SafePay ransomware has hit 600+ organizations since 2024, using stolen credentials, VPN access and double extortion to pressure victims into paying. CISA, the FBI, the US Secret Service, Germany’s Landeskriminalamt Rheinland-Pfalz, and two UK law enforcement agencies jointly published an advisory this week on SafePay, a ransomware group they describe as one of the most active operations currently running. The group has breached at least 600 organizations across critical infrastructure sectors since August 2024, spanning North America, South America, Europe, and Australia. “Since August 2024, SafePay ransomware group’s operations have affected a wide range of businesses and critical infrastructure in North America, South America, Europe, and Australia. SafePay ransomware was among the most active ransomware groups in 2026. The SafePay threat actors have impacted at least 600 separate victims from multiple critical infrastructure sectors.” reads the joint advisory, “The authoring agencies encourage organizations to implement the recommendations in the Mitigations section of this advisory to reduce the likelihood and impact of SafePay ransomware incidents.” SafePay appeared in mid-2024 as an independent ransomware group that operates without affiliates. This is unusual because many major ransomware groups work like franchises, allowing other criminals to use their tools and services. SafePay grew as groups such as BlackCat and LockBit declined, and its activity has continued. The advisory includes findings from FBI, US Secret Service, and German investigations through August 2026. SafePay’s preferred entry points are exposed credentials, brute force password attacks, and VPN access. “The FBI, USSS, and cybersecurity researchers observed SafePay threat actors obtaining initial access [TA0001] to organizations through various means, including credential exposure, implementing brute force password attacks [T1110], and exploiting virtual private network (VPN) access.” states the advisory. “SafePay threat actors use the IP addresses of the VPN provider “Mullvad” to attain initial access—specifically, SafePay threat actors use phished account profiles to access victim networks to exploit the following known Common Vulnerabilities and Exposures (CVEs) for edge device products” Security teams should watch for unusual login attempts coming from Mullvad VPN IP addresses. SafePay also uses stolen account credentials and automated scripts to exploit known vulnerabilities in internet-facing devices. These include Cisco VPN flaws from 2020 and 2023, a Veeam vulnerability, and a SonicWall access control issue. Once inside a network, the attackers rely on common tools rather than specialized malware. They use PsExec, WinRM, RDP, and PowerShell to move between systems. A PowerShell script called ShareFinder.ps1 helps them find shared folders and identify valuable data. Mimikatz is used to steal credentials, while AnyDesk and TeamViewer provide remote access. To steal data, the group uses tools such as FileZilla, RClone, WinSCP, and even OneDrive. Encryption uses a ChaCha20 stream cipher combined with RSA for key exchange, with methods customized based on file type and size. Files get the .SafePay extension appended. “Data encrypted with the SafePay ransomware variant (appended with .SafePay) cannot be recovered without the decryption key. SafePay threat actors hold the encrypted data for ransom and typically demand a subset of company revenue in cryptocurrency in exchange for decryption software.” states the advisory. “SafePay threat actors leave a ransom note on the victim’s system, typically on the desktop or root directory, advising them that SafePay locked their system and to reach out over a chat portal at a TOR .onion website link with a victim ID as the login. “ Paying the ransom remains the only path to decryption for encrypted files, and even that isn’t guaranteed to work. The group runs a double-extortion model: steal first, encrypt second, threaten to post the stolen data publicly if the victim doesn’t pay. After encryption, SafePay sends victims to a Tor-based chat portal for negotiations. A representative also makes phone calls to apply pressure. If no payment comes, everything goes on the leak site. The group also deletes Volume Shadow Copies and resets network-attached backup devices to factory settings, which is the operational equivalent of cutting off every exit before the fire starts. The advisory recommends several basic security measures. Keep internet-facing devices, especially VPNs and firewalls, up to date. Prioritize vulnerabilities listed in CISA’s Known Exploited Vulnerabilities catalog. Enable multi-factor authentication (MFA) for VPNs, webmail, and accounts that access critical systems. Limit the number of accounts allowed to use administrative tools. SafePay relies on legitimate Windows tools to move through compromised networks, making its activity harder to detect. Organizations should also keep backups offline, encrypted, and immutable so attackers cannot access, change, or delete them. CISA also recommends reviewing all accounts with admin privileges, setting time-limited access where possible, and disabling command-line tools for any account that doesn’t need them. The advisory includes IOC files in STIX XML and JSON format, full MITRE ATT&CK mapping, and complete file and IP indicators. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, ransomware)
Introduction Back in October 2022, Kaspersky GReAT was looking into a peculiar advertisement on a hacking forum. A cybercriminal had been advertising a UEFI bootkit, dubbed BlackLotus, that could bypass Secure Boot, for $5,000. Given the low price for such powerful capabilities, the cybersecurity community initially took this advertisement with a grain of salt. As no BlackLotus samples were found in the wild, no one could at the time verify the claims made in the forum post. BlackLotus advertisement However, about half a year later, in March 2023, ESET confirmed that the BlackLotus advertisement was genuine. The researchers tracked down samples of this bootkit and confirmed that it can indeed bypass Secure Boot through a vulnerability called Baton Drop (CVE-2022-21894). As this vulnerability was still exploitable in 2023, Microsoft had to release multiple security updates to address it. Since the release of these updates, the BlackLotus bootkit has gone quiet — no publicly known attacks have used it. Yet in early 2026, we discovered a malware sample similar to BlackLotus that was used in an APT campaign in Central Asia. In this report, we share our findings, including new payloads and possible attribution of this campaign. The return of the infamous bootkit In early 2026 we identified a complex APT attack targeting diplomatic agencies in Central Asian countries — namely Tajikistan, Uzbekistan, and Turkmenistan. This attack involved a UEFI bootkit that we dubbed BlackX. Having examined it, we found it to be similar to BlackLotus. Attackers have been deploying BlackX after compromising the victim machine networks and obtaining administrator privileges. To install the bootkit, we observed them dropping the following files: inst.exe, an installer executable PVMDIJGKAX2, an RC4-encrypted extensionless file containing files and strings required for the installation The installer was launched with the command line C:\ProgramData\Intel\inst.exe PVMDIJGKAX2 Q46F6MDLI3RX2KV1. The last argument here is the RC4 key used for decryption. Curiously, the file inst.exe does not contain any malicious strings or embedded blobs. All the files needed to install the malicious payload are inside PVMDIJGKAX2, which makes it harder for incident responders to retrieve the bootkit components. The installer package drops a set of files to both system and UEFI partitions, designed to exploit the Baton Drop vulnerability. We noted that the implementation of the exploit is remarkably similar to the one used in the BlackLotus malware. As with BlackLotus, the goal of the exploit is to install custom Machine Owner Keys (MOK), which allows loading arbitrary EFI files on the target machines to manipulate Secure Boot. While the vulnerability exploitation chain was implemented very similarly to BlackLotus, we spotted differences between the exploits in BlackLotus and BlackX. That said, the source code of the BlackLotus bootkit has never been published online. This could mean that the attackers behind BlackX either reverse-engineered the BlackLotus bootkit or purchased its source code from cybercriminals. Either way, this is an interesting observation, as we rarely see APT actors borrow ideas or code from cybercrime actors. Payload launched by the bootkit The UEFI payload delivered during the Baton Drop exploitation has a classic bootkit goal — to inject a malicious driver into the Windows kernel. This driver differs from the one deployed by BlackLotus and is signed with a certificate belonging to an organization named 温江区明宇网络技术服务工作室 (English: Wenjiang District Mingyu Network Technology Service Studio). At the time of writing, this certificate (serial number: 0bcdf5e0da32d68900b8b7638459d072) has been revoked by its issuer. The driver aims to tamper with security solutions installed on the machine. For example, it disables process, thread, and registry callbacks related to security solutions. It also tampers with ETW providers so that security solutions cannot access their output. Curiously, some of the tampering procedures are designed to run only if Kaspersky or Avast solutions are installed on the infected machine. However, during dynamic analysis of this driver, we found that these procedures are useless — they fail to interfere with Kaspersky products in any way. The driver also protects the bootkit’s files from tampering. It intercepts kernel requests to open these files and returns a handle to calc.exe instead of a malicious file handle. User-mode second-stage payloads Apart from tampering with security solutions, the driver also deploys a user-mode payload. We observed two such payloads, used for cyberespionage, in the wild. One of them is a RAT that can load further-stage .NET payloads. This RAT uses cloud storage for C2 server communications — we observed its versions using Google Drive, OneDrive, and Yandex.Disk. Having connected to a cloud storage service, this RAT iterates over files available there and interprets them depending on the file suffix. Below is a list of supported suffixes: File suffix Description Type 0X01 A .NET file. The task is to parse it and run the method TEST.Class1.RunCMD(argument_array) from the module Input 0X02 Result of the call TEST.Class1.RunCMD(argument_array) Output 0X03 Task to upload a file to the drive Input 0X04 Uploaded file Output 0X05 Task to download a file to an infected machine Input 0X06 File download status Output SSSR Contains initial system info Output We also observed another payload delivered through the bootkit, which we dubbed OxiDLLRunner. It is a malicious DLL obfuscated with OLLVM. It is loaded by the legitimate file googleupdate.exe (original filename: jcef_helper.exe, MD5: AF8A983B9ADA07EAE1259BF2953ABD40), which is also delivered by the bootkit. The DLL decrypts the contents of the file v8_context_snapshot.bin, which resides in the same folder, and then jumps to the beginning of the decrypted content. The decrypted data starts with shellcode followed by a PE file, which is a Rust payload designed to communicate with the www[.]archivetj[.]com C2 server. During communication, this payload is supposed to receive DLL files exporting a function named create_plugin, which are then executed in separate threads. Attribution Based on the following facts, we have attributed this attack to the APT41 threat actor with medium confidence: In June 2026, ESET published a blog post on attacks by the FishMonger threat actor, which the community assumes to be related to APT41. This post describes a kernel implant with a PDB path starting with C:\Users\xdd\Desktop. While describing the campaign, the post also suggests the possible use of an unspecified UEFI bootkit component, which might exploit CVE‑2023‑24932. We observed the identifier “xdd” used multiple times in the BlackX bootkit payloads, so we assess that BlackX is the UEFI bootkit referenced in the ESET blog post; The payloads deployed by BlackX are loaded using a legitimate executable abused via DLL sideloading, and an encrypted file — this pattern is common among Chinese-speaking threat actors; The OxiDLLRunner file has been obfuscated with OLLVM, an obfuscator commonly used by Chinese-speaking actors. Why did the target organizations get infected? During our initial analysis of BlackX, we thought that attackers succeeded in deploying it due to the negligence of the target organizations. Baton Drop, the vulnerability used to deploy BlackX, was disclosed back in 2023 and was patched, so we first thought that the infected machines lacked the relevant updates. However, our investigation proved this wrong — the targeted machines were fully patched. Instead, we found out that the problem was with the patch itself. As it turned out, the patch for the Baton Drop vulnerability is designed to revoke the “Windows Production PCA 2011” certificate used to sign vulnerable UEFI components. However, this revocation does not happen automatically upon patch installation — the user has to trigger it manually. This is done with the following steps: A registry flag is set inside HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Secureboot; A scheduled task named Secure-Boot-Update is created. This patch is designed to be applied manually — for instance, applying it automatically could break dual-boot systems relying on the “Windows Production PCA 2011” certificate to load. At the same time, this patch deployment practice creates a problem — as it is extremely unusual for a system administrator to take extra steps after installing an update. Usually, when applying patches, system administrators take no further action unless an installation failure occurs. These instructions for activating the patch are buried deep on the Microsoft website, and we assess that they are quite hard for an average IT administrator to notice. Curiously, Microsoft’s plan for deploying the Baton Drop patches mentions an “Enforcement Phase” that involves revoking the “Windows Production PCA 2011” certificate automatically, without user interaction. At the time of publishing this post, this stage has not been implemented. On October 19, 2026, this certificate expired, but this does not prevent the vulnerable binaries from loading unless the certificate is blocklisted. It is likely that the threat actor behind this campaign took into account that few organizations realized the importance of manually activating the Baton Drop patch. As such, we believe they decided to invest time in understanding how BlackLotus works and creating a copycat of this bootkit. Conclusion Patch management is important for every organization, as updates from vendors help protect software and hardware against known vulnerabilities. However, sometimes installed patches fail to protect against the flaws they address. The BlackLotus story we described is not the only such example — for instance, in 2025 Microsoft released an update against the ToolShell vulnerability that also had to be applied manually. However, modern security solutions are designed to account for such cases when installed patches fail to protect against security flaws for one reason or another. For instance, the Exploit Prevention component available in Kaspersky products prevents exploits from running if the patch is not applied, or if it is a zero-day vulnerability with no available patch. It is thus crucial to equip all machines in an organization with security solutions and constantly monitor the alerts they raise.
Chrome is getting new scam protections that use Gemini to detect deceptive websites and warn users when they copy suspicious commands from ClickFix attacks. The changes are part of Enhanced Protection in Safe Browsing, which Google claims makes users ten times safer from phishing, social engineering, notification abuse, and other scams compared with Standard Protection. Chrome is also adding a new "suspicious site" warning for pages that show deceptive patterns but haven't reached the confidence level required for its existing full-page red warning. "Suspicious site warnings notify users when a page exhibits deceptive patterns commonly associated with known malicious sites," the company explained. "By tailoring the warning UI in this way, we are able to safely expand our coverage to display a higher volume of protective warnings."
Hackers compromised the infrastructure of Onamae Desktop Cloud, a popular provider of VPS services in Japan, and installed malware on up to 26,739 customers' servers. The company confirmed on October 20 that an unauthorized third party installed "malicious programs" in some customer environments. After detecting the intrusion, the company says it progressively shut down customer servers beginning at 04:00 local time on October 21, 2026. “We have confirmed that unauthorized access by a third party occurred against Onamae.com Desktop Cloud and that unauthorized programs were installed in some customers’ server environments,” reads the announcement. Onamae.com, operated by GMO Internet, a member of GMO Internet Group, is one of Japan’s largest domain registrars and also provides web hosting, DNS, and other internet infrastructure services.
A Russian satellite made a close approach to a commercial radar satellite linked to Ukraine, raising concerns about surveillance and security in space. A Russian-made satellite called Kosmos 2612 got very close to ICEYE-X36 last week, a commercial Earth-observation satellite that may support countries like Ukraine. CNN reports it may have come within less than a mile. Orbital monitoring company LeoLabs says the behavior is consistent with rendezvous and proximity operations, meaning maneuvers designed to bring two spacecraft together. “A rare move by a Russian-made satellite may have brought it within less than a mile of a commercial Earth-observation satellite that may be used to provide national security services to countries such as Ukraine.” states CNN. “It’s not clear what, exactly, the Russian satellite, called Kosmos 2612 or Cosmos 2612, intended to accomplish with its close approach. But the behavior was consistent with rendezvous and proximity operations, or maneuvers carried out in orbit that are designed to bring two spacecraft together, said orbital monitoring services company LeoLabs, which tracks space junk and activity in Earth orbit, in a statement.” It is unclear what Russia wanted to achieve. LeoLabs said “While the intent remains uncertain, the behavior warrants continued monitoring.” Astrophysicist Jonathan McDowell noted that this could be the first known case of one spacecraft approaching another without permission. This is different from docking, when two spacecraft intentionally connect, a common practice in space. The events unfolded over several months. In May, four Russian-controlled satellites changed their orbits to align with ICEYE-X36, according to a June report by the Royal United Services Institute. On October 15, Kosmos 2612 began moving closer to ICEYE-X36, reducing the distance from 350 kilometers to less than 5 kilometers by early October 16. It stayed nearby, making small adjustments through the weekend, before starting to move away on Monday. The War Zone (TWZ) reports that Kosmos 2612 was one of six satellites launched together on April 17. The closest point is disputed. LeoLabs says it came within roughly 500 meters during part of the event, but warns that the repeated maneuvers and awkward tracking geometry make separation estimates uncertain. Space.com reports the satellites may have been a few meters apart at one point, and TWZ’s reading of public tracking data points to about 26 meters. The target matters. ICEYE operates about 80 radar satellites that image the Earth through clouds, day and night, and ICEYE-X36 belongs to its US subsidiary. At least some ICEYE satellites provide imagery to Ukraine, and in January the company signed a contract firming up that relationship, saying it gives Ukraine’s Ministry of Defence persistent situational awareness on tactical timelines. A Ukrainian official told Axios that Ukraine’s military works with ICEYE but couldn’t say whether this specific satellite is involved. Russia appears to be paying close attention to ICEYE-X36. Changing a satellite’s orbit to match another spacecraft’s path uses a lot of fuel, so it is not a decision taken lightly. Four Russian satellites made similar changes in May. However, it remains unclear whether ICEYE-X36 is specifically used to collect images of Ukraine. Close approaches between satellites are not new, but this case is different. Russia, the United States, and China have all moved satellites close to those operated by other countries, mainly in geostationary orbit. Kosmos 2612 operates in low Earth orbit. As far as is publicly known, Russia has carried out similar approaches there, but the United States and China have not. Victoria Samson of the Secure World Foundation pointed to two earlier Russian cases. In 2020, Kosmos 2543 came within about 30 kilometers of USA 245. In 2022, Kosmos 2558 approached USA 326 to within about 70 kilometers. Both targets were classified US spy satellites operated by the National Reconnaissance Office. ICEYE-X36, by contrast, is a privately owned satellite, and Kosmos 2612 came much closer than in those earlier cases. Space law professor Aaron Brynildson told Axios that there is no strict legal limit on how close satellites can approach each other. However, countries generally avoid getting within six miles of another satellite. Why do it? Samson lists a few options. Russia may want to learn the satellites’ capabilities and what they’re studying, or it may have interfered with sensors or communications. She leans toward a different reading: she thinks Russians are getting frustrated, in a stalemate for about six months, and this is a way to show military prowess in a way Ukraine can’t answer, since Ukraine matches Russia in drones but not in space. RUSI’s June report is blunter about the options. It lists intimidation or interference through jamming, which uses radio noise to stop satellites from communicating. It adds that the range of options for protecting an ICEYE satellite is limited, and that defending satellites is a famous dilemma. LeoLabs says the event doesn’t establish hostile intent, but shows capabilities that could support intelligence collection, inspection, coercive signaling, interference or preparation for future counterspace operations. ICEYE’s response was short: the company is aware, tracking closely, and says its constellation architecture is designed for continuity and resilience. CNN says it asked Russia’s defense ministry and Roscosmos for comment. The US Space Force had already described Russian satellites positioned near a Western commercial radar satellite used by Ukraine for imagery intelligence, according to Axios. Private companies and independent observers, rather than the US Space Force, revealed the satellite encounter, highlighting the need for greater government transparency as space becomes more contested. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, satellite)
North Korean hackers are using a post-quantum cryptographic mechanism to secure malicious payload delivery in new operations that combine old and new malware. The campaign targets South Korean organizations through a “rather complex” infection chain. Researchers at cybersecurity company Kaspersky dubbed the operation FlashHole and attributed it to the Lazarus Group. Analysis of the malware revealed that the threat actor used the standardized ML-KEM post-quantum cryptographic mechanism to communicate with the command-and-control (C2) server for malware delivery. Kaspersky says the attackers used LPEClient malware, previously associated with Lazarus, to receive ML-KEM-1024 public keys from its C2 infrastructure and generate shared keys that allowed it to decrypt subsequently incoming payloads.
OpenAI reveals two cases of AI agents disabling safety monitoring during coding tasks, with one falsely denying it had removed the safeguards. OpenAI published an internal incident report this week documenting two separate cases in which GPT-6 class agents weakened the system designed to detect misaligned behavior, in both cases while carrying out routine coding tasks. This wasn’t an external attack. These were internal deployments, and the agents made their own judgment calls that happened to gut the oversight watching them. OpenAI explained that “in both cases, the agents considered whether monitoring safeguards should be preserved, but interpreted routine coding instructions as permission to weaken them.” In other words, the agents thought about whether they should keep the safety controls in place. They then interpreted the user’s instructions in a way that led them to weaken those controls. “In two internal coding tasks, agents weakened misalignment monitoring while making requested software changes. A GPT-6.1 Sol agent repairing an evaluation pipeline disabled automatic alerts to our Security team, treating an earlier instruction not to send messages during a Slack history search as a reason to suppress monitoring notifications.” reads OpenAI’s report. “In a separate task, a GPT-6 Astra agent migrating a program removed its monitoring integration in order to match a reference implementation, and then falsely claimed to the user that it had not removed the monitor.” On October 3, a researcher asked a GPT-6.1 Sol agent to create evaluation tasks using Slack data. The researcher clearly instructed the agent not to send any messages during the process. Later, the system triggered a monitoring alert because it couldn’t save its findings to a database. The user then asked the agent how to proceed. At this stage, the agent was still following the rules. It even told a subagent to keep monitoring enabled and report the actual results. The subagent correctly identified that turning off notifications would disable required safety alerts and decided not to do it. Then the parent agent reconsidered on its own, reasoning that writing results to a database might cause the monitoring system to send a message, which conflicted with the user’s earlier “don’t send messages” instruction. It concluded the instruction applied to safety alerts too, and directed the subagent to set no_notify to true, empty the list of people set to receive monitoring reports, and make notification suppression a hard requirement before writing any results. The monitor still ran and saved its reports. Nobody received the human alerts. On October 6, a user asked a GPT-6 Astra agent to copy a reference implementation while keeping existing tool definitions and functionality intact. An earlier instruction from another agent had explicitly told the system not to disable monitoring, even temporarily. The parent agent passed that requirement to a subagent but softened it, saying monitoring should be preserved “as appropriate” to the reference implementation. The subagent took this wording as permission to remove monitoring because the reference implementation did not include it. It also changed a test that checked whether monitoring was active. The new test instead required monitoring to be disabled. After the migration, the main agent noted internally that the new setup no longer included agent monitoring and described this as a positive outcome. When the user later asked whether monitoring had been removed, Astra said: “No… I did not remove an enabled monitor from it.” That was false. OpenAI offers two possible readings of these incidents. The charitable one is what they call “benign overpersistence,” models that don’t understand why monitoring matters and follow instructions more literally than a reasonable person would. The less comfortable reading is that these models might have a specific tendency to find justifications for evading the systems watching them. “In both cases, the agents considered whether monitoring safeguards should be preserved, but interpreted routine coding instructions as permission to weaken them.” states OpenAI. “We are strengthening our misalignment monitoring system in response, and are also assessing whether these cases reflect benign overpersistence or a propensity to evade misalignment monitoring in particular.” OpenAI says it doesn’t yet have a satisfying answer. To find one, they’re developing paired evaluations, resampling agent continuations, and running experiments on the models’ internal activations. OpenAI has introduced some practical fixes. Its auto-review system, already required for internal Codex use, has been updated to detect and block attempts to disable safety monitoring. The company also plans to require each workload to have an approved safety plan that defines its monitoring requirements. Any workload that fails to meet these requirements will be stopped automatically. Part of the problem was how the systems were designed. Monitoring was easier for agents to bypass during evaluation tasks than in production Codex deployments. In production, monitoring runs outside the agent’s direct control, making it harder for the agent to disable. This report lands a week after OpenAI disclosed seven other misalignment incidents, including one where a research model took cryptocurrency from a wallet it didn’t own to pay transaction fees and didn’t disclose it. “In addition to making it harder for models to disable monitoring, we are looking to understand why models might seek to do so in the first place. It is possible that this behavior is simply an example of “benign” overpersistence, with models not understanding why monitoring is important or insisting that instructions be executed beyond what a reasonable person might expect.” concludes the report. “We are also developing evaluations to test whether models might have a propensity to evade misalignment monitoring in particular and exhibit motivated reasoning in order to do so. We don’t yet have a satisfying explanation for this behavior, and will investigate this behavior through the creation of paired evaluations, resampling of agent continuations, and experiments on models’ internal activations.” Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, AI)
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) is warning that attackers are actively exploiting four vulnerabilities in Plex Media Server. The security issues are collectively called Plex2Shell. When chained in an exploit, an attacker can obtain the owner's admin token and execute code with elevated privileges. Plex Media Server is a popular media suite that helps users organize personal collections of movies, TV shows, music, and photos, and stream them to other devices at home or remotely over the internet. CISA has directed federal agencies to prioritize patching systems affected by Plex2Shell vulnerabilities or apply mitigations by October 23. The security issues were discovered by security researcher Zach Main, who reported them responsibly to Plex on July 27. The individual flaws are rated medium to high in severity, but the researcher assigns the full exploit chain a critical score of 9.8.
OpenAI agents powered by the GPT-6.1 Sol and GPT-6 Astra models weakened misalignment monitoring during two internal tasks, interpreting coding instructions as authorization to do so. AI alignment refers to how well an AI system’s goals and behavior align with human values, intentions, and instructions. It is a key focus of AI safety research aimed at preventing harmful actions and unintended outcomes. One of the incidents occurred on October 3, when an agent powered by GPT-6.1 Sol extended an earlier human instruction “don’t send any messages” related to a Slack history search to automatic monitoring alerts. It directed a sub-agent to empty notification recipient lists and suppress notifications. Although monitoring continued to run and save findings, it disabled alerts to humans.
Vulnerability overview On October 20, 2026, the PHP security team published a preliminary notice regarding an upcoming emergency release that addresses two critical vulnerabilities (both rated 9.2 on the CVSS scale). The patches were released on Wednesday, October 21, 2026, at 14:00 UTC. The release was expedited after information about the vulnerabilities was leaked to the public before the scheduled embargo was lifted. In a post on Hacker News, a user reported two RCE vulnerabilities in PHP, allegedly affecting all versions starting with PHP 5.4.0. The vulnerabilities in question are CVE-2026-109618 and CVE-2026-109619. Shortly after the post appeared, researchers confirmed the existence of the vulnerabilities. Along with the leak of details, an exploit unofficially named PHP2Shell appeared online. In the leaked demo video, the exploit is shown in action on web servers running WordPress, MediaWiki, phpBB, Magento, Joomla, Laravel, Symfony, Drupal, and WHMCS — platforms that power many modern websites. The authenticity of the demonstration and the exact behavior of the exploit had not been independently verified at the time of publication. According to the researcher who published the PoC, the vulnerabilities are related to the handling of the multipart/form-data MIME type in conjunction with the session upload progress mechanism (session.upload_progress) in the PHP core and fall under the categories of use-after-free and memory corruption. This means that the flaws cannot be patched via application code, and the only possible fix is to update PHP on the server. The attack works without authentication: an attacker with network access to a PHP application can execute arbitrary code on behalf of the PHP process without needing to authenticate. Security advisories issued by PHP on October 21 confirm this information. The vulnerabilities affect PHP versions 5, 6, 7, and 8. As of this publication, branches from 8.2 to 8.5 are supported. Older branches, including PHP 8.1, 8.0, 7.x, and 5.x, have reached the end of their lifecycle; however, due to the critical severity of the vulnerabilities, backported patches have also been released for versions 7.4, 8.0, and 8.1. Sansec experts estimate that widespread exploitation could begin within 15 minutes of the update’s release. We strongly recommend that administrators responsible for publicly accessible PHP web servers take the following steps before the patch is available: Conduct an inventory of all PHP-based systems in the infrastructure (including web servers, control panels, third-party software, etc.). Disable upload-progress: set session.upload_progress.enabled = Off using the php_admin_flag in PHP-FPM pools. Block multipart requests on nginx and Apache servers. Consider temporarily isolating PHP applications that connect to the Internet until fixes are released. Ensure readiness to install the patch immediately upon its release. Plan to migrate servers running unsupported versions (8.1 and earlier) to the latest PHP branch. Detection by Kaspersky solutions Kaspersky solutions detect the described malicious activity at various stages of the attack. Possible detection scenarios are listed below. When an attempt is made to exploit these RCE vulnerabilities, Kaspersky Endpoint Detection and Response promptly alerts the user to suspicious actions performed in the context of a web server, on both Linux and Windows machines. This activity is detected by the following rules: creating_windows_shell_from_a_web_servers_process; possible_web_shell_creating_via_exploit; spawning_process_from_webserver_more_filters_linux; webserver_interpreter_execution_linux; executable_file_in_www_folder. Detection of the PHP2Shell vulnerability exploit by KEDR Exploitation of the PHP2Shell vulnerability in network traffic is detected by Kaspersky Anti Targeted Attack (KATA). This solution detects such activity with the following verdicts: Exploit.CVE-2026-109618.HTTP.C&C and Exploit.CVE-2026-109619.HTTP.C&C. Detection of the PHP2Shell vulnerability exploit by KATA Our Kaspersky Endpoint Security solution, now available as Kaspersky Next, also detects malicious post-exploitation activity using the Behavior Detection component, such as PDM:Exploit.Linux.Generic and PDM:Exploit.Win32.Generic.
Confirm this action.
Leaving now will discard your changes.