[apt28]

October 23, 2026

Two Unpatched KSMBD RCEs Go Public — and an AI Scanner Found Them

KSMBD RCEs found by Trend Micro's TrendAI scanner went public without fixes for two CVSS 9.0 flaws including a pre-authentication vulnerability, following a kernel policy change that published AI-discovered bugs immediately. Arista disclosed an actively exploited VeloCloud Orchestrator SQL injection (CVE-2026-114625, CVSS 9.9) allowing privilege escalation from read-only roles, while Fortinet faced criticism for silently patching a critical FortiWeb path-traversal (CVE-2025-64446, CVSS 9.8) for 17 days before confirming in-the-wild attacks. Node.js Brotli memory corruption (CVE-2026-111497) is being weaponized as a pre-auth RCE chain called "Node2Shell" in common Express middleware configurations. Symantec captured an offensive AI agent using a five-layer jailbreak to autonomously scan, exploit servers, steal credentials and install cryptominers on hijacked models across 127,000+ requests; meanwhile METR and Redwood found OpenAI agent monitoring gaps that could hide hundreds of recent actions from safeguard systems. Railway PaaS notified 4.8 million users to rotate secrets after unauthorized access to encrypted environment variables as part of a series of attacks on AI inference providers. LiteLLM traced its supply-chain compromise to Claude Code responses leaking GitHub OAuth tokens in gateway logs, allowing attackers to disable branch protections and serve poisoned artifacts.

October 21, 2026

• APT28 breached defense-sector targets in two unnamed NATO countries. Symantec’s Swallowtail cluster targeted a naval shipbuilder, military-aircraft engine manufacturer and law-enforcement agency. One July intrusion began with a malicious Word attachment, deployed HOOKEDGE, and later introduced an undocumented reflective loader that decrypted and executed code in memory. Activity ran from July 24 through at least September 24; sensitive-data theft and uninterrupted persistence were not confirmed, according to The Record. · Threat Activity

in PHP’s php2shell RCEs Break Cover

October 20, 2026

• Nextron attributes seven malicious Office documents submitted between July 8 and July 14 to APT28. Some initially scored only 5 detections across 62 engines. Obfuscated VBA assembled strings at runtime, performed XOR-encoded reconnaissance, and dropped a 64-bit Covenant Grunt loader disguised as a log file; the samples contacted Dropbox infrastructure. Nextron Systems · Threat Activity

in OpenCode’s Distillation Breach Exposes AI Provider Keys

July 26, 2026

• Compromised hotel Wi-Fi gateways are being used to DNS-poison travelers onto fake Microsoft 365 login pages and steal MFA-satisfied OAuth tokens, active since June 2026, per CyberInsider. The campaign introduces two notable tactics — abusing WPAD for broader traffic proxying and abusing Microsoft's device-code auth flow to obtain MFA-backed tokens (earlier device-code coverage). @blackorbird notes the tradecraft is similar to APT28. · Cloud & Identity

in Hotel Wi-Fi Becomes an MFA-Bypass Machine for M365 Accounts

July 4, 2026

• APT28 covert-attack analysis. A write-up details APT28 activity leveraging Explorer hijacking, LSB steganography, and related techniques. blackorbird · Threat Intelligence

in Silent Active Directory Recon and a Near-Perfect Linux Root Exploit Lead the Offensive Beat