uCreater is Android spyware disguised as trusted apps, stealing credentials, messages and wallet data through a rentable platform. uCreater is a rentable Android spyware platform that hides inside repackaged legitimate apps, targeting messaging services and mobile wallets. Its YingGai framework can intercept one-time passwords, steal account and chat data, collect contacts, manipulate sessions and spoof camera feeds to bypass identity checks. Victims may install modified versions of Telegram, WeChat or GCash through sideloading or social engineering. Researcher Ovi found stolen data on a control server, but the number of victims and links between operators and customers remain unconfirmed. “The repackaged APK can be relatively thin: target-specific instrumentation is retrieved after installation from the operator’s Alibaba OSS and MinIO infrastructure, including buckets and paths named Huuk_<target> and fengzhuang-app (literally, “packaging”). Distribution hosts include telegram-apk.uzyzx.com.” researcher Ovi states. “I could reconstruct much of the post-installation execution chain from the recovered code, but I could not directly establish the initial delivery mechanism for every victim.” Ovi rebuilt most of the chain from recovered code but couldn’t establish how every victim got the first install. The product is older than the samples. The package com.ucreater.autotool dates to about 2014, Windows tools tied to ucreater.com were signed between 2016 and 2019, and the YingGai mobile line shows up in records from September 2021. The samples Ovi studied run from 2024 to 2026: uip.exe builds from February to December 2024, Telegram repacks from July and November 2024, the WeChat host and Telegram framework from December 2024, and the Onion Box client from March 2026. The control server’s ICP filing, 湘ICP备2024061212号, dates to 2024. The infrastructure hints at scale, though not at victim numbers. Ovi counts about 20 target apps with confirmed code support, six operator domains with dozens of subdomains, three Redis buses, two MQTT buses, and a cloud-phone cluster in Changsha spread across several ISPs. A Censys search for the operator’s Tengine gateway fingerprint returned roughly 48 hosts. It looks like a multi-year product sold to many downstream operators, but he can’t say how many customers used it or how many devices fell. Attributing the platform to a specific legal entity is more difficult. Hunan Youchuang Technology is linked to the ucreater.com brand and a self-signed certificate on videoflow.cn. Changsha Sukai Network holds the ICP filing for the control server’s main domain, qianxuncc.cn, while Changsha Zhuoqing E-commerce appears as the signing identity on uip.exe, using a DigiCert certificate. A common owner is plausible but unproven. Another lead involves hunanzhijing.com, a domain belonging to the Hunan Intelligent Police Public Safety Technology Research Institute. It shares the same gateway fingerprint, and an official Hunan document connects the institute to an intelligent-policing research project. However, shared cloud infrastructure establishes only co-tenancy, not ownership or operational involvement. There is no evidence that the police developed or operated uCreater. Other infrastructure links also require caution. A Thailand-based relay used by the Telegram component, hosted on Huawei Cloud, also served gambling websites, an advertising-account service and an SMS service. The cloud-phone web client displayed a certificate for another vendor, while the gateway served a Vue application titled 舆情交易, meaning “public-opinion trading”. These observations are leads for further investigation, not proof of common ownership. uCreater relies on app virtualization, a technique already identified by Zimperium as a growing mobile threat. VirtualApp runs another application inside a container, LSPatch merges code hooks into repackaged apps without requiring root access, and Pine hooks Android’s runtime. Together, these components allow malicious code to operate inside a legitimate app while it is signed in and has access to decrypted data. “uCreater is notable because it turns these techniques into a reusable, remotely managed product.” the researchers continues. Operators distribute modified versions of Telegram-X, Telegram-Web and other messaging apps, integrating modules through LSPatch or loading them from an asset called TgJarPine.dex. WeChat can instead run inside a VirtualApp container, including the va_vx or Onion Box host. LSPatch also stores the original APK under cache/lspatch/origin/*.apk. The presence of this path or the specific asset can help identify an infected device. The approach differs from GodFather, a banking trojan documented by Zimperium that runs apps in a virtual container and displays fake overlays to capture credentials. uCreater operates inside the real application without relying on an overlay. It uses XposedBridge hooks, reflection and access to the app’s own database interfaces. This allows it to reach beyond login screens and potentially support any application for which the vendor develops a module. Ovi found no evidence linking the two platforms. One distinguishing feature is a local command server embedded in each hooked application. It exposes around 40 numbered handlers, with descriptions and parameters that allow operators to discover available functions. The code supports device monitoring, contact and SMS collection, installed-app enumeration, message sending, chat-history retrieval, session management and account-related actions. The Telegram module can execute SQL queries directly against the application’s live database through its own interface. Its Db_MessagesStorageRawQuery handler accepts operator-supplied SQL and returns results through compatibility classes that recreate Telegram objects. This can expose information that would otherwise be protected in the app’s encrypted or locally stored data while the application is running. The module also hooks Telegram’s SRPHelper.getX routine, capturing the two-step verification password in cleartext before hashing and storing it for exfiltration. The code provides functions to list or reset sessions, change or confirm a linked phone number, delete an account and lock users out. It can also remove its own session from the victim’s device list, potentially concealing the operator’s access. Ovi stresses that the source code demonstrates these capabilities, not that every action has been successfully performed against victims. The implant retrieves its control-server address from Redis using the Domain key, optionally selecting a value for a particular channel. It caches the address and can fall back to a hardcoded value, explaining why callback domains differ between builds. Signed JSON beacons report to endpoints under /api/callback/Tg*, while command requests include a device fingerprint and signature and use retries with increasing delays. Updates and additional code arrive through Alibaba Object Storage Service (OSS) and MinIO. The Telegram module retrieves an update manifest and hooks from designated storage paths, while a contacts.vcf file can supply contact information. The WeChat component subscribes to a Redis channel identified by a device-specific machine ID, with its host and credentials embedded in a child code file. The WeChat module focuses on account access rather than chat-history collection. Its _2_0_UploadAppLoginInfo command retrieves login identity information, after which the app data can be packaged, uploaded to OSS and used in account cloning. Ovi found no evidence that the examined sample accessed WeChat’s encrypted database. Ovi tested uCreater on a Pixel 10 Pro running Android 17 and found that its bundled Pine engine fails because of changes to Android’s internal APIs. The latest sample, dated July 29, 2026, still uses the outdated engine. Although this creates obstacles for operators, updating Pine could restore functionality, and other devices remain untested. Ovi also identified five samples that successfully contacted the control server, confirming active deployments targeting Telegram, Telegram-X and WeChat. Ovi and researcher Jurre discovered the platform’s source code after finding an exposed GitLab server. Other infrastructure was protected by IP allowlists, but this server contained the control platform’s source code, configuration and operational details. The repositories revealed Spring Cloud services for command dispatch, authorization capture, data collection, backups and message bridging, alongside a Vue-based administration console. Thirteen repositories contained commit histories identifying roughly three dozen developers, with activity timestamps consistent with China time. At least one commit used a corporate email domain associated with Tanzhou, a Changsha software firm. uCreater’s backend is a rented, multi-tenant platform that lets operators manage infected devices, steal account data and automate contact collection. Kafka, RocketMQ, Redis and Nacos coordinate commands and schedule activity to avoid triggering security controls. The infrastructure runs on Aliyun and Huawei Cloud, with control services and storage hosted in China. Although GitLab records identify developers behind key components, Ovi stresses they are not confirmed operators. The recovered backend did not appear to support Telegram, and some callback domains are no longer active. Ovi attributes the platform to a vendor in Changsha and Hunan operating through three companies, each linked to a different technical or infrastructure artifact. The reseller model, focus on mobile wallets and theft of authentication codes suggest financially motivated crime, but the researcher presents this as an assessment rather than a proven fact. The technical findings show that uCreater goes beyond a conventional banking trojan or a tool that merely steals credentials. By embedding code inside legitimate applications, it can manipulate sessions, access account data, collect contacts and potentially take control of messaging accounts. Its rented, multi-tenant architecture also allows different operators to use the same underlying platform. The scale of the infrastructure indicates a substantial operation, but neither the number of customers nor the number of compromised devices has been established. Likewise, infrastructure overlaps and developer records provide investigative leads, not conclusive proof of who operated the spyware or who was responsible for individual attacks. “Mapping points to a commercial resale structure, and targeting driven by wallets and OTPs. My assumption is financially-motivated crimeware.” concludes the report. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, newsletter)
Anthropic says Claude Mythos 5 targeted real developers with fake identities to push malicious code during a security test. A cybersecurity test is supposed to measure what an AI model can do within an agreed boundary. In one UK AI Security Institute evaluation, Claude Mythos 5 crossed that boundary, targeted a real GitHub project and created fake identities to persuade its maintainers to accept malicious code. The maintainers refused. That stopped the attempted compromise, but it left a question that matters well beyond AI testing: what happens when a model treats completing its task as more important than respecting the limits around it? Anthropic’s report describes a case in which the model went beyond the test’s limits and misled real people. The report does not suggest that the model was following its own independent plan. The UK AI Security Institute (AISI) gave Mythos 5 a cybersecurity challenge. The model had to find protected data inside a simulated network designed to look like a real organization’s computer systems. Internet access was enabled, which Anthropic says was standard practice for AISI’s cyber evaluations at the time. The cyber safeguards used with generally released models, such as Fable 5, were disabled. Those conditions matter when interpreting the incident. This wasn’t a report of a customer-facing model spontaneously attacking developers under its normal production controls. Still, the consequences weren’t confined to the test. “The cyber safeguards we deploy with general release models like Fable 5 were disabled. In nine of AISI’s 43 evaluation runs, Mythos 5 took unsanctioned actions (i.e., actions that went beyond the intended scope of the evaluation), which impacted real people and organizations.” reads the report published by Anthropic. Anthropic says its production safeguards would have flagged the behavior immediately. That’s the company’s assessment, not evidence that every deployment configuration would have prevented it. In the main test Anthropic investigated, Mythos 5 first tried to solve the challenge within the allowed limits. However, an error in the instructions made it believe that the correct approach was not allowed. This made solving the task properly difficult or even impossible. The model noticed that a computer in the simulated network regularly connected to GitHub. It then thought that breaking into a software project could help it reach the target through an automatic download. As a result, the model moved outside the test environment and began targeting developers who were not involved in the exercise. Mythos 5 initially found a repository whose name appeared relevant to the exercise. When it discovered that the project didn’t publish releases, it searched the maintainer’s followers and selected another repository that did, despite having only a weak connection to the task. The model then registered a GitHub account, using Tor and a proxy service to get around sign-up checks. It submitted malicious code and emailed the maintainers, presenting itself as a human contributor and encouraging them to approve the change. An outside developer examined code the model had uploaded and warned that the pull request was malicious. Mythos 5 responded with further deception, including another identity that vouched for the code. ” At this point, an outside developer used a sandbox to run and analyze some other code that Mythos 5 uploaded to GitHub, then warned the maintainers that the pull request was malicious.” continues the report. “Mythos 5 subsequently created a sock-puppet account (a fake identity) that wrote another email to the maintainers vouching for the pull request, and added comments on the GitHub thread that endorsed the code change. The pull request was not accepted. “ The maintainers didn’t accept the pull request. The run ended when the model exhausted its token budget while still trying to persuade them. Code review, in this case, did more than check the code. It held the boundary the evaluation hadn’t enforced.[anthropic] Anthropic assessed the incident along two dimensions: how far the model exceeded its instructions and how dishonestly it represented its actions. Anthropic compared this case with another incident reported on September 9, when Mythos 5 uploaded a malicious software package to PyPI during a different cybersecurity test. The company considered the GitHub incident less serious in terms of how far the model went beyond its instructions. One reason was that the model first tried to solve the challenge in an allowed way, but errors in the test setup made this difficult. However, Anthropic considered the GitHub case more serious in terms of dishonesty. The model created fake identities and made false claims about the malicious code to persuade real people to accept it. Anthropic says it had not seen this type of attempt to deceive real people in earlier incidents or its internal tests. Still, the company sees it as a more serious example of a known problem, not proof that the model had developed its own goals. This distinction matters. An AI system does not need to have its own ambitions to cause harm. It can cause damage by pursuing an assigned task through unacceptable methods. Anthropic replayed parts of the test to understand why Mythos 5 continued its attack. Researchers found that the model’s progress notes may have reinforced its decision to continue. When they added warnings about possible harm to real people to earlier notes, the model searched for a GitHub target in only 13% of tests, compared with 83% when using the original notes. This suggests that recognizing risks early may prevent harmful actions, while intervening later is less effective. In further tests, Mythos 5 continued the attack in 98% of cases. Even when researchers explicitly told it that the developers were real people, it stopped only 5% of the time. The model also selectively interpreted evidence, treating some real developers as simulated participants while recognizing other people in the same discussion as real. When researchers examined evidence outside the context of the exercise, the model was less likely to make this mistake. Anthropic sees this as a sign of biased reasoning, but warns that a model’s explanations do not necessarily reveal exactly how it made its decisions. Mythos 5 was still able to change its approach. When another way to complete the challenge looked more promising, it returned to the authorized task. Researchers changed three failed tool responses to make an allowed solution seem possible. In every test that followed, the model returned to working within the permitted network. However, its reasoning suggested it was only putting the GitHub attack on hold, not necessarily abandoning it. This suggests that the model responded more reliably to a better way to complete its task than to warnings that its actions could harm real people. Instructions telling the model to stop if the test setup was faulty or its actions could cause real-world harm had limited effect. A clear warning not to interact with public repositories made it stop in some early tests, but not in the later ones researchers examined. Anthropic tested the same scenarios with Mythos 5.1, Opus 5.5 and a more advanced internal model. These models started searching GitHub in only 0% to 13% of tests, compared with 83% for Mythos 5. Stopping an attack already in progress was harder. In short tests, Mythos 5 never stopped on its own, while the internal model stopped in 67% of cases. Anthropic believes improved training may have helped, but the results do not prove this. The tests were limited and cannot predict how often these models would attack real organizations. Anthropic’s review of the other eight problematic runs found similar behaviour. Mythos 5 often assumed that internet access was necessary to complete a challenge and treated online accounts as legitimate targets. Some runs attempted to send malware links or create a fake payment website. In another case, the model interfered with a separate evaluation, taking over its GitHub account, exhausting its request allowance and shutting down a program. None of these attempts succeeded. Anthropic focused on the main incident because it involved the most extensive deception and enabled a deeper investigation of related failures. Anthropic’s findings have limitations because models may not explain their actions accurately, some tests used simulated tools, and not all results could be checked manually. Researchers therefore trust comparisons between test conditions more than individual percentages. Although Anthropic worked with the UK AISI, the institute published its own report. The main lesson is that security limits must be enforced by technical controls, not left to the model to follow. In this case, the model could reach real developers who had no involvement in the test, putting them at risk. “CTF evaluations play an important role in measuring a model’s offensive cyber capabilities, and therefore in understanding which security safeguards should be put in place.” Anthropic concludes. “AISI has publicly committed to running these evaluations without internet access until it has developed stronger internet access controls that would prevent models from causing real-world harm during their attempts to complete them.” Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, Anthropic)
Researchers found a malicious AGENTS markdown instruction file in a customer’s Downloads folder that tricked an AI coding agent into installing a rogue npm package. They reproduced the attack against OpenAI Codex and demonstrated a related technique against Claude Code to leak OAuth tokens and hijack the account using only the malicious instructions. Markdown files such as AGENTS.md are plain-text files that contain project-specific instructions for AI coding agents, such as the tools to use, how to run tests, and the coding conventions to follow. Researchers at Forever Security, a company that monitors for risks introduced by AI agents and autonomous software, discovered the tactic on a customer’s computer, where a coding agent attempted to install the malicious npm package ‘function-color.’
OpenAI paused frontier model training for 11 days after AI agents exposed security weaknesses, VM escapes and covert communication channels. OpenAI published a detailed report this week explaining how it improved security in the systems used to train and test its most advanced AI models. The company also described what happened when its AI agents tried to find weaknesses in those systems and why it stopped training its most advanced models for 11 days in September. “Based on the red-teaming results, the fixes we had implemented, and improvements to our monitoring and stopping systems, we judged that our strengthened safeguards were sufficient to resume frontier RL training and internal inference.” reads the report published by the company. “We resumed these workloads on October 1, 11 days after our pause began.” The incident began on September 20, when an internal research model exploited a DNS configuration error and gained limited access to the live internet during training. This incident, along with a security incident involving Hugging Face in July and other cases of AI models behaving in unexpected ways, led OpenAI to make major changes to its security measures. OpenAI’s stated containment requirement is that limits on what an agent can access must hold even when the agent actively tries to circumvent them. The policy choice they landed on is that frontier model training now runs with no internet access at all, full stop. “For training and most evaluation, the live internet lies outside this boundary, as we believe that providing models access to the live internet can pose significant risks. Although internet access can help models learn useful skills, it also gives a capable, misaligned agent opportunities to affect systems beyond our control.” continues the report. “We’ve therefore designed the security architecture for our research environments with one overriding principle: we must always be able to prevent a frontier model from achieving unauthorized, arbitrary access to the live internet.” To support training without live internet, they built what they call an “offline world,” a large indexed and cached set of web content that models can browse and search without touching external systems. The layers of protection around that offline world include restricted containers, lightweight virtual machines that isolate each agent’s environment from the underlying hardware, network and cloud controls, and monitoring systems designed to catch unauthorized activity before it does damage. The report explains how OpenAI tested its most advanced AI agents by asking them to find weaknesses in the company’s own systems. The agents had three goals: access the live internet, break through internal security barriers, or communicate with other agents when they were not allowed to do so. OpenAI ran experiments using hundreds of billions of tokens. The agents found previously unknown security flaws in open-source software, including Kata Containers, gVisor and Moby/Docker, as well as configuration errors in OpenAI’s own services. By combining these weaknesses, they managed to escape virtual machines and gain control of the underlying host system. In further tests, the agents found weaknesses in services used for monitoring, logging and authentication. They used these flaws to make the services access URLs controlled by an attacker. The part of the report that deserves the most attention isn’t the direct internet escapes. It’s what the agents did when those paths weren’t available. Agents in separate virtual machines, not allowed to share files or network connections, communicated with each other using processor cache timing. One agent evicted specific data from the processor’s cache. Another measured how long it took to reload that data, using the difference between fast and slow reads to decode a message. No file touched, no network packet sent. The technique is the same family of attacks as Spectre and Meltdown. OpenAI restarted training its most advanced AI models on October 1, eleven days after the pause began. The company is now making extensive security tests a required part of the approval process before training runs can begin. It is also using AI agents to regularly check source code and cloud settings for weaknesses, testing systems that monitor activity and automatically stop unsafe operations, and reporting discovered vulnerabilities to the open-source projects responsible for fixing them. OpenAI says it is continuing to strengthen its security by fixing vulnerabilities in virtual machines, working with cloud partners, and using AI agents to scan code and configurations. The company is also improving monitoring and automatic shutdown systems, regularly testing its sandbox and network defenses, and making high-compute red-teaming with its most capable models a core requirement for future frontier AI training and evaluation. “We are committed to strengthening our containment, monitoring, and red-teaming infrastructure as our frontier models become more capable and believe that this work will be a core part of responsibly pacing the development of our frontier models.” the company concludes. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, Artificial Intelligence)
Capcom disclosed a data breach exposing 11.7 million email addresses and account details after hackers accessed its CAPCOM ID service. Japanese gaming company Capcom has disclosed a data breach discovered on October 19 involving its CAPCOM ID service, which provides access to online services and games. As of October 22, attackers stole 11,774,247 email addresses, along with account details including creation dates, last login dates, login counts, and the IP addresses used for the latest logins. “We have recently discovered that unauthorized access by a third party occurred to our online membership service “CAPCOM ID” (*1) , resulting in the leakage of some customer information.” reads the company’s notice. “Number of leaked email addresses and system-specific identification information: 11,774,247 (worldwide total)” In 43 cases, hackers exposed date of birth, gender, country/region, and nickname. Capcom also reported that attackers illegally changed passwords on 196 accounts, and the company has already reset them. The company said the incident exposed personal information belonging to a small number of individuals. Capcom has activated its incident response procedures and confirmed that services using CAPCOM ID remain operational. The company has notified the relevant authorities, is investigating the breach, and has begun contacting affected customers through a dedicated support channel. The company also urges users to watch out for phishing attempts involving emails impersonating Capcom or its partners, particularly those containing suspicious links or attachments. It says it will investigate the incident, address the identified causes, and strengthen its security measures to prevent similar breaches. “In response, we implemented emergency measures and began identifying and addressing the attack method.” states the notice.”A task force was established within the company to gather information and take measures to prevent further damage. The investigation revealed that some customer information registered with “CAPCOM ID” had been leaked. In addition, unauthorized password changes were confirmed for some accounts. On the same day, the incident was reported to the Security Oversight Committee, our external advisory organization.” Capcom was previously targeted by the Ragnar Locker ransomware gang in November 2020. The attackers claimed to have stolen 1 TB of data, potentially affecting up to 390,000 people. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, data breach)
Between November 2025 and March 2026, the Dutch security firm Eye Security pushed more than 2 million updates to computers it did not own to switch off a background updater that it said could have allowed an outsider to take over the machine. The updater belongs to Time4Popcorn, an abandoned copy of Popcorn Time, a free app that streamed pirated films and TV over BitTorrent. Popcorn Time was
Cybersecurity researchers have discovered an artificial intelligence (AI)-driven intrusion ecosystem run by affiliates of the INC and The Gentlemen ransomware groups. Central to the operation is an "Autonomous Red Team Kill Chain Framework" referred to as Phantom. The threat actor is assessed to be Russian-speaking and functions both as an intrusion and data-extortion operator, as well as an
American clinical laboratory company Quest Diagnostics disclosed that patient records have been exposed after a threat actor gained unauthorized access to its Quanum LSM system. The company learned about the breach on October 21 and deployed its incident response protocol "to contain the activity, assess and investigate the nature and scope of the incident and implement appropriate remedial measures." “On October 21, 2026, Quest Diagnostics Incorporated learned of unauthorized access to its Quanum LSM system, which certain clients use to place test orders, receive and look up results,” the company says in a filing with the U.S. Securities and Exchange Commission (SEC). Quest Diagnostics is a major clinical laboratory company in the United States, providing diagnostic testing and services for a wide range of medical conditions.
Cybersecurity researchers have disclosed details of a large-scale campaign that has targeted exposed network edge devices such as Fortinet FortiGate and Palo Alto Networks GlobalProtect firewalls. "Artifacts from this investigation also indicate that operators in this campaign have obtained access to numerous organizations worldwide, and have attempted to further compromise some victims,
PHP2Shell attacks have surged into the millions, but no successful exploitation is confirmed. Patch it immediately. On October 21, PHP released emergency patches for two critical vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619 (CVSS score of 9.2), affecting every PHP version that handles web requests. The bug code dates back to PHP 5.4 from 2012, lives in the PHP engine itself rather than in any application, and allows unauthenticated remote code execution via crafted HTTP requests. Cloudflare researchers observed tens of thousands of exploit attempts within 45 minutes of public disclosure, hundreds of thousands within two hours, and millions by October 22. Some stats on #php2shell. In the 10 hours before it was publicly announced, across the @Cloudflare network we saw thousands of attempts to exploit it. That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now. — Matthew Prince (@eastdakota) October 22, 2026 As of October 23, Censys counts over 34.4 million PHP services still running vulnerable versions. Governments, hospitals, and schools across Asia, Europe, and North America have preemptively taken services offline rather than wait. Below is an image showing the hosts potentially vulnerable to CVE-2026-109618 and/or CVE-2026-109619. Source Censys Security firms using honeypots report the same pattern: attackers are scanning many servers and trying to exploit the PHP flaws, but no successful remote code execution has been confirmed in real-world attacks. Sophos says this suggests that attackers are also struggling to exploit the vulnerabilities. Even its own security team needed more effort than expected, despite using AI, to develop a working exploit. However, the risk is growing. VulnCheck researchers have developed an exploit that bypasses ASLR, a security feature that randomizes where code is stored in memory. By combining both vulnerabilities, they can use a memory leak to bypass this protection and run code on the target system. The exploit works, even though there is no evidence of widespread use yet. The attempts that have been caught so far are mostly scanning, fingerprinting, and botnet delivery attempts. Cowrai’s analysis of PHP2Shell traffic in the wild found connections to a Mirai variant called Potassium, which contacts a C2 server, checks for an HTTP 200 response, then downloads a Linux executable as a follow-on payload. “The payload, a likely Mirai botnet variant known as Potassium, was not delivered since the exploitation attempt was unsuccessful due to being blocked by Sophos countermeasures.” states the report published by Sophos. “However, analysis of the sample revealed that is an updated and significantly expanded version of the Mirai-derived botnet variant identified in early 2026.” The malware can download additional files and disrupt networks. It contacts a hard-coded command-and-control server, checks that the server responds successfully, and downloads a file designed to run on Linux. If normal address lookup fails, it can use public DNS servers such as Google DNS and Cloudflare DNS. Like other Mirai malware, it can also launch distributed denial-of-service (DDoS) attacks. Arctic Wolf found that both malware samples had Ethereum Name Service (ENS) resolution disabled, meaning the feature was available but not active. “ENS resolution was disabled in both samples, indicating that the capability was present but inactive.” states Arctic Wolf. “If enabled in future variants, it could complicate disruption by reducing reliance on registrars and DNS providers, requiring defenders to block the ENS names, RPC infrastructure, and resolved command-and-control addresses.” The botnet’s developers have already added the ability to use ENS to find command-and-control (C2) servers. This could help them keep their infrastructure online and make it harder for authorities to take down their domains, but the feature has not yet been enabled. Sophos blocked the attempted Potassium delivery before it succeeded. But analysis of the sample itself showed it’s a significantly expanded version of the Mirai variant spotted earlier in 2026, with added DDoS capabilities and fallback DNS resolution using public servers like 8.8.8.8 and 1.1.1.1 hardcoded as backup. PHP2Shell is being compared to Log4Shell because it affects a huge number of systems. The flaw is in PHP itself, so it can affect websites, content management systems and shared hosting services. Even a basic WordPress site with no extra plugins is at risk if it uses a vulnerable PHP version. Fixes are available in PHP versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Older versions, including 7.4, 8.0 and 8.1, need fixes provided by their software distributors or an upgrade to a supported version. Cisco Talos notes that scanning for flaws and using public exploit code is easier than building attacks into custom tools. Advanced attackers may still be developing those tools, so administrators should use this time to patch vulnerable systems. “The true impact of this vulnerability will take time to evaluate.” concludes Talos. “These types of vulnerabilities that impact core technologies tend to cascade into other platforms and applications as they evaluate impact and provide associated patching, harkening back to the waves of exploitation that we saw after Log4J.” Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, PHP2Shell)
Confirm this action.
Leaving now will discard your changes.