AI-Powered Ransomware, PHP2Shell and Brotli Headline This Week’s Threat Landscape

From the kernel at the bottom of the stack to the website at the top, this week proved that no layer was too deep, too trusted or too obscure to escape attention. Even a humble compression library and a photo resizer became doorways, while ransomware crews brought AI along for the break-in.

CISA added eight vulnerabilities to the Known Exploited Vulnerabilities (KEV) catalog: two PHP Group flaws behind PHP2Shell, the widely reported Google Brotli flaw, and one flaw each in the Linux Kernel, Broadcom VMware ESX, Arista VeloCloud Orchestrator, Collabora and Adobe. Active exploitation also surfaced in YOOtheme Pro, Fortinet FortiSIEM and MLflow, where attackers abused unauthenticated flaws shortly after proof-of-concept code went public.

On the threat actor front, UAT-11473 exploited a Cisco SD-WAN vulnerability to deploy KeyDrift, while INC and The Gentlemen ransomware affiliates weaponized AI to exploit FortiClient EMS, SimpleHelp and cPanel. PHP2Shell exploitation attempts also aimed to deploy the Potassium botnet, showing how fast fresh flaws were folded into botnet operations.

Key highlights of the week:

• CISA added two PHP Group flaws behind PHP2Shell to the KEV catalog, and attackers soon used them in attempts to deploy the Potassium botnet.
• The widely reported Google Brotli flaw joined the KEV catalog, putting a core compression library underneath countless applications in the spotlight.
• Attackers actively exploited flaws in YOOtheme Pro, Fortinet FortiSIEM and MLflow within days of public proof-of-concept releases.
• UAT-11473 exploited a Cisco SD-WAN vulnerability to deploy KeyDrift, targeting network infrastructure at its core.
• INC and The Gentlemen ransomware affiliates weaponized AI to exploit FortiClient EMS, SimpleHelp and cPanel.

Several high-impact vulnerabilities are currently trending across the cybersecurity community, demanding immediate attention and patch prioritization. Monitoring these emerging and widely discussed threats provides valuable insights, enabling organizations to make informed security decisions and strengthen their overall defense posture.

CVE-2026-41709 - Insufficient Logging vulnerability in Broadcom VMWare ESX

An Insufficient Logging vulnerability existed in Broadcom VMware ESX, which allowed a malicious actor with administrative access to perform certain operations without them being logged. Broadcom addressed the issue in a July 2026 advisory, releasing fixes in VMware Cloud Foundation and VMware vSphere Foundation ESXi-9.1.0.0-25370933 and ESXi-9.0.2.0100-25595025, VMware ESX and VMware Telco Cloud Platform ESXi80U3j-25429389, and VMware Cloud Foundation 5.2.4. Although the flaw appeared minor at disclosure, CrowdStrike’s 2026 Legal Threat Landscape Report later revealed that Warp Panda had exploited it as a zero-day in early 2026 to reduce audit trail visibility. Following this confirmation of in-the-wild exploitation, CISA added the vulnerability to its KEV catalog on October 28, 2026.

CVE-2026-46300 - Missing Initialization of a Variable vulnerability in Linux Kernel

A Missing Initialization of a Variable vulnerability, dubbed Fragnesia, existed in the Linux kernel’s XFRM ESP-in-TCP subsystem, where a failure to preserve the shared-fragment marker during socket buffer coalescing caused ESP input processing to decrypt shared fragments in place and modify page-cache-backed data. Dream researchers observed a complete attack operation in which threat actors chained the PHP2Shell vulnerabilities with this flaw, first implanting PHP webshells and then overwriting /etc/pam.d/su with pam_permit.so to obtain root access in under 15 minutes. The operation rooted 25 servers across the United States, Japan, Taiwan, and South Korea and ended with persistent access to a US government-affiliated Active Directory domain. Although an upstream kernel fix had been available since May 13, 2026, with patched kernels released by major distributions including Red Hat, Amazon Linux, AlmaLinux, CloudLinux, and Fedora, the campaign showed that unpatched systems remained exposed months later. Following this confirmed exploitation, CISA added the vulnerability to its KEV catalog.

CVE-2026-48356 - Unrestricted Upload of File with Dangerous Type vulnerability in Adobe Commerce and Magento

An Unrestricted Upload of File with Dangerous Type vulnerability, dubbed PolyShell, existed in the Adobe Commerce and Magento Open Source REST API. The API accepted files through product custom options without proper validation, which allowed unauthenticated attackers to upload polyglot files that functioned as both images and executable scripts, resulting in arbitrary code execution and potential control over a victim’s account or session. Sansec observed an unknown threat actor running a long-term campaign, active since at least July 2025, that infected 953 online stores, most of them running Magento, with a malicious JavaScript loader injected through Magento CMS blocks, and an estimated 471 of those stores were compromised through PolyShell. The loader fetched and executed an attacker-controlled payload, although no next-stage malware was recovered, which left the campaign’s final objective unclear. Adobe addressed the flaw in security bulletin APSB26-73 on July 14, 2026, releasing patched versions 2.4.4-2026-jul through 2.4.9-2026-jul for Adobe Commerce and 2.4.6-2026-jul through 2.4.9-2026-jul for Magento Open Source. Following this confirmed exploitation, CISA added the vulnerability to its KEV catalog

CVE-2026-102785 - Unauthenticated Remote Code Execution vulnerability in YOOtheme Pro framework

An Unauthenticated Remote Code Execution vulnerability in the image-processing component of YOOtheme Pro versions 5.0.0 through 5.0.52, a commercial theme and page builder for WordPress and Joomla. The public image transformation handler incompletely bound normalized image operations and the output destination to the request signature, allowing attackers to reuse a legitimately signed image URL, load the request body through FromFile=php://input, and write a JPEG carrying PHP code in its APP13 metadata into wp-content/uploads/ through the Save parameter. YOOtheme fixed the vulnerability in YOOtheme Pro 5.0.53 on October 21, 2026, and the CVE went public on October 22, followed by proof-of-concept exploits on October 23 and webshell drops within two days of the patch. Palo Alto Networks Unit 42 confirmed in-the-wild exploitation on October 26, 2026. Automated scanners dropped yt[0-9a-f]{7}.php webshells, and human operators followed within minutes, attempting gsocket installation and deploying the ALFA Team webshell through Indonesian residential proxies.

CVE-2026-106173 - Path Traversal vulnerability in Fortinet FortiSIEM

An Unauthenticated Path Traversal vulnerability in the phQueryMaster component of Fortinet FortiSIEM 7.5.0 allowed remote code execution through specially crafted packets. The component exposed a gRPC server on TCP port 27918 without client certificate authentication, and its SendQueryResult method concatenated the attacker-controlled query-id header into a file path without validation, allowing traversal sequences and an embedded null byte to strip the server-appended suffix and achieve arbitrary file writes. The exploit chain converted the file write into code execution by overwriting /opt/charting/redishb.sh, a Redis health-check script executed by a cron job every 60 seconds. Fortinet resolved the vulnerability in FortiSIEM 7.5.1 and published advisory FG-IR-26-180 on October 13, 2026, followed by a Horizon3.ai proof-of-concept exploit on GitHub on October 20, 2026. The Canadian Centre for Cyber Security later confirmed active exploitation in the wild, without releasing attack details or attributing the activity to a specific threat actor.

CVE-2026-109618 - Memory Corruption Vulnerability in PHP

A Memory Corruption vulnerability, dubbed PHP2Shell alongside its sibling flaw, existed in PHP core, where an out-of-memory condition interrupted PHP while request data was only partially initialized and request cleanup then treated the half-built data as valid, leading to memory corruption and unauthenticated remote code execution. The flaw affected all PHP installations serving web requests, including Apache mod_php, PHP-FPM, php-cgi, FrankenPHP, and LiteSpeed, with the highest risk on mod_php, where a crafted request could trigger exploitation before any application code ran. Amazon Threat Intelligence recorded an exploitation attempt against its MadPot honeypots days before public disclosure, and researcher Adel Karimi later captured 35 working shells on PHP 8.4.26 honeypots running mod_php, with traffic closely matching a public proof-of-concept. PHP addressed the flaw on October 21, 2026, in versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Following this confirmed exploitation, CISA added the vulnerability to its KEV catalog.

CVE-2026-109619 - Stale Internal Request-State Vulnerability in PHP

A Stale Internal Request-state vulnerability, dubbed PHP2Shell alongside its sibling flaw, existed in PHP core, where request-owned internal state survived after its backing memory was freed and a later request handled by the same worker reused that stale state before initialization reset it, resulting in a use-after-free. Attackers could reach this condition by forcing a fatal error or an execution timeout, with confirmed paths through session upload progress handling and per-request INI settings applied through .htaccess on mod_php, and the flaw enabled both unauthenticated remote code execution and disclosure of worker memory holding passwords, tokens, and keys. Because persistent workers in mod_php and PHP-FPM reused request state, temporary mitigations included disabling session upload progress and recycling PHP-FPM workers after each request, although these measures blocked only the confirmed paths. PHP addressed the flaw on October 21, 2026, in versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. CISA added the vulnerability to its KEV catalog even though public honeypot evidence at the time matched only its sibling flaw.

CVE-2026-110447 - OS Command Injection Vulnerability in Collabora Online-Built-in CODE Server

An OS Command Injection vulnerability existed in the Collabora Online Built-in CODE Server app (richdocumentscode) for Nextcloud, where the app's PHP wrapper passed unescaped path values into the remote_font_config.url argument while launching the Collabora AppImage, allowing unauthenticated attackers to execute commands as the web server user whenever the CODE server was not running, such as after a restart. Attackers exploited the flaw by sending crafted GET requests to the /apps/richdocumentscode/proxy.php?status endpoint that combined encoded path traversal sequences with $() command substitution and ${IFS} whitespace obfuscation, dropping PHP webshells named shx*.php or shrf*.php and then hunting for password databases and cryptocurrency wallets. Administrators reported successful attacks as early as September 10, 2026, and only Nextcloud instances running the built-in CODE Server app were exposed, while standalone Collabora Online deployments remained unaffected. Collabora addressed the flaw in richdocumentscode version 26.4.303, although updating did not remove existing webshells, so administrators also needed to inspect the app directory and rotate all secrets accessible to the web server user. Given the active attacks against exposed Nextcloud servers, CISA added the vulnerability to its KEV catalog.

CVE-2026-111497 - Unchecked Return Value vulnerability in Google Brotli

An Unchecked Return Value vulnerability, dubbed Node2Shell and also known as Broccoli2Shell, Brotli2Shell, and HTTP2Shell, existed in the Google Brotli decoder bundled with Node.js, where the decoder treated an invalid block switch as a temporary need for more input rather than a permanent format error and continued decoding in an invalid state. This invalid state led to an out-of-bounds write, so an attacker who supplied crafted Brotli data to an application that decompressed it through node:zlib could corrupt process memory and trigger a crash, memory disclosure, or remote code execution, with frameworks such as Express 5 exposing this path remotely by transparently decoding Brotli-encoded request bodies. Imperva researchers demonstrated code execution on the official Node.js 24.22.0 Linux arm64 image, and public proof-of-concept exploits soon followed on GitHub. Node.js addressed the flaw on October 21, 2026, in versions 22.23.4, 24.22.1, and 26.12.1, while end-of-life lines such as Node.js 20 received no fix. After live exploit traffic emerged against Node.js servers, CISA added the vulnerability to its KEV catalog.

CVE-2026-114625 - SQL Injection Vulnerability in Arista VeloCloud Orchestrator

An SQL injection vulnerability existed in the Arista VeloCloud Orchestrator (VCO) on-prem, the central management system of the VeloCloud SD-WAN platform, where any authenticated user with the lowest built-in Enterprise Read Only role could gain operator privileges and masquerade as a local superuser operator, exposing internal functionality never meant to be remotely accessible. Because VCO was exposed by default and no configuration could prevent the exposure, even a stolen read-only tenant login could give an attacker full control of the orchestrator, its host, and the customer and partner data it managed. Arista detected the flaw itself while it was under active exploitation, observed attacks from the IP addresses 74.82.197[.]86 and 38.54.50[.]151, and advised administrators to block both addresses and review VCO web access logs for encoded characters, unusual URL-like path components, references to internal services, and high request rates. Arista addressed the flaw in VCO on-prem versions 5.2.3.18, 6.1.3.10, and 6.4.2.12 and later in their respective release trains, while hosted and dedicated VCO instances were already patched by the vendor. As the in-the-wild attacks came to light, CISA added the vulnerability to its KEV catalog.

CVE-2026-116690 - Path Traversal vulnerability in MLflow

An Unauthenticated Path Traversal vulnerability in MLflow that allowed arbitrary file reads from exposed tracking servers. The flaw resided in prompt model version handling, where an incomplete fix for CVE-2026-2614 validated paths only when the source carried a URL scheme, allowing attackers to store a relative path as a prompt source and retrieve files such as /etc/passwd and SQLite tracking databases through the artifact download feature. On basic-auth servers, a low-privilege account could read the authentication database, including the admin password hash. Previdian honeypots captured active exploitation attempts within a day of the October 27 disclosure, and MLflow’s GitHub advisories published full proof-of-concept code. MLflow versions 3.10.0 through 3.16.1 were affected, and administrators were advised to upgrade, enable authentication, avoid internet exposure, run the server as a non-root user, and rotate credentials on exposed instances.

Cytellite telemetry captured active exploit attempts and mass scanning campaigns against exposed services globally. The data highlights which vulnerabilities are under attack and provides source IPs and payloads to authorized teams for detailed threat analysis and validation.

Active malware campaigns exploited specific vulnerabilities to deliver payloads and carry out post-exploitation actions. Each targeted vulnerability is proactively monitored, manually analysed, and mapped to MITRE ATT&CK tactics and techniques. Insights are derived from the LOVI vulnerability intelligence platform, which aggregates and curates data from multiple sources, OSINT groups, blogs, and data leak sites.

UAT-11473 Exploited CVE-2026-20127 to Deploy KeyDrift on Cisco SD-WAN

According to Cisco Talos, a highly sophisticated APT actor tracked as UAT-11473 exploited CVE-2026-20127, an authentication bypass vulnerability in Cisco Catalyst SD-WAN Controller instances, to gain unauthorized access and deploy KeyDrift, a custom malware framework built for long-term persistence and automated theft of SD-WAN keying material, with targeting that spanned space and satellite services, defense and aerospace technology, and policy research. The framework’s primary component, PolyFlame, was a memory-resident module that the actor injected into legitimate vdaemon processes through modified runit service paths, where it hooked socket and DTLS functions to act as either a TinyShell-style backdoor for command execution and file transfer or an intermediate C2 that relayed tasking to other peers over in-band control-plane traffic. A second component, LittleFilch, hooked SSL_read inside vdaemon to extract edge node IP addresses and assessed AES-256 IPsec data-plane keys from decrypted control traffic, encrypting the stolen material with RSA before staging it in /var/tmp/vdaemon.bin for exfiltration. Talos also observed a packed PolyFlame variant that masqueraded as the aaamgr service on vBond appliances and used RC4 encryption, anti-debugging checks, and timestomping to evade detection. Talos assessed with high confidence that UAT-11473’s operating infrastructure overlapped considerably with Volt Typhoon’s “Silent Train” covert access network.

INC and The Gentlemen Affiliates Weaponized AI to Exploit FortiClient EMS, SimpleHelp, and cPanel

According to SOCRadar, affiliates operating with INC Ransomware and The Gentlemen ran an AI-driven intrusion operation, exposed through an open command-and-control server, that exploited FortiClient EMS (CVE-2026-35616), SimpleHelp (CVE-2024-57727), and cPanel/WHM (CVE-2026-41940) at scale for initial access. Operator records, which SOCRadar could not independently verify, claimed 2,236 FortiClient EMS targets with 108 backdoor admin accounts, 242 IP addresses impacted through SimpleHelp, and more than 49 cPanel breaches. The operators ran their intrusions through OpenCode with commercial models hosted on OpenRouter, using a “WormGPT” persona prompt, 32 MCP servers, and a custom “Autonomous Red Team Kill Chain Framework” called Phantom, while a human operator approved each step; the recorded AI spending exceeded $23,000. Their arsenal also included Ghost C2 polymorphic implants, a RevSocks reverse SOCKS5 framework, and a Quick Heal/Seqrite EDR killer that abused the Zemana driver. The exposed servers held 46 custom INC encryptor builds for six victims, staged for an October 1, 2026, deployment, and the records named 62 victim organizations, 36 of them in the United States.

PHP2Shell Exploitation Attempts Targeted Potassium Botnet Deployment

According to Sophos, threat actors attempted to exploit the PHP2Shell vulnerabilities to deploy Potassium, a likely Mirai botnet variant, with exploit traffic originating from 45[.]198[.]224[.]169 and carrying a “php2shell-scan/109618” User-Agent and a distinctive multipart boundary string. The attack chain was designed to fetch the payload from 92[.]118[.]112[.]100, write it to /tmp/nfs, and execute it as “./nfs php,” although Sophos countermeasures blocked the attempts before the botnet was delivered. Analysis of the sample revealed an updated and significantly expanded version of a Mirai-derived variant first identified in early 2026, combining downloader and network disruption functionality. The malware resolved a hard-coded, encrypted C2 address, connected to 134[.]199[.]154[.]64, and retrieved a Linux ELF follow-on payload after verifying an HTTP 200 response and the ELF magic bytes, while falling back on public DNS servers such as 8.8.8.8 and 1.1.1.1 for resolution. As with earlier Mirai strains, Potassium retained the ability to launch DDoS attacks.

Open-Source Software (OSS) vulnerabilities are security weaknesses discovered in publicly available codebases that can be exploited across widely used libraries, frameworks, and tools, often impacting thousands of downstream applications.

PRE-NVD vulnerabilities refer to security flaws that are discovered, discussed, or even exploited in the wild before their official inclusion in the National Vulnerability Database (NVD). These early-stage vulnerabilities often emerge through threat actor chatter, exploit proof-of-concepts, and technical disclosures shared across social media platforms and underground forums, signaling potential exploitation risks before public awareness.

The week’s lesson was clear: trust in a product, a vendor or a layer of the stack offered no protection on its own, and visibility into real exposure mattered more than any single patch. Security teams that knew which assets faced the internet, which flaws attackers were already using and which fixes deserved priority stood on far firmer ground than those working through backlogs by severity alone. LOVI (Loginsoft Vulnerability Intelligence) was built for exactly that need, turning raw vulnerability data into exploitation-aware, prioritized intelligence that helped teams decide what to fix first and why.

‍FAQs

Q1. What is PHP2Shell, and why does it matter?  

PHP2Shell refers to two critical remote code execution vulnerabilities in PHP that prompted emergency patches from the PHP Group. Both flaws were added to the CISA KEV catalog after confirmed exploitation, and attackers used them in attempts to deploy the Potassium botnet. Because PHP powers a large share of web applications, unpatched servers face direct risk of takeover.

Q2. Why is the Google Brotli vulnerability considered so serious?

Google Brotli is a widely used compression library embedded beneath countless applications and runtimes. The decoder flaw behind the Node.js remote code execution issue also affects other widely used software such as Bun and Python, so its impact extends far beyond a single product. Its addition to the CISA KEV catalog confirmed active exploitation, and organizations often rely on the library without knowing it.

Q3. What should organizations do when a vulnerability has no patch available?

When no patch exists, organizations should reduce exposure by restricting access to affected management interfaces through trusted IP allowlists or VPN connections. Security teams should actively hunt for signs of compromise, such as unexpected files, suspicious processes or unusual outbound traffic. Once the vendor releases a fix, it should be applied immediately and its effectiveness verified.

Q4. How does LOVI help organizations manage vulnerabilities effectively?

Loginsoft Vulnerability Intelligence empowers you to efficiently prioritize and respond to potential vulnerabilities by focusing on those actively exploited in the wild. LOVI correlates vulnerability data with real-world threat activity to reduce noise and improve decision-making. This approach enables faster remediation and stronger security posture.

Q5. What is Cytellite?

Cytellite is a Loginsoft security intelligence platform that provides real-time visibility into emerging threats through a global sensor network. It delivers actionable IP intelligence to help organizations detect, analyze, and respond to attacks quickly. By correlating threat data with live activity, Cytellite strengthens resilience across dynamic threat landscapes.