Cyber Threat Intelligence Digest: Week 43

Executive Summary -
Highlights of Cyber Threat Intelligence Digest

Vulnerabilities

Researchers Disclose EDK II Flaw CVE-2026-97631 - On 28 September 2026, researchers disclosed CVE-2026-97631, a critical buffer overflow in TianoCore EDK II’s PXE Base Code driver (NetworkPkg/UefiPxeBcDxe). The advisory lists EDK II master as of 14 September 2026 as affected, with no patched release, and there is no evidence of active exploitation. The flaw lies in the handling of ICMP error messages during IPv4 or IPv6 network boot: the driver copies incoming messages into a fixed 504-byte Mode.IcmpError field, but both PxeBcIcmpErrorDpcHandle and PxeBcIcmp6ErrorDpcHandle mishandle oversized messages, and their copy loops advance the destination pointer by cumulative rather than individual fragment lengths, allowing attacker-controlled bytes to overwrite adjacent memory.

Exploitation can corrupt the driver’s private context and trigger a DXE core CPU exception when a further ICMP error is processed, hanging the boot and disrupting provisioning or recovery. An attacker familiar with the target firmware build could instead embed a counterfeit event in the crafted message, causing CoreSignalEvent() to execute malicious code with firmware-level privileges before the OS loads or its components are verified or measured. The initial payload runs once, so persistence would require additional changes. Delivery requires a unicast ICMP error reaching the client during its PXE boot window, from any network distance where that traffic can arrive, and code execution depends on build-specific knowledge such as memory addresses rather than a universal exploit. Systems booting solely from local storage are not exposed, and use of EDK II by a vendor does not by itself mean every product is affected.

Arista Patches Actively Exploited VeloCloud Orchestrator Vulnerability CVE-2026-114625 - On 22 October 2026, Arista Networks patched an actively exploited flaw, CVE-2026-114625, affecting VeloCloud Orchestrator (VCO) On-Prem deployments in versions 5.2.x before 5.2.3.18, 6.1.x before 6.1.3.10, and 6.4.x before 6.4.2.12. VCO provides a web-based interface for configuring, monitoring and managing VeloCloud software-defined wide area networks (SD-WANs) and associated edge devices. CVE-2026-114625 is a critical SQL injection vulnerability that could allow an authenticated threat actor to elevate privileges, impersonate a local superuser operator and access internal functionality that should not be remotely accessible. Exploitation requires network access to the VCO web interface and a valid authenticated session, with Enterprise Read Only, the lowest built-in tenant role, providing sufficient privileges. Successful exploitation could compromise the VCO host and the confidentiality, integrity and availability of data managed by the orchestrator.

Hosted VCO deployments, including Dedicated environments, were also affected and have already been patched, whilst Arista listed VeloCloud Gateway, VeloCloud Edge and EOS-based products as unaffected. Arista identified 74[.]82.197.86 and 38[.]54.50.151 as source IP addresses associated with exploitation and recommended blocking them and reviewing logs for related activity.

Wasmtime Patches Two Critical Vulnerabilities CVE-2026-115893 and CVE-2026-115889 in Cranelift Compiler Allowing WebAssembly Sandbox Escapes - On 19th and 20th of October 2026, Bytecode Alliance’s Wasmtime patched CVE-2026-115889 and CVE-2026-115893, two critical vulnerabilities in the runtime’s default Cranelift compiler backend. Both could allow a threat actor-controlled WebAssembly module to escape its sandbox, although exploitation requires a vulnerable Wasmtime deployment to compile the malicious module. The flaws were patched in versions 36.0.19, 48.0.7 and 49.0.4, and Wasmtime 50.0.0 also includes the fixes. There is no evidence of active exploitation at the time of writing.

CVE-2026-115889 affects Wasmtime versions earlier than 36.0.19 and versions 37.0.0 through 42.x across all architectures. Cranelift packed static single assignment (SSA) value indices into 24-bit fields, allowing oversized values to overflow silently in release builds, meaning a sufficiently large or specially crafted function could cause incorrect value references, miscompilation, type confusion and a sandbox escape. CVE-2026-115893 affects ARM64/aarch64 deployments running versions earlier than 36.0.19, versions 37.0.0 through 48.0.6, and versions 49.0.0 through 49.0.3, and dates back to the introduction of ARM64 support in 2020. A Wasm br_table instruction containing more than approximately 256,000 targets could exceed the roughly 1 MiB reach of a conditional branch generated by Cranelift, with the resulting incorrect branch target redirecting execution to code at a threat actor-controlled offset and enabling a sandbox escape. The patched versions address this by changing branch handling and rejecting br_table instructions containing more than 65,520 targets.

Potential Threats

Malicious GitHub Repositories Abuse VSCode Terminal Configurations to Deploy Data-Stealing Backdoor - On 23 October 2026, SlowMist published an analysis of malicious GitHub repositories abusing Visual Studio Code (VSCode) workspace terminal configurations to deploy a data-stealing backdoor targeting Web3 developers. The campaign centres on Hylance/sol-live, a fake Solidity interview preparation repository, with eight further repositories identified. Malicious commands are hidden in .vscode/settings.json under legitimate terminal names and padded with spaces to evade notice. Once a developer launches the terminal, the command installs Node.js dependencies if needed and writes a loader that retrieves obfuscated JavaScript from hxxps://www[.]enabledomain[.]app/api/ip-check-encrypted/3aeb34a36 and executes it via eval, spawning three hidden background modules.

The browser theft module collects credentials and wallet extension data from thirteen Chromium-based browsers, alongside the macOS keychain, uploading it to 172[.]86[.]112[.]107:8085/upload. The file scanning module harvests documents, .env files, seed phrases, private keys and wallet data, uploading them to 172[.]86[.]112[.]107:8086/upload. The remote control module registers with 172[.]86[.]112[.]107:8087 and establishes a WebSocket connection supporting file enumeration and retrieval, arbitrary command execution, interactive shell sessions and clipboard monitoring, with the C2 server also able to start or stop the other modules.

Threat Actor Abuses Microsoft 365 SSPR to Compromise Cloud Identity, Download SharePoint Files, and Export ServiceNow User Records - On 19 October 2026, Sophos X-Ops published an analysis of an identity-based intrusion that abused Microsoft 365 self-service password reset (SSPR) to compromise a user account and access multiple cloud applications. The threat actor gained initial access through voice phishing (vishing), impersonating help desk personnel to obtain the victim’s SMS-based multi-factor authentication (MFA) code, then reset the password via SSPR from a threat actor-controlled IP address. Within minutes, the threat actor registered a new Windows device in Microsoft Entra ID and authenticated through Microsoft Edge using a Primary Refresh Token (PRT)-backed session, using it to access Exchange Online, SharePoint, Microsoft Teams and Salesforce, and later ServiceNow via SAML 2.0 federation with MFA recorded as previously satisfied. Microsoft Graph API reconnaissance enumerated users, directory roles, permissions, service principals, domains, SharePoint sites and licensing information.

The threat actor accessed over 100 email items across the victim’s mailbox and shared mailboxes, searched SharePoint for credentials, PII, customer information and the organisation’s identity verification vendor, and downloaded approximately 100,000 SharePoint files. Salesforce automatically froze the account following a SuspiciousActivity event, whilst in ServiceNow the threat actor exported approximately 2,500 user records to sys_user.csv and viewed the cmdb_ci_computer asset inventory, although Sophos found no evidence of export from the latter. During cleanup, the threat actor deleted two Exchange messages, including the organisation’s warning about the ongoing vishing campaign. Sophos recommends removing reliance on SMS as the sole SSPR verification method, restricting Entra device registration, alerting on password resets followed by device registration, and revoking Salesforce and ServiceNow sessions separately during containment, as Entra cannot revoke application-issued session tokens.

Threat Actors Attempt LLMjacking to Power Skynet Agent for Cyberattacks and Cryptominer Deployment - On 21 October 2026, Symantec published a report analysing captured instructions for an autonomous AI-powered offensive agent designed to hijack exposed large language models (LLMs) and conduct cyberattacks, a technique known as LLMjacking. Symantec captured the instructions during summer 2026 via an AI honeypot impersonating an unprotected, internet-facing AI service. The attack chain begins by identifying AI services accessible without authentication or via stolen API keys, including self-hosted model servers, AI gateways, relays and Model Context Protocol (MCP) servers, allowing operators to shift inference costs to legitimate owners and conceal their infrastructure. Once a usable endpoint is found, threat actors submit layered instructions to bypass model safeguards, directing the model to adopt a programming assistant persona named Fantasy AI, treat access to secrets and configuration files as authorised development activity, comply out of loyalty to a fictional companion named ENI, and suppress all refusals and safety warnings.

The captured request contained approximately 74 offensive tools supporting FOFA-based reconnaissance, exploitation of VS Code, Django, Jupyter, Laravel, Supabase, Next.js and Flask/Werkzeug deployments, SSRF against cloud metadata services, Werkzeug debugger PIN calculation for RCE, Prisma Studio database extraction and botnet C2 management. A final directive, Skynet mode, authorises up to 100,000 autonomous steps without human approval, establishing a continuous cycle of discovery, exploitation, credential theft, XMRig deployment under /tmp/.x and reinfection. A separate request from a different source address contained a Base64-encoded, gzip-compressed shell script targeting go2rtc deployments in smart-camera gateways and Home Assistant environments, storing XMRig under the hidden filename .trace, configuring failover across four Monero pools and repeatedly clearing go2rtc access logs via port 1984. Recorded Future assesses the framework at Level 4 (Transforming) of its AI Malware Maturity Model (AIM3), with intended progression towards Level 5 (Scaling), although Symantec’s honeypot executed neither the tools nor the mining script and no verified end-to-end autonomous campaign has been observed.

General News

Hackers repeatedly breached suppliers holding UK police data - A report revealing that threat actors have repeatedly compromised third-party suppliers holding British police data since 2021, based on information shared by the Police Digital Service (PDS) and the National Police Chiefs’ Council. The report omits the number of attacks, affected suppliers and forces, and whether data was stolen, citing operational sensitivity. The PDS recorded 252 cybersecurity incidents affecting policing in the first quarter of 2026, including malware attacks, unauthorised access attempts and accidental disclosures, alongside 796 near misses. The PDS identified supplier-held police data as among the sector’s biggest risks, as it sits outside its monitoring, particularly where suppliers handle information on victims, safeguarding, intelligence and investigations. Inspectors found that most supplier contracts lacked ongoing cybersecurity assurance, incident reporting obligations were sometimes unclear, and supplier system logs were often not visible to in-house teams.

The inspectorate also criticised the government for excluding policing and fire services from the National Risk Register 2025, the Government Cyber Action Plan and the Cyber Security and Resilience Bill, with no official able to explain the omission. Publicly known incidents within the timeframe include the 2023 ransomware attack on ID card maker Digital ID, which exposed Metropolitan Police and Greater Manchester Police personnel details, the July 2026 theft of officer and staff contact details from the Police National Legal Database, and a September 2026 cyberattack disrupting Dyfed-Powys Police’s non-emergency systems. Internationally, Dutch police attributed a 2024 breach of officer contact details to a likely state actor, and the FBI disclosed third-party access to a network holding wiretap data, reportedly suspected to be the work of China. His Majesty’s Inspector of Constabulary, [name masked], described the threat as significant and rapidly expanding, warning that a major cyberattack is a realistic prospect.

INTERPOL-Led Operation Serengeti III Dismantles Cybercriminal Networks Across Africa - On 22 October 2026, INTERPOL reported that Operation Serengeti III led to the arrest of 1,462 suspects, the disruption of 10,909 malicious networks and the recovery of more than $105 million in illicit funds. Law enforcement agencies from 21 countries conducted the operation across Africa between 29 June and 31 August 2026, targeting cybercriminal activity involving ransomware, business email compromise (BEC), cyber-enabled fraud and digital extortion. Authorities identified 65,929 victims and estimated financial losses at more than $385 million. In Uganda, authorities dismantled two fraud networks and arrested 365 foreign nationals linked to investment and pension schemes targeting entities in Asia, which relied on rotating call centres, scripted communications, fraudulent trading platforms and spoofed websites. In Angola, investigators took down two illicit cryptocurrency mining centres, arrested nine suspects, and seized more than 2,000 mining devices and six illegal power stations, with the electrical infrastructure valued at more than $1 million.

In Nigeria, law enforcement arrested a suspect linked to a phishing and BEC operation that harvested software credentials and collected approximately 2.1 million email addresses, whilst a separate investigation into investment fraud promoted through messaging applications led to another arrest and the tracing of more than $2.4 million in suspected criminal proceeds, most of which was laundered via cryptocurrency transactions. Additional actions disrupted a mobile loan application scam in Tanzania and social media-based vehicle import fraud in Gabon, and authorities arrested 30 suspects in the Republic of Congo. Private-sector partners, including Group-IB, Team Cymru, Kaspersky and Fortinet, provided threat intelligence and technical expertise to support the investigations. Several investigations remain active, with authorities seeking to identify additional suspects, trace proceeds and analyse seized digital evidence.

PHP says AI review of critical bugs first sparked alarm in August, but signs surfaced in 2024 - On Wednesday, the PHP Foundation published a statement explaining the history of CVE-2026-109618 and CVE-2026-109619, two vulnerabilities collectively dubbed PHP2Shell that sit in parts of PHP touched by nearly every request. CVE-2026-109618 was first identified during an external security audit in 2024, but work on a fix repeatedly stalled as the consensus-driven security team struggled to choose between options that risked backward compatibility breaks, new denial-of-service potential or widespread changes to third-party extensions, compounded by the lack of a known remote code execution path and limited core developer capacity. The issue resurfaced after AI code review tools from Anthropic and OpenAI were used to scan PHP platforms earlier in 2026, with a researcher at Calif reporting the bugs on 11 August, and OpenAI, Wiz and Trail of Bits independently identifying the same flaws. Emergency patches covering PHP 8.2 and later were released on Wednesday morning, with older versions no longer supported.

The disclosure caused hundreds of websites to be taken offline by companies and governments, with Cloudflare observing attempted exploitation. VirusTotal analysis identified 5.1 million IP addresses running PHP, including at least 758,000 running end-of-life versions, although these figures reflect internet-facing footprint rather than confirmed vulnerable systems, and Cisco Talos estimated that roughly 50% of vulnerable systems may not receive a patch. The foundation stated that its coordinated disclosure was disrupted when rumours emerged on social media, prompting it to bring disclosure forward by one day, after Calif mistakenly published a video showing its proof of concept working against several targets, which accelerated PoC development despite being deleted. The foundation also alleged that Chainguard unilaterally broke the embargo by publishing patched images early on Wednesday, allowing attackers to study the fix in binary form before public release. The PHP Foundation has since outlined numerous internal structural changes to ensure serious vulnerabilities with stalled fixes are escalated to leadership far sooner.

Threat Actor Weekly Graph

Over the past 7 days, we have been tracking the following intent and opportunity changes within our Threat Actor Landscape.

Intent represents the potential targets of a group. When a group is observed attacking a different organisation or entity, their intent will increase.

Opportunity represents the various methods and technologies these groups may use. For example, if a group started using a new attack vector, such as a new kind of ransomware, their opportunity would increase.

Both intent and opportunity are scored out of 100 and are responsible for scoring the group's severity. These updates can be seen below.