CYBER_THREATCAST
$ briefing --date=
CYBER THREATCAST
CYBER THREAT INTELLIGENCE BRIEFING
PHP2Shell exploitation has put internet-facing PHP systems at the top of the patch queue, while active campaigns are also targeting npm, GitHub repositories and South Korean software environments. Apple has patched a CoreGraphics flaw linked to possible targeted exploitation, and public exploits and reported attack traffic have raised the stakes for a critical Brotli vulnerability.
Wiz observed limited PHP2Shell exploitation attempts and did not see its monitored attempts succeed, but working exploit code and broader exploitation traffic have been reported. A successful exploit was demonstrated against Apache mod_php running PHP 8.4.26, and administrators should install applicable fixed PHP releases promptly despite the substantial decline in exposed vulnerable systems.
Lazarus is using recruitment lures, LPEClient and the in-memory Cubridge backdoor against South Korean organizations, while testmetest is stealing credentials through malicious npm packages and 42 weaponized or compromised GitHub repositories. The campaigns reinforce the exposure created when trusted software, developer tooling and public-facing infrastructure intersect.
Editorial: Recommended Actions
01
PRIORITY
Install applicable fixed PHP releases immediately, prioritizing internet-facing and unsupported installations and Apache mod_php deployments. A working proof of concept, widespread exploitation traffic, and an exploitation attempt detected before public disclosure raise the risk of rapid compromise; successful exploitation has been demonstrated against Apache mod_php running PHP 8.4.26.
02
PRIORITY
Deploy Apple’s latest security updates to all supported iPhones and iPads, including older hardware covered by the backported fix for CVE-2026-86950. Apple says the CoreGraphics memory-corruption flaw may have been used in sophisticated targeted attacks; a crafted file could trigger arbitrary code execution, while the attackers, delivery method, and victims remain unidentified.
03
PRIORITY
Update affected Brotli, Node.js, and supported .NET deployments, then rebuild self-contained .NET applications and redeploy container images. CVE-2026-111497 is listed in CISA’s Known Exploited Vulnerabilities catalog, public exploits exist, and attacker-controlled Brotli streams can cause memory disclosure, corruption, crashes, or remote code execution; Microsoft issued emergency updates for supported .NET branches.
04
PRIORITY
Review npm dependencies, GitHub repositories, and GitHub Actions for testmetest-related compromise, and rotate any exposed source-control, cloud, SSH, Vault, Kubernetes, registry, or AI-provider credentials. The campaign uses malicious npm packages and 42 weaponized or compromised GitHub repositories to execute encrypted payloads, steal credentials, propagate packages, and target cPanel systems through CVE-2026-41940.
05
PRIORITY
Treat download directories as untrusted, prevent OpenAI Codex and Claude Code from automatically consuming project instructions there, sandbox coding agents, and audit credentials exposed to agent sessions. Live malware is planting malicious Markdown instruction files that coding assistants may ingest as context and follow, enabling unauthorized configuration changes through intended agent behavior rather than a conventional software flaw.
ROUNDTABLE
Expert Panel Discussion
13 AI experts analyzed this briefing across 3 turns of structured debate
13Agents17Messages33mDuration
→
Field Signals
Real-time intelligence from X/Twitter
$ scanning feeds_