Cyber Threat Intelligence Digest: Week 42

Executive Summary -
Highlights of Cyber Threat Intelligence Digest

Vulnerabilities

Curl Project Patches CVE-2026-92392 Use-After-Free Vulnerability - On 14 October 2026, the curl project patched CVE-2026-92392, a high-severity use-after-free vulnerability affecting curl versions 8.12.0 to 8.22.0, excluding patched maintenance releases. The project fixed the vulnerability in version 8.23.0, with fixes also available in versions 8.14.3, 8.16.2 and 8.20.2 for their respective release branches. Security researchers have demonstrated remote code execution (RCE) under specific conditions. At the time of writing, there are no reports of active exploitation.

CVE-2026-92392 affects HTTP/2 uploads in curl and its underlying library, libcurl. The vulnerability stems from improper memory handling when processing certain HTTP/2 stream reset responses, which results in access to previously freed memory. Successful exploitation allows threat actors controlling a malicious server to execute arbitrary code on an affected system. However, achieving RCE requires specific knowledge of the target’s software environment, system architecture and memory layout.

Adobe Patches RCE Vulnerability CVE-2026-103849 Affecting Adobe Commerce and Magento Open Source - On 13 October 2026, Adobe patched a remote code execution (RCE) vulnerability tracked as CVE-2026-103849. It affects Adobe Commerce versions 2.4.9-2026-sep and earlier, Adobe Commerce B2B versions 1.5.3-2026-sep and earlier, and Magento Open Source versions 2.4.9-2026-sep and earlier. Successful exploitation could allow unauthenticated threat actors to achieve RCE. At the time of writing, there are no reports of the vulnerability being exploited in the wild.

To prevent exploitation of CVE-2026-103849, update Adobe Commerce to version 2.4.10-alpha1 or later, Adobe Commerce B2B to version 1.5.4-alpha1 or later, and Magento Open Source to version 2.4.10-alpha1 or later.

Horizon3 Releases PoC for FortiSIEM Vulnerability CVE-2026-106173 - On 20 October 2026, Horizon3.ai published technical details and released a proof-of-concept (PoC) exploit for CVE-2026-106173, a critical path traversal vulnerability affecting Fortinet FortiSIEM version 7.5.0. Fortinet initially disclosed the vulnerability on 13 October 2026 and patched it in FortiSIEM version 7.5.1 and later. At the time of writing, Horizon3.ai has not reported any known instances of active exploitation.

Unauthenticated threat actors can exploit the phQueryMaster gRPC service on TCP port 27918 to write arbitrary files to affected servers. Successful exploitation allows threat actors to overwrite existing system scripts and abuse scheduled tasks to execute arbitrary code remotely.

Potential Threats

Threat Actors Exploit Siemens Software Center Vulnerability CVE-2026-110936 in Romulus ClickFix Campaign - On 19 October 2026, Siemens reported active exploitation of CVE-2026-110936, an uncontrolled search path element vulnerability in Siemens Software Center versions prior to 4.0.9.8 that enables arbitrary code execution via DLL side-loading. Threat actors associated with the multi-platform “Romulus” ClickFix campaign reportedly exploited the vulnerability using a legitimate, digitally signed copy of Siemens Software Center version 3.5.8.7 alongside malicious DLL files. According to Siemens, the vulnerable application loads files from its local directory without validating them, enabling threat actors to execute malicious code embedded within the supplied DLLs. Observed indicators of compromise (IoCs) included IP address 96[.]62[.]218[.]59 and domain wizardexpensive[.]com, tied to payload hosting and command-and-control (C2) operations. Siemens also identified the now-inactive IP address 2[.]27[.]248[.]127 as the distribution channel for the malicious AllMyBasic.msi package, and noted that it found no evidence of compromise affecting its own systems, products or official update channels.

Siemens advised organisations to update Siemens Software Center to version 4.0.9.8 or later, block the identified malicious infrastructure and review logs for related activity. Siemens also recommended isolating affected systems, terminating malicious processes, removing associated persistence mechanisms, resetting passwords and following established incident response procedures.

Threat Actor Harvests Decoy Credentials and Attempts AI Agent Hijacking on Flowise Honeypot to Support iGaming Reconnaissance - On 19 October 2026, Sekoia published an analysis of an attack against its Flowise honeypot, which emulated version 2.2.8 without executing code or running a real LLM. In late August 2026, the threat actor fingerprinted the instance, enumerated workflows and retrieved simulated OpenAI, Anthropic and PostgreSQL credentials via unauthenticated API requests resembling CVE-2024-31621 behaviour, although that flaw was fixed in version 1.6.6 and not exploited here. They then created a workflow named System Status containing an HTTP Request node calling hxxp://154[.]217[.]251[.]226:19999/flowise-hb, the attack’s origin IP, which Sekoia assessed as a potential persistence or exfiltration mechanism.

The threat actor also attempted to hijack the simulated agent through command execution, system prompt disclosure, memory poisoning and requests disguised as authorised assessments, before trying to use it as an offensive assistant against Nightingale and Redis infrastructure linked to playz-prod online gambling platforms, including 98br[.]org, 98br[.]game, gr99[.]top and 11kk[.]co. Shodan data confirmed the targeted IP exposed an unsecured Redis service containing the exact keys the threat actor submitted. Sekoia assessed the activity likely involved a Chinese-speaking cybercriminal targeting iGaming infrastructure in Hong Kong and Taiwan, but could not attribute it to a known group.

Threat Actors Abuse RMM Software to Deploy Casbaneiro Banking Trojan and Malicious Browser Extension - On 13 October 2026, Palo Alto Networks’ Unit 42 reported a campaign distributing the Casbaneiro banking trojan, also known as Metamorfo and Ponteiro, alongside a malicious Chromium browser extension via abused remote monitoring and management (RMM) software. Phishing emails instruct victims to install a legitimate ScreenConnect client from a threat actor-registered trial tenant, through which the threat actors use PowerShell to stage the extension under C:\chrome\ and retrieve a signed Caphyon Advanced Installer utility, VmLauncher.exe, and a malicious DLL from hxxps://euromasterx[.]com. The DLL is renamed zlibai.dll and placed alongside the executable under C:\Docstar\ for DLL sideloading, after which it patches the host’s entry point in memory, decrypts a command string via a custom XOR routine and executes it. The Delphi banking trojan communicates with 190[.]2[.]184[.]201 over ports 8082 and 8398.

It is managed through a node.js panel named Painel Gangster, whose target list includes approximately 65 Portuguese and Brazilian banking portals and eleven cryptocurrency-related targets. The extension and banking trojan use separate C2 infrastructure hosted by different providers, supporting parallel browser manipulation and banking trojan operations.

General News

Zero-click spyware infecting devices through online ads - Parallel investigations by the Citizen Lab and Confiant documented how Israel-based purported advertising firm Discover-Tech used digital ads to deliver zero-click spyware, infecting devices used by at least 45 Al Jazeera journalists. Discover-Tech allegedly worked with Israeli spyware company Candiru, blacklisted by the US Commerce Department in 2021, using its Controlium platform to deanonymise, fingerprint and automatically infect devices the moment an ad renders. Controlium enables call recording, microphone activation and theft of messages and emails, and has been used against journalists, dissidents and embassy staff. The Citizen Lab found the malicious ads appeared on Android and iOS apps and nearly 200,000 websites over four months, while Confiant found evidence they rendered on networks belonging to the US Department of Defense, Estonia’s Information System Authority (RIA), the IAEA, the International Criminal Court and NATO.

Discover-Tech also reportedly gave other Israeli spyware companies access to Google and Yandex ad platforms, and has since been blocked by Google and other major platforms. A separate threat actor, dubbed Dark Cartographer, reportedly used the platform to link advertising IDs to phone numbers via mobile carrier vulnerabilities, facilitating mass deanonymisation. The research provides the first technical evidence that ad tech can facilitate spyware delivery, and the Citizen Lab urged ad vendors to strengthen threat detection and rigorously vet their partners and supply chains.

UK Legal Aid Agency hack worse than thought, with stolen records dating back to 1978 - On Wednesday, UK officials confirmed that a cyberattack on the Legal Aid Agency (LAA) exposed far older and broader records than previously disclosed. Initially believed to affect people who had used the agency’s online service since 2010, the breach is now known to include approximately 250,000 records predating 2007, with the earliest dating from 1978, as well as probation data covering names, dates of birth, nationalities and case reference numbers. The Justice Minister told Parliament that criminals exploited vulnerabilities in the LAA’s IT systems to access and exfiltrate personal data. Stolen information varies by case but can include full names, dates of birth, National Insurance numbers, postcodes, equality monitoring codes, financial assessments, bank account and property details, partially redacted payment card details, and the names of judges, lawyers and court reporters involved in Crown Court trials.

The agency said the breach was difficult to assess because much of the stolen data was unstructured, fragmented or incomplete. The threat actors had claimed to hold data on more than 2 million people and threatened to release it unless paid, in line with the government’s longstanding refusal to pay extortion demands. The Justice Minister stated there is no indication the data has been published or shared, and that the ministry has since strengthened authentication and access controls, improved security monitoring and begun retiring or isolating higher-risk legacy systems. The ministry continues to work with the National Crime Agency, the National Cyber Security Centre and the Information Commissioner’s Office.

PHP warns admins of two critical flaws - On 20 October 2026, the PHP security team warned administrators to prepare for emergency security updates on 21 October 2026 at 14:00 UTC to address two critical vulnerabilities, each rated 9.2 under CVSS v4.0, after details reportedly leaked ahead of their scheduled disclosure. The PHP team has not disclosed technical details, affected versions or fixed releases, and stated it may release earlier if details become public or exploitation is observed. Researchers at watchTowr reported that the vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619 and dubbed “PHP2SHELL”, are remote code execution (RCE) flaws believed to affect PHP versions 5, 6, 7 and 8, and claimed to have reproduced CVE-2026-109618. Both watchTowr and a now-deleted Hacker News post described the flaws as CVSS 10.0, differing from PHP’s official rating.

On 21 October 2026, Cloudflare released an emergency update to its managed Web Application Firewall (WAF) ruleset, available to all customers including those on free plans, and its CTO stated the company is already observing early attacks. Researchers have suggested disabling PHP’s session upload progress feature via session.upload_progress.enabled = Off in php.ini and blocking HTTP requests using the multipart/form-data content type, although these have not been verified and blocking multipart requests may disrupt form submissions and file uploads. A PHP core developer warned that no mitigations exist and that applying the official security updates is the only solution, so organisations should treat all workarounds and WAF protections as temporary measures only.

Threat Actor Weekly Graph

Over the past 7 days, we have been tracking the following intent and opportunity changes within our Threat Actor Landscape.

Intent represents the potential targets of a group. When a group is observed attacking a different organisation or entity, their intent will increase.

Opportunity represents the various methods and technologies these groups may use. For example, if a group started using a new attack vector, such as a new kind of ransomware, their opportunity would increase.

Both intent and opportunity are scored out of 100 and are responsible for scoring the group's severity. These updates can be seen below.