Open Cyber Threat Intelligence

A coordinated attack campaign dubbed 'WFX Phantom' has compromised GitHub accounts using stolen tokens to inject a malicious shell script, named 'wfx', into repositories via pull requests and direct commits. The script is executed through GitHub Actions to steal secrets, cloud credentials, and runner memory, then exfiltrates the data using Telegram or HTTP to attacker-controlled servers. The attackers rapidly revert their changes and delete workflow runs to erase evidence, making detection difficult. The campaign has affected thousands of repositories, leveraging automation accounts and third-party app tokens, including those from the Fly.io GitHub App, to propagate across projects.

CVE-2026-126187 is a critical unauthenticated remote code execution vulnerability in React Server Components' Flight protocol, with a CVSS 4.0 score of 9.5. The flaw stems from improper handling of typed arrays in shared ArrayBuffers during serialization, allowing attackers to smuggle malicious module rows into the stream by exploiting a framing bug. When a response carries multiple typed-array views over a shared buffer and an attacker controls part of the data, a corrupted Flight row can cause the parser to execute arbitrary modules from the application's bundle. The vulnerability affects React Server Components implementations in react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack across multiple version ranges, with fixes released on November 10, 2026.

From August to September 2026, Chinese-speaking threat actors conducted 25 autonomous attack operations using the open-source AI penetration testing framework Cairn, enhanced with Chinese AI models Zhipu GLM and DeepSeek. The campaign, tracked as CL-STA-1238, targeted 19 organizations in the semiconductor, defense policy, and civil society sectors, achieving unauthorized access or data retrieval in 10 cases. Attackers used a customized fork of Cairn hosted on infrastructure in Hong Kong and the U.S., leveraging weak credentials, authentication bypasses, and exposed cloud APIs to compromise systems, exfiltrate data, and create persistent access. The activity is assessed with moderate confidence as a China-nexus intelligence collection effort based on language, tooling, and target selection.

Cisco Talos highlights critical vulnerabilities in Microsoft and Google products currently under active exploitation. The Microsoft Outlook spoofing vulnerability CVE-2026-124194 is being exploited in the wild, allowing attackers to bypass security through malicious emails. Additionally, Google Chrome has a zero-day vulnerability (CVE-2026-125350) involving a use-after-free error in the XML component, enabling remote code execution via crafted HTML pages. Organizations are urged to prioritize patching these flaws and apply Snort rules to mitigate risk during remediation.

Since mid-August 2026, a phishing campaign has been hijacking Google sessions by leveraging malicious Google Calendar invites sent from compromised accounts. The lures appear legitimate, often using BCC and familiar sender domains, and redirect through Google's own URL shortener or trusted services like share.google.com. Upon clicking, victims are proxied through a live reverse proxy framework called Nyasher, which captures credentials and multi-factor authentication tokens in real time by relaying them to the legitimate Google sign-in page. The infrastructure uses ephemeral domains, wildcard certificates, and client-side JavaScript rendering to evade detection, with operators rotating tactics to bypass static and machine learning-based defenses. The campaign, dubbed Operation CloudFire by Material Security, was mitigated through infrastructure takedowns via Cloudflare abuse reporting, protecting broader user bases beyond individual organizations.

New exploits named 4EverAble2Shell and Agent2Shell have been disclosed against N-central on-premise servers, enabling unauthenticated remote code execution with root privileges and command execution as SYSTEM on Windows agents, respectively. These vulnerabilities affect patched versions, including build 2026.4.1.26, and rely on the non-default Legacy API being enabled. Probing activity has been observed from IP 157.20.241[.]16, leveraging the Apache Axis flaw CVE-2026-90436 for initial access, followed by attempts to exploit 4EverAble2Shell and download a malicious shell script.

Google Cloud has issued a security advisory regarding three CPU side-channel vulnerabilities in AMD's Turin (fifth-gen EPYC) processors that could allow data leakage across processes within virtual machines. The flaws are classified as Transient Scheduler Attacks (TSA): TSA-SQ (CVE-2024-36350), TSA-L1 (CVE-2024-36357), and a newly disclosed variant TSA-Fill (CVE-2026-0004). These vulnerabilities may enable an attacker with code execution on the same core to infer sensitive data from other processes or the kernel via the L1 cache. Google has applied host-level mitigations but requires customers to patch guest operating systems and perform a full stop-and-start of VMs to fully mitigate the risk.

The SCKit malware campaign exploits CVE-2026-84869, a critical improper privilege management flaw in ConnectWise ScreenConnect, to execute unauthorized file transfers and code execution during active remote sessions. The malware uses legitimate ScreenConnect features like Run Command to deploy a malicious MSI installer and PowerShell scripts, enabling persistence and lateral movement by hijacking authenticated technician sessions. A key component, RelayTrap, enables reverse-pivoting to infect technician workstations, leveraging trusted remote support functionality to propagate across managed service provider (MSP) environments without requiring new vulnerabilities once initial access is achieved.

Citrix has patched 12 critical vulnerabilities across its NetScaler ADC, NetScaler Gateway, NetScaler Console, and Secure Access Client products. The flaws include multiple memory overflow and memory corruption vulnerabilities that could lead to denial-of-service conditions, as well as improper authentication and privilege management issues that could allow unauthenticated access or privilege escalation. The most severe vulnerability, CVE-2026-107412, has a CVSS score of 9.5. Citrix urges customers to apply updates despite no known active exploitation at the time of disclosure.

Two critical vulnerabilities in Red Hat Quay have been disclosed, allowing attackers to read and overwrite private container images in any repository. CVE-2026-123710 enables an unauthenticated attacker to add a trusted signing key with no expiry, allowing them to generate valid access tokens for any repository, even without credentials. CVE-2026-110697 allows a user who can create a namespace with an underscore to exploit an SQL injection in the robot account listing logic, stealing other tenants' robot account tokens and gaining unauthorized access to their images.