YARA-X on DanSec Daily

Cybersecurity Brief – 2026-10-26

Mon, 26 Oct 2026 00:00:00 +0000

Major Incidents or Breaches

Genesys disclosed a security incident exposing customer data from internal systems. The Genesys Cloud, Genesys Engage, and Genesys Engage Cloud platforms were not affected ^[23].
Quest Diagnostics reported a breach impacting patient records and personal information ^[32].
953 online stores were found infected as part of a long-running malware campaign, where injected loader code served malicious payloads or remained dormant to avoid detection ^[26].
A Chinese national was extradited to the US for alleged involvement in a cryptocurrency investment scam that defrauded 174 victims of nearly $37 million ^[13].

Newly Discovered Vulnerabilities

Two critical remote code execution (RCE) vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively known as PHP2Shell, are being actively exploited in the wild. Industrial vendors including Siemens, Schneider Electric, and ABB confirmed some products are affected. Exploitation has shifted from probing to successful shell deployments against honeypots ^[15]^[22]^[25].
Two critical flaws were disclosed in Wasmtime, a WebAssembly runtime, allowing malicious modules to escape the intended sandbox ^[4].
An out-of-bounds write flaw in Google’s Brotli decoder affects Node.js, .NET, PowerShell, and Python packages, enabling code execution and prompting widespread patching efforts ^[28].
Unpatched vulnerabilities in Tailscale SSH allow a compromised device to gain root access on other reachable servers within the network ^[10].
The update process for the abandoned Popcorn Time streaming app was found to leave millions of devices exposed to remote hijacking ^[30].

Notable Threat Actor Activity

Ongoing exploitation attempts targeting the PHP2Shell vulnerabilities have been observed, with evidence of successful post-exploitation activity and suspected global scanning by North Korean actors ^[11]^[15]^[25].
An automated campaign, dubbed Gheist, is using stolen GitHub tokens to inject workflows that exfiltrate repository secrets via GitHub Actions logs ^[8].
A Microsoft 365 campaign has compromised 97 accounts across 79 organisations by leveraging adversary-in-the-middle relay attacks to capture and replay authentication tokens ^[7].
The uCreator Android spyware kit is being rented out to steal Telegram 2FA passwords and clone WeChat accounts by embedding itself in trojanised versions of the apps ^[6].
Dutch police arrested two individuals for conducting NFC relay attacks that drained over $400,000 from bank accounts, involving social engineering to trick victims into installing malicious apps and scanning credit cards ^[27].

Trends, Tools, or Tactics of Interest

Multiple headlines highlight the proliferation of RCE vulnerabilities, with attackers rapidly scanning for and exploiting new bugs such as PHP2Shell, Node2Shell, and others ^[3]^[28].
Attackers are leveraging malicious instruction files (e.g., AGENTS.md) placed in developer environments to hijack AI coding agents and install malicious npm packages ^[9]^[16].
New guidance from NIST, CISA, and NSA recommends treating incidents involving autonomous AI agents as standard security events, with a focus on tracking agent identity and authority ^[12].
Stolen reasoning traces from OpenAI models may facilitate the creation of cheaper rival AI systems, following a flaw in OpenAI’s compaction process ^[24].
Kali Linux 2026.3 was released, introducing six new security tools and desktop environment updates ^[14].
YARA-X 1.22.0 was released, delivering 11 improvements and 9 bugfixes ^[21].

Regulatory or Policy Developments

No significant regulatory or policy developments affecting the security industry were reported in the provided headlines.

Sources

Genesys Hack Exposes Customer Data From Internal Systems - securityweek.com
Patient records exposed in Quest breach: What you need to know - malwarebytes.com
953 Online Stores Infected in Long-Lasting Malware Campaign - securityweek.com
Chinese man extradited for role in $36 million cryptocurrency scam - bleepingcomputer.com
PHP2Shell security flaws now sucessfully exploited in the wild - bleepingcomputer.com
Industrial Vendors Check Products for PHP2Shell Vulnerabilities - securityweek.com
PHP2Shell Exploitation Moves From Probes to Working Shells - securityweek.com
Two Critical Wasmtime Flaws Could Let Malicious WebAssembly Modules Escape Sandboxes - thehackernews.com
Node2Shell: Brotli Flaw Triggers Patching Across Microsoft, Node.js, Python Packages - securityweek.com
Unpatched Tailscale SSH Flaws Could Let a Hacked Device Reach Root on Other Servers - thehackernews.com
Popcorn Time’s forgotten updater left millions of devices exposed to hijacking - malwarebytes.com
PHP2Shell Exploitation Attempts Continue Amid Suspected N. Korea Global Scanning Activity - thehackernews.com
Gheist Uses Stolen GitHub Tokens to Steal Private Repository Secrets via Actions Logs - thehackernews.com
Microsoft 365 Token-Replay Attacks Compromise 97 Accounts at 79 Organizations - thehackernews.com
uCreator Android Spyware Can Steal Telegram 2FA Passwords and Clone WeChat Accounts - thehackernews.com
Dutch Police Arrest Two Over NFC Relay Attacks That Drained $400,000+ From Bank Accounts - securityweek.com
⚡ Weekly Recap: This2Shell, That2Shell, Everything's an RCE? Rogue AI, Supply Chain Chaos and More - thehackernews.com
Malicious File in Downloads Folder Tries to Trick AI Coding Agent Into Installing Malware - thehackernews.com
AI coding agents hijacked using AGENTS.md file in Downloads folder - bleepingcomputer.com
When an AI Agent Is the Incident, the Identity Record Is the Evidence - bleepingcomputer.com
Stolen AI Reasoning Could Help China Build Cheaper Rivals - securityweek.com
Kali Linux 2026.3 released with 6 new tools, desktop updates - bleepingcomputer.com
YARA-X 1.22.0 Release, (Sun, Oct 25th) - isc.sans.edu

Cybersecurity Brief – 2026-08-30

Sun, 30 Aug 2026 00:00:00 +0000

Major Incidents or Breaches

Microsoft has disclosed a new ClickFix malware variant called TerminalFix, which uses fake Cloudflare CAPTCHA pages to trick users into executing malicious commands in Windows Terminal or PowerShell, resulting in the deployment of a reverse-tunnel backdoor^[1].

Newly Discovered Vulnerabilities

Critical security vulnerabilities have been identified in several widely used WordPress plugins and themes, including WPMU DEV Dashboard, Avada, TranslatePress, Pods, and GiveWP, which could allow attackers to take over affected sites or achieve remote code execution^[2].

Notable Threat Actor Activity

The TerminalFix campaign leverages social engineering tactics by presenting users with fraudulent Cloudflare CAPTCHA challenges to facilitate the execution of malicious PowerShell commands^[1].

Trends, Tools, or Tactics of Interest

Brave browser version 1.94 has introduced an ‘Email Aliases’ feature, enabling users to generate disposable email addresses to help evade tracking when registering for online services^[4].
YARA-X version 1.20.0 has been released, delivering 14 new improvements and 13 bug fixes to the malware identification and classification tool^[7].

Sources

TerminalFix Uses Fake Cloudflare CAPTCHAs to Deploy Reverse-Tunnel Backdoor - thehackernews.com
Five Critical WordPress Plugin and Theme Flaws Enable Site Takeover or RCE - thehackernews.com
Brave browser adds email aliases to help users evade tracking - bleepingcomputer.com
YARA-X 1.20.0 Release, (Sun, Aug 30th) - isc.sans.edu

Cybersecurity Brief – 2026-06-28

Sun, 28 Jun 2026 00:00:00 +0000

Major Incidents or Breaches

The Security Service of Ukraine (SSU) and the US FBI uncovered a long-running campaign by Russian intelligence services that used fake support text messages to steal messaging app credentials from Ukrainian citizens ^[1].
LastPass confirmed another incident where users had their data stolen, marking a repeat compromise for the password manager service ^[5].

Notable Threat Actor Activity

Threat actors are leveraging a Chinese-developed framework, DCloud Uni-App, to power over 200,000 scam and investment fraud websites. The toolkit is being sold and widely adopted in the cybercrime underground ^[7].
Russian intelligence services have been attributed to a credential theft campaign targeting messaging platforms in Ukraine, utilising social engineering via fraudulent support messages ^[1].

Trends, Tools, or Tactics of Interest

A new attack method has emerged where agentic AI coding tools, when tasked with cloning and setting up seemingly clean GitHub repositories, can be tricked into executing malware that evades detection by security scanners, AI agents, and human reviewers ^[3].
The education sector is experiencing increased risk from third-party breaches, highlighting the sector’s challenges in defending against ransomware and vendor-related attacks ^[4].
YARA-X released versions 1.18.0 and 1.19.0, introducing three improvements and two bug fixes to the malware detection and analysis tool ^[6].
OpenAI has released GPT-5.6 (Sol, Terra, Luna) in a restricted preview, with stronger cybersecurity safeguards, as part of a limited rollout to select companies and in collaboration with the US government ^[2].

Sources

Ukraine Says Russian Intelligence Used Fake Support Texts to Steal Messaging Credentials - thehackernews.com
Security News This Week: LastPass Users Had Their Data Stolen—Again - wired.com
Chinese Framework Powers 200,000 Scam Sites - securityweek.com
Clean GitHub repo tricks AI coding agents into running malware - bleepingcomputer.com
Third-Party Breaches Teach Education Sector a Costly Lesson in Vendor Risk - darkreading.com
YARA-X 1.18.0 and 1.19.0 Release, (Sun, Jun 28th) - isc.sans.edu
OpenAI Previews GPT-5.6 Sol With Restricted Access and Stronger Cyber Safeguards - thehackernews.com

Cybersecurity Brief – 2026-06-01

Mon, 01 Jun 2026 00:00:00 +0000

Major Incidents or Breaches

Dutch authorities dismantled a botnet comprising approximately 17 million infected devices, including computers, tablets, smartphones, and IoT devices, which had been used to conduct malicious attacks ^[1].
Attackers are actively exploiting a vulnerability in the WP Maps Pro plugin for WordPress, enabling unauthenticated creation of rogue administrator accounts on affected websites ^[2].

Newly Discovered Vulnerabilities

A security flaw in the WP Maps Pro WordPress plugin allows attackers to create administrator accounts without authentication, which is currently being exploited in the wild ^[2].

Notable Threat Actor Activity

Threat actors are using an unidentified remote access trojan (RAT) to deploy NetSupport RAT, indicating active campaigns leveraging multi-stage malware delivery ^[6].

Trends, Tools, or Tactics of Interest

YARA-X version 1.17.0 has been released, featuring five performance improvements and one bugfix, enhancing malware detection capabilities ^[7].

Sources

Dutch Authorities Dismantle Botnet Linked to 17 Million Infected Devices - thehackernews.com
WP Maps Pro bug exploited to create admin accounts on WordPress sites - bleepingcomputer.com
Unidentified RAT pushes NetSupport RAT, (Mon, Jun 1st) - isc.sans.edu
YARA-X 1.17.0 Release, (Sun, May 31st) - isc.sans.edu

Cybersecurity Brief – 2026-03-08

Sun, 08 Mar 2026 00:00:00 +0000

Major Incidents or Breaches

Ransomware threat actors tracked as Velvet Tempest have been linked to breaches involving the Termite ransomware. They are utilising the ClickFix technique and legitimate Windows utilities to deploy DonutLoader malware and the CastleRAT backdoor.
Over 100 GitHub repositories have been identified distributing the BoryptGrab stealer, which targets browser data, cryptocurrency wallets, system information, and user files.
Leakbase, a cybercrime forum, was dismantled in an international law enforcement operation.

Notable Threat Actor Activity

Velvet Tempest is deploying Termite ransomware through a chain involving ClickFix, DonutLoader, and CastleRAT, leveraging legitimate Windows tools to evade detection.

Trends, Tools, or Tactics of Interest

Microsoft reports that threat actors are now abusing artificial intelligence at every stage of cyberattacks, using AI to accelerate attacks, scale operations, and lower technical barriers.
The latest YARA-X 1.14.0 release includes four improvements and two bugfixes, enhancing malware detection and analysis capabilities.
The BoryptGrab stealer is being widely distributed via public GitHub repositories, highlighting ongoing abuse of developer platforms for malware delivery.

Regulatory or Policy Developments

The US has updated its cyber strategy, emphasising stronger deterrence against cyber adversaries, modernisation of federal networks, protection of critical infrastructure, and investment in emerging technologies such as AI and quantum computing.
The Pentagon is developing procedures for different levels of autonomy in warfare, reflecting internal debates over the use of AI in autonomous weapons systems.
US Customs and Border Protection (CBP) has used online advertising data to track phone locations, raising privacy and surveillance concerns.

Cybersecurity Brief – 2025-11-24

Mon, 24 Nov 2025 00:00:00 +0000

Major Incidents or Breaches

Iberia has disclosed a customer data leak resulting from a security breach at a third-party supplier. The airline is notifying affected customers. The incident follows a threat actor’s claim of possessing Iberia customer data on a hacking forum.

Newly Discovered Vulnerabilities

Wireshark version 4.6.1 has been released, addressing two vulnerabilities and resolving 20 bugs in the network protocol analyzer.

Notable Threat Actor Activity

A threat actor has claimed responsibility for the compromise of Iberia customer data, posting about the breach on a hacking forum prior to the airline’s disclosure.

Trends, Tools, or Tactics of Interest

SmbCrawler has been released as a credentialed SMB share crawler designed for red teams to discover misconfigured SMB shares and hunt for secrets within Windows environments.
YARA-X 1.10.0 has been released, introducing a new command to fix warnings and improve rule management for malware researchers and threat hunters.
Passwork 7 has launched as a unified, self-hosted enterprise password and secrets management platform, offering automated credential workflows for organizations.