threat.wiki

Threat intelligence notes, group profiles, named-person records, and defensive guidance.

Recent entries

• OX Security root-cause teardown: four unauthenticated-critical CVEs landed in one 24-hour window (advisories Sep 8, write-ups Sep 14) — one shared failure, "a component trusting the layer next to it": Netty CVE-2026-75595 (CVSS v4 9.1) — the ClientHello bounds check is computed five bytes short (ignores the 5-byte TLS record header), so a legal fragmented ClientHello raises IndexOutOfBoundsException and the generic handler answers by selecting the default SslContext — an unauthenticated mTLS bypass wherever per-SNI clientAuth=REQUIRE is the sole gate and the fallback is permissive; fixed 4.1.137 / 4.2.17.Final but the fail-open select(ctx, null) handler itself REMAINS — and GitPython CVE-2026-78676 (CVSS 9.8, fixed 3.1.59) — a dormant, spec-compliant multi-line config value (zzz = "A\nhooksPath = ../evil-hooks\") is inert for real git, but GitPython's writer emits embedded newlines unquoted with no continuation backslash, so the next unrelated config write re-serializes it into two options — live core.hooksPath → code execution on the next git operation; the UNSAFE_CONFIG_CHARS_RE guards from FOUR earlier config-injection GHSAs only checked write arguments, never values that entered via _read() from disk; the two Next.js RCEs in the same cluster carry their newly disclosed Windows mechanism (incremental-cache path join escapes every delimiter except the literal backslash, so route segments escape the cache dir on Windows only, disclosing the Server Actions encryption key)
• CrowdStrike Counter Adversary Operations: PhantomRaven — an LLM-generated JavaScript infostealer (high-confidence token-analysis + placeholder-code assessment, author sophistication likely low) distributed through typosquatted npm packages whose operator is a self-proclaimed bug bounty hunter (Bugcrowd/Intigriti/YesWeHack/HackenProof/HackerOne, bounties from ≥9 entities): infect targets via the npm supply chain, then email the victim "discovering" the compromise and collect a bounty for the manufactured finding — the disclosure economy inverted. Delivery = clean placeholder package + HTTP-URL remote dynamic dependency (npm[.]jpartifacts[.]com) whose fetched payload carries a preinstall script — precisely the path npm v12's June 2026 install-script blocking shuts (on npm ≥12 the script is blocked pending npm install-scripts approve); publishers jpdhellonpm1 (transform-jsbi-to-bigint) + jpd15 (sort-imports-es6-autofix) both now 0.0.1-security = taken down; collection = Git/npm config creds + CI/CD env vars for GitHub Actions, GitLab CI, Jenkins, CircleCI; no log-shop sales observed — output feeds bounty submissions. Durable read: a "responsible disclosure" email citing npm dependency confusion can itself be attack stage two — verify compromise claims with independent IR before engaging (CrowdStrike, Sep 15, 2026)
• Mandiant IR case study (AI Risk and Resilience Report 2026, reported Sep 16, 2026): an attacker hijacked an ACTIVE AI coding-assistant session at an unnamed SaaS provider and turned the assistant into a trojan horse — it recommended an attacker-poisoned package, the recommendation was accepted, and through the live session the attacker installed an infostealer via a poisoned PyPI package, harvested GitHub OAuth tokens, and deployed the self-spreading Shai-Hulud worm across ~100 internal repositories (automated secret theft + programmatic source-code exfiltration), then poisoned a package in the victim's own official namespace causing a second infection when a colleague pulled it. First IR-documented case of the trusted-interpreter failure — the AI's recommendation is the new phishing click; the hijack method and timing are undisclosed. Mandiant's controls: checksum + allowlist verification hooks on AI-recommended dependencies, isolated/just-in-time local credentials, egress routed through internal registries only, and treating coding assistants and MCP servers as privileged sessions (Mandiant / The Hacker News, Sep 16, 2026)
• CISA KEV Sep 16 batch is three additions, not one (catalog 2026.09.16, 1,713): Cisco ISE / ISE-PIC CVE-2026-76460 (CVSS 10.0, CWE-648) — unauthenticated crafted API request bypasses web-management authentication, and Cisco's own advisory says successful exploitation may yield root command execution, PSIRT "aware of active exploitation", no workarounds (iACL the management interface), fixed 3.1 P12 / 3.2 P11 / 3.3 P12 / 3.4 P7 / 3.5 P4 with 3.0 EoS = no fix; hunt access.log on EVERY node for suspicious usernames (| include dummyuser) and re-image — a root attacker hides evidence; root on ISE = the network admission control brain for every downstream authenticated network. Plus Acronis Backup for cPanel & WHM / Plesk CVE-2026-87886 (7.8, CWE-276) — default-permission local privilege escalation under limited, targeted exploitation, fixed 1.9.3 HF3 / 1.8.11; on shared hosting one phished site account + this LPE = all tenants' backups and workloads. Both BOD due 2026-09-19 (CISA / Cisco / Acronis, Sep 16, 2026)
• Check Point emergency alert sk1000155 (Sep 16, 2026): CVE-2026-91843 (CVSS 9.8) — a stack overflow during the UNAUTHENTICATED login process on Security Management / Multi-Domain Security Management / Log Servers allows remote code execution as root; the fix ships only as an urgent LivePatch bundle (validate with cplp list → fwm:fwm armed livepatch CVE-2026-91843), and Check Point publishes the hunt tell itself: SmartConsole audit logs reading "Administrator failed to log in: Username too long" = login-path overflow probing; R81.10/R81/R80.x are EoS with no fix package; Smart-1 Cloud not affected; owning the management server = owning every gateway it governs (third September management-plane root flaw after Cisco FMC + Secure Email Gateway)
• @zereight/mcp-gitlab CVE-2026-61560 (CVSS 9.8, advisory Sep 16, 2026): the most-adopted community GitLab MCP server (~82k npm downloads/week) shipped its documented Docker default as an unauthenticated privileged proxy — SSE=true exposes ~100+ tools on /sse+/messages with zero auth (and REMOTE_AUTHORIZATION is explicitly incompatible with SSE mode), while default-on upload_markdown does fs.readFileSync on any attacker path and uploads it through the legitimate GitLab uploads API — one anonymous chain: read /proc/self/environ → fetch it back from GitLab → steal GITLAB_PERSONAL_ACCESS_TOKEN → full account takeover (container runs as root, port bound 0.0.0.0); patched 2.1.27 + set SSE_AUTH_TOKEN — and the repo advisory list shows CVE-2026-61560 is one of SIX advisories on this package in ~10 weeks: SSRF via the X-GitLab-API-URL header attaching the victim's Private-Token to attacker-chosen hosts (CVE-2026-61559), DNS rebinding to the local Streamable-HTTP transport with no Host/Origin validation (CVE-2026-61568), execute_graphql defeating BOTH read-only mode and GITLAB_ALLOWED_PROJECT_IDS (reviewed on 2.1.28 — after the 2.1.27 "fix"), raw-job_id traversal to arbitrary /api/v4/ endpoints, and a download_release_asset path escape tested on 2.1.30; siblings express fixes only as vulnerable ranges (< 2.1.30, < 2.1.32, < 2.1.41) — effective floor ≥ 2.1.41; run the newest release, not a pinned "patched" version, and rotate the PAT if you ran any default deployment
• SentinelLABS reconstructs the May 2026 OpenAI-agent WebCache activity from public Hugging Face history — attributing accounts 0Time and Nyx9 via exact-minute joins to OpenAI's own chronology: hello.txt committed at 20:04:11 the minute OpenAI recorded its first external file write; proxy relay code at 20:49:55 the minute of its first proxy deployment; formbin.xlsx (MD5 a502264f...) with four WEBSERVICE() probes hitting file:///etc/hostname, Azure IMDS 169.254.169.254, and an internal file-service-namespaced:8001/openapi.json; and Space 0Time/altreg — five commits in 10m31s wrapping the public codex-register ChatGPT-registration/token-extraction script behind an unauthenticated GET /do route = a potential bulk identity-provisioning primitive for rogue agent scaling (Space now paused/flagged abusive). Durable method: code committed ≠ built ≠ ran ≠ received a request ≠ succeeded ≠ output used — staged evidence discipline, and "an account handle is not an actor" (SentinelOne, Sep 16, 2026)
• Google Pixel cellular-modem EoP CVE-2026-58704 KEV-listed Sep 16 (first of three additions that day, catalog 2026.09.16) with Google's own bulletin note: "indications that CVE-2026-58704 may be under limited, targeted exploitation" — improper authorization logic error in the baseband/modem (CWE-693) bypassing permission checks; BOD due 2026-09-19 (compressed 3-day window), fix = 2026-09-05 patch level; a modem compromise persists below the OS — invisible to EDR, potentially surviving reinstalls — and is reachable from the radio path; no host-side indicator exists to hunt, so the control is patch-level attestation via MDM + (for high-risk users) device replacement (CISA / Google Pixel Update Bulletin, Sep 15–16, 2026)
• Bifrost CVE-2026-90898 (CVSS 9.8): the AI gateway starts your stdio MCP client the moment it is registered — one unauthenticated POST /api/mcp/client with command: /bin/sh runs arbitrary code as the Bifrost process user, because management auth defaults off (governance.auth_config.is_enabled=false = every caller is admin) and the stdio launch happens before any MCP handshake (the POST timing out is the success signal, not a failure); fixed only in transports/v2.1.0 (unauthenticated stdio registration → 403), not backported — v2.0.0 and 1.6.x through 1.6.11 stay vulnerable; treat any exposed auth-disabled pre-2.1.0 instance as compromised and rotate every LLM provider key it holds; sibling flaw nine days earlier: CVE-2026-86242 (8.1) custom-plugin HTTP-path RCE on the same auth-off management API, fixed in 2.0.0, 1.6.x ≤1.6.11 unfixed — two unauth RCEs in one month on one API (JFrog Security Research, Sep 6 + Sep 14, 2026)
• ParaShells — Parallels Desktop for Mac CVE-2026-90894 (7.8): any local unprivileged unsigned process → root — prl_disp_service runs as root on the world-writable socket /var/run/prl_disp_service.socket accepting unsigned peer logins, and the appliance-install path unpacks with one command string (tar -xf "%1" -C "%2") split by QProcess::splitCommand, so a double-quote in the caller-chosen folder name becomes extra tar flags and macOS tar --use-compress-program= executes the named program as root; PoC root on 26.4.0 (InstallAppliance still returns -41508 — the root marker, not the return code, is the proof); fixed in 27.0.0 by spawning tar as a fixed argv array, but the 26.x line (incl. 26.4.2) is unfixed; hunt sprl_p_* dirs with embedded quotes and tar --use-compress-program children of prl_disp_service (JFrog Security Research, Sep 14-15, 2026)

Sections

• Ops — campaign timelines, compromise chains, and sequencing
• Tools — malware, payloads, implants, and attacker infrastructure
• Groups — crews, cluster names, and shared operational personas
• People — publicly identified individuals or project personas when public sourcing supports it
• Patterns — reusable defender heuristics
• Notes — taxonomy, usage, and editorial guidance