Open Cyber Threat Intelligence

Cisco Talos and Recorded Future’s Insikt Group identified espionage activity conducted by threat actor UAT-6275 targeting government and critical infrastructure entities in the Commonwealth of Independent States (CIS). The group uses multiple infection chains, including macro-enabled documents, GitHub-hosted scripts, and exploitation of a WinRAR vulnerability, to deploy custom reverse shells. Operational security lapses by the actor allowed researchers to observe their infrastructure and malware development. The group is evolving its tradecraft, leveraging legitimate platforms like GitHub for payload hosting and showing signs of expanding to Linux and internet-facing appliances.

NGINX has released updates (versions 1.30.6 and 1.31.7) to address five vulnerabilities, including potential remote code execution (RCE) and a TLS session forgery flaw that could bypass client-certificate checks. The most severe flaws are heap overflows and a use-after-free condition, exploitable under specific configurations involving alias with rewrite, regex maps, AIO with SSI, or shared TLS session caches. The TLS flaw (CVE-2026-97629) stems from improper rotation of session ticket keys, allowing non-deterministic forged session resumption. No active exploitation has been reported, but prior NGINX flaws have seen rapid weaponization post-disclosure.

Citizen Lab identified a zero-click spyware campaign conducted by the Israeli firm Candiru, targeting Al Jazeera staff through malicious online ads served via Discover-Tech, a company posing as a legitimate digital advertising vendor. The attack exploited ad delivery infrastructure to silently deploy spyware without user interaction, with initial access established when targeted devices loaded malicious ads that triggered callbacks to attacker-controlled servers. At least 45 devices were targeted in 2024 and 2025, and the attack chain was confirmed through traffic logs and a recovered Windows malware sample linked to Candiru's known toolset.

Multiple active threats were reported, including ransomware groups Qilin and Settra exploiting a PAN-OS authentication bypass vulnerability (CVE-2026-0257). A cryptocurrency wallet drainer kit called Noir uses DNS TXT records hosted on Cloudflare Pages to locate backend infrastructure. A new Rust-based remote access trojan, CikaBika Bot, leverages Discord for C2 communications. The KGB RAT malware, advertised on cybercrime forums, combines data theft with psychological harassment features. Adobe Experience Manager cloud instances are vulnerable to an unauthenticated RCE chain. Samsung patched a critical unauthenticated RCE in its QA-Board tool, while NVIDIA's Linux GPU driver has a privilege escalation and container escape flaw.

A critical vulnerability in the Linux kernel, tracked as CVE-2026-99999 and nicknamed PwnEscape, allows guest virtual machines to read host memory, crash the host, and potentially execute code on it. The flaw resides in the kernel's networking code and was demonstrated against Vercel's production sandboxes, where specially crafted network packets from a guest VM could exfiltrate up to 32 bytes of host memory per packet. Although the vulnerability has not been exploited in the wild, it poses a broad risk to cloud providers using shared Linux kernel infrastructure, as it enables VM escape and host-level compromise.

A threat actor uploaded malicious packages to the Arch User Repository (AUR) under the username 'marchos1as', impersonating popular AUR helper tools 'yay' and 'paru' using typosquatted names like 'yyay'. These packages contained legitimate source code combined with a malicious install script that executed a remote shell script with root privileges. The payload was fetched via a Wayback Machine URL pointing to a GitFlic-hosted repository 'hellscripter/install-scripts'. Potential connections exist to the 'DirtyBlanket' npm campaign involving the same infrastructure, though no definitive link has been confirmed. Arch Linux maintainers removed the packages and banned the account.

Threat actors are actively exploiting a critical remote command execution vulnerability, CVE-2026-110447, in the Collabora Online - Built-in CODE Server app (richdocumentscode) for Nextcloud. The flaw exists in versions prior to 26.4.303 and allows unauthenticated OS command injection via the proxy.php endpoint when the built-in server is stopped. Attackers are deploying PHP webshells to search for password databases, password manager artifacts, and cryptocurrency wallets. Exploitation began in mid-September, over four weeks before the CVE was published on October 14, highlighting a dangerous gap between patch availability and formal disclosure.

The article discusses the evolving threat landscape due to AI-accelerated development and exploitation, highlighting the importance of Application Security Posture Management (ASPM) to manage increased risk velocity. It references a specific critical vulnerability, CVE-2025-55182 (React2Shell), which enables remote code execution in Next.js applications, leading to widespread exposure across micro-frontends and containerized workloads. The vulnerability results in thousands of findings across repositories and container images, necessitating contextual prioritization to identify exploitable instances. Wiz Code is presented as a solution to correlate scanner findings with cloud exposure and runtime context to prioritize remediation.

Drupal has patched a critical remote code execution (RCE) vulnerability, tracked as CVE-2026-108097, in its Field UI module. The flaw allows unauthenticated attackers to execute arbitrary code on affected servers through exploit paths involving contributed modules. While the core vulnerability cannot be exploited directly, at least one known path via contributed modules requires no authentication. The fix was released in multiple supported versions, but older branches including Drupal 8, 9, and earlier end-of-life versions remain unpatched. Additionally, the Entity List module is affected by a similar RCE flaw, CVE-2026-108099, with identical exploitation conditions.

Next.js released an out-of-band security update on October 14, 2026, to address two critical remote code execution (RCE) vulnerabilities and one high-severity denial-of-service (DoS) flaw. The first RCE flaw, in React Server Components, affects apps using Cache Components with a use cache function returning multiple typed arrays. The second RCE stems from a memory bug in the librsvg library, accessible through the sharp package when processing attacker-supplied SVG files on glibc-based Linux systems. The DoS vulnerability affects App Router applications with Server Actions, allowing attackers to cause full CPU utilization on a server process.