Threat Alerts

A suspected Chinese-nexus threat actor, tracked as CL-UNK-1280, has successfully compromised 25 Palo Alto Networks PAN-OS firewalls and management servers across the United States, Japan, Taiwan, and South Korea, including systems associated with multiple organization. The attackers chained PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) with a Linux kernel privilege escalation vulnerability (CVE-2026-46300) to achieve remote code execution and obtain root privileges. Following initial compromise, they deployed PHP webshells and established persistent reverse SSH access, enabling further intrusion into internal infrastructure. Post-exploitation activity included LDAP credential theft, Active Directory enumeration, and attempts to compromise additional accounts. The campaign marks a significant development in PHP2Shell exploitation, demonstrating successful compromise of perimeter infrastructure and subsequent access to internal networks.

A multistage phishing campaign was uncovered distributing a previously undocumented variant of the Sirius backdoor through emails impersonating FedEx tax invoices. The emails contain ZIP archives with malicious PDF documents designed to execute encoded PowerShell commands when opened, provided the recipient approves the PDF reader’s security prompt. The campaign combines fileless execution, encrypted payloads, and legitimate Windows processes to evade traditional file-based detection.

The infection chain begins with the PDF’s /OpenAction and /Launch features, which trigger PowerShell to decrypt and decompress an embedded payload before loading a .NET assembly directly into memory. Subsequent stages use RC4 encryption and additional obfuscation techniques, patch Event Tracing for Windows (ETW) to interfere with security monitoring, and retrieve the final Sirius payload. The backdoor is injected into legitimate processes such as msbuild.exe or svchost.exe using Early Bird APC injection. Sirius supports credential and browser data theft, keylogging, screen and audio surveillance, hidden desktop control, and SOCKS5 proxy functionality, alongside persistence through scheduled tasks, registry modifications, and Windows provisioning packages.

A malware campaign tracked as Yoba is abusing the popularity of AI applications such as ChatGPT and Claude to distribute malware through fake GitHub repositories and GitHub Pages websites. The malicious projects impersonate desktop applications associated with well-known AI platforms and are likely promoted through SEO poisoning, causing them to appear prominently in search results. Victims who download and execute the installers receive legitimate, digitally signed application binaries bundled together with malicious DLLs.

The infection chain relies on DLL sideloading, where legitimate signed executables are used to load the YobaDropper, which subsequently deploys the YobaLoader. The malware performs anti-analysis checks, verifies administrator privileges, establishes persistence through scheduled tasks, and uses trusted services such as Google DNS-over-HTTPS, Telegram, Tor, Catbox, and GitHub to reduce reliance on dedicated command-and-control infrastructure and blend malicious traffic with legitimate activity.

The YobaLoader can retrieve and execute additional PE files or PowerShell payloads, including through process injection into svchost.exe. In observed infections, the final payload was an XMRig cryptocurrency miner that communicated with an onion-based mining endpoint through a local Tor proxy. However, the loader is generic and can deliver other malware in future campaigns, making the threat broader than cryptomining alone.

Threat actors have compromised 42 legitimate GitHub repositories belonging to 11 owners by embedding malware in trusted startup hooks used by popular AI coding assistants and code editors. The attack triggers when developers open an affected project, allowing malicious scripts to execute without requiring prompt manipulation or additional user interaction. The campaign aims to steal GitHub and npm credentials and use them to publish malicious package updates, creating a self-propagating software supply chain attack.

The infection involves hidden scripts, executed through project configuration files and editor startup hooks. The payload can also operate through GitHub Actions to publish malicious npm packages. Three compromised npm packages use encrypted payloads and native addons to execute scripts while evading automated analysis through environment and debugging checks. Additionally, attacker-controlled workflows scan for cPanel and WHM systems vulnerable to CVE-2026-41940, although no successful exploitation has been confirmed. The campaign also includes a token-revocation wiper, making careful credential revocation and repository cleanup essential. Developers should inspect repository startup configurations, GitHub Actions workflows, npm dependencies and exposed access tokens for suspicious modifications.

Two significant vulnerabilities affect Veeam Backup & Replication and Veeam ONE. CVE-2026-108142 (CVSS 9.1 – Critical) affects Veeam Backup & Replication and allows an unauthenticated remote attacker to bypass authorization on the CDP Coordinator Service. The vulnerability affects Veeam Backup & Replication 13.1.1.18 and earlier 13.1 builds, as well as 13.0.2.29 and earlier 13.0 builds. Older 12.x releases are not affected.

CVE-2026-107671 (CVSS 8.5 – High) affects Veeam ONE 13.1.0.7233 and earlier 13.1 builds. The flaw allows an attacker who already possesses valid Administrator credentials to bypass multi-factor authentication by disabling MFA globally before completing MFA verification, potentially weakening an important security control and enabling broader administrative access. Veeam ONE 13.0.x and 12.x releases are not affected.

The same Veeam security releases also address additional vulnerabilities beyond these two issues, including path traversal and other security flaws affecting Veeam Backup & Replication.

A critical use-after-free vulnerability in the Linux kernel‘s IPv4 TCP handshake implementation, tracked as CVE-2026-98432 (CVSS 9.8), could allow unauthenticated remote attackers to execute commands with root privileges on affected systems with a multipath TCP listener. The flaw has existed since Linux 4.4 and stems from a race condition in which the kernel transfers IP options to a newly established socket without copying the underlying memory. Concurrent processing can cause one CPU core to access the memory after another core has freed it. An AI research lab reportedly developed an exploit demonstrating remote root access by first leaking kernel memory addresses to bypass KASLR and then overwriting a callback pointer to execute attacker-controlled commands.

The exploit requires precise timing with repeated attempts possible without crashing the server. Although the kernel CVE team assigned a CVSS score of 9.8, vendor assessments vary due to differences in evaluating the race condition’s exploitability. Some Linux distributions have released fixes, while others still list supported versions as vulnerable. No exploitation in the wild has been reported and a weaponised exploit has not been publicly released. Administrators should review vendor advisories and apply available kernel updates, particularly on systems running multipath TCP listeners.