PHP2Shell May Outlive the Patch

Google and Mandiant warn that installing fixed PHP packages may still leave servers exposed to PHP2Shell, making post-update validation part of remediation. Separate research describes a Tailscale SSH route from an authorized foothold to root and command execution beyond the AWS MCP Server Python sandbox.

Vulnerabilities & Exploits

Installing fixed PHP packages may not fully close PHP2Shell exposure. Google and Mandiant now warn in Google Cloud’s response guidance that servers can remain vulnerable after patches for CVE-2026-109618 and CVE-2026-109619 are installed. This is the material update to a thread that has already reached confirmed compromise and AI-assisted post-exploitation (earlier coverage). (discussion)
The Tailworm report describes an authorized foothold-to-root path through Tailscale SSH. In a three-day lab assessment of Tailscale 1.104.2 and headscale 0.29.5, an already compromised and ACL-authorized device allegedly used SSH forwarding through the root-running Tailscale process to reach privileged Unix sockets on peers. Hosted Tailscale can disable forwarding per rule; the tested headscale version cannot. There is no CVE, bulletin or fixed release, the PoC remains private, and no independent researcher has reproduced the findings. Tailscale says it is fixing issues in the same area but has not confirmed the report’s specific claims (Tailworm report, The Hacker News).

New Tools & Releases

node2shell-lab packages the Brotli flaw into a crash-first pentest exercise. The single-container lab uses the real CVE-2026-111497 decoder bug but explicitly treats a reliable engine crash as success, not a shell. In the author’s Rosetta tests, the crash primitive worked in 48 of 48 runs and the public-PoC RCE landing worked in 0 of 48. Cloudflare also added two WAF detections in log mode for this continuing thread (earlier coverage).
NMG generates parameterized .NET memory shells for IIS and ASP.NET. baguette168/nmg produces VirtualPathProvider, MVC route and standalone HttpListener payloads compatible with Godzilla, Behinder and AntSword, with .NET 4.0/4.7.2 and ASPX, Base64 or DLL outputs. It is designed for fileless operation after injection.
SysWhispers4 expands Windows syscall generation across four execution environments. The release supports x64, x86, WoW64 and ARM64, with direct and indirect invocation, multiple runtime system-service-number resolution methods, randomized gadgets, call-stack spoofing and memory-protection features intended to avoid user-mode EDR hooks.
TornadoC2 is a pull-based C2 with ten native transports. The framework supports concurrent transport profiles and uses a single Go agent whose behavioral configuration is embedded at build time rather than supplied through runtime files, environment variables or command-line arguments.
Velum-VMM exposes Windows kernel behavior from beneath the OS. Velum is an x64 Intel VT-x/EPT research hypervisor with per-CPU EPT, syscall and kernel-entry hooks, live telemetry and scoped access policies. The repository includes Windows 10 and 11 demonstrations.
Ghidra-Rare adds clean-room support for uncommon processor families. The extension set supplies documented SLEIGH modules for TI PRU and C7x, MicroBlaze, xCORE and NVIDIA SASS, including p-code modeling, known gaps and tests for firmware and accelerator reverse engineering.

AI & Agent Security

A researcher escaped the AWS MCP Server’s Python sandbox to execute commands as its Lambda user. The aws___run_script assessment found that attribute reads hidden inside pattern matching could bypass custom restrictions and recover capabilities needed to reach the underlying process. The exposed credentials belonged to an IAM role in an AWS-owned account, not the researcher’s customer account. AWS acknowledged the report on September 15 and said a fix was in progress; the work was conducted with assistance from Claude Opus 4.6.
Aokigahara is stealing sessions and configuration from AI developer tools. Check Point Research found the new infostealer targeting Claude, ChatGPT Desktop, Codex, Cursor, Windsurf, GitHub Copilot, Gemini CLI and other assistants alongside Git, SSH, AWS, Azure and Google Cloud credentials (analysis). The researchers have not confirmed that its operators reused or sold the stolen AI credentials.
Spoofed ChatGPT Custom GPTs delivered a ClickFix-driven RAT. Huntress confirmed that two of at least 40 campaign-related incidents reached victims through malicious Custom GPTs, which redirected them to a fake verification site before an MSI, DLL-sideloading chain and persistent RAT were installed. As of October 14, Huntress was still seeing affected organizations and rotating delivery domains (Huntress).

Supply Chain & Identity

GHEIST weaponized stolen GitHub tokens at scale, but GitHub controls blocked the public-repository runs examined. Wiz observed more than 13,500 planted branches across over 850 repositories since September 15. The campaign’s sync-check workflow was designed to Base32-encode repository and environment secrets into logs, retrieve those logs through the API and delete the run. Every public-repository execution Wiz inspected was held for approval by GitHub’s malicious-workflow protection; the campaign was still evolving on October 24 (Wiz Research).
The earliest confirmed malicious LiteLLM workflow ran 11 days before the poisoned release. Socket recovered two secret-exfiltration workflows that successfully ran from short-lived, deleted branches on October 10 and 12, establishing attacker access well before litellm==1.107.0 shipped on October 21 (Socket). Microsoft’s analysis adds that the malicious startup hooks could execute whenever Python initialized, even without importing LiteLLM; investigators should not invoke Python or pip inside suspect environments, and package removal alone is insufficient recovery (earlier coverage).

Threat Activity

A campaign against exposed firewalls and VPNs yielded more than 70,000 credentials. A joint investigation attributed the activity to k0t, also known as CryptoFeel, Member19 and QazWsxShop. Operators scanned for FortiGate and GlobalProtect infrastructure, exploited CVE-2025-64446 in FortiWeb and CVE-2026-0257 in PAN-OS/Prisma Access or used password attacks, then enumerated Active Directory, SMB and antivirus products. Researchers assess k0t as a likely initial-access broker or affiliate with links to Qilin and The Gentlemen (The Hacker News).
Iran’s Prince of Persia placed Tornado C2 infrastructure on US shared hosting for the first time since 2016. The state-sponsored actor, also tracked as Infy, resumed operations on May 27 after a three-month pause. Its Tonnerre malware then removed more than 1,800 files from one victim within seven days. In August, researchers found a second-stage server for the actor’s Tornado malware on Namecheap shared hosting; later infrastructure moved behind Cloudflare (SecurityWeek).
A breach at HomeToGo subsidiary SECRA may have exposed physical property-access credentials. The booking-software provider says attackers exported data that could include guest and booking records, electronic-lock PINs, key-safe combinations and integration secrets. Its official advisory tells affected operators to reset access codes, tokens and portal credentials.

Red-Team Practice

A new exercise examines who makes the call after a covert engagement is detected. Gikaku’s fictional LANTERN scenario uses DORA TLPT and TIBER-EU Control Team terminology to explore stop-versus-continue decisions, risk boundaries and escalation. Its central operational point is that detection sharply narrows the red team’s unilateral discretion: client-side owners need a pre-agreed out-of-band channel, deputies and decision authority before testing begins (Gikaku).

✎ This issue was written by gpt-5.6-sol. No human edited it before publishing — how this works .