Open Cyber Threat Intelligence

A critical vulnerability, CVE-2026-85097 (CVSS 10.0), in the Bricksforge WordPress plugin is under active exploitation, enabling unauthenticated remote code execution (RCE). Attackers exploit a flaw in file upload validation by uploading a GIF/PHP polyglot file and manipulating the 'temporaryFileUploads' parameter to execute PHP code via mismatched URL extensions. Exploitation targets the '/wp-json/bricksforge/v1/form_submit' or '/wp-admin/admin-ajax.php' endpoints with crafted payloads, using techniques like alternate PHP extensions, case manipulation, and URL encoding to bypass filters. At least 63 unique IPs have been observed in attack campaigns, with six responsible for nearly half of all requests, indicating automated, distributed exploitation. Users are urged to update to version 4.0.1 and audit for suspicious form submissions and unexpected PHP files in upload directories.

A critical pre-authenticated server-side request forgery (SSRF) vulnerability, CVE-2026-102255 (CVSS score: 10.0), in SonicWall SMA 1000 appliances is being actively exploited shortly after public disclosure. Patches were released on October 6, 2026, but exploitation attempts began as early as October 8, with 135 observed attempts originating from two unique U.S.-based IP addresses. The flaw allows remote attackers to force the appliance to make unauthorized internal requests, potentially leading to initial access, credential theft, and lateral movement into internal corporate networks.

Ledger has identified an unauthorized hardware implant in at least one Ledger device sold through the reseller CryptoBilis, leading to theft of cryptocurrency funds exceeding $86 million from affected users in Southeast Asia. The compromised devices were tampered with, potentially including pre-generated recovery phrases or hardware modifications, allowing attackers to access user wallets. Ledger is warning users who purchased from CryptoBilis in the last 90 days to avoid setting up their devices and to move assets to a new Ledger signer if they already set up the device. The incident highlights supply chain risks from unauthorized resellers, and Ledger is investigating the scope with CryptoBilis having paused all hardware wallet sales.

GitLab has disclosed and patched a maximum-severity remote code execution vulnerability, tracked as CVE-2026-97229, in its CI/CD Regular Expression Compiler. The flaw, caused by an integer overflow, could allow unauthenticated attackers to execute arbitrary code on GitLab servers by supplying a specially crafted regular expression in a pipeline configuration file. The vulnerability affects self-managed GitLab instances prior to versions 19.2.8, 19.3.4, and 19.4.2, and immediate patching is advised. GitLab.com is already protected, and dedicated customers are unaffected.

Socket Threat Research identified a coordinated campaign involving 16 malicious Firefox extensions designed to steal cryptocurrency wallet recovery phrases and private keys. The extensions impersonate legitimate wallets such as Rabby and OKX, using cloned interfaces to trick users into revealing sensitive information. Stolen credentials are exfiltrated to attacker-controlled Cloudflare Workers. Fifteen of the extensions communicate with the domain icy-star-f45c[.]workers[.]dev, while one uses a different endpoint. Mozilla has since unpublished the malicious extensions, but users who entered wallet recovery data should consider their wallets compromised and take immediate remediation steps.

A Chinese-speaking threat actor used the ARTEX AI penetration testing framework and Anthropic's Claude AI agents to conduct cyberattacks against major South Korean banks, including Shinhan Bank, KB Kookmin Bank, and Hana Bank. The attacks led to exposure of customers' personal and financial data, as well as system outages. Infrastructure analysis revealed open directories containing ARTEX configuration files, Claude session histories, and memory files, which exposed the attacker's methods and partial identity. The actor used multiple LLMs, including DeepSeek v4.1-flash, GLM-5.3, and Grok 4.6, accessed via the API proxy xcai[.]pro, and showed interest in monetizing stolen data through Telegram.

Multiple U.S. states have filed lawsuits against TP-Link Systems over claims of misleading consumers about router security and ties to China. The complaints highlight real-world attacks involving TP-Link routers, including exploitation by state-backed hackers from China and Russia. Specific vulnerabilities in TP-Link devices, particularly those supplied by ISPs under the Aginet brand, were disclosed and technically detailed by SEC Consult, allowing unauthenticated attackers to gain full control of affected devices. These flaws, including CVE-2025-30237 through CVE-2025-30241, enable privilege escalation, command execution, and credential decryption, with fixes distributed via ISPs but not always accessible to end users.

Threat actors are actively exploiting two unpatched vulnerabilities in the AhsayCBS backup management platform to gain unauthorized access, deploy webshells, and mine cryptocurrency. The attack chain begins with CVE-2026-105133, an authentication bypass, followed by CVE-2026-105134, which enables OS command injection. Attackers deploy JSP webshells, install the XMRig miner disguised as edge.exe, and use a PowerShell script to hide mining activity from Task Manager. The malware persists via a malicious service named 'MicrosoftEdgeUpdateSvc' and may leverage the WinRing0x64.sys driver to enhance mining performance.

A new wave of the GhostAction campaign has compromised maintainer accounts on GitHub, injecting a malicious workflow named security-audit.yml into 346 repositories, including high-profile projects like uber/athenadriver and kitao/pyxel. The workflow exfiltrates both GitHub Actions secrets and cloud/AI service credentials from the working tree and full Git history, sending them to a hardcoded C2 server. This variant expands on prior GhostAction activity by combining stolen publishing credentials with the harvesting of committed cloud credentials, including AWS, OpenAI, and GitHub API keys. The malicious workflow runs on every push and remains active on affected repositories, posing ongoing supply chain and cloud security risks.

The GhostAction campaign has resurged with a new wave of malicious GitHub Actions workflows injected into compromised open-source repositories. Attackers compromised maintainer accounts (kitao, henrywoo) to push malicious 'security audit' workflows directly to default branches, bypassing review. These workflows exfiltrate GitHub Actions secrets and mine the entire git history for credentials, including AWS, AI provider, and SaaS tokens. The exfiltration endpoint has shifted to the IP address 193.32.204.199, using plain HTTP to evade domain-based detection. Successful exfiltration was confirmed in multiple repositories, including Uber's athenadriver.