🚨 ACTIVE EXPLOITATION
- CVSS 10.0 Bricksforge WordPress file upload flaw under active exploitation, enabling unauthenticated RCE
CVE-2026-85097
Attackers are actively exploiting a critical unauthenticated arbitrary file upload flaw (CVE-2026-85097) in the Bricksforge WordPress plugin to achieve remote code execution.- Affects WordPress sites running the Bricksforge plugin (a Bricks Builder add-on) versions up to and including 3.1.8.9; fixed in 3.1.8.10.
- The flaw stems from insufficient validation of the attacker-controlled 'url' field in the 'temporaryFileUploads' parameter during form submission, allowing arbitrary PHP upload and execution (CVSS 10.0).
- Attack chain: obtain a nonce via the unauthenticated 'bricksforge_regenerate_nonce' AJAX endpoint, upload a GIF/PHP polyglot that passes MIME checks, then submit a form pointing the file path to the image but the url to a .php destination.
- Exploitation targets /wp-json/bricksforge/v1/form_submit and /wp-admin/admin-ajax.php with 'bricksforge_form_submit', using extension evasion like .php5, .phtml, case manipulation, and URL-encoded variants; some payloads drop login_admin_*.php files into the regular uploads directory.
- Patchstack observed exploitation from October 7, 2026, across 63 unique source IPs; top sources include 177.75.57[.]20, 23.97.62[.]146, 84.247.60[.]125, 38.154.185[.]97, 150.109.16[.]166, and 153.75.90[.]146.
🕵️ RESEARCH & DEEP DIVES
CyberXero uses Claude Code AI agents in campaign stealing 628,000+ Ukrainian records
SOCRadar exposed a Russian-speaking initial access broker, CyberXero, that used Claude Code AI agents and Cobalt Strike to mass-exploit WordPress sites and target Ukrainian critical infrastructure.- Applies to WordPress, Magento, PrestaShop site owners and organizations exposing Redis servers, plus Ukrainian energy and utility entities.
- Over 628,000 records of Ukrainian individuals were exfiltrated from four organizations, including 564,073 subscriber records from a Kharkiv district heating provider.
- The global pipeline exploited wp2shell (CVE-2026-63030, CVE-2026-60137) and Support Board plugin SQL injection CVE-2026-4815, creating rogue admins and deploying WSO web shells.
- The actor ran up to 51 specialized Claude Code agents for reconnaissance, exploitation, and exfiltration, and connected PentAGI to a Cobalt Strike Team Server via an AI provider API.
- The operation was exposed by an open directory at 46.21.250[.]135 leaking 90,000+ files including AI session logs, plaintext tokens, and victim data; Cobalt Strike infrastructure ran at 42.193.227.214 (ports 9995, 1002, 8044, 8033).
75 recovered AI agent transcripts show autonomous intrusions from recon to root
Recovered attack transcripts show autonomous AI agents running real intrusions end to end with no human at the keyboard.- 75 AI agent attack transcripts were recovered from threat actors' own servers, covering intrusions run by autonomous agents with operators only setting targets and rules
- Likely multiple operators, mostly Chinese-speaking: 'Backdoor' hit online retail for unauthenticated RCE, 'Keymaster' harvested AI model keys, 'Cashout' stole card data and crypto wallet keys
- Agents reached command execution on 23 hosts, most as root or SYSTEM, using unauthenticated RCE via upload shells, deserialization, SQLi-to-command-execution, SSTI, and SSRF
- A single application SSRF escalated to a full cloud account takeover, and one target was rooted via CVE-2026-0766 in self-hosted Open WebUI
- Toolkit includes the codeg multi-agent harness, a shared coordination record called Cairn, Claude Code on DeepSeek, and pi/CyberStrikeAI workers; uploader shells avoid command-execution signatures
- 150,574 AI gateway resellers were swept for upstream model keys; one target was held for 5 days across 304 reasoning steps
LG webOS sync-demo preauth RCE chain yields root command execution on smart TVs
Researchers disclosed a pre-authentication exploit chain in LG webOS TVs that leads to root command execution.- Affects LG smart TVs including models 32LQ636BPSA and 27TQ600SW running webOS 7.5.7-25 (Rockhopper, mullet-mirima), firmware 04.54.40
- The chain starts with a client-key issuance bypass: replaying the LG-signed manifest in com.webos.app.sync-demo makes SSG issue a SECURE-tier client-key without a PIN prompt
- cmp-client then navigates to an attacker-controlled interactiveUrl, where the loaded page uses PalmServiceBridge to call private/system Luna services as cmp-client (SSRF)
- Finally, pmlogd's collectAllLog inserts targetDir and targetFile into shell command strings, letting shell metacharacters execute as root in PmLogDaemon
- Disclosed by an independent researcher who placed third in the LG webOS category at TyphoonPWN 2026; LG has issued a fix via its TV security bulletin
Power BI phishing campaign deploys rogue ScreenConnect RMMs for persistent access
A phishing campaign abuses Microsoft Power BI to deliver rogue ScreenConnect remote access clients to Windows systems.- Affects Windows users receiving Outlook phishing emails; Huntress observed several affected endpoints plus 22 more in a retroactive hunt, campaign active since September 10, 2026.
- Attackers host a blurred fake 'Download Reference' form on the legitimate app.powerbi.com domain, letting the link bypass Microsoft 365 mail filtering and secure email gateways.
- Clicking the button opens attacker-controlled staging pages (dailylifeproject[.]site, burnsworth[.]site, essaywritingservice[.]site, openpediatrics[.]site) that fingerprint OS, browser, user-agent, and automation signs, sending victim telemetry to a Telegram bot.
- A delayed script clicks a hidden link to download a ScreenConnect installer from the hamham27[.]screenconnect[.]com tenant; a second client connects to onthegotree[.]site infrastructure.
- A PowerShell script (SCAutoFix.ps1) installs the second client and uninstalls the first, alongside HideUL_x64.exe evasion tooling and a scheduled task (SCAutoRepairEvery2Min) re-running the script every two minutes.
Sources 📄 Source: huntress.com · 📎 Coverage: itsecurityguru.org · 👁 via Cyber Security News, cryptika.com (discovered)
📋 ADVISORIES
- Let's Encrypt cuts default TLS certificate validity to 64 days starting February 2027
Let's Encrypt will issue 64-day TLS certificates by default starting February 10, 2027, down from 90 days.- Applies to all Let's Encrypt subscribers; those already using optional 45-day or 6-day certificates are unaffected.
- From February 10, 2027, all newly issued and renewed certificates will have a 64-day validity period; the last 90-day certificate is expected to expire May 11, 2027.
- Staging environment switches to 64-day certs on October 14, 2026 for testing; 45-day defaults are planned for 2028.
- Clients with automated renewals supporting ACME Renewal Info (ARI) need no changes; setups with hardcoded renewal offsets (e.g., 83, 80, or 60 days) must update to renew at about two-thirds of the lifetime.
- The authorization reuse period will shrink from 30 days to 10 days, then to seven hours in 2028; ACME endpoints, issuance chains, and rate limits are unaffected.
📋 ADVISORIES
📄 Source for iRhythm data breach affects at least 360,000 cardiac monitor patients — d18rn0p25nwr6d.cloudfront.net
📄 Source for Dell patches critical path traversal flaw (CVE-2026-86360) enabling root RCE in Dell System Update — dell.com
📄 Source for CVE-2026-91768: PHP-FPM FastCGI allowed_clients compared only 96 of 128 IPv6 bits — github.com
🔓 CVEs & KEV
CVE-2026-93582 — OTRS GmbH (former OTRS AG) OTRS — CVSS 9.4 — OTRS Community Edition Unauthenticated Remote User Impersonation via Crafted Header
CVE-2026-1907 — Kong Enterprise Gateway — CVSS 7.5 — SQL Injection in Clustering Communication (Hybrid Mode)A SQL Injection (SQLi)...