php2shell attempts are easy to spot even though nobody is landing it yet. Watch for the php2shell user-agent (seen as php2shell-scan/109618 and php2shell-109618), multipart POSTs carrying a PHP_SESSION_UPLOAD_PROGRESS field with an oversized body, and bursts of "Allowed memory size exhausted" in PHP-FPM logs. Those show you were targeted, not compromised.

We also published the scanner and staging infrastructure (the Mirai-style botnet scanner network, payload host, botnet binary hosts and C2 domains) as block/detect indicators. Patch to 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35. Disabling session.upload_progress was floated early but does not close the bug, since the flaw is the OOM-bailout handling, not that feature.

This week's actively exploited flaws, sorted by urgency:

- **Plex Media Server CVE-2026-96652/96654/96655/96656** (added to CISA's KEV on Oct 20): a chain that gives unauthenticated code execution on servers older than 1.43.3.10861. Plex says it's being widely exploited for crypto miners and proxy software. Update, then check the Codecs folder and running processes.
- **PAN-OS GlobalProtect CVE-2026-0257** (in CISA's Known Exploited Vulnerabilities (KEV) catalog since May 29): Unit 42's Oct 19 update says the Qilin and Inc ransomware groups use it to open VPN sessions, then move laterally over RDP and SMB. Fixed in 12.1.7, 11.2.12, 11.1.15 and 10.2.18-h6, plus hotfixes. The stopgap is to turn off authentication override cookies.
- **D-Link ShareCenter NAS CVE-2024-3272/3273** and **UniFi Video Log4Shell**: both are end of life, and GreyNoise caught a proxyjacking campaign on 143+ devices. There's no patch, so retire them.

Full write-up with versions and IOC pointers: https://patchorpass.beehiiv.com/?utm_source=reddit&utm_medium=social&utm_campaign=issue1&utm_content=sysadminblogs

I’ve spent the evening heavily developing and testing (in prod, where else) what appears to now be a relatively robust coverage set of 6 sequenced KQL/Advanced Hunting queries, 3 each across Linux and Windows. Sharing the love. Copy pasta, follow the in-line guidance - Might be useful in addition to your current methods! PRs welcome, if they don’t suck, and if my robot agrees.

https://github.com/deathbydata/php2shell-exposurehunt

This hunting set seeks to fill a gap while we all respond - there are plenty of IOC hunting repos, exposurehunt aims to help surface and verify known and unknown instances of naughty PHP.

Enjoy ☺️

Scenario: an agent processes a PDF invoice. Buried in it, an instruction to read .env, base64-encode the contents, and email it out.
The resulting email has no red flags at all — no "password", no "api key", just a base64 blob. This is exactly the case where keyword/regex filtering fails.
Our guard still blocks it, because it doesn't inspect the text — it tracks the data flow: label secrets by origin, pre-compute their base64/hex/URL encodings, and deny SECRET → external sink.
Video of the live demo below. Building this open source (link in comments — not posting it in the body per subreddit etiquette). Would love feedback from people running agents with real tool access, especially on what we might have missed.
One thing we'll say up front: this isn't a silver bullet. Taint tracking reduces risk, it doesn't eliminate it — it's one layer in a stack.

Probably not the best week to be dropping research, i know alot of ya'll in the industry are working hard right now - stay safe out their!

Tracking a new campaign by PHISHLETS 10k phaas kit dropped in August in the wild..

8 intermediate CA private keys from eMudhra were exposed because of critically weak P-384 key generation. 6 of them were used for TLS and 2 for code signing.

Browsers have already blocked the affected chains, so most people will never notice. The less obvious exposure is anywhere that ships its own CA bundle:

→ Non-browser clients (curl, language runtimes, Java keystores)
→ CI/CD runners and build images
→ Containers built on older base images
→ Embedded devices that rarely get trust-store updates

The code-signing keys matter most here. A signature chaining to one of these intermediates could make malware look legitimate to anything that still trusts it.

Worth checking which of your images and appliances bundle their own roots and when they were last updated. Has anyone already audited their fleet for this?