Skip to content

Security Sense

AI Threat Intelligence

  • About
  • Blog
  • Privacy Policy

Tag: high

CVE-2026-119977: WordPress Core RCE via TOCTOU Race Condition

Posted on November 3, 2026 by Kyle

Overview

CVE-2026-119977 is a high-severity Time-of-Check Time-of-Use (TOCTOU) race condition vulnerability affecting WordPress Core. It allows unauthenticated attackers to execute arbitrary code on the server. This threat is particularly critical as it leverages the legitimate core upgrade process, making affected WordPress installations vulnerable during their update windows.

Technical Analysis

WordPress Core versions 4.7 through 7.1.3 are vulnerable to Remote Code Execution (RCE) due to a TOCTOU race condition (CWE-367). The vulnerability arises from the use of predictable, web-accessible staging paths during full-package core upgrades. An unauthenticated attacker can exploit this window by racing the legitimate upgrade process, likely by injecting malicious code into these temporary staging paths before they are fully processed or used by the system. The CVSS 3.1 score for this vulnerability is 8.1 (High), with a vector of CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H.

  • Affected Versions: WordPress Core versions 4.7 through 7.1.3.
  • Attack Vector: Unauthenticated network access (AV:N).
  • Prerequisites: The target WordPress instance must be undergoing a full-package core upgrade.
  • Exploitation: Attackers exploit a race condition during the upgrade process, leveraging predictable, web-accessible staging paths to introduce malicious code.

Detection

Detecting exploitation of CVE-2026-119977 primarily involves monitoring for anomalous activity during or immediately after WordPress core upgrades.

  • Web Server Logs: Monitor for unusual or unexpected requests to wp-admin or temporary upgrade directories (e.g., wp-content/upgrade/) that do not align with legitimate upgrade traffic patterns.
  • Process Monitoring: Look for the web server process (e.g., httpd, nginx, php-fpm, w3wp.exe) spawning unusual child processes such as cmd.exe, powershell.exe, sh, bash, python, or perl outside of expected administrative tasks.
  • File Integrity Monitoring (FIM): Monitor for unexpected file creations or modifications in WordPress core directories (wp-admin, wp-includes, wp-content) during or immediately following an upgrade, especially for executable file types (.php, .pl, .py, .sh).
  • Network Traffic Analysis: Look for outbound connections initiated by the web server process to unusual external IP addresses or domains, which could indicate a successful webshell or backdoor.

Sigma Detection Rules

⚠️ AI-generated detection rules. These are experimental starting points. Review field names, EventIDs, and logic against your environment’s schema before deploying. Tune to reduce false positives.

Web Server Process Spawning Suspicious Child Process (Windows)

title: Web Server Process Spawning Suspicious Child Process (Windows)
id: 5f9e2d1c-8b7a-4c3e-9e7f-0d2a1b3c4e5f
status: experimental
description: Detects a web server process spawning suspicious child processes, indicative of successful RCE exploitation on Windows.
logsource:
  product: windows
  service: sysmon
detection:
  selection:
    ParentImage|endswith:
      - '\\w3wp.exe'
      - '\\httpd.exe'
      - '\\nginx.exe'
      - '\\php-cgi.exe'
    Image|endswith:
      - '\\cmd.exe'
      - '\\powershell.exe'
      - '\\pwsh.exe'
      - '\\cscript.exe'
      - '\\wscript.exe'
  condition: selection
level: high

Web Server Process Spawning Suspicious Child Process (Linux)

title: Web Server Process Spawning Suspicious Child Process (Linux)
id: 6a7b8c9d-0e1f-2a3b-4c5d-6e7f8a9b0c1d
status: experimental
description: Detects a web server process spawning suspicious child processes, indicative of successful RCE exploitation on Linux.
logsource:
  product: linux
  service: auditd
detection:
  selection:
    type: 'EXECVE'
    process.parent.name:
      - 'apache2'
      - 'httpd'
      - 'nginx'
      - 'php-fpm'
    process.name:
      - 'sh'
      - 'bash'
      - 'python'
      - 'perl'
      - 'php'
      - 'nc'
      - 'ncat'
      - 'wget'
      - 'curl'
  condition: selection
level: high

Mitigations

  1. Patch Immediately: Upgrade all WordPress installations to version 7.1.4 or later. This is the most critical mitigation.
  2. Restrict Access During Upgrades: If possible, temporarily restrict network access to the wp-admin directory or the entire WordPress site during core upgrade windows to minimize the attack surface.
  3. Implement Strong File Permissions: Ensure strict file permissions are enforced on WordPress directories, especially wp-content and wp-admin, to prevent unauthorized file writes.
  4. Deploy a Web Application Firewall (WAF): A WAF can help detect and block suspicious requests targeting WordPress upgrade paths or common webshell patterns.
  5. Regular Backups: Maintain regular, tested backups of your WordPress site and database to facilitate recovery in case of compromise.

References

  • https://nvd.nist.gov/vuln/detail/CVE-2026-119977
  • https://core.trac.wordpress.org/browser/tags/7.1.3/src/wp-admin/includes/class-core-upgrader.php#L162
  • https://core.trac.wordpress.org/browser/tags/7.1.3/src/wp-admin/includes/class-wp-upgrader.php#L378
  • https://core.trac.wordpress.org/browser/tags/7.1.3/src/wp-admin/includes/update-core.php#L1549
  • https://core.trac.wordpress.org/browser/tags/7.1.3/src/wp-admin/setup-config.php#L282
  • https://core.trac.wordpress.org/browser/tags/7.1.4/src/wp-admin/includes/class-wp-upgrader.php#L346
  • https://core.trac.wordpress.org/browser/tags/7.1.4/src/wp-admin/includes/update-core.php#L1545
  • https://wordpress.org/news/2026/10/wordpress-7-1-4/
  • https://www.wordfence.com/threat-intel/vulnerabilities/id/4b4da0cf-d9f4-47c4-a0e8-6c4dc5a6f250?source=cve
  • https://ltna.com.au/cyber

Indicators of Compromise

No public IOCs available at time of writing.

MITRE ATT&CK

  • T1190 — Exploit Public-Facing Application
  • T1059 — Command and Scripting Interpreter
🤖 AI Attribution
Generated by gemini-2.5-flash ·
2,187 input / 1,937 output tokens ·
Reviewed and approved by a human analyst before publication
Posted in vulnerabilityTagged cwe-367, high, rce, vulnerability, web, wordpressLeave a comment

CVE-2026-118527: Ivanti Connect Secure Predictable Numbers Vulnerability Leading to File Upload

Posted on November 3, 2026 by Kyle

Overview

CVE-2026-118527 affects Ivanti Connect Secure, enabling a remote authenticated attacker to upload arbitrary, attacker-controlled files to a specific location on the appliance’s disk. This vulnerability is significant as it provides a critical primitive for establishing persistence or further exploitation, often chained with other vulnerabilities like CVE-2026-104935 and CVE-2026-111357. Its inclusion in CISA’s Known Exploited Vulnerabilities Catalog indicates active exploitation.

Technical Analysis

The vulnerability in Ivanti Connect Secure is related to the generation of predictable numbers or identifiers. An authenticated attacker can leverage this predictability to bypass controls and upload files containing arbitrary content to a pre-determined location on the appliance’s filesystem. This capability can be used to drop web shells, configuration files, or other malicious payloads, paving the way for further compromise. The vulnerability requires prior authentication, meaning an attacker must first obtain valid credentials. Specific affected versions are not detailed in the provided source material.

Detection

  • Monitor Ivanti Connect Secure appliance logs for successful POST requests to unusual or unexpected paths, especially those with large body sizes indicative of file uploads.
  • Look for subsequent GET or POST requests targeting newly created or modified files in web-accessible directories (e.g., files with extensions like .jsp, .php, .sh, .pl, .py).
  • Analyze network traffic for large POST requests directed at Ivanti Connect Secure, followed by requests for unusual file types or paths that are not part of normal appliance operation.
  • If filesystem monitoring is available on the appliance, detect writes to sensitive or web-root directories by unexpected processes.

Sigma Detection Rules

⚠️ AI-generated detection rules. These are experimental starting points. Review field names, EventIDs, and logic against your environment’s schema before deploying. Tune to reduce false positives.

Ivanti Connect Secure – Suspicious File Upload Attempt

title: Ivanti Connect Secure - Suspicious File Upload Attempt
id: 9c0e4f1c-7e2a-4d3b-8c8f-1a2b3c4d5e6f
status: experimental
description: Detects suspicious file upload attempts to Ivanti Connect Secure, potentially indicating exploitation of CVE-2026-118527 or similar vulnerabilities. Looks for POST requests with common web shell extensions.
logsource:
  product: webserver
detection:
  selection:
    cs-method: 'POST'
    cs-uri-stem|endswith:
      - '.jsp'
      - '.php'
      - '.aspx'
      - '.sh'
      - '.pl'
      - '.py'
      - '.cgi'
      - '.txt' # Could be a staging file
      - '.conf' # Could be a config overwrite
    sc-status: 200
  condition: selection
level: high

Ivanti Connect Secure – Large POST Request (Potential File Upload)

title: Ivanti Connect Secure - Large POST Request (Potential File Upload)
id: 0f1e2d3c-4b5a-6c7d-8e9f-0a1b2c3d4e5f
status: experimental
description: Detects unusually large POST requests to Ivanti Connect Secure, which could indicate a file upload related to CVE-2026-118527 or other vulnerabilities. Threshold may need tuning.
logsource:
  product: webserver
detection:
  selection:
    cs-method: 'POST'
    c-bytes|gte: 102400 # Example: greater than 100KB. Adjust based on normal traffic patterns.
    sc-status: 200
  condition: selection
level: medium

Mitigations

  1. Apply vendor patches immediately once they become available. Regularly check Ivanti’s security advisories for updates.
  2. Implement and enforce strong authentication policies, including multi-factor authentication (MFA), for all Ivanti Connect Secure users and administrators to mitigate the risk of compromised credentials.
  3. Regularly review and audit Ivanti Connect Secure appliance logs for any anomalous activity, suspicious file creations, or unusual access patterns.
  4. Restrict network access to the Ivanti Connect Secure administration interface and other sensitive endpoints to only trusted IP addresses or networks.

References

  • https://nvd.nist.gov/vuln/detail/CVE-2026-118527

Indicators of Compromise

No public IOCs available at time of writing.

MITRE ATT&CK

  • T1078 — Valid Accounts
  • T1505.003 — Web Shell
  • T1105 — Ingress Tool Transfer
🤖 AI Attribution
Generated by gemini-2.5-flash ·
1,530 input / 1,269 output tokens ·
Reviewed and approved by a human analyst before publication
Posted in vulnerabilityTagged authenticated, connect secure, file upload, high, ivanti, vulnerabilityLeave a comment

CVE-2026-111357: Ivanti Connect Secure Privilege Escalation

Posted on November 3, 2026 by Kyle

Overview

CVE-2026-111357 is a high-severity privilege escalation vulnerability affecting Ivanti Connect Secure appliances, actively exploited in the wild since October 2026. This flaw allows a local authenticated attacker to escalate their privileges to root by manipulating the dsinvoked broker’s trust in DSCache configuration data. The vulnerability is particularly critical as it can be chained with other Ivanti zero-day exploits.

Technical Analysis

Ivanti Connect Secure versions 22.8 and 25.1.0.0 through 25.1.1.3 are affected by CVE-2026-111357. The vulnerability stems from the dsinvoked broker’s improper handling and trust of DSCache configuration data. A local authenticated attacker can exploit this weakness to achieve privilege escalation to root. The NVD record indicates a CVSS 3.1 score of 7.0 (High), with an attack vector of local (AV:L) and low privileges required (PR:L), but high attack complexity (AC:H). This vulnerability is categorized as CWE-829 (Improper Handling of Sensitive Information). It has been observed in the wild and can be chained with CVE-2026-104935 and CVE-2026-118527 for more impactful attacks.

Detection

Detection efforts should focus on identifying unusual activity originating from or within Ivanti Connect Secure appliances, particularly related to process execution and configuration changes.
* Monitor Ivanti Connect Secure appliance logs for unexpected process spawns, especially sh, bash, python, or other shell interpreters, initiated by the dsinvoked process or running with root privileges.
* Look for anomalous modifications to system configuration files or DSCache related data that deviate from normal administrative operations.
* Monitor for unusual authentication attempts or privilege changes on the appliance that precede suspicious process activity.

Sigma Detection Rules

⚠️ AI-generated detection rules. These are experimental starting points. Review field names, EventIDs, and logic against your environment’s schema before deploying. Tune to reduce false positives.

Ivanti Connect Secure dsinvoked Shell Spawn

title: Ivanti Connect Secure dsinvoked Shell Spawn
id: 90e8f7d6-c1b3-4a2e-8d5f-1e2a3c4b5d6e
status: experimental
description: Detects suspicious shell execution potentially indicative of CVE-2026-111357 exploitation on Ivanti Connect Secure appliances. Assumes process creation logging is available.
logsource:
  product: linux
  service: auditd
detection:
  selection:
    ParentImage|endswith: '/dsinvoked'
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/zsh'
      - '/python'
      - '/perl'
  condition: selection
level: critical

Mitigations

  1. Apply Vendor Patches: Immediately apply all available security patches from Ivanti. Refer to the official Ivanti Security Advisory for CVE-2026-104935, which may include fixes or workarounds for chained vulnerabilities.
  2. Restrict Local Access: Limit local authenticated access to Ivanti Connect Secure appliances to only essential personnel.
  3. Network Segmentation: Isolate Ivanti Connect Secure appliances on a dedicated network segment to minimize potential lateral movement post-exploitation.
  4. Regular Auditing: Conduct regular security audits of Ivanti Connect Secure configurations and logs to detect any unauthorized changes or suspicious activity.

References

  • https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935
  • https://www.volexity.com/blog/2026/10/13/a-series-of-unauthenticated-events-chained-exploitation-of-ivanti-connect-secure-zero-days/
  • https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-111357
  • https://nvd.nist.gov/vuln/detail/CVE-2026-111357

Indicators of Compromise

No public IOCs available at time of writing.

MITRE ATT&CK

  • T1068 — Exploitation for Privilege Escalation
🤖 AI Attribution
Generated by gemini-2.5-flash ·
2,041 input / 1,179 output tokens ·
Reviewed and approved by a human analyst before publication
Posted in vulnerabilityTagged cve, high, ivanti, privilege-escalation, vulnerabilityLeave a comment

CVE-2026-76418: Cisco Secure Firewall ASA/FTD Denial of Service Vulnerability

Posted on November 3, 2026 by Kyle

Overview

CVE-2026-76418 addresses a critical denial of service vulnerability in Cisco Secure Firewall ASA and FTD Software. An unauthenticated, remote attacker can trigger an unexpected device reload by sending crafted requests to the SSL remote access VPN service. This vulnerability is due to logic errors related to secondary authentication on tunnel groups and is currently listed in CISA’s Known Exploited Vulnerabilities Catalog.

Technical Analysis

A vulnerability in the Remote Access SSL VPN service of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition.

  • Vulnerability Type: Unchecked return value to NULL pointer dereference (CWE-690).
  • Affected Products: Cisco Secure Firewall Adaptive Security Appliance (ASA) Software, Cisco Secure Firewall Threat Defense (FTD) Software.
  • Attack Vector: Remote Access SSL VPN service.
  • Prerequisites: Secondary authentication must be configured on a tunnel group.
  • Exploitation: An unauthenticated, remote attacker sends a crafted request when connecting to the SSL remote access VPN.
  • Impact: A successful exploit causes the affected device to reload, resulting in a denial of service (DoS) condition.
  • CVSS 3.1 Score: 8.6 (HIGH) – CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Detection

  • Monitor Cisco ASA/FTD device logs for unexpected reloads or crashes, specifically looking for system messages indicating a reload event.
  • Look for an increased volume of failed or abnormal SSL VPN connection attempts preceding a device reload.
  • Analyze network traffic for unusual or malformed SSL VPN connection requests, particularly those targeting devices with secondary authentication configured.
  • Review device uptime and availability metrics for unexpected interruptions.

Sigma Detection Rules

⚠️ AI-generated detection rules. These are experimental starting points. Review field names, EventIDs, and logic against your environment’s schema before deploying. Tune to reduce false positives.

Cisco ASA FTD Unexpected Device Reload

title: Cisco ASA FTD Unexpected Device Reload
id: 90f7a01d-5b3e-4f1c-9e2a-7b8d6c5f4e3c
status: experimental
description: Detects unexpected device reloads in Cisco ASA/FTD logs, indicative of a denial of service condition or system instability.
logsource:
  product: cisco
  service: asa
detection:
  selection:
    message|contains:
      - 'Reloading due to'
      - 'System is restarting'
      - 'Device rebooted unexpectedly'
  condition: selection
level: high

Mitigations

  1. Apply security patches from Cisco as soon as they become available. (As of the NVD publication date, the vulnerability is undergoing analysis, and patches are anticipated).
  2. Review configurations of SSL remote access VPN tunnel groups to identify instances where secondary authentication is enabled.
  3. Implement network segmentation to restrict access to the SSL VPN service from untrusted networks where possible.
  4. Ensure robust logging and monitoring are in place for Cisco ASA/FTD devices to detect reloads or suspicious activity.

References

  • https://nvd.nist.gov/vuln/detail/CVE-2026-76418
  • https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-tunnel-dos-s6mgkb75
  • https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-76418
  • https://ltna.com.au/cyber

Indicators of Compromise

No public IOCs available at time of writing.

MITRE ATT&CK

  • T1499 — Endpoint Denial of Service
🤖 AI Attribution
Generated by gemini-2.5-flash ·
1,903 input / 1,133 output tokens ·
Reviewed and approved by a human analyst before publication
Posted in vulnerabilityTagged cisco, denial-of-service, high, network-device, vpn, vulnerabilityLeave a comment

CVE-2026-46300: Linux Kernel Privilege Escalation via Shared Fragment Handling

Posted on November 3, 2026 by Kyle

Overview

CVE-2026-46300 is a high-severity vulnerability in the Linux kernel affecting how shared fragments are handled during socket buffer coalescing. This flaw can lead to unintended modification of page-cache-backed data, specifically allowing ESP input processing to decrypt shared fragments in place. When chained with other vulnerabilities, this can enable privilege escalation, the implantation of PHP webshells, and arbitrary command execution as root, posing a significant threat to Linux-based systems, including IoT devices.

Technical Analysis

The vulnerability stems from a missing initialization of a variable within the skb_try_coalesce() function. When skb_try_coalesce() transfers paged fragments from one socket buffer (@from) to another (@to), it fails to preserve the SKBFL_SHARED_FRAG marker if @from had it set. This breaks an invariant relied upon by later in-place writers, particularly ESP input processing. Consequently, ESP input checks skb_has_shared_frag() and, if the marker is missing, incorrectly determines that an uncloned nonlinear skb can skip skb_cow_data(), leading to in-place decryption over page-cache backed fragments.

This unintended modification of page-cache-backed data can be leveraged for privilege escalation. The NVD record explicitly states that this vulnerability can be chained with CVE-2026-109618 and CVE-2026-109619 to implant PHP webshells and execute commands as root.

  • CVSS 3.1 Score: 7.8 (High)
  • CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  • Weaknesses: CWE-787 (Out-of-bounds Write), CWE-456 (Missing Initialization of a Variable), CWE-123 (Write-what-where Condition)
  • Affected Versions:
    • Linux kernel versions >= 3.9 and <= 5.10.257
    • Linux kernel versions >= 5.11 and < 5.15.208
    • Linux kernel versions >= 5.16 and < 6.1.174
    • Linux kernel versions >= 6.2 and < 6.6.141
    • Linux kernel versions >= 6.7 and < 6.12.91
    • Linux kernel versions >= 6.13 and < 6.18.33
    • Linux kernel versions >= 6.19 and < 7.0.10
    • Linux kernel version 7.1

Detection

Direct detection of the kernel vulnerability exploitation itself can be challenging from user-space logs. However, the post-exploitation activities described (webshells, root command execution) provide clear detection opportunities.

  • Suspicious File Writes: Monitor web server directories (/var/www/, /srv/www/, /usr/share/nginx/html/, etc.) for the creation or modification of .php files by unusual processes or with suspicious content (e.g., base64 encoded strings, eval() functions). Utilize auditd logs for PATH events related to file creation/modification.
  • Privileged Process Execution: Look for sh, bash, php, python, or perl being executed with root privileges (UID 0) by unexpected parent processes or in unusual contexts. This is particularly relevant if the parent process is a network service or a process that should not typically spawn shells. Monitor auditd logs for SYSCALL events related to execve.
  • Network Activity: Monitor for unusual outbound connections from compromised systems, especially those indicative of botnet activity (e.g., DDoS attacks, C2 communications) if linked to malware families like KATARU or Mirai.

Sigma Detection Rules

⚠️ AI-generated detection rules. These are experimental starting points. Review field names, EventIDs, and logic against your environment’s schema before deploying. Tune to reduce false positives.

Linux Webshell Creation in Web Directories

title: Linux Webshell Creation in Web Directories
id: 752a1b3e-f1c3-4d0a-b8e7-2c9f0e1d4a3b
status: experimental
description: Detects the creation or modification of .php files in common web server directories, indicative of webshell deployment after exploitation.
logsource:
  product: linux
  service: auditd
detection:
  selection:
    type: 'PATH'
    name|endswith:
      - '.php'
      - '.phtml'
      - '.phar'
    # Common web server root directories
    directory|contains:
      - '/var/www/'
      - '/srv/www/'
      - '/usr/share/nginx/html/'
      - '/var/www/html/'
      - '/var/www/htdocs/'
  condition: selection
level: high

Linux Suspicious Root Command Execution

title: Linux Suspicious Root Command Execution
id: 9e0c3f1a-5b6d-4e7c-8a2b-1d0f2e3c4b5a
status: experimental
description: Detects execution of common shell or scripting interpreters with root privileges, which could indicate successful privilege escalation.
logsource:
  product: linux
  service: auditd
detection:
  selection:
    type: 'SYSCALL'
    a0|contains:
      - '/bin/sh'
      - '/bin/bash'
      - '/usr/bin/php'
      - '/usr/bin/python'
      - '/usr/bin/perl'
    uid: '0' # Root user
  condition: selection
level: high

Mitigations

  1. Apply Kernel Patches: Immediately update Linux kernel to a version that includes the fix for CVE-2026-46300. Refer to the provided kernel Git references for specific patch details.
  2. Regular System Updates: Ensure all Linux-based systems, including IoT devices, are kept up-to-date with the latest security patches from their respective distributions.
  3. Principle of Least Privilege: Restrict user and process privileges to the absolute minimum required to perform their functions.
  4. Network Segmentation: Isolate critical systems and IoT devices on separate network segments to limit lateral movement in case of compromise.
  5. Web Server Hardening: Implement strong web server security configurations, including disabling unnecessary PHP functions, restricting write access to web directories, and using Web Application Firewalls (WAFs).

References

  • https://nvd.nist.gov/vuln/detail/CVE-2026-46300
  • https://git.kernel.org/stable/c/2f2b16022a2e10ca7bccfb98db5ed2ec0f72641c
  • https://git.kernel.org/stable/c/3599e6b3cc1ada96883d496a50a210d3afbb6987
  • https://git.kernel.org/stable/c/3884358a9286b17f389a72b1426fc4547c23c111
  • https://git.kernel.org/stable/c/3bd9e113d50034db99d7ef69fd8e5242d15e414a
  • https://git.kernel.org/stable/c/760e1addc27ba1a7beb4a0a7e8b3e9ec49e7a34e
  • https://git.kernel.org/stable/c/78bf6b6bb19541d19fbda6242e7cfe2c682763c0
  • https://git.kernel.org/stable/c/9d3e5fd19fe1063bf607219e8562fbd567b8e8d5
  • https://git.kernel.org/stable/c/f84eca5817390257cef78013d0112481c503b4a3
  • https://www.nozominetworks.com/blog/kataru-iot-malware-adopts-public-lpe-exploits
  • https://ltna.com.au/cyber

Indicators of Compromise

Type Value Description
SHA256 13382c16e2401b07451577b46e634b8031ec254d98b876e59692b5fa22abc1d4 KATARU ARM32 payload hash (via https://www.nozominetworks.com/blog/kataru-iot-malware-adopts-public-lpe-exploits)
SHA256 6fbae3505ae0d638b820165c572d548ce92dda71e82dc47e8efe13f30617f35f KATARU ARM32 payload hash (via https://www.nozominetworks.com/blog/kataru-iot-malware-adopts-public-lpe-exploits)
SHA256 9d7cd4948a1fcbaeadc425752fce9a933bd6fc41eeede030dffd7b99b3bc51d5 KATARU AMD64 payload hash (via https://www.nozominetworks.com/blog/kataru-iot-malware-adopts-public-lpe-exploits)
SHA256 9d87e6615c810907443ebd5e915f3b35099c3b5c6b6c684637138a7f8ec9cebc KATARU ARM32 payload hash (via https://www.nozominetworks.com/blog/kataru-iot-malware-adopts-public-lpe-exploits)
SHA256 cc76bc218627279ecb4d0ce74ad2651e9db9e3e843e35d6569576e056e3a9218 KATARU loader hash (via https://www.nozominetworks.com/blog/kataru-iot-malware-adopts-public-lpe-exploits)
IP Address 160.191.242.92 KATARU Telnet brute force and C2 IP (via https://www.nozominetworks.com/blog/kataru-iot-malware-adopts-public-lpe-exploits)
Domain bins.sh Domain for fetching per-architecture payloads (via https://www.nozominetworks.com/blog/kataru-iot-malware-adopts-public-lpe-exploits)

MITRE ATT&CK

  • T1068 — Exploitation for Privilege Escalation
  • T1505.003 — Web Shell
  • T1059 — Command and Scripting Interpreter
  • T1110.001 — Password Guessing
  • T1498.001 — Direct Network Flood
  • T1053.003 — Cron
  • T1082 — System Information Discovery
  • T1499.002 — Service Exhaustion Flood
  • T1106 — Native API
  • T1016 — System Network Configuration Discovery
  • T1059.004 — Unix Shell
  • T1562.001 — Disable or Modify Tools
  • T1027 — Obfuscated Files or Information
  • T1573.002 — Asymmetric Cryptography
  • T1095 — Non-Application Layer Protocol
  • T1037.004 — RC Scripts
  • T1543.002 — Systemd Service
  • T1105 — Ingress Tool Transfer
🤖 AI Attribution
Generated by gemini-2.5-flash ·
2,776 input / 2,315 output tokens ·
Reviewed and approved by a human analyst before publication
Posted in vulnerabilityTagged high, iot, kataru, kernel, linux, mirai, privilege-escalation, vulnerability, webshellLeave a comment

CVE-2026-109619: PHP Stale Internal Request-State RCE Vulnerability

Posted on November 3, 2026 by Kyle

Overview

CVE-2026-109619 is a high-severity vulnerability in PHP that enables unauthenticated remote code execution. The flaw stems from stale internal request-state, allowing attackers to manipulate freed memory. This vulnerability affects a wide range of PHP versions and products, including critical network devices, and is being actively exploited by threat actors, including state-sponsored groups and ransomware operators, often in conjunction with PHP2Shell exploitation.

Technical Analysis

  • Vulnerability: CVE-2026-109619 is a stale internal request-state vulnerability in PHP.
  • Mechanism: PHP contains various global state variables that temporarily point to request memory. In certain scenarios, this global state may not be correctly reset or may be repopulated after being reset, leading to it referring to freed request memory. Subsequent requests can then read or branch on this stale state before it is fully initialized.
  • Impact: Multiple strategies can trigger this condition, leading to unauthenticated remote code execution (RCE).
  • CVSS v3.1: 8.1 (HIGH) – CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H.
  • Weaknesses: CWE-416 (Use After Free), CWE-755 (Improper Handling of Exceptional Conditions), CWE-824 (Access of Uninitialized Pointer), CWE-1325 (Unchecked Return Value to NULL Pointer Dereference).
  • Affected Versions:
    • PHP php versions >= 5.4.0 < 8.2.35
    • PHP php versions >= 8.3.0 < 8.3.36
    • PHP php versions >= 8.4.0 < 8.4.27
    • PHP php versions >= 8.5.0 < 8.5.12
    • Siemens ruggedcom_ape1808_firmware
    • Palo Alto Networks pan-os versions >= 10.2.0 < 10.2.7
    • Palo Alto Networks pan-os version 10.2.7
    • Palo Alto Networks pan-os version 10.2.8
    • Palo Alto Networks pan-os version 10.2.9
    • Palo Alto Networks pan-os version 10.2.10
  • Attack Vector: Network-based (AV:N), unauthenticated (PR:N), requiring no user interaction (UI:N). The attack complexity is high (AC:H).

Detection

  • Monitor web server access logs for unusual requests to PHP files, especially those with suspicious parameters, encoded commands, or patterns indicative of PHP2Shell exploitation. Look for unexpected HTTP methods or large POST bodies to unusual endpoints.
  • Detect unexpected process spawns originating from web server processes (e.g., php-fpm.exe, httpd.exe, nginx.exe, apache2, php-fpm) or their child processes. Look for cmd.exe, powershell.exe, sh, bash, python, perl, nc, wget, curl, or other command-line utilities.
  • Monitor for the creation of suspicious files (e.g., .php, .txt, .log files containing web shell code) in web-accessible directories (/var/www/html, htdocs, wwwroot). Look for files containing common web shell keywords like eval(, system(, passthru(, shell_exec(, base64_decode(, $_GET[, $_POST[, or PHP2Shell specific strings.
  • Analyze network flow logs for outbound connections initiated by web server processes to unusual or external IP addresses/domains, indicative of C2 communication or data exfiltration.
  • Review PHP error logs for unexpected errors or warnings that might indicate exploitation attempts or memory corruption.

Sigma Detection Rules

⚠️ AI-generated detection rules. These are experimental starting points. Review field names, EventIDs, and logic against your environment’s schema before deploying. Tune to reduce false positives.

Web Server Process Spawning Suspicious Shell

title: Web Server Process Spawning Suspicious Shell
id: 90c7e2b1-d3f4-4a8e-a2c3-f0e2b1d3f4a8
status: experimental
description: Detects suspicious process creation by common web server processes, indicative of RCE exploitation of CVE-2026-109619.
logsource:
  product: windows
  service: sysmon
detection:
  selection_parent:
    ParentImage|endswith:
      - '\\httpd.exe'
      - '\\nginx.exe'
      - '\\php-fpm.exe'
  selection_child:
    Image|endswith:
      - '\\cmd.exe'
      - '\\powershell.exe'
      - '\\sh.exe'
      - '\\bash.exe'
      - '\\python.exe'
      - '\\perl.exe'
      - '\\nc.exe'
      - '\\wget.exe'
      - '\\curl.exe'
  condition: all of selection_*
level: critical

Suspicious PHP File Creation in Web Root

title: Suspicious PHP File Creation in Web Root
id: 4f1c7e2b-d3f4-4a8e-a2c3-f0e2b1d3f4a8
status: experimental
description: Detects creation of new PHP files in web-accessible directories by web server processes, potentially indicating webshell deployment (e.g., PHP2Shell) after CVE-2026-109619 exploitation.
logsource:
  product: windows
  service: sysmon
detection:
  selection:
    EventID: 11
    Image|endswith:
      - '\\httpd.exe'
      - '\\nginx.exe'
      - '\\php-fpm.exe'
    TargetFilename|endswith:
      - '.php'
      - '.phtml'
      - '.php5'
    TargetFilename|contains:
      - '\\inetpub\\wwwroot\\'
      - '\\Apache24\\htdocs\\'
      - '\\nginx\\html\\'
      - '\\www\\html\\'
  condition: selection
level: high

Web Access Log – Generic PHP RCE Attempt

title: Web Access Log - Generic PHP RCE Attempt
id: 7e2b1d3f-4a8e-a2c3-f0e2b1d3f4a8
status: experimental
description: Detects common patterns in web access logs indicative of PHP RCE attempts, potentially targeting CVE-2026-109619. This rule may produce false positives and requires tuning.
logsource:
  category: webserver
  service: apache
detection:
  selection:
    cs-uri-query|contains:
      - 'cmd='
      - 'exec='
      - 'system='
      - 'passthru='
      - 'shell_exec='
      - 'eval='
      - 'base64_decode='
      - 'id%20'
      - 'whoami%20'
      - 'cat%20/etc/passwd'
      - 'wget%20'
      - 'curl%20'
    cs-uri-stem|endswith:
      - '.php'
      - '.phtml'
      - '.php5'
  condition: selection
level: medium

Mitigations

  1. Patch PHP: Upgrade PHP installations to the latest patched versions: 8.2.35, 8.3.36, 8.4.27, 8.5.12, or newer, as soon as possible.
  2. Patch Affected Products: Apply vendor-specific patches for Siemens ruggedcom_ape1808_firmware and Palo Alto Networks pan-os to versions that address CVE-2026-109619.
  3. Implement Web Application Firewall (WAF): Deploy and configure a WAF to detect and block exploitation attempts targeting PHP vulnerabilities, including known PHP2Shell patterns and generic RCE payloads.
  4. Least Privilege: Ensure PHP processes and web servers run with the minimum necessary privileges to limit the impact of successful exploitation.
  5. Network Segmentation: Isolate web servers running PHP applications from critical internal networks to contain potential breaches.
  6. Regular Audits: Conduct regular security audits and penetration tests of PHP applications and underlying infrastructure to identify and remediate vulnerabilities.

References

  • https://nvd.nist.gov/vuln/detail/CVE-2026-109619
  • https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp
  • http://www.openwall.com/lists/oss-security/2026/10/21/16
  • https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-glocal-php-infrastructure/
  • https://hunt.io/blog/php2shell-cve-2026-109618-109619-open-directories
  • https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/
  • https://www.vulncheck.com/blog/php2shell-vulnerabilities
  • https://socradar.io/blog/inc-gentlemen-ransomware-ai-infrastructure

Indicators of Compromise

Type Value Description
SHA256 0c5486f06620e26e316f4b33f318b0d646d5e1133789331aa2fed012360d1486 PHP2Shell second-stage ELF x86-64 binary hash (via https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-glocal-php-infrastructure/)
SHA256 1485e14e0f62bc94664eec341cabd275dad7d30b1d496c40ec340c9a0d9f0ba8 Hash of follow-up POST request body (via https://www.vulncheck.com/blog/php2shell-vulnerabilities)
SHA256 150ae88f0999032e2a6113501d6082f54a3ed98d02427b21a96e773a27d7bf16 Hash of uploaded file part ‘a’ (via https://www.vulncheck.com/blog/php2shell-vulnerabilities)
SHA256 27d926a6708d6769d97d065e7a5a860ab496eab272c03d1cebc55ec71b954fa2 Hash of uploaded file part ‘b’ (via https://www.vulncheck.com/blog/php2shell-vulnerabilities)
SHA256 40caf199ca1ebe056a74427f8e9db06c66899e33ae09c0ec2769ec70bf6dd8e7 Hash of uploaded file part ‘a’ (via https://www.vulncheck.com/blog/php2shell-vulnerabilities)
SHA256 43898a0a53bbd25d31ad9f5018ed3182be98a66109b22c9cab545a9fc447992a PHP2Shell scanner/OOM-tool HTTP request body hash (via https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-glocal-php-infrastructure/)
SHA256 7bc41ed79a9ae909927a9e40701736460a8cb70fca16ce1510e58677aca764b6 PHP2Shell scanner/OOM-tool HTTP request body hash (via https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-glocal-php-infrastructure/)
IP Address 103.114.163.188 PHP2Shell-associated anonymisation network IP (via https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-glocal-php-infrastructure/)
IP Address 103.216.220.92 PHP2Shell-associated anonymisation network IP (via https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-glocal-php-infrastructure/)
IP Address 109.71.252.97 PHP2Shell scanner/exploitation IP (via https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-glocal-php-infrastructure/)
IP Address 134.209.159.64 PHP2Shell-associated anonymisation network IP (via https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-glocal-php-infrastructure/)
IP Address 221.14.159.134 Exploitation attempt IP for CVE-2026-109618 (via https://www.vulncheck.com/blog/php2shell-vulnerabilities)
IP Address 31.223.184.166 PHP2Shell-associated anonymisation network IP (via https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-glocal-php-infrastructure/)
IP Address 37.19.200.5 PHP2Shell-associated anonymisation network IP (via https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-glocal-php-infrastructure/)
IP Address 45.198.224.169 PHP2Shell scanner/exploitation IP (via https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-glocal-php-infrastructure/)
IP Address 85.11.167.243 PHP2Shell scanner/exploitation IP (via https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-glocal-php-infrastructure/)
IP Address 91.90.123.25 Verification IP for CVE-2026-109618 (via https://www.vulncheck.com/blog/php2shell-vulnerabilities)
IP Address 92.118.112.100 PHP2Shell second-stage payload staging host IP (via https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-glocal-php-infrastructure/)
IP Address 95.217.98.37 PHP2Shell-associated anonymisation network IP (via https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-glocal-php-infrastructure/)
URL https://fedi.katze.sh/@elise/117478655339557825 Fediverse post discussing a different PHP vulnerability (via http://www.openwall.com/lists/oss-security/2026/10/21/17)
URL https://fedi.katze.sh/@elise/117479383739450605 Fediverse post reporting incomplete PHP fix (via http://www.openwall.com/lists/oss-security/2026/10/21/17)

MITRE ATT&CK

  • T1190 — Exploit Public-Facing Application
  • T1059.004 — Unix Shell
  • T1059.003 — Windows Command Shell
  • T1505.003 — Web Shell
  • T1590.005 — IP Addresses
  • T1053.003 — Cron
  • T1005 — Data from Local System
  • T1608.001 — Upload Malware
  • T1595.002 — Vulnerability Scanning
  • T1583.004 — Server
  • T1098.004 — SSH Authorized Keys
  • T1552.001 — Credentials In Files
  • T1041 — Exfiltration Over C2 Channel
  • T1210 — Exploitation of Remote Services
  • T1486 — Data Encrypted for Impact
  • T1496 — Resource Hijacking
  • T1105 — Ingress Tool Transfer
  • T1588.005 — Exploits
  • T1592 — Gather Victim Host Information
  • T1133 — External Remote Services
  • T1071.004 — DNS
  • T1036.005 — Match Legitimate Resource Name or Location
  • T1499.004 — Application or System Exploitation
  • T1071 — Application Layer Protocol
  • T1036 — Masquerading
  • T1595 — Active Scanning
  • T1090.002 — External Proxy
  • T1090 — Proxy
  • T1059 — Command and Scripting Interpreter
  • T1078 — Valid Accounts
  • T1573 — Encrypted Channel
  • T1592.002 — Software
  • T1203 — Exploitation for Client Execution
  • T1499 — Endpoint Denial of Service
  • T1059.006 — Python
  • T1071.001 — Web Protocols
  • T1046 — Network Service Discovery
  • T1082 — System Information Discovery
  • T1583.003 — Virtual Private Server
  • T1102 — Web Service
  • T1562.001 — Disable or Modify Tools
  • T1070.004 — File Deletion
  • T1021 — Remote Services
  • T1083 — File and Directory Discovery
  • T1136 — Create Account
  • T1018 — Remote System Discovery
  • T1003.003 — NTDS
  • T1021.001 — Remote Desktop Protocol
  • T1567.002 — Exfiltration to Cloud Storage
  • T1587.001 — Malware
  • T1489 — Service Stop
  • T1087.002 — Domain Account
  • T1053.005 — Scheduled Task
  • T1219 — Remote Access Tools
  • T1558.003 — Kerberoasting
  • T1583.001 — Domains
  • T1135 — Network Share Discovery
  • T1059.001 — PowerShell
  • T1588.002 — Tool
  • T1490 — Inhibit System Recovery
  • T1110 — Brute Force
  • T1204.002 — Malicious File
  • T1114.001 — Local Email Collection
  • T1572 — Protocol Tunneling
  • T1021.002 — SMB/Windows Admin Shares
  • T1072 — Software Deployment Tools
  • T1566.001 — Spearphishing Attachment
  • T1070.006 — Timestomp
  • T1074.001 — Local Data Staging
  • T1555.003 — Credentials from Web Browsers
  • T1056.002 — GUI Input Capture
  • T1003.006 — DCSync
  • T1057 — Process Discovery
  • T1591 — Gather Victim Org Information
  • T1056.001 — Keylogging
  • T1555 — Credentials from Password Stores
  • T1132.001 — Standard Encoding
  • T1566.002 — Spearphishing Link
  • T1573.001 — Symmetric Cryptography
  • T1218.011 — Rundll32
  • T1497.001 — System Checks
  • T1539 — Steal Web Session Cookie
  • T1027 — Obfuscated Files or Information
  • T1102.002 — Bidirectional Communication
  • T1140 — Deobfuscate/Decode Files or Information
  • T1055.012 — Process Hollowing
  • T1110.001 — Password Guessing
  • T1087.001 — Local Account
  • T1021.004 — SSH
  • T1040 — Network Sniffing
  • T1567 — Exfiltration Over Web Service
  • T1552 — Unsecured Credentials
  • T1552.004 — Private Keys
  • T1087 — Account Discovery
  • T1087.004 — Cloud Account
🤖 AI Attribution
Generated by gemini-2.5-flash ·
2,763 input / 2,653 output tokens ·
Reviewed and approved by a human analyst before publication
Posted in vulnerabilityTagged high, php, rce, vulnerability, web, webshellLeave a comment

CVE-2026-96656: Plex Media Server Arbitrary File Write Vulnerability Exploited In-The-Wild

Posted on November 3, 2026 by Kyle

Overview

CVE-2026-96656 is a high-severity arbitrary file write vulnerability in Plex Media Server, affecting versions prior to 1.43.3.10861. An authenticated admin user can exploit this to write arbitrary files, which are then executed upon server load. This vulnerability is being actively exploited in conjunction with other Plex vulnerabilities to deploy cryptominers such as XMRig, posing a significant resource hijacking and potential further compromise risk.

Technical Analysis

  • Vulnerability ID: CVE-2026-96656
  • Weakness Enumeration: CWE-73 (External Control of File Name or Path).
  • Affected Products: Plex Media Server before 1.43.3.10861.
  • Attack Vector: An authenticated admin user can manipulate the TranscoderH264Options preference.
  • Exploitation Mechanism: The TranscoderH264Options preference is appended verbatim to x264’s option string during transcoding. This allows an attacker to inject arbitrary data into a file path or name, leading to the creation of arbitrary files.
  • Code Execution: At startup, Plex Media Server loads and executes all .so (shared object) files without signature, execute bit, or symbol checks. By writing a malicious .so file to a directory Plex loads from, an attacker can achieve arbitrary code execution.
  • Chaining: This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96655 to achieve broader impact, such as privilege escalation or bypassing other controls.
  • CVSS 3.1 Score: 7.2 (HIGH) – CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H.

Detection

  • Monitor Plex Media Server log files for unusual TranscoderH264Options modifications or errors related to transcoding that indicate path manipulation attempts.
  • Look for the creation of new or modified .so files in Plex Media Server installation directories, data directories (e.g., C:\ProgramData\Plex Media Server\ on Windows, /var/lib/plexmediaserver/ on Linux), or temporary directories (e.g., C:\Windows\Temp\, /tmp/).
  • Monitor for unexpected child processes spawned by the Plex Media Server executable (e.g., Plex Media Server.exe, Plex Transcoder.exe) or its associated processes. Look for cmd.exe, powershell.exe, sh, bash, python, or known cryptominer executables (e.g., xmrig).
  • Implement network monitoring to detect outbound connections from the Plex Media Server to known cryptomining pools, suspicious IP addresses, or C2 infrastructure.
  • Utilize File Integrity Monitoring (FIM) on critical Plex Media Server directories to detect unauthorized file changes or creations.

Sigma Detection Rules

⚠️ AI-generated detection rules. These are experimental starting points. Review field names, EventIDs, and logic against your environment’s schema before deploying. Tune to reduce false positives.

Plex Media Server Spawning Suspicious Process

title: Plex Media Server Spawning Suspicious Process
id: 9381e4b3-c15b-4b1a-8e2a-1f2d3c4e5f6a
status: experimental
description: Detects suspicious process creation by Plex Media Server, indicative of post-exploitation activity after arbitrary file write.
logsource:
  category: process_creation
  product: windows
  service: sysmon
detection:
  selection:
    ParentImage|endswith:
      - '\Plex Media Server.exe'
      - '\Plex Transcoder.exe'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\sh.exe'
      - '\bash.exe'
      - '\python.exe'
  condition: selection
level: high

Plex Media Server Suspicious Shared Object File Creation

title: Plex Media Server Suspicious Shared Object File Creation
id: 7a2b0c1d-e3f4-5g6h-7i8j-9k0l1m2n3o4p
status: experimental
description: Detects the creation of new .so files in potentially exploitable locations by Plex Media Server, which could indicate arbitrary file write exploitation.
logsource:
  product: windows
  service: sysmon
detection:
  selection:
    EventID: 11
    TargetFilename|endswith: '.so'
    Image|endswith:
      - '\Plex Media Server.exe'
      - '\Plex Transcoder.exe'
    TargetFilename|contains:
      - 'C:\ProgramData\Plex Media Server\'
      - 'C:\Users\Public\'
      - 'C:\Windows\Temp\'
  condition: selection
level: high

XMRig Cryptominer Process Activity

title: XMRig Cryptominer Process Activity
id: 5d6e7f8a-9b0c-1d2e-3f4a-5b6c7d8e9f0a
status: experimental
description: Detects common process creation patterns associated with XMRig cryptominer, often deployed after successful exploitation of vulnerabilities like CVE-2026-96656.
logsource:
  category: process_creation
  product: windows
  service: sysmon
detection:
  selection_img:
    Image|contains:
      - 'xmrig'
      - 'miner'
  selection_cmd:
    CommandLine|contains:
      - '--donate-level'
      - '--url'
      - '--user'
      - '--pass'
      - '-o stratum+tcp://'
      - '-a rx/0'
      - '-k --nicehash'
  condition: 1 of selection_*
level: high

Mitigations

  1. Patch Immediately: Upgrade Plex Media Server to version 1.43.3.10861 or later. Refer to the official Plex release notes for the latest security updates.
  2. Restrict Admin Access: Limit administrative access to Plex Media Server to only trusted and authorized personnel.
  3. Network Segmentation: Isolate Plex Media Server instances on a dedicated network segment to limit lateral movement and impact in case of compromise.
  4. Monitor Outbound Connections: Implement egress filtering on network firewalls to prevent unauthorized outbound connections from the Plex Media Server, particularly to known cryptomining ports or suspicious IP ranges.
  5. Regular Backups: Maintain regular backups of Plex Media Server configurations and data to facilitate recovery from potential compromise.

References

  • https://forums.plex.tv/t/plex-media-server/30447/711
  • https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-266-01.json
  • https://www.cve.org/CVERecord?id=CVE-2026-96656
  • https://zmain.info/blog/plex2shell
  • https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html
  • https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-96656

Indicators of Compromise

Type Value Description
SHA256 2d3c618b21a7e2f8bcd735da188e44a7609ff3f204832dd0781cd09e4388c9db XMRig cryptominer payload (via https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html)
SHA256 50e93e8d8c26bd95d0ba91ba9b7c5c15532050866f52c3aef04f9773b7418767 Unknown malware · confidence 100% · first seen 2026-10-20
SHA256 5712ef510481f15fe8b18fdd10b73026d57cb3d9d151878a692358b99a464441 Cryptominer payload (docker) (via https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html)
SHA256 68938fb428f2bcfef4ede62f7b29cd0f15f37ed59e94462c099f2ca64e36baa7 Cryptominer payload ‘x’ (UPX packed) (via https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html)
SHA256 6915f57c96c880803863d30eefaa5e3fe3923e11c948cb6747c68478d2e6cf40 Unknown malware · confidence 100% · first seen 2026-10-20
SHA256 a580786ff7336e916e92bb79db96d5d6f48119cd3b0b4e45211b47e298be5380 Unknown malware · confidence 100% · first seen 2026-10-20
SHA256 a9a309154493193c70bf6f805fe70e1bc4e9564e2f0e20cd1600c72587c7e65f XMRIG · confidence 95% · first seen 2026-10-18
SHA256 b20f39fc00d242e706b6c30367ad811c676e0575050a4ec2f30104b696944b49 Cryptominer payload ‘x’ (UPX unpacked) (via https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html)
SHA256 cababb6448ee3f2a274f516dc6b0fdc9f47d084a84d7bd164546c9c4b1755d44 Unknown malware · confidence 100% · first seen 2026-10-20
SHA256 e546b10aee5edc754da4f9b0baace00392257121911f630145078eafad1e6bd9 Proxy payload ‘myawesomeproxy’ (via https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html)
SHA256 f083b3647e50fb548c2b97887e51927bc62b429aaa7c4828e316bd5ef6503453 Unknown malware · confidence 100% · first seen 2026-10-20
SHA256 f599491cce46b1d94c762eff392458ae015e7163620b07ad7ceaa16708b1bf4f Unknown malware · confidence 100% · first seen 2026-10-20
IP Address 176.65.139.228 Source IP of exploitation attempts (via https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html)
IP Address 202.78.167.55 Unknown malware · confidence 100% · first seen 2026-10-20
IP Address 217.60.194.116 Source IP for malicious file download (via https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html)
IP Address 45.194.92.222 Source IP of exploitation attempts (via https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html)
IP Address 77.90.185.205 XMRIG · confidence 95% · first seen 2026-10-18
IP Address 91.92.40.202 Source IP of exploitation attempts (via https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html)
Domain 127.0.0.1.45-194-92-222.sslip.io Dynamic DNS domain used in exploitation URI (via https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html)
Domain autoccb.tech Unknown malware · confidence 100% · first seen 2026-10-20
Domain ota.proxystream.st XMRIG · confidence 95% · first seen 2026-10-18
Domain proxystream.st Domain related to proxy service traffic (via https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html)
Domain www.autoccb.tech Unknown malware · confidence 100% · first seen 2026-10-20
URL http://217.60.194.116/docker XMRIG · confidence 95% · first seen 2026-10-18
URL https://www.autoccb.tech/api/v1/poll Unknown malware · confidence 100% · first seen 2026-10-20
URL https://www.autoccb.tech/api/v1/result Unknown malware · confidence 100% · first seen 2026-10-20
URL https://zmain.info/blog/plex2shell Vulnerability research blog detailing the chained exploit (via https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html)

MITRE ATT&CK

  • T1059.001 — PowerShell
  • T1059.003 — Windows Command Shell
  • T1574.002 — DLL Side-Loading
  • T1496 — Resource Hijacking
  • T1036.005 — Match Legitimate Resource Name or Location
  • T1583 — Acquire Infrastructure
  • T1133 — External Remote Services
  • T1204.002 — Malicious File
  • T1071 — Application Layer Protocol
  • T1190 — Exploit Public-Facing Application
  • T1090.002 — External Proxy
  • T1090 — Proxy
  • T1059 — Command and Scripting Interpreter
  • T1583.003 — Virtual Private Server
  • T1204 — User Execution
  • T1571 — Non-Standard Port
  • T1027 — Obfuscated Files or Information
  • T1486 — Data Encrypted for Impact
  • T1573 — Encrypted Channel
  • T1569 — System Services
  • T1027.002 — Software Packing
  • T1071.001 — Web Protocols
  • T1105 — Ingress Tool Transfer
  • T1090.001 — Internal Proxy
🤖 AI Attribution
Generated by gemini-2.5-flash ·
2,236 input / 2,147 output tokens ·
Reviewed and approved by a human analyst before publication
Posted in vulnerabilityTagged arbitrary file write, cryptominer, cwe-73, high, high-severity, media server, plex, remote code execution, vulnerability, xmrigLeave a comment

CVE-2026-106931: EG Secure Solutions SiteGuard Server Edition OS Command Injection

Posted on November 3, 2026 by Kyle

Overview

CVE-2026-106931 identifies an OS command injection vulnerability within EG Secure Solutions SiteGuard Server Edition. This flaw enables a local attacker with low privileges to execute arbitrary operating system commands with elevated root or SYSTEM privileges. The vulnerability is critical due to its potential for full system compromise and is listed in CISA’s Known Exploited Vulnerabilities Catalog.

Technical Analysis

EG Secure Solutions SiteGuard Server Edition is susceptible to an OS command injection vulnerability (CWE-78). A local attacker with low privileges can leverage this flaw to inject and execute arbitrary OS commands. The successful execution of these commands occurs with the privileges of the affected product, which are root or SYSTEM. The CVSS 3.0 score is 7.8 (HIGH), with a vector of CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating a local attack vector requiring low privileges, with high impact on confidentiality, integrity, and availability.

  • Vulnerability Type: OS Command Injection (CWE-78)
  • Affected Product: EG Secure Solutions SiteGuard Server Edition
  • Attack Vector: Local (AV:L)
  • Privileges Required: Low (PR:L)
  • Impact: Arbitrary OS command execution with root or SYSTEM privileges, leading to high impact on confidentiality, integrity, and availability.
  • Affected Versions: Specific affected versions are not detailed in the provided source material, but the vulnerability affects SiteGuard Server Edition.

Detection

Detection efforts should focus on identifying unusual process execution patterns originating from the SiteGuard Server Edition process, particularly the spawning of shell interpreters or system utilities.

  • Monitor process creation events for SiteGuard Server Edition (or its associated executable) spawning suspicious child processes like cmd.exe, powershell.exe, sh, bash, python, perl, or other scripting interpreters.
  • Look for command-line arguments passed to these child processes that indicate system modification, privilege escalation attempts, or data exfiltration.
  • Analyze web server logs (if SiteGuard has a web interface) for unusual or malformed requests that could trigger command injection, especially in parameters known to be processed by the application.
  • Review system logs for unexpected changes to critical system files, user accounts, or service configurations that might follow successful exploitation.

Sigma Detection Rules

⚠️ AI-generated detection rules. These are experimental starting points. Review field names, EventIDs, and logic against your environment’s schema before deploying. Tune to reduce false positives.

SiteGuard Server Edition Spawning Windows Shell

title: SiteGuard Server Edition Spawning Windows Shell
id: 934d6731-a1b2-4c3e-8d5f-e2f0a1b2c3d4
status: experimental
description: Detects SiteGuard Server Edition spawning cmd.exe or powershell.exe, indicative of OS command injection exploitation.
logsource:
  product: windows
  service: sysmon
detection:
  selection:
    EventID: 1
    ParentImage|contains: 'SiteGuard'
    Image|endswith:
      - '\\cmd.exe'
      - '\\powershell.exe'
  condition: selection
level: high

SiteGuard Server Edition Spawning Linux Shell

title: SiteGuard Server Edition Spawning Linux Shell
id: 5e6f7a8b-c9d0-1e2f-3a4b-5c6d7e8f9a0b
status: experimental
description: Detects SiteGuard Server Edition spawning common Linux shells, indicative of OS command injection exploitation.
logsource:
  product: linux
  service: auditd
detection:
  selection:
    type: 'EXECVE'
    a0|contains: 'SiteGuard'
    a1|endswith:
      - '/bin/sh'
      - '/bin/bash'
      - '/bin/dash'
      - '/bin/zsh'
  condition: selection
level: high

Mitigations

  1. Patch Immediately: Apply all available security updates and patches from EG Secure Solutions for SiteGuard Server Edition. Refer to the vendor’s security advisories for specific patch information.
  2. Least Privilege: Ensure that the SiteGuard Server Edition service runs with the absolute minimum necessary privileges. If possible, restrict its ability to spawn new processes or execute arbitrary commands.
  3. Network Segmentation: Isolate systems running SiteGuard Server Edition on a dedicated network segment to limit potential lateral movement if compromised.
  4. Endpoint Detection and Response (EDR): Deploy and configure EDR solutions to monitor for and block suspicious process creation and command execution originating from the SiteGuard Server Edition process.
  5. Input Validation: While a vendor fix is paramount, ensure that any custom integrations or scripts interacting with SiteGuard Server Edition implement robust input validation to prevent similar injection flaws.

References

  • https://nvd.nist.gov/vuln/detail/CVE-2026-106931
  • https://jvn.jp/en/jp/JVN88474777/
  • https://www.eg-secure.co.jp/siteguard/news/alert-202610-1
  • https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-106931
  • https://ltna.com.au/cyber

Indicators of Compromise

No public IOCs available at time of writing.

MITRE ATT&CK

  • T1059 — Command and Scripting Interpreter
  • T1059.003 — Windows Command Shell
  • T1059.004 — Unix Shell
🤖 AI Attribution
Generated by gemini-2.5-flash ·
1,901 input / 1,513 output tokens ·
Reviewed and approved by a human analyst before publication
Posted in vulnerabilityTagged cisa_kev, command_injection, high, privilege_escalation, siteguard, vulnerabilityLeave a comment

CVE-2026-21589: Atlassian Data Center Arbitrary File Read Vulnerability

Posted on October 17, 2026 by Kyle

Overview

CVE-2026-21589 is an arbitrary file access vulnerability impacting multiple Atlassian Data Center products, including Bitbucket, Confluence, Jira Software, Jira Service Management, Bamboo, Crowd, Crucible, and Fisheye. This flaw allows an unauthenticated attacker to read specific files from the web application root directory. Given reports of active exploitation, immediate patching is critical for affected organizations.

Technical Analysis

  • Vulnerability: CWE-552 (Files or Directories Accessible to External Parties). An unauthenticated attacker can access specific files within the web application root directory.
  • Affected Products & Versions:
    • Bitbucket Data Center: introduced in >= 4.6.0, vulnerable up to < 9.4.26, < 10.2.8, < 10.5.1
    • Confluence Data Center: introduced in >= 5.10.0, vulnerable up to < 9.2.26, < 10.2.19
    • Crowd Data Center: introduced in >= 2.11.0, vulnerable up to < 6.3.7, < 7.0.3, < 7.1.7, < 7.2.4
    • Jira Software Data Center: introduced in >= 7.1.0, vulnerable up to < 9.12.40, < 10.3.26, < 11.3.12
    • Jira Service Management Data Center: introduced in >= 3.1.0, vulnerable up to < 5.12.40, < 10.3.26, < 11.3.12
    • Bamboo Data Center: introduced in >= 7.0.1, vulnerable up to < 10.2.24, < 12.1.12
    • Crucible: vulnerable up to < 4.9.15
    • Fisheye: vulnerable up to < 4.9.15
  • Attack Vector: Network (AV:N). Exploitation is remote and unauthenticated (PR:N).
  • Prerequisites: The attacker must have prior knowledge of the exact filename and path of the target file. The vulnerability does not allow directory enumeration.
  • Impact: Confidentiality (C:H). Successful exploitation can lead to the disclosure of sensitive files, potentially including configuration files, credentials, or other proprietary data. Integrity and Availability are not directly impacted (I:N, A:N).
  • CVSS v3.1 Score: 7.5 (High) – CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.

Detection

  • Web Server Access Logs: Monitor web server access logs (e.g., Apache, Nginx, IIS) for GET requests to known sensitive files or file types within the Atlassian application’s web root that are not typically served publicly.
    • Look for requests to configuration files such as dbconfig.xml, atlassian-user.xml, server.xml, web.xml, setenv.sh, setenv.bat, application.properties, application.yml.
    • Look for requests to backup files (.bak, .zip, .sql) or log files (.log, catalina.out, .env) directly within the web application root or common subdirectories.
    • Analyze sc-status codes for successful (200) or unusual (e.g., 403, 404 for files that should exist but not be accessible) access attempts to these paths.
  • Network Intrusion Detection Systems (NIDS): Deploy NIDS rules to identify HTTP GET requests targeting specific sensitive file paths associated with Atlassian products.

Sigma Detection Rules

⚠️ AI-generated detection rules. These are experimental starting points. Review field names, EventIDs, and logic against your environment’s schema before deploying. Tune to reduce false positives.

Atlassian Data Center – Suspicious Configuration File Access (CVE-2026-21589)

title: Atlassian Data Center - Suspicious Configuration File Access (CVE-2026-21589)
id: 75751911-c918-4a6c-9418-866415779496
status: experimental
description: Detects unauthenticated attempts to access sensitive Atlassian or Java web application configuration files via CVE-2026-21589.
logsource:
  category: webserver
detection:
  selection:
    cs-method: 'GET'
    cs-uri-stem|endswith:
      - 'dbconfig.xml'
      - 'atlassian-user.xml'
      - 'server.xml'
      - 'web.xml'
      - 'setenv.sh'
      - 'setenv.bat'
      - 'application.properties'
      - 'application.yml'
      - 'config.xml'
      - 'settings.xml'
  condition: selection
level: high

Atlassian Data Center – Suspicious Log or Backup File Access (CVE-2026-21589)

title: Atlassian Data Center - Suspicious Log or Backup File Access (CVE-2026-21589)
id: 02d44e54-4f0e-4a11-8c4b-149d6837895e
status: experimental
description: Detects unauthenticated attempts to access sensitive log, backup, or environment files within the web application root via CVE-2026-21589.
logsource:
  category: webserver
detection:
  selection:
    cs-method: 'GET'
    cs-uri-stem|endswith:
      - '.log'
      - '.bak'
      - '.zip'
      - '.sql'
      - '.env'
      - 'catalina.out'
  condition: selection
level: medium

Mitigations

  1. Patch Immediately: Apply the latest security patches for all affected Atlassian Data Center products. Refer to the Atlassian advisories linked in the references for specific fix versions.
    • Bitbucket Data Center: Upgrade to 9.4.26, 10.2.8, 10.5.1 or later.
    • Confluence Data Center: Upgrade to 9.2.26, 10.2.19 or later.
    • Crowd Data Center: Upgrade to 6.3.7, 7.0.3, 7.1.7, 7.2.4 or later.
    • Jira Software Data Center: Upgrade to 9.12.40, 10.3.26, 11.3.12 or later.
    • Jira Service Management Data Center: Upgrade to 5.12.40, 10.3.26, 11.3.12 or later.
    • Bamboo Data Center: Upgrade to 10.2.24, 12.1.12 or later.
    • Crucible: Upgrade to 4.9.15 or later.
    • Fisheye: Upgrade to 4.9.15 or later.
  2. Restrict File Access: Ensure proper file system permissions are in place, limiting read access to sensitive configuration and data files to only the necessary service accounts.
  3. Network Segmentation: Isolate Atlassian Data Center instances from direct internet exposure where possible, placing them behind reverse proxies or web application firewalls (WAFs) that can filter suspicious requests.
  4. Monitor Logs: Continuously monitor web server and application logs for suspicious access patterns to sensitive files.

References

  • https://nvd.nist.gov/vuln/detail/CVE-2026-21589
  • https://jira.atlassian.com/browse/BAM-26567
  • https://jira.atlassian.com/browse/BSERV-20604
  • https://jira.atlassian.com/browse/CONFSERVER-104488
  • https://jira.atlassian.com/browse/CRUC-8741
  • https://jira.atlassian.com/browse/CWD-6610
  • https://jira.atlassian.com/browse/FE-7583
  • https://jira.atlassian.com/browse/JRASERVER-79546
  • https://jira.atlassian.com/browse/JSDSERVER-16809
  • https://www.securityweek.com/attackers-target-critical-atlassian-vulnerability-within-hours-of-poc-publication/
  • https://previdian.com/CVE-2026-21589
  • https://labs.watchtowr.com/you-wont-hear-about-these-even-in-myths-atlassian-jira-confluence-and-more-pre-auth-arbitrary-file-read-cve-2026-21589/
  • https://thehackernews.com/2026/10/atlassian-data-center-flaw-draws.html
  • https://github.com/watchtowrlabs/watchTowr-vs-Atlassian-CVE-2026-21589
  • https://www.bleepingcomputer.com/news/security/hackers-exploit-critical-atlassian-flaw-after-public-poc-release/

Indicators of Compromise

No public IOCs available at time of writing.

MITRE ATT&CK

  • T1190 — Exploit Public-Facing Application
  • T1083 — File and Directory Discovery
  • T1552.001 — Credentials In Files
🤖 AI Attribution
Generated by gemini-2.5-flash ·
3,117 input / 2,588 output tokens ·
Reviewed and approved by a human analyst before publication
Posted in vulnerabilityTagged active-exploitation, arbitrary-file-read, atlassian, cve, data-center, high, pre-auth, vulnerabilityLeave a comment

CVE-2026-105133: AhsayCBS Improper Authentication Vulnerability Exploited

Posted on October 17, 2026 by Kyle

Overview

CVE-2026-105133 is an improper authentication vulnerability in Ahsay AhsayCBS versions up to 10.3.2. This flaw allows remote attackers to bypass authentication via manipulation of a specific API parameter. The vulnerability is actively exploited in the wild, often chained with CVE-2026-105134, leading to post-exploitation activities such as webshell deployment and cryptominer installation.

Technical Analysis

  • Vulnerability: Improper Authentication (CWE-287).
  • Affected Software: Ahsay AhsayCBS up to version 10.3.2.
  • Affected Component: API component, specifically the checkSysPwd function within com/ahsay/obs/api/ApiStructsAction.java.
  • Attack Vector: Remote attackers can manipulate the random argument during API calls to bypass authentication.
  • CVSS 3.1 Score: 7.3 (HIGH) – CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. This indicates a network-based attack, low attack complexity, no privileges required, no user interaction, and low impact on confidentiality, integrity, and availability.
  • Exploitation: The exploit is public and actively used. It can be chained with CVE-2026-105134 for further compromise.
  • Observed Post-Exploitation: Deployment of webshells and XMRig cryptominer.

Detection

  • Monitor web server access logs for suspicious requests to the /obs/api/ApiStructsAction.java endpoint, particularly those manipulating the random parameter or exhibiting unusual authentication patterns (e.g., failed authentication followed by immediate success without valid credentials).
  • Look for unexpected file creations or modifications in web root directories, indicative of webshell deployment (e.g., .jsp, .php, .aspx files).
  • Monitor for new, unauthorized processes, especially those related to cryptomining (e.g., xmrig.exe, miner.exe) or unusual command-line executions originating from the AhsayCBS process.
  • Detect outbound network connections from AhsayCBS servers to known cryptomining pools or unusual C2 infrastructure.
  • Monitor for sustained high CPU utilization on AhsayCBS servers, which could indicate cryptomining activity.

Sigma Detection Rules

⚠️ AI-generated detection rules. These are experimental starting points. Review field names, EventIDs, and logic against your environment’s schema before deploying. Tune to reduce false positives.

AhsayCBS API Improper Authentication Attempt

title: AhsayCBS API Improper Authentication Attempt
id: 902b7194-c71b-4d2a-a22a-1c3906a1a123
status: experimental
description: Detects suspicious access patterns to the AhsayCBS API endpoint related to CVE-2026-105133.
logsource:
  category: webserver
detection:
  selection:
    cs-uri-stem|contains: '/obs/api/ApiStructsAction.java'
  condition: selection
level: medium

AhsayCBS Webshell Deployment in Web Root

title: AhsayCBS Webshell Deployment in Web Root
id: 7e7f8e1d-c3d9-4b1a-8b0c-0a1b2c3d4e5f
status: experimental
description: Detects creation of suspicious files (potential webshells) in the AhsayCBS web application directory.
logsource:
  product: windows
  service: sysmon
detection:
  selection:
    EventID: 11
    TargetFilename|contains|all:
      - '\AhsayCBS\webapps\obs\'
    TargetFilename|endswith:
      - '.jsp'
      - '.aspx'
      - '.php'
  condition: selection
level: high

XMRig Cryptominer Process Execution

title: XMRig Cryptominer Process Execution
id: 1a2b3c4d-5e6f-7a8b-9c0d-e1f2a3b4c5d6
status: experimental
description: Detects common process names or command-line arguments associated with XMRig cryptominer activity.
logsource:
  product: windows
  service: sysmon
detection:
  selection_image:
    EventID: 1
    Image|contains:
      - 'xmrig'
      - 'miner'
  selection_cmdline:
    EventID: 1
    CommandLine|contains|all:
      - '--donate-level'
      - '-o'
  condition: 1 of selection_*
level: critical

Mitigations

  1. Upgrade Ahsay AhsayCBS to version 10.3.4 or later immediately.
  2. Implement network segmentation to restrict access to AhsayCBS servers from untrusted networks.
  3. Deploy a Web Application Firewall (WAF) to detect and block suspicious API requests and webshell uploads.
  4. Regularly audit AhsayCBS server logs for signs of compromise, including unauthorized file changes and process execution.
  5. Ensure endpoint detection and response (EDR) solutions are deployed and configured to detect cryptomining activity and suspicious process behavior.

References

  • https://nvd.nist.gov/vuln/detail/CVE-2026-105133
  • https://vuldb.com/cve/CVE-2026-105133
  • https://vuldb.com/submit/942688
  • https://vuldb.com/vuln/413350
  • https://vuldb.com/vuln/413350/cti
  • https://www.ahsay.com/en/support/help-centre/release-notes/cbs/v10.3.4
  • https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-105133
  • https://www.huntress.com/blog/ahsaycbs-flaws-exploit
  • https://ltna.com.au/cyber

Indicators of Compromise

Type Value Description
SHA256 05f69ae6b2b89c1c4dcf836bff032232f11bf0109f2b498e2345045d06139034 Modified NSSM utility (msedge.exe) (via https://www.huntress.com/blog/ahsaycbs-flaws-exploit)
SHA256 481728a7c9c4c02be07051d9c1958d902ea6397ebb8952ab83944818e3d25d21 Powershell script (Taskgmr.ps1) (via https://www.huntress.com/blog/ahsaycbs-flaws-exploit)
SHA256 4dcb0202fe8b2d4d7b183764e38184cd6ed50132786cc7e7d1f7f4bce1dd6f3d XMRig miner (edge.exe) (via https://www.huntress.com/blog/ahsaycbs-flaws-exploit)
IP Address 51.195.127.124 XMR cryptomining pool IP address (via https://www.huntress.com/blog/ahsaycbs-flaws-exploit)
Domain imagefiles-backup.oss-ap-southeast-7.aliyuncs.com Payload hosting domain (Alibaba Cloud Object Storage) (via https://www.huntress.com/blog/ahsaycbs-flaws-exploit)
Domain xmr.kryptex.network XMR cryptomining pool domain (via https://www.huntress.com/blog/ahsaycbs-flaws-exploit)
URL http://imagefiles-backup.oss-ap-southeast-7.aliyuncs.com Payload hosting server for various files (Taskgmr.ps1, msedge.exe, edge.exe, config.json, WinRing0x64.sys) (via https://www.huntress.com/blog/ahsaycbs-flaws-exploit)

MITRE ATT&CK

  • T1190 — Exploit Public-Facing Application
  • T1078 — Valid Accounts
  • T1505.003 — Web Shell
  • T1496 — Resource Hijacking
  • T1036.005 — Match Legitimate Resource Name or Location
  • T1564 — Hide Artifacts
  • T1543.003 — Windows Service
  • T1608.001 — Upload Malware
  • T1036.004 — Masquerade Task or Service
  • T1057 — Process Discovery
  • T1059.001 — PowerShell
  • T1571 — Non-Standard Port
  • T1059.003 — Windows Command Shell
  • T1071.001 — Web Protocols
  • T1105 — Ingress Tool Transfer
  • T1569.002 — Service Execution
  • T1124 — System Time Discovery
🤖 AI Attribution
Generated by gemini-2.5-flash ·
2,120 input / 1,803 output tokens ·
Reviewed and approved by a human analyst before publication
Posted in vulnerabilityTagged ahsaycbs, cryptomining, high, improper authentication, known_exploited, vulnerability, webshell, xmrigLeave a comment

Posts navigation

Older posts
Proudly powered by WordPress | Theme: micro, developed by DevriX.