although active exploitation has not yet been observed, researchers warn that the complexity of the attack path is mitigated by AI tools that can rapidly reverse-engineer working exploits from patches, making mass exploitation likely in the near term. The vulnerability impacts Magento Open Source and Adobe Commerce up to version 2.4.9 and Adobe Commerce B2B up to 1.5.3, requiring both the BlockStrap and prior StyleSmuggler fixes to be applied for full protection.

UAT-11985, an advanced persistent threat group, has conducted a spear-phishing campaign targeting individuals affiliated with Taiwan research organizations using fake event invitations. The emails impersonate legitimate institutions and include malicious links or QR codes that direct victims to adversary-in-the-middle (AitM) phishing sites mimicking Google Forms and Google login pages. These sites harvest Google credentials and multi-factor authentication codes in real time, enabling full account takeover, with infrastructure tailored to Chinese-speaking users by supporting Simplified and Traditional Chinese locales.