SecureChap

MPTCP listeners on IPv4 sockets trigger a use-after-free of inet_opt and ireq_opt during the TCP handshake. The bug lives in net/ipv4/af_inet.c and tcp_ipv4.c. It affects kernels 4.4 through 5.10.271, 5.15.222, 6.1.189, 6.6.158, 6.12.112, 6.18.55 and 7.2.9. Eric Dumazet replaced the kfree with kfree_rcu in commit e3f33b0 on 1 October. Check exposure with: sysctl net.mptcp.enabled ss -Mlnp Go 1.24 and later creates MPTCP listeners by default when the sysctl is 1. IPv6 sockets are not affected. The window exists on any IPv4 TCP socket before application data. Apply the upstream change or disable the listener: ```diff - kfree(opt); + kfree_rcu(opt, rcu); ``` Set net.mptcp.enabled=0 to close the path until the host kernel is patched.

VOLTA drops Identity_Report.txt on the victim then immediately builds a raw JSON POST to openrouter.ai/api/v1/chat/co… with no SDK or library calls. The system prompt forces the model into a forensic intelligence analyst role; the default model is anthropic/claude-opus-4.6 with fallbacks to moonshotai/kimi-k2 and google/gemini-2.5-flash at temperature 0.2. The reply is written straight to AI_Analysis.txt before both files are zipped as volta_dox.zip. The same binary later produces volta_log.zip after first collection and volta_doxnet.zip after token harvesting. Every LLM call runs locally over the victim’s own network connection. The sample is a build-time template carrying six encrypted config slots. The decryption key is derived by SHA-256 of two hardcoded constants stored inside the binary, a pattern consistent with a builder sold to multiple operators. No C2 domains or IPs are present. Watch for processes reaching out to openrouter.ai, sudden creation of Identity_Report.txt or AI_Analysis.txt, and the three volta_*.zip packages.

The malicious anthropic.claude-code 2.1.313 package on the Cursor Marketplace alone reached up to 5,000 users before anyone noticed. A 66-line loader sat at the front of the main JavaScript bundle. It appended the attacker's key labeled svc-telemetry straight to ~/.ssh/authorized_keys, opened a reverse SSH tunnel to 134.209.82[.]225, and fired a beacon containing hostname, username, OS, Git email, and environment variable names to 134.209.82[.]225:8099/beacon. Persistence came via scheduled task on Windows, crontab on Linux, and LaunchAgent on macOS. The campaign ran only from 02:27 to 13:35 PT on 2026-10-29 and used the exact same package name as the legitimate release, but only through the Cursor channel. Anthropic pushed clean version 2.1.314 to Open VSX and the Microsoft marketplace the next day. Check ~/.ssh/authorized_keys, review recent crontab and LaunchAgents entries, and block 134.209.82[.]225 at the firewall.

GET /wp-content/upgrade/wordpress-4.7.0/wp-admin/setup-config.php WordPress 4.7 through 7.1.3 dropped the full update package into a predictable wp-content/upgrade path. The installer files stayed world-readable until the process finished its own cleanup. Attackers simply requested setup-config.php and the other staging files using the exact version string from the update request. No auth, no guessing. Patches shipped in 7.1.4 with no CVE assigned. Block wp-content/upgrade/ from web access before the next update window opens.

Claude Code for VS Code v2.1.313 on the Cursor Marketplace shipped a backdoor. No CVE assigned. The payload sat as an IIFE prefix in the bundled extension.js. It pulled in child_process, fs, os, path, http and crypto, then appended an attacker key to ~/.ssh/authorized_keys using the comment svc-telemetry. Only the comment string was checked. Outbound reverse tunnel ran as user tunnel to 134.209.82.225:22 with an embedded Ed25519 key (comment svc-telemetry-tun). Flags included -R *:0:localhost:22, -N, BatchMode, IdentitiesOnly, ServerAliveInterval=30 and ExitOnForwardFailure, falling back from autossh to ssh. Persistence wrote ~/.config/.smt and ~/.config/.smtk. macOS dropped ~/Library/LaunchAgents/com.apple.sysmond.plist (RunAtLoad + KeepAlive true) and loaded it via launchctl. Windows wrote %APPDATA%/.../sysmon.cmd. A recon beacon exfiltrated hostname, username, platform, arch, HOME, CWD, git email, public IP and env vars matching /KEY|TOKEN|SECRET|PASS|AWS|GCP/i. The extension was removed October 30. Marketplace review never inspected the bundled extension.js. To audit: unzip the .vsix, grep extension.js for IIFE patterns and hardcoded ssh keys.

Hundreds of Magento stores already backdoored via PolyShell. PolyShell is an unrestricted file upload flaw in Adobe Commerce and Magento that drops arbitrary code through CMS block injection. Exploitation has run since at least July 2025. Attackers fetch payloads from remote hosts and persist via injected blocks. Broccoli2Shell is a Brotli decoder bug in Node.js and PHP that turns a crafted stream into memory corruption, info leaks, DoS or RCE. A single attempt hit honeypots on 27 Oct from 94.154.43.7, and a working public exploit exists. Update Node.js to 22.23.4, 24.22.1 or 26.12.1. For PHP run: apt update && apt install php8.2=8.2.35-1 php8.3=8.3.36-1 php8.4=8.4.27-1 php8.5=8.5.12-1 On Magento, audit every CMS block for unexpected script tags and rotate admin credentials. Check running processes and web logs for 94.154.43.7 and unexpected .php files in media or pub directories.

GMO Onamae Desktop Cloud intrusion on 20 October left MT4/MT5 credentials on up to 26,739 servers exposed after malware landed. **Incident** Intrusion hit Onamae Desktop Cloud that day. Malware reached as many as 26,739 customer servers. No ransomware executed on any machine. **Exposure** MT4/MT5 logins and trading account details now sit at risk. Payment data stayed untouched. The actor published both company and customer records online. Check the MT4/MT5 Tools > Options > Server tab first so you can see the exact last login IP and time and spot any unknown access. Log into the broker portal, review every active session, and terminate connections you do not recognise to cut the actor’s foothold. Reset investor and master passwords at once, then regenerate API keys so stolen credentials lose value. Watch the Experts and Journal tabs for the next 48 hours to catch fresh commands or connections. Verify no new logins appear after the password reset to confirm the account is clean.

A ransomware victim got billed $150k after MonsterCloud quietly paid the attackers just $8,200. CEO Zohar Pinhasi was indicted for running the same play across multiple cases. He told clients their data would be recovered without paying hackers, then settled the ransoms himself and added a massive markup. Total take exceeded $19 million while actual payouts topped $8 million. The firm had pitched law enforcement agencies on a strict “we never pay” policy. Several agencies chose them on that claim. Victims or agencies could have required on-chain transaction hashes or direct attacker confirmation to verify the no-payment story. Next time, demand the actual blockchain proof before wiring recovery fees.

INISAFE CrossWeb EX from Initech is now the loader vector against construction, software and wire-communication targets in South Korea. Operation FlashHole has run since July 2025. Malicious GitHub pages trigger CrossWeb EX to spawn fsquirt.exe, which sideloads TechHub via its legitimate export table. TechHub then reaches out to GitHub for TouchHub, and TouchHub abuses mscoree.dll to load TOUCHSHIFT in memory before launching a second TechHub instance that never touches disk. That second TechHub fetches ClientHub over HTTPS or the Dropbox API. ClientHub drops and runs LPEClient, which in turn plants Cubridge to handle module loading and persistence. Cubridge refines the SIDESHOW and LightlessCan techniques while TechHub upgrades the older CLOUDBURST and NickelLoader patterns. LPEClient itself dates back to 2019 and was tied by Check Point in August 2026 to zero-day use of CVE-2026-68820 in the Windows Ancillary Function Driver for WinSock, specifically through a crafted AF_UNIX socket call that grants SYSTEM. The group keeps swapping in fresh signed security binaries to keep the chain alive.

CoreGraphics out-of-bounds write during image file processing leads to arbitrary code execution. The flaw was originally addressed in the September release for current OS versions. Meta Product Security reported it after observing use against older builds. A separate dyld issue, CVE-2026-20700, was exploited in the same campaign and fixed earlier. Backports now cover iPhone XS through XR, iPad 7th generation and later, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later.

University of Copenhagen left a test environment packed with records for 525,000 people reachable from outside. Unauthorized access was spotted on 20 October. Public notice came three days later. The next update revealed an extra 20,000 staff and student PIN codes had also been exposed, along with full names, CPR numbers, phone numbers and email addresses. The incident was reported to the Danish Data Protection Agency. Physical access to key campus sites was restricted while the PINs remained at risk. Production systems stayed untouched. Treat every test environment like production. Apply the same network controls, logging and data minimisation or keep live records out of it entirely.

Operators behind helpdeskteam365.onmicrosoft.… opened Teams chats with staff at a European manufacturer, using the display name “IT Service Desk – Liam”. They began with mail bombing from hundreds of newsletter sign-ups to bury any prior alerts. Once inside, the operators pasted step-by-step instructions directly into the Microsoft Notes pane rather than sending links, evading Safe Links and ZAP inspection. The same tenant then pushed an MSI from Azure Blob Storage that dropped a Python implant performing LDAP queries for computer and user objects. Abused RMM tools observed across the cluster include Quick Assist, AnyDesk, ScreenConnect, TeamViewer, Atera, Zoho Assist, NetSupport, LogMeIn and Level. Fifty percent of the paid domains used for tenant registration were .top. Hunt proxy and Teams admin logs for MSI downloads from blob.core.windows.net followed immediately by python.exe LDAP binds to domain controllers.

Brotli decoder just handed unauthenticated RCE to anyone who can reach the stream. The flaw lives in versions 1.0.3 through 1.2.0. Once the decoder passes the point where it should reject the input, it keeps accepting bytes and performs an out-of-bounds write into a small working buffer. That single overflow is enough for direct code execution in the calling process. Node and Python shipped the issue; OpenAI had already traced the same root cause months earlier. The upstream patch existed in February but stayed unreleased as a security update until after disclosure. Every language binding pulling an unpatched libbrotli copy is affected: Python 3.x brotli wheels, Node 20.x, Bun, Envoy, and the C++ reference. Apache and Nginx skip the decoder by default. Upgrade libbrotli to 1.2.1 or apply the February patch now.

Logs from 133 sessions showed Russian-speaking operators feeding victim-specific prompts into OpenCode via OpenRouter while Phantom handled access, movement, and exfil. Initial access hit unpatched SimpleHelp gateways, FortiClient EMS consoles, and cPanel instances. CVE-2024-57727 in SimpleHelp was exploited for unauthenticated RCE on exposed management portals. CVE-2026-35616 and CVE-2026-41940 were used against FortiClient EMS and cPanel respectively to drop initial implants. Prompts directed the model to generate RevSocks tunnel commands and Ghost C2 config. QuickLine then routed traffic over Cloudflare and Telegram DNS. BYOVD with zam64.sys was loaded from a dropped driver to disable EDR before WormGPT-MCP scripted lateral movement. Four of the 62 targeted organizations later appeared on INC and The Gentlemen leak sites. Block zam64.sys loads from non-system paths and flag internal hosts beaconing to Cloudflare edge nodes without proxy authentication.

Time4Popcorn updaters on Windows and macOS allowed unauthenticated RCE as SYSTEM or root via a single domain. CVE-2026-30612 stemmed from the updater fetching executables over plain HTTP from popcorntimeupd.xyz with no signature checks. The client shipped a 2014 Chrome engine that had no sandbox. Eye Security registered the domain and observed 3 million Windows plus 350 000 macOS connections. A remediation payload delivered November 2025 through March 2026 was downloaded two million times. Traffic fell 98 % once ownership moved to The Shadowserver Foundation. Pin the update domain’s TLS certificate in the client. Reject any executable that lacks a valid signature before writing it to disk or spawning it.

Imperva showed unauth RCE on stock Node.js 24 by sending a malicious br response. Node.js fetch() and node:zlib hand untrusted Brotli data straight to the decoder. The flaw sits in Google's Brotli library and permits out-of-bounds writes from crafted streams. All 20.x, 22.x and 24.x releases before the October fixes are affected. Bun <=1.4.3 ships the same code; 1.4.4 closed the fetch and node:zlib paths. Envoy is exposed only when its Brotli decompressor is on. A malicious Huffman code-length table overflows the internal tables and triggers the write. Update Node.js and Bun immediately. Set brotli.decompression.enabled: false in Envoy until patched. Verify with: node --version curl -I --compressed-allow-redirect -H "Accept-Encoding: br" https://target

Scans for the PHP RCE pair started within hours of disclosure. Crafted HTTP requests to vulnerable installs trigger unauthenticated remote code execution before any auth checks fire. The box at 206.188.197[.]105:9999 is already serving aslr_exploit.py aimed at PHP 8.4.26 on Apache mod_php, plus php2shell_fp.py, deep_probe.py and wp_attack.py. Nearby hosts expose open directories full of PHP2Shell tooling. Activity links straight to the Potassium Mirai variant. It encrypts its config with ChaCha20 using static byte 0xED, offers SHELL and SHOUT reverse shells, mangles DNS A records, and runs ICMP, TCP, UDP plus OpenVPN floods. C2 sits at 134.199.154[.]64:50792. Block 92.118.112[.]100 first.

Brotli decoder accepts an impossible block-type transition without resetting state and keeps decoding. Node.js 22.x/24.x/26.x state machine fails to reject the switch, turning it straight into an out-of-bounds write. The same stream reaches the decoder through Express 5 body-parser and the fetch response path. Patched builds now return a format error on that transition. Update to 24.22.1 immediately.

CVE-2026-109618 + CVE-2026-109619: unauth RCE before app code on mod_php, plus memory reads from worker processes. The flaws let an attacker reach code execution prior to any application bootstrap or include logic. That timing differs from typical post-bootstrap issues because the payload lands inside the interpreter itself rather than after userland files load. mod_php carries the highest exposure. PHP-FPM, php-cgi, FrankenPHP and LiteSpeed follow in risk order. Patches for 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 landed at 14:00 UTC 21 Oct 2026; versions back to 5.4 are affected and 8.1 and older remain unsupported. Apply the update, confirm the new version with php -v, then restart the workers. Test mod_php instances first because they share the process address space with the web server; FPM pools need separate verification that the new binary is actually running. Check worker memory exposure in logs or via targeted tests that exercise the reported read paths.

litellm 1.107.0 PyPI wheel dropped cook.pth, cook.py, and sitecustomize.py straight into site-packages. cook.pth forces "import cook" on every startup. cook.py runs the base64-zlib exec payload immediately. sitecustomize.py then spawns a daemon that pulls a new domain hourly and re-execs fresh code from it. The matching sdist carried an unexpected "data = cook" entry under [tool.maturin] with no matching directory in the upstream repo. Docker tags v1.107.0, latest, main-latest, and main-stable on both registries carried the same payload after the 2024-10-21 push window. PyPI yanked the release at 13:23 UTC. The letters9813 account vanished at 13:40 UTC. Three developer tokens plus one org-owner token, all harvested from logs of an exposed internal LiteLLM instance, were used to trigger the release workflow. The pipeline trusted the very tokens the application had already logged.