Top Intelligence Briefings
PHP2Shell Crisis Intensifies: Emergency Fixes Followed by New RCE Warning (CVE-2026-115560)
PHP maintainers and infrastructure teams are scrambling following the disclosure of the critical 'PHP2Shell' vulnerabilities (CVE-2026-109618 and CVE-2026-109619), which Amazon Threat Intelligence telemetry indicates were actively exploited in the wild via MadPot honeynet infrastructure days before public disclosure. Compounding the crisis, PHP issued warnings regarding an additional unpatched remote code execution vector (CVE-2026-115560) just 48 hours after emergency patches for PHP 8.2 through 8.5 were deployed. With approximately 70% of websites dependent on core PHP software and public repositories flooded with weaponized Proof-of-Concept tools within hours, enterprise environments face severe site outages and potential unauthenticated system takeovers if robust runtime protections and WAF rules are not immediately enacted.
Large-Scale Campaign Compromises Enterprise Edge Devices, Exposing 70,000+ Credentials
A coordinated, large-scale threat campaign has successfully targeted exposed enterprise network edge devices, specifically focusing on Fortinet FortiGate and Palo Alto Networks GlobalProtect firewalls and VPN gateways. The breach has resulted in the mass exposure of over 70,000 corporate credentials, providing unauthorized actors with direct insertion points into corporate enterprise perimeters. This systemic perimeter failure bypasses traditional internal network segmentation controls, allowing attackers to harvest valid credentials, deploy lateral movement frameworks, and compromise identity providers.
MythicRatatoskr: Go-Backed Backdoor Leverages Yggdrasil Mesh Network in Destructive Attacks
ESET researchers have uncovered a sophisticated collaboration between UAC-0099 and the Sandworm APT group featuring a previously unknown Go-based backdoor dubbed MythicRatatoskr. This novel malware uniquely leverages the Yggdrasil encrypted mesh network to obscure its Command-and-Control (C&C) infrastructure, effectively routing malicious communications through decentralized node networks and bypassing conventional IP-based firewall blacklists. The backdoor served as the primary staging mechanism for a destructive attack targeting a critical Ukrainian entity, highlighting the continuous evolution of state-sponsored tradecraft toward resilience against network disruption.