Drughub vendor usernames now tracked and added to threatactorusernames.com/ #osint #threatintel #cti #cybersecurity #infosec #dnm

... get it while its hot... 😈 > CVE-2026-109618 / CVE-2026-109619 (pre-patch PHP 8.x) > session.upload_progress UAF > jackalsyn.com/posts/php-up-2… > Courtesy of Me, @acd421 & @Archknight23 #CyberSecurity #infosec #php2shell #php

the Everest ransomware group adds 4 victims to their DLS ● PLD Group ● Lindauer Dornier ● Lanham Associates ● Haier

Teamwork makes the dream work. The team and I @J4ck3LSyN @Archknight23 🚨 Heads-up for anyone running PHP: two critical RCE bugs, patch drops tomorrow. The PHP project has confirmed an emergency security release for two critical remote code execution vulnerabilities: CVE-2026-109618 and CVE-2026-109619, both rated CVSS v4.0 9.2. 📅 Patch lands Wednesday, Oct 21 at 14:00 UTC (9:00 AM Central). PHP has reserved the right to ship it earlier if details leak or exploitation shows up. PHP runs about 75% of the web, including WordPress, Drupal, Joomla, Laravel, Magento, and countless custom apps. If you operate a PHP server, this is your weekend-ruiner unless you act. Here's the part the big threat-intel shops aren't shouting about: No official technical details are public yet. But based on my own source-code analysis of php-src, my best assessment (moderate confidence, NOT officially confirmed) is that the vulnerable path is PHP's session.upload_progress / multipart form-data (rfc1867) handling: 🔹 Present since PHP 5.4 🔹 Enabled by default (the compiled-in default is On; the sample php.ini ships it commented out, so stock installs have it live) 🔹 Processes uploaded request data before any of your application code runs, so it's reachable pre-authentication on a default config That lines up exactly with the public breadcrumbs: "affects default installs," "every version since 5.x," "fires before user code." Treat it as a working hypothesis, not gospel. The official advisory supersedes all of this when it lands. ✅ What to do right now: 1. Inventory your PHP. Know every host and version (php -v). Anything on PHP 7.x or older won't get a fix, so plan to upgrade. 2. Apply the stopgap (best-intel, low-risk, reversible). In php.ini / .user.ini / .htaccess: session.upload_progress.enabled = Off Reload PHP-FPM or your web server. My analysis says this closes one of the two likely paths. 3. Clamp multipart uploads at the edge. The second likely path lives in the multipart parser itself, which runs for any multipart/form-data POST regardless of the setting above. If you've got a WAF or reverse proxy, tighten inspection or rate-limit multipart POSTs to endpoints that don't need uploads. This is the same network-layer mitigation the enterprise vendors are quietly deploying for their paying customers. 4. Patch the second it drops. Current stable: 8.5.11 / 8.4.26 / 8.3.35 / 8.2.34. If your hosting is managed, confirm your provider's timeline today. Why I'm posting this for free: A pre-patch mitigation shouldn't be a subscription perk. I'm a one man shop, and the orgs most likely to get burned in the gap between leak and patch are the small teams without an enterprise threat intel contract. The steps above cost nothing. Spend tonight reducing risk, not tomorrow doing incident response. I'll follow up once the official advisory publishes and confirm whether my root cause read was right. Stay patched. 🔒 #PHP #CyberSecurity #InfoSec #RCE #CVE #WordPress #Laravel #ThreatIntel #VulnerabilityManagement #AppSec

I have successfully recreated & lab/field tested CVE-2026-109618 / CVE-2026-109619 > Two heap use-after-free primitives in PHP's `session.upload_progress` handler (`php_session_rfc1867_callback`, ext/session/session.c)... #CyberSecurity #infosec #php #C4b1NKr3W #php2shell

The PHP security team is giving advance notice: Upcoming security release Wed, Oct 21st 2026, 14:00UTC, two critical vulnerabilities, both rated CVSSv4 9.2. PHP users are encouraged to prepare to update. Earlier release if details become public or active exploit evidence.

oh boy

the Dark Project ransomware group lists 3 new victims - Asensus Surgical (615 gb of data) - The Excalibur Group (687 gb of data) - Beach Eye Medical Group (225 gb of data)

when you realize you're entering your PHI into a vibe-coded app at the doctors office... what in the HIPPA breach, get me tf outta here 😬

me when I see an @IntelOpsV3 tweet

🚨 New Research | AI-Driven #Ransomware Operations Exposed We identified an AI-driven intrusion ecosystem associated with INC and The Gentlemen #Ransomware affiliates. The investigation uncovered seven exposed adversary-controlled servers containing AI session histories, operational knowledge bases, credentials, and the source code of #Phantom, an Autonomous Red Team Kill Chain Framework. Key findings: - 62 Identified Victims (36 US-based) -46 customized INC Ransomware encryptor builds - $23K+ in AI service spending - AI session logs and operational knowledge bases - Phantom, Ghost C2, RevSocks, and custom offensive tooling Blog: socradar.io/blog/inc-gentlem… Whitepaper: socradar.io/resources/whitep… #ThreatIntelligence #CTI #ThreatHunting #Malware

some threat actor nerd named Blacknet00 is selling email access to a corporate email account that has 35 gb of "confidential data" and contains 355k emails. they are asking $600.

an initial access broker eforst82 is selling SSL-VPN access to a large corporation in the marine shipping and transportation industry. the corporation is estimated to have $162M in annual revenue. geo: Indonesia. they are asking $2k paid in BTC or XMR.

New: Chinese hackers broke into Staples. Staples has an internal customer support tool called Nexus, Chinese hackers got into that, issued millions of dollars of gift cards. Mules then went on a spending spree across the U.S. Gang made $100 million+ 404media.co/how-a-massive-ch…

the Qilin ransomware group lists several new victims this morning °º¤ø,¸¸, Dental Team FL °º¤ø,¸¸, Johnson & Pace °º¤ø,¸¸, SkyWorld Air Cargo °º¤ø,¸¸, WalkingTree Technologies °º¤ø,¸¸, CREDIN °º¤ø,¸¸, Salauno

Feds Suspect Ransom Negotiator Ran ShinyHunters Extortion Site krebsonsecurity.com/2026/10/…

a threat actor named RustScout is seeking affiliates for their new ransomware as a service (Raas) offerings where they offer a 60/40 split.