@2Workly

Helping SOC, detection, and CTI teams stay ahead with cybersecurity news, CTI reporting, and IOC coverage they can act on.

2workly.com
Joined August 2026
  • Tweets982
  • Following0
  • Followers2
Cloudflare logged millions of exploitation attempts within hours of PHP2Shell disclosure. As exploit discovery accelerates, perimeter exposure windows collapse. Enforce edge blocks early. Source: CTI desk wired.com/story/kernel-panic… 2workly.com

The PHP Meltdown Shows How AI Makes Bugs More Exploitable

Security researchers used AI tools to help uncover years-old vulnerabilities in the PHP web scripting language. Then the AI-assisted attacks began.

wired.com
1
LiteLLM hijacked to push poisoned v1.107.0 via an unrevoked master key. Attacker exfiltrated secrets via CI workflows to webhook[.]site and beaconed to litellm[.]dev. Block the IOCs: thehackernews.com/2026/10/le… Intel: 2workly.com #2workly

Leaked LiteLLM Master Key Let Attackers Steal GitHub Tokens and Hijack Release Pipeline

An unrevoked LiteLLM master key enabled GitHub token theft and a malicious PyPI release that steals credentials and installs a backdoor.

thehackernews.com
Eye Security neutralized CVE-2026-30612 (CVSS 9.8), an RCE risk in legacy Time4Popcorn updaters running as root/SYSTEM. Hunt for Updater.exe, PT.updd, and egress to popcorntimeupd[.]xyz. Details: Intel thehackernews.com/2026/10/re… 2workly.com

Researchers Push Over 2 Million Updates to Remotely Disable Popcorn Time Updater That Could Fuel a...

Eye Security sent over 2 million updates to disable Time4Popcorn's vulnerable updater, which could install unverified code with elevated privileges.

thehackernews.com
2
CVE-2026-111497 in Google's Brotli decoder impacts Node.js, Bun, Envoy, and Python. Crafted compressed streams allow memory corruption via incoming requests or client fetches. Patch runtimes or block thehackernews.com/2026/10/br… 2workly.com

Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software

Brotli decoder flaw CVE-2026-111497 affects Node.js, Bun, Python packages and Envoy; code execution was demonstrated on one Node.js build.

thehackernews.com
3
CISA added CVE-2026-110447 (Nextcloud/Collabora RCE) and CVE-2026-114625 (Arista VeloCloud SQLi) to KEV. Arista tracks active abuse from 74.82.197[.]86 and 38.54.50[.]151. Block inbound and patch edge thehackernews.com/2026/10/ci… 2workly.com

CISA Flags Two Actively Exploited Critical Flaws in Collabora Online and Arista VeloCloud

CISA adds exploited Collabora Online and Arista VeloCloud flaws to KEV, with federal agencies directed to patch by October 26.

thehackernews.com
1
Ransomware affiliates deployed the Phantom framework to target edge systems (SimpleHelp, Fortinet). Attackers leveraged RevSocks tunnels and zam64.sys BYOVD evasion. Details: thehackernews.com/2026/10/ex… Intel: 2workly.com #2workly

Exposed Infrastructure Reveals How Ransomware Affiliates Used AI Agents to Execute Intrusions

Ransomware affiliates used human-approved AI workflows to exploit edge systems, steal data, and target an estimated 62 organizations.

thehackernews.com
The FCC banned video transmitters and dashcams using Huawei HiSilicon surveillance chips under expanded supply chain rules. Defenders must audit underlying IoT chipsets, not just chassis brands. therecord.media/fcc-bans-dev… 2workly.com #2workly

FCC bans two devices with surveillance chips linked to Huawei

The banned items — a wireless video transmitter and dashboard camera — are made with chips manufactured by Huawei subsidiary HiSilicon, which markets its products as “designed for the surveillance...

therecord.media
Candiru delivered zero-click spyware through ad networks via Discover-Tech. Treat ad exchanges as untrusted code delivery: enforce DNS-level ad blocking and strip MAIDs. Read: cyberscoop.com/targeted-ads-… CTI desk: 2workly.com #2workly

Senators say targeted ads are a security risk. Ad groups say the critics are off base.

A Citizen Lab report linking ad vendor Discover-Tech to mercenary spyware sparks renewed calls for U.S. agencies to ban targeted ads on government devices.

cyberscoop.com
Metasploit added exploit modules for Langflow (CVE-2026-93680, CVE-2026-0768) and OpenCTI pre-auth RCE (CVE-2026-27960/39980). Patch internal LLM stacks and CTI servers before scanning ramps up. Details rapid7.com/blog/post/pt-meta… 2workly.com

Metasploit Wrap Up: Langflow, MongoDB, and More

This release adds multiple new modules, and 6 of those modules point at a single target: Langflow, the open-source LLM workflow builder. Together they cover an authentication bypass (CVE-2026-93680),...

rapid7.com
CVE-2026-73570 allows unauthenticated RCE in Zimbra via Swatchdog log parsing. Note that public PoCs often fail to match the trigger. Detect shells spawning non-snmptrap binaries. elastic.co/security-labs/thr… 2workly.com #2workly

Zimbra command injection vulnerability, CVE-2026-73570

A single malformed email address turns a Zimbra log file into code execution. How the command injection vulnerability works, plus the detection rule.

elastic.co
Broker k0t breached Fortinet and Palo Alto edge devices via CVE-2025-64446 and CVE-2026-0257, leaking 70k+ credentials. Monitor perimeter hosts for OpenConnect, Atera, and Rclone. Source: thehackernews.com/2026/10/ha… 2workly.com #2workly

Hackers Breach Enterprise Firewalls and VPNs, Exposing Over 70,000 Credentials

A campaign attributed to k0t exploits exposed network devices, establishes persistent access, and exfiltrates data using Rclone.

thehackernews.com
3
Botnet operators are weaponizing PHP2Shell (CVE-2026-109618 / CVE-2026-109619) to drop Mirai variants. With ASLR bypass exploits now appearing, unpatched PHP servers face immediate scanning. Details: Intel securityweek.com/mirai-botne… 2workly.com

Mirai Botnet Operators Join PHP2Shell Attacks as ASLR Bypass Exploits Emerge

Researchers tie PHP2Shell attempts to a Mirai botnet and show an ASLR bypass, but no successful compromise has been confirmed yet.

securityweek.com
UAC-0099 deployed MythicRatatoskr, routing C2 traffic over the Yggdrasil mesh network before handing access to Sandworm for GPO-driven SDelete wiping. Watch for unauthorized P2P mesh overlays on endpoints thehackernews.com/2026/10/ru… 2workly.com

Russian-Linked Hackers Used New Mesh Network Backdoor in Destructive Ukraine Attack

Sandworm wiped a Ukrainian logistics firm in September 2025 after UAC-0099 gained access and deployed a new Yggdrasil-based backdoor.

thehackernews.com
1
Default x402 SDK clients lacked spending limits, allowing malicious APIs to drain automated AI agent wallets. Silent fixes leave npm audit and PyPI blind. Update TypeScript and Python packages to 2.23.0+ thehackernews.com/2026/10/cr… 2workly.com

Critical x402 SDK Flaw Could Let Malicious APIs Drain AI Agents’ Token Balances

Three patched x402 flaws could expose auto-signing agents to full-balance payments, let Solana transactions bypass payment, or relay wallet logins.

thehackernews.com
BeyondTrust Remote Support CVE-2026-102764 has been exploited as a zero-day since late Aug. GTIG ties it to suspected PRC-nexus ARMORY CASTLE. In CISA KEV since Oct 16. Patch BT26-05, then hunt the admin plane: 2workly.com/insights/beyondt…

BeyondTrust Remote Support CVE-2026-102764:

CVE-2026-102764 in BeyondTrust Remote Support was exploited as a zero-day. What attackers did inside the appliance, sourced IOCs, and how to hunt it.

2workly.com
2
Atlassian patched 75 third-party vulnerabilities across Data Center and Server products, including six critical flaws in Tomcat, Netty, and Bouncy Castle. Update Confluence and Jira instances. Details securityweek.com/atlassian-p… 2workly.com

Atlassian Patches 75 Third-Party Flaws in Data Center and Server Products

Atlassian’s October bulletin lists 176 vulnerability entries, including 14 critical-severity issues, all in third-party components.

securityweek.com
2
Researchers proved Node2Shell RCE via the Node.js Brotli decoder (CVE-2026-111497). It triggers via Express 5 bodies or outbound fetch() calls. WAFs miss outbound responses; patch runtimes to 24.22.1 thehackernews.com/2026/10/re… 2workly.com

Researchers Demonstrate Node2Shell RCE Exploit on Node.js Build Using Crafted Brotli Data

Imperva demonstrated code execution via crafted Brotli data on an official Node.js 24.22.0 Linux arm64 image; Node.js has issued fixes.

thehackernews.com
21
Attackers are targeting PHP2Shell (CVE-2026-109618/CVE-2026-109619) to deploy the Potassium Mirai botnet. Block C2 134.199.154[.]64 and patch PHP to supported branches now. Intel: 2workly.com Source: thehackernews.com/2026/10/ph… #2workly #CTI

2Workly - Cyber Threat Intelligence Platform

2Workly - Cyber Threat Intelligence Platform. Independent cybersecurity and cyber threat intelligence reporting — threat campaigns, indicators of compromise (IOCs), detection, and enforcement — for...

2workly.com
3
Iran's Prince of Persia (Infy) deployed a Tornado C2 on US shared hosting—its first US node since 2016—while using Telegram bots for exfil. Audit Telegram API egress and shared hosting traffic: Enforce securityweek.com/irans-princ… 2workly.com

Iran’s Prince of Persia APT Hosts C&C in US for First Time Since 2016

After a three-month lull, Prince of Persia hid a Tornado C&C server on US shared hosting, its first US-based server since 2016.

securityweek.com
eMudhra exits global SSL/TLS after 8 intermediate CA private keys were found to be < 256. Chrome and Mozilla distrust emSign ECC Root CA - G3, impacting ~30k certs. Inventory your PKI and replace affected thehackernews.com/2026/10/em… 2workly.com

eMudhra to Exit Global SSL/TLS Business After 8 Intermediate CA Keys Found Easily Guessable

eMudhra plans to exit global SSL/TLS certificates after eight weak CA keys were recovered, as Chrome and Firefox withdraw trust in its ECC root.

thehackernews.com
2
Load more