Year: 2026 - RH-ISAC Blog

Executive Summary CISA added the critical PHP2Shell vulnerabilities, CVE-2026-109618 and CVE-2026-109619, to its Known Exploited Vulnerabilities (KEV) Catalog following confirmation of in-the-wild exploitation. In-the-wild RCE was confirmed after honeypot activity recorded successful exploitation against an Apache mod_php installation running PHP 8.4.26. This represents an escalation from earlier reporting in which Cloudflare, Amazon, Hadrian, watchTowr, Previdian,…

Executive Summary A critical flaw dubbed “HTTP2Shell” in Brotli, the C decoder library built into Node.js, could allow attackers to corrupt memory and access sensitive data. Tracked as CVE-2026-111497s the vulnerability is also known as “Broccoli2Shell” and “Node2Shell.” Node.js says the flaw can crash the process, expose memory, and enable remote code execution (RCE), and…

Executive Summary PHP has released an advisory on 21 October 2026 detailing the vulnerabilities listed above, confirming the severity of CVE-2026-109618 and CVE-2026-109619. PHP is encouraging affected users to update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35. PHP 8.1 and older will not receive relevant update packages to mitigate CVE-2026-109618 and CVE-2026-109619, but some distributions…

Executive Summary Eight intermediate certificate authority (CA) certificates operated by eMudhra have been  comprised, triggering an industry-wide response from browser vendors, including Firefox and Chrome, operating system providers, and software maintainers after researchers discovered the certificates’ private keys could be derived from publicly available certificate data. The issue was not caused by a network intrusion…

Executive Summary  On 14 October 2026, Group-IB researchers published an in-depth analysis of KGB RAT. KGB RAT is a Remote Access Trojan (RAT) for sale on the dark web under the pretense of a legitimate Remote Administration Tool targeting Windows platforms. KGB RAT operates with a MaaS (Malware as a Service) distribution model, and the…

Executive Summary  A large-scale cyberattack targeting refrigeration systems at French supermarkets has highlighted the risks of internet-exposed operational technology (OT), with attackers remotely forcing refrigeration units into defrost mode and causing spoiled food, equipment damage, and significant financial losses. Beginning on 11 October, per a newly released report from Computer Emergency Response Team France (CERT-FR),…

Executive Summary A joint advisory, published on 8 October 2026, from multiple international government agencies, including FBI, CISA, NSA, and NCSC-UK, details how Integrity Technology Group, a company with links to the Chinese government, enables China-linked threat actors to compromise networks and steal sensitive data from organizations worldwide. The threat actors targeted multiple U.S. critical…

Executive Summary Cofense Intelligence is tracking email campaigns targeting the hospitality accommodation industry with fake guest complaints, negative reviews, and inquiry-related messages that deliver blockchain technology-abusing malware, via a report published 7 October 2026. The campaigns use links to archive files containing malicious LNK shortcut files masquerading as JPG images, which ultimately install either EtherRAT…

Executive Summary On 5 October 2026, CloudSEK identified a Russian-speaking The Gentlemen ransomware affiliate who used the Model Context Protocol (MCP) to execute malicious commands during live intrusions, turning an AI coding assistant’s tool interface into an operational command-and-control channel. The operator, designating himself Azazel, also operated LEAKNED, an independent leak site that allegedly diverted…

Executive Summary On 28 September 2026, Huntress researchers reported threat actors exploiting ChatGPT Custom GPTs as a delivery mechanism for ClickFix lures and DLL-sideloaded malware, including a Remote Access Trojan (RAT). This campaign represents a novel abuse of legitimate AI platforms to socially engineer victims and bypass traditional security controls. Key Takeaways Key points provided…