Cyber Attack | Breaking Cybersecurity News | The Hacker News

Cybersecurity researchers have disclosed details of three cyber attacks targeting organizations in Japan in which artificial intelligence (AI) was a key element, either in the driving seat or to assist a human operator. TrendAI, which analyzed three exposed server environments used by threat actors to conduct the malicious cyber operations, described them as distinct from previously published attacks that have leveraged ARTEX , an autonomous AI penetration testing framework, to single out entities in South Korea and Japan. "These environments held reconnaissance and attack tools, scripts, target lists, results, logs, and command histories," security researchers Bakuei Matsukawa and Joseph C Chen said. "They ranged from workspaces used largely by hand by skilled operators to AI-agent platforms that automated the entire workflow, including command and control." The first of the three attacks has been found to abuse CyberStrikeAI , another open-source penetra...

The North Korea-linked Lazarus Group has been attributed to a cyber espionage campaign dubbed Operation FlashHole targeting at least three organizations in South Korea spanning the construction, software, and wire-communication equipment manufacturing sectors. According to Russian cybersecurity company Kaspersky, the campaign has been active since at least July 2025. It's assessed to pick up from where Operation SyncHole left off. "The group targeted victims more selectively, sending spear‑phishing emails with links to fabricated but relevant sites, such as portfolio and résumé pages tailored to each target," Sojun Ryu, senior security researcher at Kaspersky GReAT, said in an exhaustive analysis. Operation SyncHole was first documented by Kaspersky in April 2025, detailing the state-sponsored adversary's targeting of South Korea's software, IT, financial, semiconductor manufacturing, and telecommunications industries since November 2024 to deliver malwa...

The Computer Emergency Response Team of Ukraine (CERT-UA) has issued an alert warning of unauthorized remote access to video surveillance systems manufactured by Dahua. "Cases of compromising IP cameras and DVRs with access to the video stream, changing the device configuration and creating third-party accounts have been recorded," the State Special Communications Service of Ukraine (SSSCIP) said in an alert issued last week. The primary initial access vector used in the attacks is via Easy4IP , a peer-to-peer (P2P) platform that allows users to remotely monitor homes or small businesses by connecting their Dahua IP cameras, NVRs, and DVRs via a smartphone app or web browser by scanning a QR code or entering the hardware Serial Number (SN). The agency has warned that the serial numbers have a predictable structure containing a 10-character model prefix that's identical for all units of the same device family and a five-character hexadecimal counter that's i...

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday confirmed active exploitation of the recently patched PHP2Shell flaws by adding them to its Known Exploited Vulnerabilities ( KEV ) catalog. The PHP vulnerabilities, both rated 9.2 on the CVSS scoring system, facilitate unauthenticated remote code execution on affected deployments - CVE-2026-109618 - An out-of-memory corruption vulnerability that allows for unauthenticated remote code execution. CVE-2026-109619 - A stale internal request-state vulnerability that allows for unauthenticated remote code execution. The addition of the two flaws to the KEV catalog comes after Adel Karimi, detection and response lead at Perplexity, confirmed successful instances of remote code execution against honeypot systems on October 24, 2026. "This is now confirmed RCE with usable memory disclosure, not just a crash followed by a suspicious process," Karimi said . "The response delivered an 800 ...

An unknown threat actor has infected 953 online stores, most of them running Magento, as part of a long-running campaign active since July 2025. According to Dutch e-commerce security company Sansec, the activity is designed to add a small piece of code to the store's pages that, when visited by unsuspecting users, serves malicious JavaScript loader code through Magento CMS blocks. "When you visit, that code makes your browser ask the group's server what to do next," Sansec said . "The server first checks whether you are a real shopper or a security scanner, so scanners get nothing." No less than five distinct domains have been observed over time in connection with the campaign - manulfie[.]click, first seen in July 2025 neswnsssn[.]click, first seen in December 2025 lanhd6549tdhse[.]top, first seen in March 2026 additionalver[.]com, first seen in June 2026 deepveindrilling[.]com, first seen in October 2026 Sansec said it found deep...

Every SOC struggles with a pile of alerts. Very few of those alerts explain how an attack started or how it progressed. Network data, like that from a network detection and response (NDR) platform, connects individual alerts into one timeline, and it feeds the defensive systems that can tie all events together into one coordinated view. SOC teams often first see the shape of an intrusion through a series of smaller alerts that are triggered (e.g., when a signature matches a known malware hash, a threshold flags an unusual spike in failed logins, or an endpoint agent detects suspicious activity). When viewed through the SIEM dashboard, an attack often begins as a series of distinct events with related or overlapping timestamps. Artificial intelligence has accelerated modern attacks, enabling attackers to automate reconnaissance, craft targeted payloads, and execute scripts in seconds. Yet, speed does not obfuscate the need for stealth. To evade detection, adversaries deliberately d...

An automated campaign is using stolen GitHub tokens to plant workflows that print a repository's secrets into its GitHub Actions logs, which the attackers then download before deleting the runs. The attacks have succeeded in private repositories and GitHub Enterprise environments, according to an analysis by cloud security company Wiz. A  GitHub safeguard  that pauses suspicious workflow runs stopped every public-repository run Wiz checked, but it does not cover private repositories or GitHub Enterprise Server. Each workflow sits on a new branch named ci-sync- followed by six random characters. Deleting a branch, or the run it started, does not undo the exposure. Every secret the repository could read should be rotated, and the token that pushed the branch revoked. Wiz has tracked the campaign since September 15 and calls it Gheist , after the user agent gheist that the attackers' tool sends with GitHub API requests. Wiz has recovered mor...

A malicious instruction file sitting in a developer's Downloads folder tried to make their AI coding agent install a known-malicious npm package, security firm Forever Security said in a report published last week. The company caught the attempt on a real customer's machine and stopped the agent before any code ran. It could not determine how the file got into the folder. The file was  AGENTS.md, a plain-text instructions file that a coding agent, such as OpenAI's Codex, reads when it starts in a folder and follows as directions. It was dressed up as ordinary engineering notes. One section told the agent to add a server to its own configuration and install a package called function-color from npm. That package is part of a malware campaign that other researchers have  documented separately : function-color pulls in a downloader called function-flag, which fetches and runs a Windows payload. Researchers at CloudSEK and Checkmarx, who ...

In an update, Palo Alto Networks Unit 42 said it's retracting its earlier assessment that the post-compromise activity targeting the European government agency involved the exploitation of the PHP2Shell flaws. "What researchers saw was an attack against a European government agency executed in the context of a vulnerable PHP application," a spokesperson for the company told The Hacker News via email. "This led us to believe that it was exploitation of those vulnerabilities. We are unable to confirm that initial access is associated with the specific PHP2Shell CVEs." The original story follows. Threat actors have been observed using agentic artificial intelligence (AI) platforms for post-exploitation activity following the abuse of the PHP2Shell vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619. "In one case, the attackers targeted a government entity in Europe and within two hours of the initial exploitation they had successfully acce...

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added two vulnerabilities impacting Collabora Online Built-in CODE Server and Arista VeloCloud Orchestrator (VCO) to its Known Exploited Vulnerabilities ( KEV ), citing reports of active exploitation in the wild. The critical-severity vulnerabilities are listed below - CVE-2026-110447 (CVSS score: 9.2) - An operating system command injection vulnerability in Collabora Online – Built-in CODE Server (aka richdocumentscode) when used within the NextCloud platform that could allow remote code execution via "proxy.php" when the CODE local document server isn't running. (Fixed in September 2026 in version 26.4.303) CVE-2026-114625 (CVSS score: 9.9) - An SQL injection vulnerability in on-premise versions of Arista VeloCloud Orchestrator that could allow a remote attacker to access privileged internal functionality. (Fixed in October 2026  in versions 5.2.3.18, 6.1.3.10, and 6.4.2.12) As r...

Cybersecurity researchers have disclosed details of a large-scale campaign that has targeted exposed network edge devices such as Fortinet FortiGate and Palo Alto Networks GlobalProtect firewalls. "Artifacts from this investigation also indicate that operators in this campaign have obtained access to numerous organizations worldwide, and have attempted to further compromise some victims, resulting in persistent remote access and data exfiltration," according to a joint investigation published by Group-IB and NyxLab. The widespread exploitation activity has been attributed to a threat actor known as k0t, who also goes by the aliases CryptoFeel, Member19, and QazWsxShop. The cybercriminal actor was first seen in the wild on October 22, 2025. The threat actor is assessed to share connections with ransomware groups such as Qilin and The Gentlemen, likely operating as an initial access broker or an affiliate. Analysis of the threat actor's dark web activity reveals a k...

The Russian state-sponsored hacking group Sandworm teamed up with another threat actor to carry out a destructive wiping attack targeting a Ukrainian logistics company last year. According to ESET , the attack involved UAC-0099 (aka Earth Sirrush) obtaining initial access to the target on July 16, 2025, via a spear-phishing email bearing a malware-laced attachment that led to the deployment of the MATCHWOK backdoor through a downloader called MATCHBOIL. The activity ultimately concluded with the threat actor handing off access to Sandworm, which then conducted a data-wiping attack on September 17, 2025, more than two months after it obtained a foothold. What makes the attack stand out is UAC-0099's use of a previously undocumented backdoor called MythicRatatoskr that communicates with a command-and-control (C2) server hosted inside the Yggdrasil mesh network. The backdoor was deployed a day after MATCHWOK was executed. There are indications that development on the back...

Threat actors have been observed unsuccessfully attempting to exploit the newly disclosed PHP2Shell vulnerabilities to rope infected systems into a Mirai botnet variant called Potassium , as it emerges that weaponizing the flaws may be harder than previously thought. The attacks aim to exploit CVE-2026-109618 and CVE-2026-109619 (CVSS scores: 9.2), which can result in unauthenticated remote code execution (RCE) via specially crafted HTTP requests. The vulnerabilities have been patched in PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. "However, analysis of the sample revealed that it is an updated and significantly expanded version of the Mirai-derived botnet variant identified in early 2026," Sophos said . "The sample displays downloader and network disruption functionality." ⚡ WARNING — PHP Warns of Another Unpatched RCE Flaw CVE-2026-115560 Specifically, it resolves a hard-coded, encrypted command-and-control (C2) address, establishes a TCP connec...

Attackers are exploiting a zero-day SQL injection flaw in Arista's VeloCloud Orchestrator (VCO), the  central management system  for VeloCloud SD-WAN networks, the company said in an  advisory  on October 22. The flaw lets anyone who can log in to the orchestrator, even with a read-only customer account, gain operator privileges, the top level of control over it. For on-premises orchestrators, the fix is in VCO 5.2.3.18, 6.1.3.10, and 6.4.2.12, while Hosted and Dedicated orchestrators have already been patched. The flaw is tracked as CVE-2026-114625 and rated 9.9 on the CVSS scale. Orchestrators running the releases that fixed the VCO flaws exploited in July and September are still affected, because those releases are older than the new fixes. Arista bought the VeloCloud SD-WAN product line from Broadcom, announcing the deal in July 2025. The products were earlier known as VMware SD-WAN by VeloCloud. To exploit the flaw, an attacker needs network acc...

Platform-as-a-Service (PaaS) provider Railway on Wednesday disclosed "anomalous activity" related to systems that store customer environment variables. Upon further investigation, the company found that an unauthorized third party may have gained access to encrypted environment variables, and, in some cases, obtained the decrypted contents. The impact, it said, is limited to a "subset of users," although it did not disclose an exact number. Environment variables refer to user-defined key-value pairs that are used to store sensitive data like API keys, database credentials, or feature flags. They are configured at the operating system or container environment level instead of hard-coding the values directly into a program's source code. Railway said the incident is likely part of a series of attacks designed to target platform companies with the ultimate goal of compromising artificial intelligence (AI) inference providers. The company also said it has n...

Amazon's Threat Intelligence team on Wednesday said it detected an attempt to exploit the newly disclosed PHP2Shell vulnerabilities dating back to October 17, 2026, against its MadPot honeypot service, as the flaws come under broad exploitation in the wild following the release of the patches. "The exploit attempt originated from an IP address associated with a commercial anonymization network," CJ Moses, CISO of Amazon Integrated Security, said in a post shared with The Hacker News. "While the vulnerability was under embargo, the targeting of a honeypot from an anonymized IP address suggests the activity was conducted by a threat actor, though it remains unclear how the actor acquired exploit information prior to disclosure." The attempt, Amazon said, was recorded from " 103.216.220[.]92 ," an IP address geolocated to Australia. An Amazon spokesperson told The Hacker News the activity was largely a one-off probe, adding "there was no ev...

Microsoft on Wednesday disclosed that a China state-aligned actor dubbed Storm-0940 was behind the recent supply chain compromise of the ConnectWise Cloud Backup application. During the incident, Storm-0940 used ARTEX , a Go-based agentic AI penetration testing framework that was made closed-source in the wake of its abuse in cyber attacks targeting South Korean financial institutions, to speed up scanning and reconnaissance, password spraying, and OAuth application abuse at downstream victims. The tech giant said the threat actor used the AI tool at "machine speed" to automate attacks targeting hundreds of organizations across the world spanning a broad range of sectors since September 2026. Targets include aerospace and defense, automotive, chemicals, energy, financial services, government, legal, manufacturing, media, military, semiconductor, software, technology, and think tanks and non-profits. "Storm-0940's use of ARTEX accelerated the speed of comprom...

The popular LiteLLM Python package has been compromised as part of a software supply chain attack that delivered a credential stealer and a backdoor, according to reports from SafeDep , Socket , StepSecurity , and Upwind . The compromise affects LiteLLM 1.107.0, distributed through PyPI wheels and Docker images. The Python package has since been quarantined on Python Package Index (PyPI), and the malicious Docker images have been removed. Oliver Jensen, director of security at LiteLLM, said an investigation into the incident is ongoing, and that it's still working to trace the original attack vector by which the threat actor published the malicious release. "We have identified that the malicious actions were taken through three engineers' GitHub accounts, appearing to be by way of stolen GitHub CLI OAuth tokens," Jensen said . "The threat actor used one user's account to trigger the project-releaser run, and another user's account to approve it. A...

PHP has released emergency updates that fix two critical flaws in the language itself, letting an attacker without an account run code on a web server. The fixes are in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and the PHP team says only updating fully protects a server. The flaws, together called PHP2Shell , sit in the PHP runtime, not in any application, so a site is exposed even when its own code is secure. The risk is highest on servers using Apache's mod_php, where a working exploit triggers the attack before any application code runs. Both flaws are rated 9.2 on the CVSS v4.0 scale and carry the identifiers  CVE-2026-109618  and  CVE-2026-109619 . PHP published them around the scheduled release time of 14:00 UTC on October 21, a day after details leaked ahead of a planned October 22 disclosure. ⚡ WARNING — PHP Warns of Another Unpatched RCE Flaw CVE-2026-115560 Researchers at Wiz, Calif, and OpenAI found and reported the flaws, which affect nearly every ...

Cybersecurity researchers have disclosed details of a previously undocumented China-aligned threat cluster known as Bronze Sandcastle that has been observed targeting organizations in Asia and Africa since mid-2025. "The most distinctive technical marker for Bronze Sandcastle is its consistent use of Sandboxie DLL sideloading," Sophos security researcher Gabor Szappanos said in a post published Tuesday. Between August 2025 and August 2026, attacks mounted by the threat actor have resulted in victims in the Philippines, Taiwan, Afghanistan, Namibia, and likely South Korea. Evidence indicates that Bronze Sandcastle is most active in the UTC+8 time zone.  DLL sideloading is a popular adversarial technique that exploits the way Windows loads DLL files, allowing an attacker to trick a legitimate program into loading a malicious DLL . When an application is launched, it needs to load various DLLs in order to function correctly. If the application does not provide the f...