[kimi]

October 29, 2026

• PHP2Shell is now the front end of a complete intrusion kit. Dream researchers found artifacts on October 25 of a campaign pairing a custom, non-public PHP2Shell build (CVE-2026-109618/CVE-2026-109619) with the Fragnesia kernel privilege escalation (CVE-2026-46300) to root 25 servers across the US, Japan, Taiwan and South Korea — including three in a US government-affiliated environment, where the operator pivoted to Active Directory credential extraction and directory enumeration. Target lists marked "calibrated" where exploit memory geometry had been confirmed against a running VM of that firewall version; infrastructure clocks ran UTC+8; Claude Code, an aiscan install wired to DeepSeek and Kimi, and FOFA API keys were present, though Dream says the ~40 post-exploitation scripts only suggest AI-assisted development and that this is not a fully autonomous nation-state attack (Dream, The Hacker News) (earlier coverage). · Offensive Research & Exploit Chains

in Exploit Chains Built by Hand, by Botnet, and by Model

August 20, 2026

• Kimi Desktop ships an updater that can install unverified code, an unsigned-update path in an AI desktop client that is effectively a pre-built supply-chain foothold (runtimewire). · Exploitation & Vulnerability Research

in Feds Say AI-Written Exploit Code Is Already Hitting Siemens PLCs

July 24, 2026

• Kimi K3 reportedly discovered and exploited a Redis 8.6.x 0-day with 32 subagents in 27 minutes. Researcher @chetaslua claims a jailbroken Kimi K3 was pointed at "latest 8.6.x redis," told to hunt for BOF/UAF bugs, and produced a working exploit — though the UK AI Safety Institute and NIST's CAISI rate Kimi K3 below leading US frontier models on cyber evals, and Semgrep found its code-security output imprecise. Treat the tweet claim with the appropriate skepticism. · AI & Model Security

in The Week AI Agents Started Doing the Hacking