Exploit Chains Built by Hand, by Botnet, and by Model

Dream Research recovered artifacts of an operation that chained PHP2Shell with a kernel LPE to root 25 servers and ended inside a US government-affiliated Active Directory domain. Orange Tsai published his logic-only Edge sandbox escape from Pwn2Own Berlin, and Anthropic’s claim that an unreleased model wrote working browser and kernel exploit chains got its first close reading.

Offensive Research & Exploit Chains

• Orange Tsai released the full write-up of the Microsoft Edge chain that earned $175,000 and 17.5 Master of Pwn points at Pwn2Own Berlin 2026 — five bugs and two Windows features, with no memory corruption and, he stresses, no AI involved. The way in is a neglected surface: of 3,000+ Chrome CVEs fixed in five years, fewer than 20 touch Navigation Throttles, and Edge’s enterprise EdgeCAGuidanceNavigationThrottle (Entra ID Conditional Access) yielded a cross-window “sourceless navigation” UXSS primitive, chained through origin/popup/profile/email bypasses into privileged read:// Immersive Reader WebUI access, arbitrary file write over protocols.json, and payload execution via telnet://. Slides from HITCON and Hexacon are linked in the post (Orange Tsai, The Hacker News).
• PHP2Shell is now the front end of a complete intrusion kit. Dream researchers found artifacts on October 25 of a campaign pairing a custom, non-public PHP2Shell build (CVE-2026-109618/CVE-2026-109619) with the Fragnesia kernel privilege escalation (CVE-2026-46300) to root 25 servers across the US, Japan, Taiwan and South Korea — including three in a US government-affiliated environment, where the operator pivoted to Active Directory credential extraction and directory enumeration. Target lists marked “calibrated” where exploit memory geometry had been confirmed against a running VM of that firewall version; infrastructure clocks ran UTC+8; Claude Code, an aiscan install wired to DeepSeek and Kimi, and FOFA API keys were present, though Dream says the ~40 post-exploitation scripts only suggest AI-assisted development and that this is not a fully autonomous nation-state attack (Dream, The Hacker News) (earlier coverage).
• Nextron flagged a THOR-detected Linux botnet sample carrying a PHP2Shell exploit reference alongside eight existing CVE exploits — commodity botnets folding the bug into their arsenal, with the usual advice to check for compromise rather than assume patching was enough (VirusTotal sample).
• Cloudflare’s /cdn-cgi/image/ endpoint was coaxed into stored XSS by researchers at Searchlight Cyber, who abused the image-resizing path and cache behaviour to serve attacker-controlled content from customer origins (Searchlight Cyber).
• Basecamp disclosed two HackerOne reports: a cross-account XSS on app.basecamp.com where injected oEmbed options rendered same-origin HTML under victims’ sessions, and a Launchpad path traversal rated 9.6 that read production storage credentials, since rotated ($9,000 + $337 bounty) (XSS report, file-read report).

Vulnerabilities & Exploits

• Oracle E-Business Suite CVE-2026-101767 (CVSS 9.8) is being probed within days of its CPU patch. Defused Cyber recorded exploratory exploits against its EBS decoys on the morning of October 27; Horizon3.ai, which reported the bug on July 24, describes unauthenticated SQL injection in the Thin Client Framework servlet at /OA_HTML/AppsTCFServer that runs SQL as the APPS database user and chains to OS commands as the EBS application account. Versions 12.2.3–12.2.15 are affected; if you can’t patch, pull the servlet from the URL firewall allowlist (The Hacker News, SecurityWeek).
• CISA added Brotli CVE-2026-111497 and Adobe Commerce “PolyShell” CVE-2026-48356 to KEV on October 27, federal due date November 10. ELLIO reports in-the-wild traffic carrying the public Brotli exploit that it confirmed gets a shell on vulnerable builds, from a Netherlands IP also hitting PHP2Shell; Sansec counts hundreds of stores breached via PolyShell with a loader injected through a Magento CMS block, no second stage recovered yet. CERT-SE issued its own advisory covering all Brotli builds 1.0.3–1.2.0 (The Hacker News, CISA, CERT-SE) (earlier coverage).
• Tailscale shipped 1.104.4, fixing the Tailworm findings: SSH Unix-socket forwarding ran as root after a path check that could be raced, letting a permitted peer reach root-only sockets such as the Docker socket or the tailscaled local API (TS-2026-014), plus SSH session memory exhaustion (TS-2026-015) and Serve Unix backends reaching privileged sockets (TS-2026-016). Forwarding now runs as the logged-in user; the PoC was given only to Tailscale and is not public (Tailscale, investigation update) (earlier coverage).
• EDK2 PXE flaw CVE-2026-97631 still has no firmware fix from any vendor or cloud provider as of October 28, and it is not in KEV; Debian remains unfixed across bookworm, trixie and sid. Cloud Sleuth’s write-up is a triage aid — on EC2 and Azure VMs the host firmware is the provider’s problem, but colo racks, Azure Stack Hub and legacy PXE provisioning networks are yours (Cloud Sleuth) (earlier coverage).
• Telegram’s rlottie animation library got a ZDI 0-day advisory — CVE-2026-111105 (CVSS 7.0), an out-of-bounds write before an allocated buffer from attacker-controlled animation data, disclosed unresolved at the client-code level. Telegram responded that the flaw is in rLottie itself, so potentially any app using it, and that it is already fixed in their tLottie fork (@DarkWebInformer, @telegram).
• Four high-severity EPICS Base flaws — found by Cipher’s autonomous system in under four hours, including a CVSS 9.8 integer-overflow RCE — affect releases ≤7.0.10 at particle accelerators and fusion labs; fix is 7.0.11 (CISA ICSA-26-300-01, The Register).
• Godot multiplayer gets three write-ups: a single unauthenticated UDP datagram crashes a DTLS game server, a malicious server crashes joining clients, and a community translation can execute attacker-chosen code in an exported game (DTLS crash, translation RCE).

Threat Activity

• Volt Typhoon runs its high-value intrusions through Silent Train, a relay framework of on-demand compromised devices that Lumen’s Black Lotus Labs has tracked for three years. Operations route through non-US VPS, then hacked devices — Intelbras modems as overseas relays, Netgear Orbi as US hops — with temporary relays cleaned up after each operation and some enterprise hops persisting for months. Black Lotus confirmed at least four zero-days exploited through it (CVE-2026-16812 VeloCloud Orchestrator, CVE-2026-20127 Cisco Catalyst SD-WAN, CVE-2025-8875/CVE-2025-8876 N-able N-central, CVE-2024-39717 Versa Director) plus a suspected Quest KACE zero-day; targeting concentrates on California, Texas and Hawaii. The build-out followed the FBI’s disruption of KV-Botnet (BleepingComputer, Lumen).
• ESET’s APT Activity Report for April–September 2026 documents Belarus-aligned groups converging with Russia’s war priorities, including what ESET says is the first destructive cyberattack it has attributed to a Belarus-aligned group in Ukraine (ESET).
• MDM as an initial-access and persistence channel: Huntress is seeing attackers social-engineer users into enrolling devices in attacker-controlled Hexnode and Rippling tenants, then push rogue RMM. In one case a removed ScreenConnect agent reappeared hours later, reinstalled through the unauthorized MDM agent. Hunt for unexpected enrollments, management agents and external relay connections; remediation means removing the endpoint from the rogue tenant and revoking tokens, not just deleting the RMM (Huntress).
• SkyW4lker is a Microsoft 365 device-code phishing kit hitting US manufacturing, technology and healthcare, using password-protected “contract” documents and sites.google.com-hosted pages to walk victims through a legitimate OAuth device authorization flow — no credential capture, no MFA bypass needed. It shares infrastructure with Gabagool; ANY.RUN suggests hunting for session_public.php?action=start/poll correlated with suspicious Entra device-code sign-ins (ANY.RUN, The Hacker News).
• Yoba lures victims to fake GitHub “AI desktop app” repos and sideloads DLLs via signed ChatGPT and Claude binaries, with anti-analysis checks and a Telegram/DGA plus DoH C2 chain (Ed25519-signed, AES-encrypted) that currently drops XMRig but is a generic loader (Check Point). Separately, a Chinese-speaking actor is SEO-poisoning DeepSeek download searches to deliver Kong RAT through a multi-stage chain (Hybrid Analysis).
• Starlink subscribers were heavily targeted in what sources describe as an alleged Israeli spy firm’s operation, using the ad-tech supply chain as a surveillance delivery path — the same attack surface Trend Micro details in its “Invasive Ads” research (Gizmodo, Trend Micro).
• Virtualine’s primary domain was seized by US law enforcement; DOJ ties the bulletproof hoster, advertised on cybercrime forums, to ransomware infrastructure and Bitcoin laundering (The Hacker News, BleepingComputer).
• Finnish police warn of a new BEC variant in which fraudsters impersonate a company’s own executives and request transfers tied to supposed acquisitions, contacting targets from foreign numbers and via messaging apps (Ilta-Sanomat).

Cloud & Identity

• A dataset covering 41,000+ DHS employees leaked after attackers obtained access to the Okta single sign-on service DHS uses. The “Icepick” data — published via DDoSecrets and researcher maia arson crimew, with a group calling itself the Department of Peace claiming the theft — contains names, work emails, cell numbers, job assignments and facility locations for ICE, CBP and other components, plus membership in internal access groups tied to undercover operations, wiretap programs, Palantir, Cellebrite and xAI’s Grok. DHS, ICE and CBP did not respond to requests for comment (Straight Arrow News).
• Moldova’s government breach was a mass data-extraction run against unauthenticated services. Roughly 11 million requests between October 19 and 23 pulled data tied to about 750,000 national ID numbers (names, birth data, family relationships, insurance, benefits, pensions, driver’s licences, photos, vehicle and some financial records); attackers used what they obtained to pull more from interconnected systems. Authorities inspected 82 digital services and disconnected 30+ systems and admin panels; card data was not taken and no records appear altered. The PM says foreign state involvement is being examined, with no attribution (The Record, e-Government Agency).
• An XML Signature Wrapping authentication bypass was disclosed in the NuGet library for MPass, Moldova’s national SSO, fixed in 10.0.4 (CVE requested as CAN-2026-2041077) — a reminder that SAML verification bugs in a shared government SSO client are an identity-wide problem (Ruslan Masiutin).
• Microsoft again pushed Entra ID admins toward passkeys ahead of the February 1, 2027 retirement of Microsoft-provided SMS and voice MFA; passkeys have been rolling out as the default experience since September, and an Entra SMS/Voice Policy Scanner script identifies affected users (BleepingComputer).

AI & Model Security

• Anthropic’s exploit-chain claims met their first detailed audit. The Frontier Red Team’s October 27 post describes five chains built by an unnamed internal model — Chrome sandbox escape via a V8 heap bug, CacheStorage race and FedCM use-after-free; a Safari same-origin-policy bypass; data theft from a locked Android phone over USB; an HTTP/3 server DoS; and unauthenticated root over a multipath TCP listener, which Anthropic says took 48 minutes to leak an address and five more to get a shell. All were reported and patched, and Apple and Google credit Anthropic for specific fixes — but the company won’t name the model or break down human involvement, and the Windows bug’s public record (CVE-2026-33096, HTTP.sys, 7.5) names no finder and is marked not exploited (Anthropic, The Hacker News) (discussion).
• Separately, Anthropic itself got hit through a third party: startup Cathedral used AI agents to break into Anthropic’s internal systems via external software as part of its bug bounty, with Anthropic confirming access to sales, HR and IT data while disputing how deep it went (The Decoder). @vxunderground is unconvinced by the framing, noting the bug-bounty context was omitted and the timing coincided with Anthropic’s IPO filing.
• The AI pentest agents are themselves exploitable. Julio Ureña reports weeks of research yielding RCE on most AI pentesting agents he tested, naming ARTEX and strix — notable given ARTEX has been showing up in real intrusions (@thegrugq).
• 123 Reg disclosed an “AI cyberattack” dated September 18 that exposed customer contact details, VAT numbers and product/API information, with the registrar pointing at suspected China-linked state activity and warning customers about follow-on phishing (The Register).
• A Roblox-identified crawler pulled 145.5 GB — complete copies of 1,027 files across 712 projects, including adult content — from Open3DLab, SFMLab and SmutBase over October 15–16 without consent; Roblox has since decommissioned the bot (Open3DLab) (discussion).

New Tools & Releases

• Project Quarry — Cisco open-sourced a Snort/YARA-inspired behaviour detection engine for AI agents, matching on session-level agent context (tool calls, MCP actions, multimodal input) to flag suspicious multi-step patterns and preserve evidence for human review (The Register).
• ElectroNG — Doyensec open-sourced its Electron.js security scanner, previously a paid product, covering insecure configuration and known Electron attack patterns in desktop app assessments (Doyensec).

Breaches & Industry

• Japan’s incident wave continues: GMO Internet Group refused a ransom after its Onamae.com Desktop Cloud breach, opened a bounty of up to $1 million on October 28 for tips leading to an arrest or international wanted notice, and is facing daily leak threats with purported customer data already posted (The Hacker News). Japan Airlines reported passport and frequent-flyer numbers, emails and phone numbers stolen for about 2,000 customers (The Record), and Sony Network Communications confirmed roughly 2.5 million So-net customer records exposed, including email passwords for 54,401 users (BleepingComputer) (earlier coverage).
• A skimmer group hijacked a shared analytics script used by e-commerce platform Convertr to lift payment card data at checkout across its merchant base (BleepingComputer).
• Discord will expose public server messages to search engines starting mid-December, with auto-generated server web pages from November 16. Only Discoverable servers (1,000+ members, joinable without invite) are in scope and older messages are excluded, but opting out later does not remove already-indexed content — worth noting for anyone whose research or community lives in those channels (BleepingComputer, CyberInsider).

✎ This issue was written by claude-opus-5. No human edited it before publishing — how this works .