PHP2Shell, Fragnesia and new ITW exploits, APT and cyberspionage operations, the latest from Italy

Vulnerabilities: new developments concerning PHP2Shell and active exploitation of flaws in Linux, Brotli and enterprise products

During the week, developments concerning CVE-2026-109618 and CVE-2026-109619 (CVSS 9.2), collectively known as PHP2Shell, gained particular significance. On 24 October, 35 successful command executions were documented on three honeypots configured with PHP 8.4.26 and Apache mod_php. The evidence, reconstructed by correlating HTTP requests with system processes, confirms the actual exploitation of the first vulnerability without separately demonstrating exploitation of the second, and concerns decoy systems rather than production infrastructure. In parallel, security researchers identified a possible reconnaissance campaign potentially linked to the North Korean Lazarus Group, targeting government, financial, industrial and transport infrastructure in several countries. The activities reportedly involved 216 hosts through low-volume scanning and IP address rotation, with no confirmed evidence of successful compromises or sufficient elements for definitive attribution. A PHP2Shell offensive toolkit was also identified in the infrastructure of the adversary kkkkevin777, comprising scripts for automated exploitation attempts, without evidence of successful intrusions. On 23 October, CVE-2026-115560 was also reported, a new vulnerability in PHP session handling that could potentially be exploited for RCE, requiring an unusual combination of application configurations and not addressed by the updates released on 21 October. Attention also extended to products incorporating PHP: according to monitoring by the Dutch NCSC, as of 28 October, 757 products were potentially affected, of which 216 were classified as vulnerable, 136 had fixes available and 364 were still undergoing verification. Italy’s ACN highlighted the need to check appliances, administrative interfaces and applications integrating vulnerable versions of the interpreter, while Palo Alto Networks reported exploitation activity against Internet-exposed PAN-OS management interfaces. In Italy, an initial nationwide assessment identified 285,149 PHP services exposing potentially vulnerable versions, while improvements were recorded in the Public Administration, with a reduction in potentially vulnerable URLs from 650 to 467 (-28.2%) and 168 initially reported addresses now indicating updated versions. Another significant discovery concerned a campaign that allegedly led to the compromise of 25 servers through the chained exploitation of PHP2Shell and CVE-2026-46300, named Fragnesia (CVSS 7.8), a Linux kernel flaw allowing local privilege escalation to root. The attackers reportedly used a custom PHP2Shell exploit to achieve RCE on Palo Alto Networks PAN-OS firewall management interfaces, escalate privileges and install persistent web shells. The attacks on 23 and 24 October reportedly affected 24 firewalls and one internal management server across the United States, Japan, Taiwan and South Korea, including three systems associated with US government infrastructure. In the latter environment, reverse SSH tunnels, LDAP credential harvesting and Active Directory reconnaissance were reportedly observed, while 22 firewalls allegedly remained with web shells installed. Analysis of the offensive infrastructure also identified Claude Code and a platform named aiscan, configured with DeepSeek and Kimi models, suggesting the possible use of artificial intelligence in the development of malicious tools, without direct evidence of its use to create the exploits. Another development concerned CVE-2026-111497 (CVSS 9.2), an Out-of-bounds Write vulnerability in the Brotli compression decoder, also known as Node2Shell, HTTP2Shell and Broccoli2Shell. The flaw affects several software ecosystems, including Node.js, Python, .NET and PHP on Windows, and can cause memory corruption, information disclosure, Denial of Service or RCE when vulnerable applications decompress attacker-controlled data. Laboratory RCE exploits were demonstrated on Node.js, and ITW exploitation attempts were observed from 26 October, without confirmation of successful compromises. Regarding the institutional response, CISA added eight new vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, establishing different remediation deadlines for US Federal Civilian Executive Branch (FCEB) agencies: 26 October for CVE-2026-110447 in Nextcloud/Collabora Online and CVE-2026-114625 in Arista VeloCloud Orchestrator; 29 October for CVE-2026-109618 and CVE-2026-109619 in PHP2Shell; 31 October for CVE-2026-46300 in the Linux kernel; 10 November for CVE-2026-48356, named PolyShell, in Adobe Commerce/Magento and CVE-2026-111497 in Brotli; and 11 November for CVE-2026-41709 in VMware ESX. The latter, an Insufficient Logging vulnerability, allows an attacker who already has administrative privileges to perform certain operations without them being recorded in logs. It was exploited as a 0-day by the China-linked espionage group WARP PANDA, in intrusions against US organizations characterized by the use of BRICKSTORM, TetanusStorm, SharpStorm, DualGauge and GuestConduit malware. Arista also confirmed active exploitation of CVE-2026-114625 (CVSS 9.9), an SQL Injection vulnerability allowing authenticated users with minimal privileges to obtain elevated permissions on the SD-WAN orchestrator, while PolyShell enables unauthenticated uploading of potentially malicious files to Adobe Commerce and Magento Open Source platforms, with possible consequences for system integrity and user sessions. Finally, Apple released security updates including additional fixes for CVE-2026-86950, an Out-of-bounds Write vulnerability previously patched on 28 September and associated with possible highly sophisticated, targeted attacks against specific individuals.

APT: Chinese cyberspionage operations and the growing use of artificial intelligence

Security researchers attributed the ConnectWise Cloud Backup supply chain compromise campaign, which had already emerged the previous week, to Storm-0940. Since September 2026, the adversary has used ARTEX, an open-source penetration testing framework based on AI agents, to automate attacks against hundreds of organizations across various sectors. Between 10 and 14 October, the group conducted password spraying activity against 327 accounts belonging to eight organizations, generating more than 151,000 failed authentication attempts without achieving successful access. From 15 October, after gaining control of ConnectWise multi-tenant application credentials, it exploited pre-existing OAuth permissions to access customers’ Microsoft 365 tenants without interactive authentication and without triggering users’ MFA controls. Reconnaissance through Microsoft Graph, the addition of application credentials to establish persistence, and attempts to modify identities, groups and administrative roles were also observed. The same infrastructure was also identified in activities against an Okta tenant, where the attacker created five accounts through self-service registration, without any involvement of ConnectWise. Another campaign linked to Beijing was conducted by BRONZE SANDCASTLE between August 2025 and August 2026 against organizations in the Philippines, Taiwan, Afghanistan and Namibia, with a probable additional target in South Korea. The intrusions used DLL Side-Loading through legitimate Sandboxie executables to load a malicious library and decrypt a payload contained in the config.ini file. The payload consisted of a custom backdoor with characteristics associated with Meterpreter, executed entirely in memory and equipped with components derived from COFFLoader. Also on the Chinese front, an investigation into Silent Train was published on 28 October. This clandestine infrastructure has been used by Volt Typhoon since at least November 2023 to conduct cyberspionage operations against US organizations in the telecommunications, government, defence, IT services and critical infrastructure sectors. The infrastructure relies on temporary chains of compromised SOHO routers, IoT devices and enterprise systems, used as relays to conceal the origin of attacks through SSH tunnels and tools such as Chisel. Connections passed through as many as six nodes, reaching victims through US IP addresses to bypass geographic and reputation-based controls. The analyses identified four confirmed 0-day campaigns associated with CVE-2024-39717 in Versa Director, CVE-2025-8875 and CVE-2025-8876 in N-able N-central, CVE-2026-20127 in Cisco Catalyst SD-WAN and CVE-2026-16812 in VeloCloud Orchestrator, as well as a probable campaign against Quest KACE. The activities predominantly affected organizations in California, Texas and Hawaii, with target selection consistent with maintaining strategic access to infrastructure relevant to potential geopolitical crises in the Indo-Pacific, without evidence of sabotage. The exploitation of CVE-2026-20127 (CVSS 10.0) was also observed in a separate campaign attributed to the adversary UAT-11473, targeting organizations in the space, satellite, aerospace, defence and public policy research sectors. Following initial access to Cisco Catalyst SD-WAN systems, the attacker deployed KeyDrift, a malicious framework designed to ensure persistence and steal sensitive information. The analyses revealed significant overlap between the infrastructure of UAT-11473 and Silent Train, without demonstrating that the two groups are the same. A further cyberspionage operation linked to the Chinese threat landscape targeted diplomatic agencies in Tajikistan, Uzbekistan and Turkmenistan through a campaign identified in early 2026 and attributed to Axiom. The activity stands out for its use of BlackX, a UEFI bootkit technically similar to BlackLotus, designed to establish firmware-level persistence by exploiting CVE-2022-21894 (Baton Drop) and manipulating Secure Boot protections. Completing the overview of the week’s cyberspionage activity, a new analysis documented the growing use of artificial intelligence in APT operations against Russian organizations in the industrial, commercial, government and defence sectors. During 2026, indications emerged of AI tool usage by eight groups: Mythic Likho, HeartlessSoul, Paper Werewolf, PhantomCore, Rezet, Armored Likho, SkyCloak and AITencShell APT. The evidence points to increasing integration of AI into reconnaissance, malicious tool development and the automation of offensive operations, without demonstrating, in the cases analyzed against Russian organizations, the execution of fully autonomous attacks.

Italy: DDoS and ransomware attacks against Italian organizations

Over the past week, the pro-Russian collective NoName057(16) once again turned its attention to Italy, targeting several portals, including: Conemar Shipping and Chartering S.r.l.; ALIS; Western Ligurian Sea Port Authority; Transadriatica S.r.l.; City of Cagliari; Sogedim S.p.A.; CESTES-PROTEO – Center for Economic and Social Transformation Studies; Veneto Sviluppo S.p.A.; STEF Italia S.p.A.; Federation of the Greens (Europa Verde); Province of Treviso; Municipality of Arzignano; Europorte; Confcommercio Palermo; SA.G.E.M. S.r.l.; Ministry of Infrastructure and Transport – Public Contracts Service; TechnoAlpin AG; Province of Ragusa; Province of Trapani; Province of Syracuse; Italian Trade Agency (ICE) – Agency for the promotion abroad and internationalization of Italian companies; Italian Defence Industries Agency (AID); Leonardo S.p.A.; Province of Livorno; FEDESPEDI (Italian Federation of International Freight Forwarding Companies); SCP S.p.A.; Auta Marocchi S.p.A.; Autotrasporti e Spedizioni Barone S.p.A. According to the group’s statements, the portals were targeted as part of an act of solidarity with citizens who took to the streets to protest against the war and Italy’s economic and military support for Ukraine. The group criticized policies supporting Kyiv and NATO, presenting the attacks as gestures of support for Italian demonstrators. Furthermore, the country was targeted as part of a “digital strike” directed against institutional portals and industrial organizations. The pro-Palestinian group Dark Storm Team also intervened in support of NoName057(16), claiming DDoS attacks against the Liguria Region, the Defence Industries Agency and Port Informer Augusta. The hacktivist collective BD Anonymous, allegedly of South Asian/Bengali origin, also claimed attacks against the Italian State Police, Ciampino Local Police, Carabinieri Biodiversity Unit and Province of Treviso. The actions were allegedly carried out in retaliation against the position attributed to the Italian Government, accused of refusing to recognize Palestine as a state while maintaining diplomatic relations with Israel, as well as against alleged abuses committed by the Italian State Police against demonstrators, including in connection with an incident in Mestre. Turning to the ransomware landscape, AuditTeam claimed on its leak site the compromise of Zena Office S.r.l.; LockBit Team claimed Art School Società Cooperativa Sociale (Dorsi Art School); Aur0ra claimed Ernesto Malvestiti S.p.A.; The Gentlemen claimed Spontini Holding S.r.l. and SOME S.r.l.; Everest Team claimed Natuzzi S.p.A.; EMPERADOR claimed Twice S.r.l. and La Profumeria S.r.l.; PANZER claimed PQE Group (Pharma Quality Europe); and new details emerged concerning the compromise of Coop Italia claimed by Qilin Team, according to which the victim would be Unicoop Etruria Società Cooperativa. A user of an underground forum, identified by the pseudonym Angel_Batista, allegedly offered for sale a database containing personal information relating to approximately 1.1 million members of the Italian Tennis and Padel Federation (FITP), the national body responsible for managing and promoting tennis, padel and wheelchair tennis. The alleged sale was initially announced in mid-October 2026 before recently returning to attention. At present, the FITP has not confirmed any breach related to the report. In addition, new phishing campaigns themed around traffic fines were observed in Italy, exploiting compromised certified email (PEC) accounts to distribute fraudulent payment requests in the name of pagoPA. Finally, on 27 October 2026, information emerged about a series of cyberattacks that had reportedly targeted the systems of the Chamber of Deputies in the preceding days, focusing on the email accounts of numerous members of parliament, including the account assigned to Giorgia Meloni in her capacity as a deputy, separate from the address used for government communications. According to sources at Montecitorio, the attacks were reportedly large-scale, but the situation remained under control thanks to the security measures adopted. Some reports suggest the possible compromise of three email accounts belonging to Giorgia Meloni, Andrea Delmastro and Paolo Formentini, although no public technical confirmation is available. An intensification of similar attempts against other Italian and international institutions was also reported. At present, the actual extent of the compromises, any data exfiltration, the techniques used and the identity of the attackers have not been established.

Weekly Threats Report is Telsy‘s weekly update covering the main developments in cyberattacks and threat actors worldwide, produced by our Threat Intelligence & Response team.

The team consists of security analysts and researchers with technical and investigative expertise and internationally recognized experience.

Through the continuous monitoring of cyber threats and geopolitical events, it produces and provides organizations with actionable intelligence to anticipate attacks and understand their impact, while relying on a trusted partner in the event of a cyber incident.

Learn more about our Cyber Threat Intelligence solution.