October 22, 2026
- PHP2Shell is now an active-exploitation story. KrebsOnSecurity reports working exploits and in-the-wild activity against CVE-2026-109618 and CVE-2026-109619. Ellio logged the first exploit requests 5.5 hours before fixes shipped and found Mirai-style loaders in some scanning traffic. The flaws affect web-facing PHP 5.4+, and CISA lists fixed supported builds as PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. No source establishes how many sites were compromised. This moves yesterday’s disclosure-and-patch story into incident response. (discussion)
· Vulnerabilities & Exploits
in PHP2Shell Is Already in the Wild
October 11, 2026
- The FBI and DoJ seized seven domains used by Flax Typhoon (also tracked as Ethereal Panda and RedJuliett, linked to Beijing contractor Integrity Technology Group), disrupting two tools: MicroScan, a Python web tool bundling over 1,300 pentest scripts targeting OpenSSL, Oracle WebLogic, Rejetto, WordPress, Juniper ScreenOS, Jenkins and Apache Struts, in use since as early as 2017 and still reachable via
c0cc[.]cc as recently as 9 September 2026; and FishHub, whose confirmed victims include 20 Taiwanese universities. Court documents also detail a Mirai-variant IoT botnet managed by an application called Sparrow, whose database held records for more than 1.2 million infected devices as of 5 June 2024 — including over 385,000 unique U.S. devices, with roughly 126,000 U.S. devices actively infected at that point. The Hacker News, BleepingComputer
· Threat Activity
in Microsoft's 17 Trillion-Row Analytics Service Fell to One Unchecked JWT
October 9, 2026
- An international coalition seized seven domains behind Microscan and FishHub, the vulnerability-scanning and spear-phishing tools tied to Flax Typhoon and Beijing-based Integrity Technology Group; Microscan drove a Mirai-based botnet to scan for exploitable flaws, with targets including a South Carolina power company, airports in Japan and Poland, Taiwanese energy firms, universities and a multinational NGO (DOJ, The Record). Companion advisory AA26-281A details the TTPs — scanning, XSS, password spraying against Exchange, persistence via VPN software, scripted email and credential exfiltration — across government, critical manufacturing, healthcare and IT, with IOCs and CVEs newly added to KEV (CISA, NCSC-UK).
· Threat Activity
in Third NetScaler RCE in a Month Lands on the Same SAML Surface
August 16, 2026
- Evooo1Bot — a new Linux botnet family that bolts the Mirai DDoS engine onto a more modular, capable framework and turns compromised routers into traffic-relay nodes. BleepingComputer
· Threat Activity
in Bring Your Own EDR: Turning a Commercial Endpoint Agent Into a Trojan Horse