PHP2Shell and new ITW exploits, APT and cyberspionage operations, the latest from Italy

Vulnerabilities: active exploitation of vulnerabilities in PHP, Plex, Siemens, Nextcloud and
BeyondTrust

During the week, the landscape of vulnerabilities exploited in the wild (ITW) was marked by an intensification of offensive activity. Of particular significance was PHP2Shell, the name given to the critical vulnerabilities CVE-2026-109618 and CVE-2026-109619 (CVSS 9.2), for which the PHP project released emergency updates on 21 October 2026. The flaws, respectively related to unsafe handling of out-of-memory conditions and a Use-After-Free vulnerability, allow unauthenticated remote code execution (RCE) under certain conditions, affecting several PHP configurations, including Apache with mod_php and PHP-FPM. Offensive activity escalated rapidly: Cloudflare detected thousands of attempts before public disclosure, followed by tens of thousands in the first 45 minutes and volumes subsequently rising into the millions, with payload modifications aimed at evading protections. According to Amazon Threat Intelligence, its MadPot honeypot network recorded a PHP2Shell exploitation attempt on 17 October 2026, four days before the public disclosure of the vulnerabilities. The attempt originated from an IP address associated with a commercial anonymization service. More than 22.6 million exposed instances are potentially vulnerable, while further analysis demonstrated the possibility of achieving RCE on WordPress, Drupal and Joomla applications and reading sensitive information from process memory. The available evidence confirms intense exploitation activity but does not allow the number of successful compromises to be quantified. The vulnerabilities also prompted security assessments of third-party products, including PAN-OS and Panorama, and precautionary suspensions of institutional and corporate services in several countries. In parallel, active exploitation of Plex2Shell was documented. This chain of four Plex Media Server vulnerabilities, tracked as CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656, combines SSRF, abuse of plugin functionality, theft of the administrative token and arbitrary file writing, enabling unauthenticated RCE. The day after a PoC was published on 16 October, attacks against a Linux/Docker Plex honeypot were observed, culminating in the deployment of the XMRig cryptominer, running under the process name mylovelyminer, and the myawesomeproxy proxy/backdoor, potentially usable to route traffic through compromised systems. Further offensive activity affected Siemens Software Center, for which the vendor confirmed on 19 October the exploitation of CVE-2026-110936 (CVSS 8.4), an Uncontrolled Search Path Element vulnerability that enables code execution through DLL Side-Loading. The flaw was used in a campaign associated with the Romulus malware distribution platform, based on the ClickFix technique. Siemens detected no compromises of its systems or official distribution channels and did not disclose a verified number of victims. Additional evidence of ITW exploitation involved Nextcloud, with the documented compromise of a server in Italy beginning on 10 September through CVE-2026-110447 (CVSS 9.2), an OS Command Injection vulnerability in the Collabora Online – Built-in CODE Server component. The vulnerability allows unauthenticated remote command execution when the integrated CODE server is not running. The attackers installed three PHP web shells, used to establish remote access and search for password databases, credential manager artifacts and cryptocurrency wallets, with no evidence of access to user documents, privilege escalation or lateral movement. Significant activity was also attributed to the China-linked group UNC5221, responsible for exploiting CVE-2026-102764 in BeyondTrust Remote Support, observed as early as 29 August against a single SaaS instance and a single self-hosted appliance. The flaw, classified as Improper Origin Validation, allows an unauthenticated remote attacker to perform file operations on the appliance. The documented intrusions involved deployment of the SAWFLY web shell, acquisition of root privileges, extraction of credentials from the vault, installation of the BARECLAW SOCKS5/WebSocket tunneler, modification of administrative roles to facilitate lateral movement and systematic deletion of logs. CISA added BeyondTrust’s CVE-2026-102764 to its KEV catalog on 16 October, followed by the four Plex2Shell vulnerabilities and Siemens’ CVE-2026-110936 on 20 October, establishing different remediation deadlines for US Federal Civilian Executive Branch (FCEB) agencies: 19 October for CVE-2026-102764, 23 October for CVE-2026-96654 and CVE-2026-96656, and 3 November for CVE-2026-96652, CVE-2026-96655 and CVE-2026-110936. Finally, security researchers report continued attempts to exploit CVE-2026-0257 by ransomware operators associated with Qilin Team and INC RANSOM Team, identified respectively as Spikey Scorpius and Tarnished Scorpius. Based on public reports, the same vulnerability is also being used by the SETTRA ransomware operator.

Threats: cyberspionage, supply chain and ransomware

Security researchers identified a campaign named Operation FlashHole, attributed to the North Korean Lazarus Group, active since January 2026 against at least three South Korean organizations in the software, construction and telecommunications sectors. An evolution of Operation SyncHole, the campaign uses spear-phishing emails containing links to fake résumé and portfolio websites hosted on GitHub Pages, exploiting the legitimate CrossWeb EX software to initiate a predominantly in-memory infection chain. This includes the CLOUDBURST downloader, which communicates through GitHub, the TouchHub and TouchShift components for persistence, ClientHub, LPEClient and SIDESHOW, used to orchestrate subsequent stages of the attack. In parallel, the Russian group Sofacy was linked to an espionage campaign against organizations in two NATO countries, including a law enforcement agency, a military shipyard and a manufacturer of aircraft engines for defence applications. In an intrusion that began on 24 July and continued until at least 24 September, the attacker used Word documents containing malicious macros, the HOOKEDGE backdoor, reverse SSH tunnels and NTLM credential harvesting techniques, also deploying a new reflective loader, ld.exe, to execute encrypted payloads in memory. No exfiltration was confirmed, but the selection of targets is consistent with military intelligence objectives. On the cloud supply chain front, a campaign involved ConnectWise Cloud Backup (formerly SkyKick), a service used by Managed Service Providers (MSPs). Unidentified attackers exploited a compromised application credential to access customers’ Microsoft 365 tenants through OAuth permissions already granted to the service. A few days after the publication of the initial analysis, which had provided no information about the suspected perpetrators, security researchers revealed that the responsible actor was the Chinese state-aligned group Storm-0940, which exploited ARTEX. The agentic framework was used to accelerate the abuse of compromised applications to authenticate to target environments through applications that had already been granted access, allowing the attacker to operate without requiring interactive user access. In the ransomware landscape, on 20 October, CISA, the FBI, the U.S. Secret Service and German and British law enforcement authorities released an advisory outlining the tactics, techniques and procedures (TTPs) of the SAFEPAY operator. Active since August 2024, the adversary has targeted more than 600 organizations worldwide. In the field of cyberspionage, an investigation by the University of Toronto’s Citizen Lab, conducted in collaboration with the Belgrade-based nonprofit SHARE Foundation, revealed two new cases of targeting with commercial spyware in Serbia. Forensic analysis established that Vladan Đokić, Rector of the University of Belgrade, was infected in 2026 with Pegasus spyware developed by Israel’s NSO Group. Rade Bajić, a former senior associate of the Serbian Prosecutor’s Office for Organized Crime, instead received an Apple notification warning of a possible attack; no infection was confirmed in his case. In parallel, a campaign attributed to an attacker named CL-UNK-1211, conducted between October 2025 and April 2026 against government entities and state-affiliated infrastructure, was reconstructed. The adversary compromised Linux servers through web shells, establishing persistence by modifying PHP configurations, SSH keys and deploying the cross-platform SysGoRAT RAT, developed in Go. The activities included credential theft, reconnaissance using LinPEAS, the use of tools associated with vulnerabilities CVE-2021-4034 and CVE-2025-55182, lateral movement and exfiltration of databases and email information. The payloads also contained elements consistent with the use of artificial intelligence tools to generate malicious code, although there was insufficient evidence to establish the degree of automation.

Italy: DDoS and ransomware attacks against Italian organizations

Following the previous week’s activity, the pro-Russian collective NoName057(16) renewed its interest in Italy. The adversary claimed DDoS attacks against the following portals: Interporto Padova S.p.A.; Metropolitan City of Cagliari; Sogedim S.p.A.; Arco Spedizioni S.p.A.; CONFETRA; ALIS; Western Ligurian Sea Port System Authority (Single Administrative Desk); Centro Studi Trasformazioni Economico-Sociali (CESTES); Veneto Sviluppo S.p.A.; Trasmar S.r.l.; Dogado S.r.l.; STEF; SUSA S.p.A.; Transadriatica S.r.l. The Dark Storm Team collective also claimed DDoS attacks against Italian portals, including: Logtainer; Pratiche.it S.r.l.; La Bolgetta (Tempospazio S.r.l.); Ehiweb (Ehinet S.r.l.); SDA Express Courier S.p.A.; Team Shipping Agency S.r.l. In addition, the group BD Anonymous, allegedly of South Asian/Bengali origin, claimed attacks against: Municipality of Arzignano; Metropolitan City of Cagliari; Florence Airport (Amerigo Vespucci); and Pisa International Airport (Galileo Galilei). The actions were allegedly carried out in retaliation against the position attributed to the Italian Government, accused of refusing to recognize Palestine as a state while maintaining diplomatic relations with Israel. Finally, the CyberTroll Team hacktivist collective claimed a DDoS attack against the portal of the Intelligence System for the Security of the Republic. Turning to the ransomware landscape, Everest Team claimed the compromise of Galleria di Base del Brennero – Brenner Basistunnel BBT SE, while Qilin Team claimed Mastelli S.r.l. – Società Benefit and Coop Italia. Finally, on 21 October 2026, a claim attributed to the hacker group DubleDump emerged, alleging that the University of Salento (UniSalento) had been compromised, resulting in the theft of 79,000 student records.

Weekly Threats Report is Telsy‘s weekly update covering the main developments in cyberattacks and threat actors worldwide, produced by our Threat Intelligence & Response team.

The team consists of security analysts and researchers with technical and investigative expertise and internationally recognized experience.

Through the continuous monitoring of cyber threats and geopolitical events, it produces and provides organizations with actionable intelligence to anticipate attacks and understand their impact, while relying on a trusted partner in the event of a cyber incident.

Learn more about our Cyber Threat Intelligence solution.