CVE-2026-19907: CRITICAL (CVSS 9.8) auth bypass in Shipo WP plugin v1.6 – 1.8.0. Unauthenticated attackers can impersonate admins & gain full site control. Disable affected versions ASAP. More: https://radar.offseq.com/threat/cve-2026-19907-cwe-287-improper-authentication-in-shipo-shipo-924d020ff101b91a #OffSeq #WordPress #CVE202619907 #Infosec

CVE-2026-19907: CRITICAL (CVSS 9.8) auth bypass in Shipo WP plugin v1.6 – 1.8.0. Unauthenticated attackers can impersonate admins & gain full site control. Disable affected versions ASAP. More: https://radar.offseq.com/threat/cve-2026-19907-cwe-287-improper-authentication-in-shipo-shipo-924d020ff101b91a #OffSeq #WordPress #CVE202619907 #Infosec

CRITICAL: CVE-2026-129250 affects Edimax BR6478ACV2 v1.23 – buffer overflow in formPPTPSetup enables RCE/DoS. No patch, public exploit out. Isolate device, restrict access, monitor closely. https://radar.offseq.com/threat/cve-2026-129250-buffer-overflow-in-edimax-br6478acv2-88525ec07286374a #OffSeq #CVE2026129250 #Infosec #RouterVuln

CRITICAL: CVE-2026-129250 affects Edimax BR6478ACV2 v1.23 – buffer overflow in formPPTPSetup enables RCE/DoS. No patch, public exploit out. Isolate device, restrict access, monitor closely. https://radar.offseq.com/threat/cve-2026-129250-buffer-overflow-in-edimax-br6478acv2-88525ec07286374a #OffSeq #CVE2026129250 #Infosec #RouterVuln

CVE-2026-118182: HIGH severity auth flaw in Duplicate Post WordPress plugin <1.5.8. With slug takeover enabled, users with plugin access can hijack permalinks & replace content. Patch to 1.5.8+ ASAP. https://radar.offseq.com/threat/the-duplicate-post-wordpress-plugin-before-158-does-not-check-that-a-user-duplicating-a-post-is-3d9a3cf265683150 #OffSeq #WordPress #Vuln #Security

CVE-2026-118182: HIGH severity auth flaw in Duplicate Post WordPress plugin <1.5.8. With slug takeover enabled, users with plugin access can hijack permalinks & replace content. Patch to 1.5.8+ ASAP. https://radar.offseq.com/threat/the-duplicate-post-wordpress-plugin-before-158-does-not-check-that-a-user-duplicating-a-post-is-3d9a3cf265683150 #OffSeq #WordPress #Vuln #Security

AutomatorWP Pro plugin (≤1.4.4) suffers a CRITICAL auth bypass (CVE-2026-126173). Unauth attackers can reset any WP user password and take over accounts if webhooks are misconfigured. Restrict webhook setups now. https://radar.offseq.com/threat/the-automatorwp-pro-plugin-for-wordpress-webhook-addon-is-vulnerable-to-authorization-bypass-in-all-347402ba31c0e215 #OffSeq #WordPress #CVE2026_126173 #Security

CVE-2026-126173 – AutomatorWP Webhooks (≤1.4.4) has a CRITICAL auth bypass (CVSS 9.8). Attackers can reset any WordPress user password, including admins, if certain webhook configs are used. Patch now! https://radar.offseq.com/threat/cve-2026-126173-cwe-862-missing-authorization-in-automatorwp-automatorwp-webhooks-b9427035b1b20d72 #OffSeq #WordPress #Vuln #Security

AutomatorWP Pro plugin (≤1.4.4) suffers a CRITICAL auth bypass (CVE-2026-126173). Unauth attackers can reset any WP user password and take over accounts if webhooks are misconfigured. Restrict webhook setups now. https://radar.offseq.com/threat/the-automatorwp-pro-plugin-for-wordpress-webhook-addon-is-vulnerable-to-authorization-bypass-in-all-347402ba31c0e215 #OffSeq #WordPress #CVE2026_126173 #Security

CVE-2026-126173 – AutomatorWP Webhooks (≤1.4.4) has a CRITICAL auth bypass (CVSS 9.8). Attackers can reset any WordPress user password, including admins, if certain webhook configs are used. Patch now! https://radar.offseq.com/threat/cve-2026-126173-cwe-862-missing-authorization-in-automatorwp-automatorwp-webhooks-b9427035b1b20d72 #OffSeq #WordPress #Vuln #Security

📰 Check Point Zero-Day Exploited to Gain Root Access, Deploy Wiper

Actively exploited Check Point zero-day (CVE-2026-123039) allows root access on security gateways. Attackers are pivoting to VMware ESXi hosts to deploy destructive wiper malware. CISA added to KEV. Patch now! #CyberSecurity #ThreatIntel #CVE

🔗 https://cyber.netsecops.io/articles/check-point-zero-day-cve-2026-123039-exploited-to-deploy-wiper/?utm_source=mastodon&utm_medium=social&utm_campaign=daily

Check Point: CVE-2026-123039 (escalation a root via DynamicCLI) sfruttata contro "un paio di dozzine" di clienti (vendor). In CISA KEV dal 13/11, scadenza 16/11.

Catena (Check Point Research): ingresso dal portale Mobile Access con PHP2Shell, poi root sul gateway, webshell e backdoor; in alcuni casi wiper su ESXi.

Fix: Jumbo Hotfix R82.20 Take 14, R82.10 Take 52, R82 Take 132, R81.20 Take 174. Senza patch: fermare dynamic_server.

https://support.checkpoint.com/results/sk/sk1000362

#CheckPoint #infosec

🟠 New security advisory:

CVE-2026-123039 affects multiple systems.

• Impact: Significant security breach potential
• Risk: Unauthorized access or data exposure
• Mitigation: Apply patches within 24-48 hours

Full breakdown:
https://www.yazoul.net/advisory/cve/cve-2026-123039-gaia-os-root-escalation-exploited-in-wild-poc/?utm_source=mastodon&utm_medium=social

by Yazoul AI

#CVE #PatchNow #InfoSecCommunity

----------------

🎯 Threat Intelligence: PHP2Shell Exploitation on Check Point Gateways
===================

Check Point Research reports scanning and exploitation against unpatched Security Gateways beginning on October 30, 2026. In one investigated intrusion, attackers used vulnerable Mobile Access portals for initial access, escalated to root and subsequently reached a VMware ESXi host where a wiper was deployed.

The first wave targeted Israeli organizations and included destructive activity against some victims. A second wave on November 2 targeted organizations in multiple countries and sectors, including some previously targeted in Israel. The researchers found no evidence of destructive activity in that second wave.

🔹 Attack Chain Analysis

🎣 Initial Access: Activity consistent with PHP2Shell targeted Mobile Access portals. The report associates PHP2Shell with CVE-2026-109618 and CVE-2026-109619. The first observed activity originated from 130.94.19[.]204, approximately one week after a security fix became available.

🛡️ Privilege Escalation: In the investigated intrusion, the attacker moved from the portal service account to root through CVE-2026-123039, a local privilege-escalation vulnerability in the DynamicCLI IPC interface.

🦠 Persistence: Privileged command execution was used to deploy PHP webshells and the persistent TSGA backdoor. TSGA includes the TSProxy networking component.

🎯 Lateral Movement: The attacker pivoted from the gateway to a VMware ESXi host over SSH.

🔒 Destruction: The attacker deployed the destroy_v6 wiper and left politically themed DREAM_ANNEXATION.txt notes.

🔹 Artifacts and detection context

The report describes PHP session artifacts under /opt/CPcvpn-R81.20/tmp/, including files containing the upload_progress_pwn marker. Apache/PHP workers on the affected portal also experienced hundreds of segmentation faults during the exploitation window. These observations are associated with the reported activity; the provided excerpt does not establish that either artifact is unique to this campaign.

The source names the PHP webshells, TSGA, TSProxy, destroy_v6 and the note file as additional artifacts. It does not provide hashes, detection rules or complete network indicators in the supplied text.

🔹 Malware relationship and attribution

TSGA and TSProxy are modified variants of PhiliKit, a framework previously documented in attacks exploiting Ivanti vulnerabilities. Check Point reports shared code, configuration and cryptographic material. ESET previously associated PhiliKit with China-nexus UNC5221, but the researchers do not attribute this complete operation with high confidence.

Several explanations remain possible: the identified actor ran the campaign, acted only as an initial access broker, or was involved in a false-flag operation. The destructive activity might also have served as a smoke screen. The note uses the Dream Security brand; its timing relative to Dream's earlier PHP2Shell research does not establish retaliation as a motive.

🔹 Mitigation and references

The report says a security fix was available approximately one week before the initial activity. The supplied excerpt does not specify patch versions or provide a complete remediation procedure.

Reference: Check Point Research, “PHP2Shell Exploitation on Check Point Gateway,” November 12, 2026. Relevant identifiers: CVE-2026-109618, CVE-2026-109619 and CVE-2026-123039.

🔹 PHP2Shell #CheckPoint #TSGA #PhiliKit

🔗 Source: https://research.checkpoint.com/2026/php2shell-exploitation-on-check-point-gateway/

----------------

🎯 Threat Intelligence: PHP2Shell Exploitation on Check Point Gateways
===================

Check Point Research reports scanning and exploitation against unpatched Security Gateways beginning on October 30, 2026. In one investigated intrusion, attackers used vulnerable Mobile Access portals for initial access, escalated to root and subsequently reached a VMware ESXi host where a wiper was deployed.

The first wave targeted Israeli organizations and included destructive activity against some victims. A second wave on November 2 targeted organizations in multiple countries and sectors, including some previously targeted in Israel. The researchers found no evidence of destructive activity in that second wave.

🔹 Attack Chain Analysis

🎣 Initial Access: Activity consistent with PHP2Shell targeted Mobile Access portals. The report associates PHP2Shell with CVE-2026-109618 and CVE-2026-109619. The first observed activity originated from 130.94.19[.]204, approximately one week after a security fix became available.

🛡️ Privilege Escalation: In the investigated intrusion, the attacker moved from the portal service account to root through CVE-2026-123039, a local privilege-escalation vulnerability in the DynamicCLI IPC interface.

🦠 Persistence: Privileged command execution was used to deploy PHP webshells and the persistent TSGA backdoor. TSGA includes the TSProxy networking component.

🎯 Lateral Movement: The attacker pivoted from the gateway to a VMware ESXi host over SSH.

🔒 Destruction: The attacker deployed the destroy_v6 wiper and left politically themed DREAM_ANNEXATION.txt notes.

🔹 Artifacts and detection context

The report describes PHP session artifacts under /opt/CPcvpn-R81.20/tmp/, including files containing the upload_progress_pwn marker. Apache/PHP workers on the affected portal also experienced hundreds of segmentation faults during the exploitation window. These observations are associated with the reported activity; the provided excerpt does not establish that either artifact is unique to this campaign.

The source names the PHP webshells, TSGA, TSProxy, destroy_v6 and the note file as additional artifacts. It does not provide hashes, detection rules or complete network indicators in the supplied text.

🔹 Malware relationship and attribution

TSGA and TSProxy are modified variants of PhiliKit, a framework previously documented in attacks exploiting Ivanti vulnerabilities. Check Point reports shared code, configuration and cryptographic material. ESET previously associated PhiliKit with China-nexus UNC5221, but the researchers do not attribute this complete operation with high confidence.

Several explanations remain possible: the identified actor ran the campaign, acted only as an initial access broker, or was involved in a false-flag operation. The destructive activity might also have served as a smoke screen. The note uses the Dream Security brand; its timing relative to Dream's earlier PHP2Shell research does not establish retaliation as a motive.

🔹 Mitigation and references

The report says a security fix was available approximately one week before the initial activity. The supplied excerpt does not specify patch versions or provide a complete remediation procedure.

Reference: Check Point Research, “PHP2Shell Exploitation on Check Point Gateway,” November 12, 2026. Relevant identifiers: CVE-2026-109618, CVE-2026-109619 and CVE-2026-123039.

🔹 PHP2Shell #CheckPoint #TSGA #PhiliKit

🔗 Source: https://research.checkpoint.com/2026/php2shell-exploitation-on-check-point-gateway/

📢 Apache corrige une RCE critique dans HTTP Server (CVE-2026-119618) découverte par Anthropic et Google

⚠️ Vulnérabilité principale : CVE-2026-119618 Type : Race condition dans le module modhttp2 Versions affectées : Apache HTTP Server 2.4.55 à 2.4.70 Score CVSS : 9.8 (attribué par Red Hat) Impact : Exécution de code arbitraire à distance (RCE) sans…

📖 cyberveille : https://cyberveille.ch/posts/2026-11-13-apache-corrige-une-rce-critique-dans-http-server-cve-2026-119618-decouverte-par-anthropic-et-google/
🌐 source : https://www.securityweek.com/apache-patches-critical-http-server-rce-found-by-anthropic-google
🟢 vérification factuelle haute
#RCE #ApacheHTTPServer #Cyberveille

📰 CISA Warns of Actively Exploited Critical Flaw in UnrealIRCd

CISA adds critical UnrealIRCd flaw (CVE-2026-114713) to KEV catalog. The command injection bug allows server-level command execution and is actively exploited. Update to version 6.2.7.1 immediately. #CVE #UnrealIRCd #ThreatIntel

🔗 https://cyber.netsecops.io/articles/cisa-warns-of-actively-exploited-unrealircd-flaw-cve-2026-114713/?utm_source=mastodon&utm_medium=social&utm_campaign=daily

Exploiters Target UnrealIRCd Servers with High-Severity Flaw

UnrealIRCd servers are under attack by exploiters who are taking advantage of a high-severity flaw, CVE-2026-114713, that allows them to inject malicious commands with server-level privileges. The vulnerability has a CVSS score of 8.6 and can be exploited by any user on a network with linked servers.

https://osintsights.com/exploiters-target-unrealircd-servers-with-high-severity-flaw?utm_source=mastodon&utm_medium=social

#Unrealircd #Cve2026114713 #CommandInjection #ServerVulnerability #Exploit

CISA added a high-severity security flaw impacting UnrealIRCd to its Known Exploited Vulnerabilities catalog following reports of active exploitation.

Tracked as CVE-2026-114713 with a CVSS score of 8.6, the vulnerability involves improper neutralization allowing arbitrary command execution.

Affected versions include UnrealIRCd 6.0.0 through 6.2.7.0 due to issues in the labeled-response module.

Project leader Bram Ma…

https://en.hacks.gr/sovaro-keno-asfaleias-sto-unrealircd-mpainei-sto-stochastro-epitheseon/

#UnrealIRCd #CISA #CVE_2026_114713 #Vulnerability

CVE-2026-129180: HIGH severity SQL injection in projectworlds Visitor Management System 1.0 via 'purpose' param in actionpage.php. Remote, unauthenticated exploit possible. Public exploit code exists. Mitigate with WAF/input validation. https://radar.offseq.com/threat/a-flaw-has-been-found-in-projectworlds-visitor-management-system-10-cve-2026-129180-577e82a8f129c3fb #OffSeq #SQLi #infosec

CVE-2026-129180: HIGH severity SQL injection in projectworlds Visitor Management System 1.0 via 'purpose' param in actionpage.php. Remote, unauthenticated exploit possible. Public exploit code exists. Mitigate with WAF/input validation. https://radar.offseq.com/threat/a-flaw-has-been-found-in-projectworlds-visitor-management-system-10-cve-2026-129180-577e82a8f129c3fb #OffSeq #SQLi #infosec

CVE-2026-110331 (HIGH, CVSS 7.8) in Red Hat Enterprise Linux 6 abrt: Local users can bypass incomplete checks & seize dump directories, risking data and DoS. Mitigate by disabling ABRT or restricting access. Details: https://radar.offseq.com/threat/cve-2026-110331-missing-authorization-in-red-hat-red-hat-enterprise-linux-6-e45f0af4f45b79d0 #OffSeq #Linux #Vuln #RedHat

CVE-2026-110331 (HIGH, CVSS 7.8) in Red Hat Enterprise Linux 6 abrt: Local users can bypass incomplete checks & seize dump directories, risking data and DoS. Mitigate by disabling ABRT or restricting access. Details: https://radar.offseq.com/threat/cve-2026-110331-missing-authorization-in-red-hat-red-hat-enterprise-linux-6-e45f0af4f45b79d0 #OffSeq #Linux #Vuln #RedHat

🟠 CVE-2026-71531 - High (8.1)

PrestaShop before 8.2.9 and 9.2.1 contains an authorization flaw in the Webservice API that allows an attacker holding a key restricted to one shop to act on data of every shop by submitting requests with id_shop=all or id_shop_group=N, which expa...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-71531/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-71531 - High (8.1)

PrestaShop before 8.2.9 and 9.2.1 contains an authorization flaw in the Webservice API that allows an attacker holding a key restricted to one shop to act on data of every shop by submitting requests with id_shop=all or id_shop_group=N, which expa...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-71531/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-71519 - High (8.1)

PrestaShop before 8.2.9 and 9.2.1 contains a broken access control vulnerability that allows an authenticated Webservice API key holder to read and modify customer records belonging to any shop in a multi-shop installation. Attackers can exploit t...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-71519/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-71519 - High (8.1)

PrestaShop before 8.2.9 and 9.2.1 contains a broken access control vulnerability that allows an authenticated Webservice API key holder to read and modify customer records belonging to any shop in a multi-shop installation. Attackers can exploit t...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-71519/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 Critical Red Hat Quay Vulnerability (CVE-2026-123710 | CVSS 9.8)

An unauthenticated authorization bypass in the /keys endpoint lets attackers upload rogue signing keys and hijack private container repositories.

https://denizhalil.com/2026/11/14/red-hat-quay-cve-2026-123710-vulnerability-analysis/

#CyberSecurity #InfoSec #RedHat

PLANET Technology fixed two PLANET GS-5220-8P2T2S vulnerabilities, CVE-2026-109445 and CVE-2026-2336, in firmware v3.2412b261022. Update switches now.

#PLANETTechnology #GS52208P2T2S #CVE2026109445 #CVE20262336 #BufferOverflow #Cybersecurity

https://securityonline.info/planet-gs-5220-8p2t2s-vulnerabilities/?utm_source=mastodon&utm_medium=jetpack_social

PLANET Technology fixed two PLANET GS-5220-8P2T2S vulnerabilities, CVE-2026-109445 and CVE-2026-2336, in firmware v3.2412b261022. Update switches now.

#PLANETTechnology #GS52208P2T2S #CVE2026109445 #CVE20262336 #BufferOverflow #Cybersecurity

https://securityonline.info/planet-gs-5220-8p2t2s-vulnerabilities/?utm_source=mastodon&utm_medium=jetpack_social

🐧 SIGINT // Ubuntu Watch — 2026-11-14

A 9.8 CVSS in the kernel TCP stack (CVE-2026-98432) hits Ubuntu and RHEL, so anything with an exposed listener is in scope. Patch and reboot, or live-patch, and check your kernel versions. Treat nftables mitigations as a stopgap, not a fix.

🔗 https://thehackernews.com/2026/10/linux-kernel-tcp-flaw-with-98-cvss.html

#Ubuntu #Linux #infosec

🚨 A critical MISP Modules authorization flaw can let unauthenticated attackers modify external tool configurations; CVE-2026-127016

PoC: https://github.com/fumioryoto/CVE-2026-127016

The vulnerability affects the MISP Modules website component, where external tool management endpoints fail to enforce the configured administrator authentication policy.

An unauthenticated attacker with network access can add or remove tools, toggle their status, and modify settings including API keys and ingestion URLs.

MISP Modules | Missing Authorization:

• CVSS: 9.2 Critical
• Affected: MISP Modules ≤ 3.1.4
• Attack: Remote, unauthenticated
• Impact: External tool configuration tampering, API key changes, ingestion URL modification
• CWE: CWE-862 Missing Authorization

The issue only applies when ADMIN_PASSWORD is configured; installations without an admin password intentionally allow open management access.

🚨 A critical MISP Modules authorization flaw can let unauthenticated attackers modify external tool configurations; CVE-2026-127016

PoC: https://github.com/fumioryoto/CVE-2026-127016

The vulnerability affects the MISP Modules website component, where external tool management endpoints fail to enforce the configured administrator authentication policy.

An unauthenticated attacker with network access can add or remove tools, toggle their status, and modify settings including API keys and ingestion URLs.

MISP Modules | Missing Authorization:

• CVSS: 9.2 Critical
• Affected: MISP Modules ≤ 3.1.4
• Attack: Remote, unauthenticated
• Impact: External tool configuration tampering, API key changes, ingestion URL modification
• CWE: CWE-862 Missing Authorization

The issue only applies when ADMIN_PASSWORD is configured; installations without an admin password intentionally allow open management access.

CVE-2026-91203: symlink race in Cockpit Files lets local attackers redirect privileged chown/chmod to arbitrary files. CVSS 6, no patch yet. Audit your exposure before deploying. #CVE #infosec #cybersecurity https://www.valtersit.com/cve/CVE-2026-91203/

CVE-2026-124194: Outlook NTLM Zero-Day Explained

https://thecybersecguru.com/news/cve-2026-124194-outlook-ntlm-zero-day/

New in the known-exploited catalogue: CVE-2026-124194 in 365_apps. Exploited in the wild — the only phrase in this field that still means exactly what it says.

Patch the edge appliance. It is always the edge appliance.

#KEV #vulnerability

CVE-2026-124194: Outlook NTLM Zero-Day Explained

https://thecybersecguru.com/news/cve-2026-124194-outlook-ntlm-zero-day/

🔵 THREAT INTELLIGENCE

Exploit Attempts for GPUStack Authentication Bypass (CVE-2026-102895), (Thu, Nov 12th)

Vulnerability | CRITICAL
CVEs: CVE-2026-102895

CVE-2026-102895 is a trivial authentication-bypass vulnerability. GPUStack is also an attractive target. It is open-source software that manages...

Full analysis:
https://www.yazoul.net/news/article/exploit-attempts-for-gpustack-authentication-bypass-cve-2026-102895-thu-nov-12th/?utm_source=mastodon&utm_medium=social

by Yazoul AI

#CyberSecurity #APT #CyberNews

CVE-2026-93574: Netty netty-codec-http chunk-size parsing flaw enables HTTP request smuggling, letting attackers bypass controls or reach unauthorized resources in proxy/backend setups. CVSS 6.5. https://www.valtersit.com/cve/CVE-2026-93574/

Siemens Building Automation and Energy Products Vulnerable to Critical PHP Flaws

Siemens reported that several building automation and energy products are affected by two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, which allow unauthenticated remote code execution.

**If you use Siemens Energy Engage or Spectrum Power products, update to the latest versions or apply the recommended PHP patches right away to prevent remote code execution. And always make sure to isolate the affected systems behind a firewall and restrict all unnecessary network access.**
#cybersecurity #infosec #attack #activeexploit
https://beyondmachines.net/event_details/siemens-building-automation-and-energy-products-vulnerable-to-critical-php-flaws-3-u-m-h-y/gD2P6Ple2L

----------------

🎯 Threat Intelligence: PHP2Shell Exploitation on Check Point Gateways
===================

Check Point Research reports scanning and exploitation against unpatched Security Gateways beginning on October 30, 2026. In one investigated intrusion, attackers used vulnerable Mobile Access portals for initial access, escalated to root and subsequently reached a VMware ESXi host where a wiper was deployed.

The first wave targeted Israeli organizations and included destructive activity against some victims. A second wave on November 2 targeted organizations in multiple countries and sectors, including some previously targeted in Israel. The researchers found no evidence of destructive activity in that second wave.

🔹 Attack Chain Analysis

🎣 Initial Access: Activity consistent with PHP2Shell targeted Mobile Access portals. The report associates PHP2Shell with CVE-2026-109618 and CVE-2026-109619. The first observed activity originated from 130.94.19[.]204, approximately one week after a security fix became available.

🛡️ Privilege Escalation: In the investigated intrusion, the attacker moved from the portal service account to root through CVE-2026-123039, a local privilege-escalation vulnerability in the DynamicCLI IPC interface.

🦠 Persistence: Privileged command execution was used to deploy PHP webshells and the persistent TSGA backdoor. TSGA includes the TSProxy networking component.

🎯 Lateral Movement: The attacker pivoted from the gateway to a VMware ESXi host over SSH.

🔒 Destruction: The attacker deployed the destroy_v6 wiper and left politically themed DREAM_ANNEXATION.txt notes.

🔹 Artifacts and detection context

The report describes PHP session artifacts under /opt/CPcvpn-R81.20/tmp/, including files containing the upload_progress_pwn marker. Apache/PHP workers on the affected portal also experienced hundreds of segmentation faults during the exploitation window. These observations are associated with the reported activity; the provided excerpt does not establish that either artifact is unique to this campaign.

The source names the PHP webshells, TSGA, TSProxy, destroy_v6 and the note file as additional artifacts. It does not provide hashes, detection rules or complete network indicators in the supplied text.

🔹 Malware relationship and attribution

TSGA and TSProxy are modified variants of PhiliKit, a framework previously documented in attacks exploiting Ivanti vulnerabilities. Check Point reports shared code, configuration and cryptographic material. ESET previously associated PhiliKit with China-nexus UNC5221, but the researchers do not attribute this complete operation with high confidence.

Several explanations remain possible: the identified actor ran the campaign, acted only as an initial access broker, or was involved in a false-flag operation. The destructive activity might also have served as a smoke screen. The note uses the Dream Security brand; its timing relative to Dream's earlier PHP2Shell research does not establish retaliation as a motive.

🔹 Mitigation and references

The report says a security fix was available approximately one week before the initial activity. The supplied excerpt does not specify patch versions or provide a complete remediation procedure.

Reference: Check Point Research, “PHP2Shell Exploitation on Check Point Gateway,” November 12, 2026. Relevant identifiers: CVE-2026-109618, CVE-2026-109619 and CVE-2026-123039.

🔹 PHP2Shell #CheckPoint #TSGA #PhiliKit

🔗 Source: https://research.checkpoint.com/2026/php2shell-exploitation-on-check-point-gateway/

Siemens Building Automation and Energy Products Vulnerable to Critical PHP Flaws

Siemens reported that several building automation and energy products are affected by two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, which allow unauthenticated remote code execution.

**If you use Siemens Energy Engage or Spectrum Power products, update to the latest versions or apply the recommended PHP patches right away to prevent remote code execution. And always make sure to isolate the affected systems behind a firewall and restrict all unnecessary network access.**
#cybersecurity #infosec #attack #activeexploit
https://beyondmachines.net/event_details/siemens-building-automation-and-energy-products-vulnerable-to-critical-php-flaws-3-u-m-h-y/gD2P6Ple2L

----------------

🎯 Threat Intelligence: PHP2Shell Exploitation on Check Point Gateways
===================

Check Point Research reports scanning and exploitation against unpatched Security Gateways beginning on October 30, 2026. In one investigated intrusion, attackers used vulnerable Mobile Access portals for initial access, escalated to root and subsequently reached a VMware ESXi host where a wiper was deployed.

The first wave targeted Israeli organizations and included destructive activity against some victims. A second wave on November 2 targeted organizations in multiple countries and sectors, including some previously targeted in Israel. The researchers found no evidence of destructive activity in that second wave.

🔹 Attack Chain Analysis

🎣 Initial Access: Activity consistent with PHP2Shell targeted Mobile Access portals. The report associates PHP2Shell with CVE-2026-109618 and CVE-2026-109619. The first observed activity originated from 130.94.19[.]204, approximately one week after a security fix became available.

🛡️ Privilege Escalation: In the investigated intrusion, the attacker moved from the portal service account to root through CVE-2026-123039, a local privilege-escalation vulnerability in the DynamicCLI IPC interface.

🦠 Persistence: Privileged command execution was used to deploy PHP webshells and the persistent TSGA backdoor. TSGA includes the TSProxy networking component.

🎯 Lateral Movement: The attacker pivoted from the gateway to a VMware ESXi host over SSH.

🔒 Destruction: The attacker deployed the destroy_v6 wiper and left politically themed DREAM_ANNEXATION.txt notes.

🔹 Artifacts and detection context

The report describes PHP session artifacts under /opt/CPcvpn-R81.20/tmp/, including files containing the upload_progress_pwn marker. Apache/PHP workers on the affected portal also experienced hundreds of segmentation faults during the exploitation window. These observations are associated with the reported activity; the provided excerpt does not establish that either artifact is unique to this campaign.

The source names the PHP webshells, TSGA, TSProxy, destroy_v6 and the note file as additional artifacts. It does not provide hashes, detection rules or complete network indicators in the supplied text.

🔹 Malware relationship and attribution

TSGA and TSProxy are modified variants of PhiliKit, a framework previously documented in attacks exploiting Ivanti vulnerabilities. Check Point reports shared code, configuration and cryptographic material. ESET previously associated PhiliKit with China-nexus UNC5221, but the researchers do not attribute this complete operation with high confidence.

Several explanations remain possible: the identified actor ran the campaign, acted only as an initial access broker, or was involved in a false-flag operation. The destructive activity might also have served as a smoke screen. The note uses the Dream Security brand; its timing relative to Dream's earlier PHP2Shell research does not establish retaliation as a motive.

🔹 Mitigation and references

The report says a security fix was available approximately one week before the initial activity. The supplied excerpt does not specify patch versions or provide a complete remediation procedure.

Reference: Check Point Research, “PHP2Shell Exploitation on Check Point Gateway,” November 12, 2026. Relevant identifiers: CVE-2026-109618, CVE-2026-109619 and CVE-2026-123039.

🔹 PHP2Shell #CheckPoint #TSGA #PhiliKit

🔗 Source: https://research.checkpoint.com/2026/php2shell-exploitation-on-check-point-gateway/

Siemens Building Automation and Energy Products Vulnerable to Critical PHP Flaws

Siemens reported that several building automation and energy products are affected by two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, which allow unauthenticated remote code execution.

**If you use Siemens Energy Engage or Spectrum Power products, update to the latest versions or apply the recommended PHP patches right away to prevent remote code execution. And always make sure to isolate the affected systems behind a firewall and restrict all unnecessary network access.**
#cybersecurity #infosec #attack #activeexploit
https://beyondmachines.net/event_details/siemens-building-automation-and-energy-products-vulnerable-to-critical-php-flaws-3-u-m-h-y/gD2P6Ple2L

----------------

🎯 Threat Intelligence: PHP2Shell Exploitation on Check Point Gateways
===================

Check Point Research reports scanning and exploitation against unpatched Security Gateways beginning on October 30, 2026. In one investigated intrusion, attackers used vulnerable Mobile Access portals for initial access, escalated to root and subsequently reached a VMware ESXi host where a wiper was deployed.

The first wave targeted Israeli organizations and included destructive activity against some victims. A second wave on November 2 targeted organizations in multiple countries and sectors, including some previously targeted in Israel. The researchers found no evidence of destructive activity in that second wave.

🔹 Attack Chain Analysis

🎣 Initial Access: Activity consistent with PHP2Shell targeted Mobile Access portals. The report associates PHP2Shell with CVE-2026-109618 and CVE-2026-109619. The first observed activity originated from 130.94.19[.]204, approximately one week after a security fix became available.

🛡️ Privilege Escalation: In the investigated intrusion, the attacker moved from the portal service account to root through CVE-2026-123039, a local privilege-escalation vulnerability in the DynamicCLI IPC interface.

🦠 Persistence: Privileged command execution was used to deploy PHP webshells and the persistent TSGA backdoor. TSGA includes the TSProxy networking component.

🎯 Lateral Movement: The attacker pivoted from the gateway to a VMware ESXi host over SSH.

🔒 Destruction: The attacker deployed the destroy_v6 wiper and left politically themed DREAM_ANNEXATION.txt notes.

🔹 Artifacts and detection context

The report describes PHP session artifacts under /opt/CPcvpn-R81.20/tmp/, including files containing the upload_progress_pwn marker. Apache/PHP workers on the affected portal also experienced hundreds of segmentation faults during the exploitation window. These observations are associated with the reported activity; the provided excerpt does not establish that either artifact is unique to this campaign.

The source names the PHP webshells, TSGA, TSProxy, destroy_v6 and the note file as additional artifacts. It does not provide hashes, detection rules or complete network indicators in the supplied text.

🔹 Malware relationship and attribution

TSGA and TSProxy are modified variants of PhiliKit, a framework previously documented in attacks exploiting Ivanti vulnerabilities. Check Point reports shared code, configuration and cryptographic material. ESET previously associated PhiliKit with China-nexus UNC5221, but the researchers do not attribute this complete operation with high confidence.

Several explanations remain possible: the identified actor ran the campaign, acted only as an initial access broker, or was involved in a false-flag operation. The destructive activity might also have served as a smoke screen. The note uses the Dream Security brand; its timing relative to Dream's earlier PHP2Shell research does not establish retaliation as a motive.

🔹 Mitigation and references

The report says a security fix was available approximately one week before the initial activity. The supplied excerpt does not specify patch versions or provide a complete remediation procedure.

Reference: Check Point Research, “PHP2Shell Exploitation on Check Point Gateway,” November 12, 2026. Relevant identifiers: CVE-2026-109618, CVE-2026-109619 and CVE-2026-123039.

🔹 PHP2Shell #CheckPoint #TSGA #PhiliKit

🔗 Source: https://research.checkpoint.com/2026/php2shell-exploitation-on-check-point-gateway/

Siemens Building Automation and Energy Products Vulnerable to Critical PHP Flaws

Siemens reported that several building automation and energy products are affected by two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, which allow unauthenticated remote code execution.

**If you use Siemens Energy Engage or Spectrum Power products, update to the latest versions or apply the recommended PHP patches right away to prevent remote code execution. And always make sure to isolate the affected systems behind a firewall and restrict all unnecessary network access.**
#cybersecurity #infosec #attack #activeexploit
https://beyondmachines.net/event_details/siemens-building-automation-and-energy-products-vulnerable-to-critical-php-flaws-3-u-m-h-y/gD2P6Ple2L

----------------

🎯 Threat Intelligence: PHP2Shell Exploitation on Check Point Gateways
===================

Check Point Research reports scanning and exploitation against unpatched Security Gateways beginning on October 30, 2026. In one investigated intrusion, attackers used vulnerable Mobile Access portals for initial access, escalated to root and subsequently reached a VMware ESXi host where a wiper was deployed.

The first wave targeted Israeli organizations and included destructive activity against some victims. A second wave on November 2 targeted organizations in multiple countries and sectors, including some previously targeted in Israel. The researchers found no evidence of destructive activity in that second wave.

🔹 Attack Chain Analysis

🎣 Initial Access: Activity consistent with PHP2Shell targeted Mobile Access portals. The report associates PHP2Shell with CVE-2026-109618 and CVE-2026-109619. The first observed activity originated from 130.94.19[.]204, approximately one week after a security fix became available.

🛡️ Privilege Escalation: In the investigated intrusion, the attacker moved from the portal service account to root through CVE-2026-123039, a local privilege-escalation vulnerability in the DynamicCLI IPC interface.

🦠 Persistence: Privileged command execution was used to deploy PHP webshells and the persistent TSGA backdoor. TSGA includes the TSProxy networking component.

🎯 Lateral Movement: The attacker pivoted from the gateway to a VMware ESXi host over SSH.

🔒 Destruction: The attacker deployed the destroy_v6 wiper and left politically themed DREAM_ANNEXATION.txt notes.

🔹 Artifacts and detection context

The report describes PHP session artifacts under /opt/CPcvpn-R81.20/tmp/, including files containing the upload_progress_pwn marker. Apache/PHP workers on the affected portal also experienced hundreds of segmentation faults during the exploitation window. These observations are associated with the reported activity; the provided excerpt does not establish that either artifact is unique to this campaign.

The source names the PHP webshells, TSGA, TSProxy, destroy_v6 and the note file as additional artifacts. It does not provide hashes, detection rules or complete network indicators in the supplied text.

🔹 Malware relationship and attribution

TSGA and TSProxy are modified variants of PhiliKit, a framework previously documented in attacks exploiting Ivanti vulnerabilities. Check Point reports shared code, configuration and cryptographic material. ESET previously associated PhiliKit with China-nexus UNC5221, but the researchers do not attribute this complete operation with high confidence.

Several explanations remain possible: the identified actor ran the campaign, acted only as an initial access broker, or was involved in a false-flag operation. The destructive activity might also have served as a smoke screen. The note uses the Dream Security brand; its timing relative to Dream's earlier PHP2Shell research does not establish retaliation as a motive.

🔹 Mitigation and references

The report says a security fix was available approximately one week before the initial activity. The supplied excerpt does not specify patch versions or provide a complete remediation procedure.

Reference: Check Point Research, “PHP2Shell Exploitation on Check Point Gateway,” November 12, 2026. Relevant identifiers: CVE-2026-109618, CVE-2026-109619 and CVE-2026-123039.

🔹 PHP2Shell #CheckPoint #TSGA #PhiliKit

🔗 Source: https://research.checkpoint.com/2026/php2shell-exploitation-on-check-point-gateway/

🚨 EUVD-2026-125778

📊 Score: 7.8/10 (CVSS v3.1)
📅 Updated: 2026-11-13

📝 A flaw was found in abrt. The completeness check introduced to mitigate CVE-2026-54228 and CVE-2026-54229 only verifies that a dump directory contains a "count" element, which an unprivileged user can create. This allows a local attacker to bypass the guard and again poison elements in, or se...

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-125778

#cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-125778

📊 Score: 7.8/10 (CVSS v3.1)
📅 Updated: 2026-11-13

📝 A flaw was found in abrt. The completeness check introduced to mitigate CVE-2026-54228 and CVE-2026-54229 only verifies that a dump directory contains a "count" element, which an unprivileged user can create. This allows a local attacker to bypass the guard and again poison elements in, or se...

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-125778

#cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-125778

📊 Score: 7.8/10 (CVSS v3.1)
📅 Updated: 2026-11-13

📝 A flaw was found in abrt. The completeness check introduced to mitigate CVE-2026-54228 and CVE-2026-54229 only verifies that a dump directory contains a "count" element, which an unprivileged user can create. This allows a local attacker to bypass the guard and again poison elements in, or se...

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-125778

#cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-125778

📊 Score: 7.8/10 (CVSS v3.1)
📅 Updated: 2026-11-13

📝 A flaw was found in abrt. The completeness check introduced to mitigate CVE-2026-54228 and CVE-2026-54229 only verifies that a dump directory contains a "count" element, which an unprivileged user can create. This allows a local attacker to bypass the guard and again poison elements in, or se...

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-125778

#cybersecurity #infosec #euvd #cve #vulnerability

CVE-2026-74985: HIGH severity privilege escalation in Microsoft Enterprise Policies v4.0 🛡️ No patch or active exploitation reported. Review MSRC for updates and monitor permissions. https://radar.offseq.com/threat/privilege-escalation-in-the-enterprise-policies-component-5ed155f1bb128f0f #OffSeq #Microsoft #Vuln #PrivilegeEscalation

CVE-2026-74985: HIGH severity privilege escalation in Microsoft Enterprise Policies v4.0 🛡️ No patch or active exploitation reported. Review MSRC for updates and monitor permissions. https://radar.offseq.com/threat/privilege-escalation-in-the-enterprise-policies-component-5ed155f1bb128f0f #OffSeq #Microsoft #Vuln #PrivilegeEscalation

📢 Triple zero-day Ivanti Connect Secure : chaîne d'exploitation CVE-2026-104935/111357/118527

Cet article analyse une chaîne d'exploitation triple zero-day affectant Ivanti Connect Secure (ICS), un appliance SSL VPN largement déployé en périphérie de réseau. L'exploitation active a été confirmée dès le 3 octobre 2026, avant la…

📖 cyberveille : https://cyberveille.ch/posts/2026-11-11-triple-zero-day-ivanti-connect-secure-chaine-d-exploitation-cve-2026-104935-111357-118527/
🌐 source : https://www.criminalip.io/knowledge-hub/blog/38984#mtm_campaign=Weekly-CIP-Newsletter
🟡 vérification factuelle moyenne
#IvantiConnectSecure #ChaîneDExploitation #Cyberveille

CVE-2026-77528 Autobahn Python: decompression bomb bypasses maxMessagePayloadSize, letting unauthenticated clients blow past message limits. CVSS 5.3. Patch still under review, so pin and monitor. #CVE #infosec #cybersecurity https://www.valtersit.com/cve/CVE-2026-77528/

CVE-2026-61670 microsandbox CVSS 6.5: secrets leak via process command lines, enabling code execution. Patch under review; update to 0.5.10 now. #CVE #infosec #cybersecurity https://www.valtersit.com/cve/CVE-2026-61670/

CVE-2026-76899 CordysCRM 1.7.0-1.7.4 SQLi via SortRequest.name allows authenticated users to inject DB functions into ORDER BY (CVSS 5.7). Patch still under review, so restrict access to MODULE_SETTING_UPDATE now. #CVE #infosec #cybersecurity https://www.valtersit.com/cve/CVE-2026-76899/

CVE-2026-71537 Paymenter: concurrent downgrade race lets authenticated customers inflate credit via unsynced increment, CVSS 6.5. No patch released yet, track review and update immediately. #CVE #infosec #cybersecurity https://www.valtersit.com/cve/CVE-2026-71537/

CVE-2026-61822 pg_partman <5.5.0: a partman_user can poison part_config so run_maintenance() aborts early, blocking all later partition sets. CVSS 6.5. Patch under review, restrict partman_user access now. #CVE #infosec #PostgreSQL https://www.valtersit.com/cve/CVE-2026-61822/

CVE-2026-93869: Open redirect in Cotonti 1.0.0 via regex missing an end-of-string anchor in cot_url_check(), letting attackers bypass the redirect guard to phishing hosts. CVSS 6.1, no patch known. Update immediately. #CVE #infosec #cybersecurity https://www.valtersit.com/cve/CVE-2026-93869/

CVE-2026-11710: IBM WebSphere 8.5 HTTP request smuggling via Content-Length header mishandling. CVSS 6.5, no patch yet. Check your exposure and apply mitigations. #CVE #infosec #IBM https://www.valtersit.com/cve/CVE-2026-11710/

CVE-2026-11711: insecure deserialization in IBM WebSphere 9.0/8.5 Name Service, CVSS 6.5, unpatched. Restrict exposure and watch for a fix. #CVE #infosec #IBM https://www.valtersit.com/cve/CVE-2026-11711/

CVE-2026-17262: IBM i 7.3-7.6 local attacker can trigger denial of service via improper FTP auth command validation. CVSS 5.4, no patch confirmed yet. Check your exposure and apply fixes as soon as available. #CVE #infosec #IBM https://www.valtersit.com/cve/CVE-2026-17262/

CVE-2026-7848: SQL injection in Alior Bank's PrestaShop raty module, CVSS 7.2, unpatched. Update immediately. #CVE #infosec #PrestaShop https://www.valtersit.com/cve/CVE-2026-7848/

CVE-2026-4103: stored XSS in Publisher and Developer Portal via insufficient HTML sanitization, letting malicious JavaScript run in the browser when API docs are viewed. CVSS 6.4, patch status unknown. Treat as unpatched and update immediately. https://www.valtersit.com/cve/CVE-2026-4103/

CVE-2026-15600: SQL injection in Alior Bank's PrestaShop "raty" module (toggleCategoryPromotionAction) lets backoffice users run arbitrary SQL. CVSS 8.1, patch status unknown - update immediately. #CVE #infosec #PrestaShop https://www.valtersit.com/cve/CVE-2026-15600/

SCKit abuses ScreenConnect to deploy remote access and target technician sessions

1. ScreenConnect architecture and attack surfaces
2. Attack chain overview
3. Mitigation and protection guidance
4. Indicators of compromise and supporting artifacts
5. References
6. Learn More

Beginning on November 11, 2026, ConnectWise reported an active campaign of a threat actor gaining unauthorized access to cloud-hosted ConnectWise ScreenConnect instances belonging to managed service providers (MSPs). Microsoft Threat Intelligence has confirmed ConnectWise’s reported activity and we have also observed threat actors abusing ScreenConnect, a legitimate remote-support application, to install unauthorized remote-access clients and deploy a malicious worm, SCKit, on ConnectWise customer managed endpoints.

Additionally, Microsoft analyzed the malicious worm’s behavior: deployment starts with commands issued through ScreenConnect to silently install an identical client connected to threat actor-controlled infrastructure. A batch launcher retrieves a PowerShell decoder that decrypts and extracts SCKit using device-specific key material. The toolkit establishes persistence through scheduled tasks and registry Run entries and deploys RelayTrap, a component designed to deliver a malicious payload to a connecting technician.

We have identified that the worm targets IT support technician workstations using the hijacked authenticated ScreenConnect Session and uses the victim’s management console to distribute payloads to other managed devices. The resulting access to either target enables threat actors to remotely administer affected endpoints, execute commands, and deploy further tools independently of the legitimate support instance.

Defenders should investigate technician workstations and downstream affected endpoints. Removing an unauthorized client alone does not remove the toolkit’s persistence or invalidate exposed web sessions. In this blog, we examine SCKit’s attack chain and payload components and provide mitigation guidance, indicators of compromise, and Microsoft Defender XDR advanced hunting queries to help organizations identify and disrupt this activity.

ScreenConnect, formerly ConnectWise Control, is a remote-support and access platform used by MSPs to administer customer devices, often alongside remote monitoring and management (RMM) software. Its operating model has three parts:

• Management instance. A cloud-hosted or on-premises ScreenConnect server provides the web console and manages sessions. Its relay service carries communication between the technician and endpoint clients.
• Technician workstation. Support staff sign in to the console through a browser and launch a local host client for interactive support.
• Customer endpoint. An installed guest, or access, client maintains unattended access and executes commands delivered through ScreenConnect.

An Access session provides persistent, unattended access through the installed client. A Support session is a temporary connection that an end user joins for assistance. ScreenConnect also supports remote commands from the web console without an interactive technician session. The endpoint client receives the command and runs it on the customer device; the technician workstation is not an intermediary for that execution.

Extensions are add-ons installed on the ScreenConnect server to add features or integrate with other products, including ticketing and RMM tools. ConnectWise Automate was formerly named LabTech; Labtech Plus is a third-party extension, not the Automate product itself. The RMM+ extension family exposes remote-command APIs protected by a separately configured passphrase rather than the technician’s normal console sign-in.

ConnectWise’s advisory describes a reported authentication flaw in RMM+ versions 1.0.31 and 1.0.32: when no access key was configured, the extension accepted an empty key. In that configuration, an unauthorized caller could submit commands to the server’s API for delivery to managed endpoints without a normal ScreenConnect user sign-in. ConnectWise is investigating extension abuse as an initial-access route; the entry method for the reported campaign remains under investigation.

SCKit is a malware toolkit that includes RelayTrap, a malicious replacement for the ScreenConnect client on an affected customer endpoint. RelayTrap is designed to deliver a payload to a technician’s workstation when they connect for support. ConnectWise states that the fix for CVE-2026-84869 blocks the toolkit’s attempted endpoint-to-technician spread. This client-side attack path is separate from the server-side access used to deploy SCKit.

The deployment sequence below runs on the customer endpoint. It establishes a separate remote-access connection and prepares the scripts and RelayTrap component that target a later technician

The threat actor uses the MSP’s ScreenConnect management instance to direct the installed endpoint client to start cmd.exe. That local process invokes curl.exe to download an MSI over HTTP from an attacker-controlled ScreenConnect server. The command requests /Bin/ScreenConnect.ClientSetup.msi with access-session parameters and a c=Exploited<N> marker (c=Exploited9 in the illustrated command), and saves the installer to C:\Windows\Temp\sc.msi.

Windows Installer then installs the package silently on that endpoint, without restarting it, using /i, /qn, and /norestart. The added client connects to an attacker-controlled ScreenConnect instance, creating a remote-access channel separate from the MSP’s approved instance. Securing access to the legitimate console does not remove this additional client or its connection.

Further commands on the customer endpoint stage the toolkit. A PowerShell command decodes a URL-safe Base64 string and writes the result to a batch file in Windows Temp. The batch sets BATPATH to its own location, downloads the decoder from ns[.]mo7sen[.]dev/EadF.php?p=4, and starts it with -Mode full.

The decoder reads BATPATH, or falls back to SCKIT_SELF, to locate the launcher. Its hidden-relaunch branch creates a VBScript wrapper and runs it through wscript.exe to start the same batch without a visible window.

The scripts use the following p values at the same server path to request individual components:

The decoder reads MachineGuid from HKLM\SOFTWARE\Microsoft\Cryptography and includes it as the m request parameter. The response provides a Base64-encoded body and two headers, X-Lab-Half and X-Lab-Salt.

To derive the decryption key, the decoder hashes the UTF-8 machine identifier with SHA-256, XORs that hash with 32 bytes decoded from X-Lab-Half, and appends the machine-identifier bytes to the recovered secret material. PBKDF2-HMAC-SHA256 then derives a 32-byte key using the response salt and 4,096 iterations.

The decoder uses the first 16 bytes of the decoded response body as the initialization vector (IV). It decrypts the remaining bytes using AES-256-CBC with PKCS7 padding, decompresses the plaintext with GZip, and writes the resulting ZIP archive. The archive is then extracted to %TEMP%\SCKitBundle.

In full mode, the decoder prepares %TEMP%\SCKit\trapkit\payload and stages the watcher, installer, alert script, and RelayTrap.cs. It also copies its batch launcher into the payload directory for RelayTrap to distribute. The copied launcher retrieves the decoder and starts toolkit deployment.

The decoder also stages ToolboxRelayUploader.exe for console-based payload distribution and retrieves sqlite3.exe for browser-cookie queries if a suitable copy is absent. It includes two launch paths: full mode starts the distribution script without a separate configuration file and supplies a local script path; the other path stages a helper and lab-context.json and passes -SkipLocalExecution.

Alongside the bundle decoder, SCKit includes a separate loader for encrypted PowerShell scripts. Unlike the decoder, which retrieves and expands an archive, this component requests a script using p=1 with the machine identifier. It applies the same secret-recovery, PBKDF2, AES-CBC, and GZip operations, but uses a salt embedded in its source rather than one supplied in a response header.

After decompression, the loader converts the bytes to UTF-8 text and writes %TEMP%\k<32-hex>.ps1, using a newly generated random GUID for the filename. It starts a hidden PowerShell process to run the file with the forwarded arguments, then attempts to remove the script after the child process exits.

On the customer endpoint, persistence keeps the toolkit available for a later support connection. The deployment places scripts under C:\ProgramData\RelayTrap. The RelayTrapLiteAlert value in the machine-wide CurrentVersion\Run key launches an alert script at user logon. A scheduled task starts the watcher with a payload filename and lists of client identifiers and relay hosts to exclude. The -PollSeconds 10 argument configures the watcher to poll every 10 seconds.

The watcher enumerates ScreenConnect client services and reads their executable paths and connection parameters. For each client, its build routine creates a directory under trapbins, copies libraries from that client’s installation, and uses the .NET C# compiler to build RelayTrap.exe. It checks for changes to the source or client libraries before rebuilding.

RelayTrap is designed to reuse the customer endpoint’s ScreenConnect connection details in place of its normal client. When a technician connects with a vulnerable host client, RelayTrap attempts to deliver the staged batch launcher through that session. The launcher retrieves the same decoder, extending the toolkit’s deployment design from the customer device to the technician workstation. Configured skip lists exclude specified client identifiers and relay hosts from processing.

ScreenConnect services are also configured for automatic startup. Registry writes target Microsoft Defender Antivirus path exclusions for staged MSI copies and CWInstall_…\Installer.ps1. The installer configuration lists sc[.]payproofkit[.]com and cdn007-digitaldownloads[.]com as additional ScreenConnect MSI sources. A subsequent curl.exe command downloads another client installer from sc[.]payproofkit[.]com.

SCKit also targets the technician’s browser, which is used to sign in to the management console. The browser-access code searches Chrome, Edge, Opera, and Opera GX profiles for cookies named .ASPXAUTH. Its database route identifies associated hosts and queries encrypted cookie values. It copies cookie databases and their supporting files, with a volume-shadow-copy fallback for locked databases. The decryption code uses the Chromium master key and the Windows Data Protection API (DPAPI) in the current user’s context, with AES-GCM routines for v10 and v11 cookie values.

The memory-scanning route first examines browser network-service processes identified by network.mojom.NetworkService in their command lines. An embedded C# scanner uses OpenProcess, VirtualQueryEx, and ReadProcessMemory to inspect readable committed memory regions for cookie strings and nearby host strings. If the initial scan finds no candidates, it scans other browser processes.

The console-distribution component is designed to combine an authentication cookie with the required anti-forgery and access tokens, enumerate accessible sessions, upload a payload using ToolboxRelayUploader.exe, and queue execution through the Shared Toolbox. The workflow also includes removing the uploaded Toolbox item after distribution.

This component targets the technician’s management-console access, rather than only the original customer device. The account’s permissions determine which additional sessions and devices the distribution workflow can reach.

The toolkit’s cleanup script places a stop marker in the trap directory. It removes trap-related tasks, services, processes, Run entries, and files, and restores ScreenConnect client services unless client removal was requested. It then removes any remaining stop marker to allow a newly deployed watcher to run.

After running the cleanup script, the decoder’s cleanup mode starts the bundled dropper again unless -NoReArm is set. Cleanup therefore also serves as a path to redeploy the toolkit.

Address the server-side extension APIs and technician clients separately. Extension authentication and client-side file transfer are different attack surfaces; securing one does not remove the other or an existing endpoint installation.

• Keep the identified extensions disabled. Follow the vendor advisory for Labtech Plus, RMM Plus, RMM+, RMM Plus Password Link, and RMM+ Password Link. Review their installation and configuration history alongside administrative access.
• Update technician clients separately from the console. ConnectWise states that ScreenConnect client 26.6.5 and later block the toolkit’s attempted endpoint-to-technician transfer technique. The fix for CVE-2026-84869 was released on September 8, 2026. Verify each technician client’s installed version; a cloud-console update does not automatically update those clients. The vendor bulletin also describes temporary file-transfer restrictions while updates are pending.

• Investigate through a separate channel. Use Microsoft Defender for Endpoint live response or another approved out-of-band method instead of ScreenConnect on a suspected affected device. Isolate affected endpoints and include connecting technician workstations in scope.
• Preserve console and endpoint evidence. Retain extension, authentication, Run Command, and Toolbox records together with process, file, task, and registry history. Review Toolbox history for tools removed after use, and inspect queued commands and tools before reconnecting devices.
• Revoke exposed sessions from a clean device. Invalidate affected ScreenConnect web sessions and associated identity-provider sessions, rotate exposed credentials, and review accounts and permissions. Password changes alone do not address every existing session.
• Remove persistence and unapproved clients. Validate each client’s enrolled instance and relay destination before removing it. Remove malicious tasks, Run values, trap files, and unauthorized exclusions through approved response tooling. Do not use a cleanup script recovered from the kit as a remediation tool.
• Verify the complete state before restoring connectivity. Confirm approved services and destinations, effective antivirus settings, and the absence of re-created tasks or scripts. Review tamper-protection events when investigating exclusion changes. Rebuild devices when integrity cannot be established.

Keep Microsoft Defender Antivirus, cloud-delivered protection, and tamper protection enabled. Verify that devices meet the requirements for protecting antivirus exclusions. Maintain an inventory of authorized remote-management instances and use application control to restrict unapproved software.

Microsoft Defender XDR customers can use the following Microsoft Defender for Endpoint alert titles to investigate activity associated with this threat. Review related alerts together with device timelines and ScreenConnect audit records to trace command execution, persistence, browser-data access, and network connections.

Microsoft Defender XDR customers can use the following threat analytics report to get the latest intelligence on SCKit and the abuse of ScreenConnect, including protection status, affected assets, and recommended actions for their environment.

Customers can access the threat analytics report: SCKit abuses ScreenConnect to deploy remote access and target technician sessions

Customers can also access recommended controls and guidance on Secure Now.

Each query below runs independently and uses a 14-day lookback. Adjust the time range to the investigation window and available retention, and correlate results with approved administrative activity.

Connections to campaign infrastructure

Find connections to the listed domains and IP addresses. Review the full destination, initiating process, and approved remote-support infrastructure for each match.

DeviceNetworkEvents
| where Timestamp > ago(14d)
| where RemoteUrl has_any (
    "ns.mo7sen.dev", "sc.payproofkit.com",
    "newnewnew.gotdns.org", "soxnewwork.homedns.org",
    "cdn007-digitaldownloads.com")
    or RemoteIP in ("185.99.255.28", "155.94.150.39")
| project Timestamp, DeviceId, DeviceName, RemoteUrl, RemoteIP,
    InitiatingProcessFileName, InitiatingProcessCommandLine, ReportId

Toolkit command lines and cookie-query activity

Find command lines containing distinctive toolkit names, staging paths, installer markers, or cookie-query strings.

DeviceProcessEvents
| where Timestamp > ago(14d)
| where ProcessCommandLine contains "/EadF.php"
    or ProcessCommandLine contains "SCKit"
    or ProcessCommandLine contains "RelayTrap"
    or ProcessCommandLine contains "Panel-Lateral"
    or ProcessCommandLine contains "ToolboxRelayUploader"
    or ProcessCommandLine contains ".ASPXAUTH"
    or ProcessCommandLine contains "c=Exploited"
| project Timestamp, DeviceId, DeviceName, FileName,
    ProcessCommandLine, InitiatingProcessFileName, ReportId

Known installer, archive, and uploader files

Find file events for the sc.msi package, staged ZIP, and uploader using their SHA-1 hashes. The query uses SHA-1 because SHA256 is usually unpopulated in DeviceFileEvents. Combine hash matches with command-line and persistence findings.

DeviceFileEvents
| where Timestamp > ago(14d)
| where SHA1 in~ (
    "0be01e7bd69cfdd222645d49bb5ad9961372fef2",
    "3f81c9c874a896c46e4bccea2fad2eaa3d9f2054",
    "13ce33b19daee3963f7e15d461b191c38f6bc0d3")
| project Timestamp, DeviceId, DeviceName, FileName, FolderPath,
    SHA1, InitiatingProcessFileName, ReportId

Registry values referencing RelayTrap

Find writes to the RelayTrapLiteAlert value or values containing RelayTrap. Review the registry key, value data, and initiating process.

DeviceRegistryEvents
| where Timestamp > ago(14d)
| where ActionType == "RegistryValueSet"
| where RegistryValueName =~ "RelayTrapLiteAlert"
    or RegistryValueData contains "RelayTrap"
| project Timestamp, DeviceId, DeviceName, RegistryKey,
    RegistryValueName, RegistryValueData,
    InitiatingProcessFileName, ReportId

RelayTrap scheduled-task events

Find scheduled-task events containing RelayTrap or TrapWatch. Inspect the task definition to identify its triggers, executable, and arguments.

DeviceEvents
| where Timestamp > ago(14d)
| where ActionType contains "ScheduledTask"
| where AdditionalFields contains "RelayTrap"
    or AdditionalFields contains "TrapWatch"
| project Timestamp, DeviceId, DeviceName, ActionType,
    AdditionalFields, InitiatingProcessFileName, ReportId

Microsoft Defender Antivirus path-exclusion writes

Find Microsoft Defender Antivirus path-exclusion registry writes. Review changes naming Windows Temp, ConnectWiseControl_, CWInstall_, or RelayTrap, and verify their authorization and effective policy.

DeviceRegistryEvents
| where Timestamp > ago(14d)
| where ActionType == "RegistryValueSet"
| where RegistryKey contains @"\Windows Defender\Exclusions\Paths"
| project Timestamp, DeviceId, DeviceName, RegistryKey,
    RegistryValueName, RegistryValueData,
    InitiatingProcessFileName, ReportId

SCKit – Generated PowerShell Loader Artifacts

Identifies temporary PowerShell files matching the k<32-hex>.ps1 naming pattern generated by the SCKit loader, potentially revealing staged payloads independently of known file hashes or infrastructure.

DeviceFileEvents
| where Timestamp > ago(30d)
| where FileName matches regex @"(?i)^k[0-9a-f]{32}\.ps1$"
| project Timestamp, DeviceId, DeviceName,
ActionType, FileName, FolderPath, SHA256,
InitiatingProcessFileName

Network addresses are defanged. Use the installer hashes to locate the listed packages, then verify the client’s enrolled ScreenConnect instance and related activity. The toolkit also uses the legitimate SQLite utility; investigate its use alongside the browser-cookie queries described above.

Hashes identify individual files. The watcher compiles RelayTrap against local client libraries, and embedded configuration changes script hashes. Use file and process behavior to investigate other builds. The table includes configuration, cleanup, and proof artifacts to support the investigation.

• ConnectWise security investigation and partner guidance (advisory covering the RMM+ extension authentication flaw). ConnectWise (accessed 2026-11-13)
• ScreenConnect security bulletin, 2026-09-08 (CVE-2026-84869 fix and client 26.6.5 guidance). ConnectWise (accessed 2026-11-13)
• ScreenConnect extensions. ConnectWise (accessed 2026-11-13)
• 6 tips for ConnectWise Control partners (remote commands from the web console). ConnectWise (accessed 2026-11-13)
• Requirements for protecting antivirus exclusions with tamper protection. Microsoft Learn (accessed 2026-11-13)
• Investigate entities on devices using live response. Microsoft Learn (accessed 2026-11-13)
• Take response actions on a device. Microsoft Learn (accessed 2026-11-13)
• Advanced hunting best practices in Microsoft Defender XDR. Microsoft Learn (accessed 2026-11-13)
• DeviceFileEvents table (advanced hunting schema). Microsoft Learn (accessed 2026-11-13)

For the latest security research from the Microsoft Threat Intelligence community, check out the Microsoft Threat Intelligence Blog.

To get notified about new publications and to join discussions on social media, follow us on LinkedIn, X (formerly Twitter), and Bluesky.

To hear stories and insights from the Microsoft Threat Intelligence community about the ever-evolving threat landscape, listen to the Microsoft Threat Intelligence podcast.

Review our documentation to learn more about our real-time protection capabilities and see how to enable them within your organization.  

• Learn more about securing Copilot Studio agents with Microsoft Defender 
• Evaluate your AI readiness with our latest Zero Trust for AI workshop.
• Microsoft 365 Copilot AI security documentation
• How Microsoft discovers and mitigates evolving attacks against AI guardrails
• Prompt injection protection in Microsoft Defender for Office 365 – official documentation of the prompt injection protection in Microsoft Defender for Office 365.
• How Microsoft discovers and mitigates evolving attacks against AI guardrails | Microsoft Security Blog
• Manipulating AI memory for profit: The rise of AI Recommendation Poisoning | Microsoft Security Blog – a related example of an AI-era technique observed in email traffic
• Defending the inbox against prompt injection attacks | Microsoft Defender for Office 365 Blog – feature announcement introducing prompt injection protection in Microsoft Defender for Office 365.
• Learn how Microsoft is reimagining the SOC for the agentic era with ISOC in Microsoft Defender

The post SCKit abuses ScreenConnect to deploy remote access and target technician sessions appeared first on Microsoft Security Blog.

PLANET Technology fixed two PLANET GS-5220-8P2T2S vulnerabilities, CVE-2026-109445 and CVE-2026-2336, in firmware v3.2412b261022. Update switches now.

#PLANETTechnology #GS52208P2T2S #CVE2026109445 #CVE20262336 #BufferOverflow #Cybersecurity

https://securityonline.info/planet-gs-5220-8p2t2s-vulnerabilities/?utm_source=mastodon&utm_medium=jetpack_social

PLANET Technology fixed two PLANET GS-5220-8P2T2S vulnerabilities, CVE-2026-109445 and CVE-2026-2336, in firmware v3.2412b261022. Update switches now.

#PLANETTechnology #GS52208P2T2S #CVE2026109445 #CVE20262336 #BufferOverflow #Cybersecurity

https://securityonline.info/planet-gs-5220-8p2t2s-vulnerabilities/?utm_source=mastodon&utm_medium=jetpack_social

CVE-2026-44432: HIGH-severity DoS vulnerability in miniforge3 (via urllib3). Affects <25.11.0.1-r6, <26.3.2.3-r6. No known exploits, but immediate upgrade recommended to prevent downtime. https://radar.offseq.com/threat/miniforge3-urllib3-is-an-http-client-library-for-python-cve-2026-44432-c6dc222c5be5e261 #OffSeq #Python #DenialOfService #Vuln

CVE-2026-44432: HIGH-severity DoS vulnerability in miniforge3 (via urllib3). Affects <25.11.0.1-r6, <26.3.2.3-r6. No known exploits, but immediate upgrade recommended to prevent downtime. https://radar.offseq.com/threat/miniforge3-urllib3-is-an-http-client-library-for-python-cve-2026-44432-c6dc222c5be5e261 #OffSeq #Python #DenialOfService #Vuln

CVE-2026-33186: CRITICAL vuln in yunikorn-k8shim (<1.8.0-r4) via gRPC-Go allows remote compromise of confidentiality & integrity. Patch to 1.8.0-r4 ASAP. No active exploits. https://radar.offseq.com/threat/yunikorn-k8shim-grpc-go-is-the-go-language-implementation-of-grpc-cve-2026-33186-2e9a48dbd612b0ea #OffSeq #Kubernetes #VulnMgmt #InfoSec

CVE-2026-33186: CRITICAL vuln in yunikorn-k8shim (<1.8.0-r4) via gRPC-Go allows remote compromise of confidentiality & integrity. Patch to 1.8.0-r4 ASAP. No active exploits. https://radar.offseq.com/threat/yunikorn-k8shim-grpc-go-is-the-go-language-implementation-of-grpc-cve-2026-33186-2e9a48dbd612b0ea #OffSeq #Kubernetes #VulnMgmt #InfoSec

Wow. I don't know whether this is the most ridiculous expectation of URL decoding or just REALLY bad input data.

I've had probes for paths including the string "%%32%65"

Which decodes as "%2e"

Which decodes as "."

Is someone REALLY expecting double-decoding issues to let them bypass filters? 🤨

Edit: Went to add it to my list of "malicious probes" that get Fail2banned and… it's already in my config! Apparently it's CVE-2021-42013 in Apache!

🟠 CVE-2026-128134 - High (7.8)

NLTK (Natural Language Toolkit) is a suite of open source Python modules, data sets, and tutorials supporting research and development in Natural Language Processing. Prior to 3.10.4, nltk.parse.dependencygraph.dot2img resolves the Graphviz dot ex...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-128134/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-128134 - High (7.8)

NLTK (Natural Language Toolkit) is a suite of open source Python modules, data sets, and tutorials supporting research and development in Natural Language Processing. Prior to 3.10.4, nltk.parse.dependencygraph.dot2img resolves the Graphviz dot ex...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-128134/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack