Top Intelligence Briefings
Amazon Threat Intelligence identifies PHP2Shell exploitation prior to public disclosure in MadPot
Active exploitation of the PHP2Shell remote code execution vulnerabilities (CVE-2026-109618 and CVE-2026-109619) was detected in MadPot telemetry as early as October 17, 2026—four full days before official public disclosures. Following the advisory drop, a deluge of malicious public repositories, defense tools, and PoCs flooded GitHub, while security teams scrambled to address nearly 70% of web servers requiring immediate patching. Compounding the crisis, the PHP project disclosed an additional edge-case RCE vector under CVE-2026-115560, prompting emergency Web Application Firewall (WAF) rule deployments across enterprise environments.
MythicRatatoskr: An Yggdrasil-enabled backdoor deployed in a UAC-0099-Sandworm collaboration
ESET researchers uncovered "MythicRatatoskr," a novel Go-based backdoor leveraging the decentralized Yggdrasil mesh network to hide its Command and Control (C&C) infrastructure. Deployed as part of a destructive joint operation by UAC-0099 and Sandworm targeting Ukrainian critical infrastructure, the malware demonstrates how state-sponsored APTs are adopting encrypted mesh networks to bypass traditional perimeter telemetry and egress filtering controls.
Two Critical Wasmtime Flaws Could Let Malicious WebAssembly Modules Escape Sandboxes
Two critical vulnerabilities discovered in Wasmtime—a high-performance WebAssembly runtime embedded in various host applications—allow malicious WebAssembly modules to completely break out of their intended execution sandboxes. Given Wasmtime's widespread integration across modern serverless and edge computing architectures, these flaws expose underlying host operating systems to arbitrary code execution if untrusted WebAssembly code is processed.