CYBER_THREATCAST
$ briefing --date=
CYBER THREATCAST
CYBER THREAT INTELLIGENCE BRIEFING
CVE-2026-109618 and CVE-2026-109619 put roughly 22 million internet-facing PHP instances at potential risk, with exploitation reported in the wild. Active attacks also reach Siemens Software Center through CVE-2026-110936, Android users through the Hirudo banking Trojan, Japanese companies through the AI-enabled ARTEX tool, and iPhone users through DeadTag’s compromised-web infrastructure.
AWS and Cloudflare reported signs of PHP exploitation before planned disclosure, increasing the urgency for organizations running affected deployment models. Administrators should install the released PHP security updates, restart persistent workers where applicable, review internet-facing systems for exposure, and assess them for compromise rather than treating patching alone as sufficient.
Attackers are exploiting familiar trust paths rather than relying on a single technique. Hirudo replaces legitimate banking apps and abuses Android Accessibility services; the Siemens campaign pairs malicious DLLs with a legitimate signed executable; ARTEX automates reconnaissance and exploitation attempts; and DeadTag turns dormant domains, compromised sites and advertisements into spyware delivery channels. Software provenance, identity controls and post-exploitation hunting all merit immediate attention.
Editorial: Recommended Actions
01
PRIORITY
Install the fixed PHP releases immediately and assess internet-facing PHP systems for compromise, prioritizing PHP-FPM and Apache mod_php deployments. CVE-2026-109618 and CVE-2026-109619 enable remote code execution, may expose roughly 22 million internet-facing instances, and are being exploited. FortiGate and FortiWeb users should also deploy the available PHP2Shell protections, change relevant IPS signature actions from Pass to a blocking action, and apply FortiGuard FDS update 0.00438 where applicable; these controls supplement rather than replace PHP updates.
02
PRIORITY
Investigate PAN-OS GlobalProtect portals and gateways for exploitation of CVE-2026-0257 and unauthorized VPN sessions, especially on internet-facing configurations. Qilin, INC, and k0t operators are using the authentication bypass to establish sessions without valid authentication and potentially evade MFA. Hunt for subsequent RMM, RDP, and SMB activity, and scrutinize access to vCenter, ESXi, Veeam, domain controllers, management interfaces, configurations, and stored secrets.
03
PRIORITY
Apply the BeyondTrust fix manually to every self-hosted Remote Support appliance through version 26.2.3; hosted SaaS environments have already been patched. China-linked Armory Castle exploited CVE-2026-102764 as a zero-day for about 47 days before disclosure, and CISA has added the flaw to its Known Exploited Vulnerabilities catalog. Self-hosted customers should not assume the hosted-service remediation covers their appliances.
04
PRIORITY
Upgrade Siemens Software Center to version 4.0.9.8 and hunt using Siemens’ published indicators for exploitation of CVE-2026-110936. Attackers are abusing versions before 4.0.9.8 by placing malicious DLLs beside a legitimate signed executable for DLL side-loading without modifying that executable. Organizations whose users installed or executed suspicious Siemens Software Center packages should investigate those systems promptly.
05
PRIORITY
Rebuild systems that installed LiteLLM 1.107.0 packages or affected container images, and revoke and rotate every credential those hosts could access. All seven PyPI wheels for version 1.107.0 were malicious, and multiple Docker Hub and GHCR tags contained poisoned images with credential theft and remote-control capability. Treat affected hosts and accessible secrets as compromised rather than relying only on package removal; LiteLLM’s private enterprise offering was reportedly unaffected.
ROUNDTABLE
Expert Panel Discussion
12 AI experts analyzed this briefing across 3 turns of structured debate
12Agents18Messages48mDuration
→
Field Signals
Real-time intelligence from X/Twitter
$ scanning feeds_