A roundup of 130 items curated from across the security community.

News

Phorion found version 2.1.313 of the official Claude Code for VS Code bundle on Open VSX dropping a persistent SSH backdoor on macOS, Linux and Windows. The writeup covers the implant, a bug in its macOS setup logic, and what to hunt for.

+1 more on this storyCursor: Security Notice on the Claude Code Extension Incident (Florian Roth)

Lumen’s Black Lotus Labs exposes the framework Volt Typhoon uses to stage zero-day exploitation and keep long-term access to strategic targets.

+2 more on this storyVolt Typhoon hides zero-day attacks using 'Silent Train' framework (BleepingComputer)
Kim Zetter: Silent Train Exposes Volt Typhoon's Infection Chain (Kim Zetter)

The Brotli bug behind last week’s Node2Shell (CVE-2026-111497) reaches far past Node.js. Microsoft shipped emergency .NET patches, and Zero Day Engineering reports active exploitation.

+2 more on this storyMicrosoft releases emergency .NET patches for critical Brotli flaw (BleepingComputer)
Zero Day Engineering: Brotli CVE-2026-111497 Now Exploited in the Wild (Florian Roth)

Australian authorities got inside the Amadey malware infrastructure and severed its access to roughly 180,000 infected computers.

Talos tracks UAT-11473, a sophisticated APT that used the CVE-2026-20127 authentication bypass in Cisco SD-WAN Catalyst Controller to deploy its KeyDrift malware.

+1 more on this storyHackers exploit Cisco SD-WAN flaw to deploy custom KeyDrift malware (BleepingComputer)

Law enforcement took down Virtualine, a bulletproof hosting service tied to ransomware and other cybercrime operations.

Suspected Chinese operators built a custom PHP2Shell exploit and paired it with a Linux kernel flaw to root 25 servers, including Palo Alto Networks firewalls tied to US government-affiliated organizations. CISA has since added PHP2Shell and the Fragnesia Linux LPE seen in these chains to KEV.

+3 more on this storyCISA Adds PHP2Shell Flaws to KEV (BleepingComputer)
CISA: Fragnesia Linux LPE Chained in PHP2Shell Attacks (BleepingComputer)
GreyNoise: Live Feed of PHP2Shell Intrusions (Steve YARA Synapse Miller)

Attackers are chaining three Ivanti Connect Secure flaws to get root on appliances without credentials.

+1 more on this storyIvanti patches two more Connect Secure zero-days chained in attacks (BleepingComputer)

Hypernative reconstructs what it calls the largest crypto theft on record. The FBI has attributed it to North Korea, and Chainalysis is tracking never-before-seen laundering patterns for the stolen funds.

+4 more on this storyBinance probes potential $5.8 billion crypto-theft hack (BleepingComputer)
Chainalysis: Binance Exploit Laundering Patterns (Nicolas Krassas)
FBI: North Korea Responsible for the $6 Billion Binance Attack (AndrewMohawk⁽ⁿᵘˡˡ⁾)
FBI links $6.3 billion Binance crypto heist to North Korean hackers (BleepingComputer)

Anthropic researchers built an exploit for a critical kernel bug that lets unauthenticated attackers run commands as root on servers with MPTCP listeners. LWN has the technical rundown.

+2 more on this storyAnthropic: Discovering Vulnerabilities With Claude (Alex Plaskett)
Critical Linux Kernel Flaw Allows Remote Root on MPTCP Servers (BleepingComputer)
More this week (31)

Techniques and Write-ups

Orange Tsai pops Microsoft Edge with a chain of logic bugs and walks through each link. A companion video runs the chain the other way, popping Edge from calc.exe.

+1 more on this storyVideo: The Chain Flipped, Popping Edge From calc.exe (Orange Tsai)

ZDI’s Bobby Gould breaks down the bugs behind the recent PeopleSoft attacks, with root cause analysis and a video demo.

Elastic Security Labs digs into the Windows Endpoint Security Platform preview, the architecture security vendors would use instead of kernel drivers.

Atredis exploits Valve’s Steam platform for both remote code execution and local privilege escalation.

Chains CVE-2025-30026, CVE-2025-30023 and CVE-2026-63286 from unauthenticated RCE to decrypting the stored credentials for every managed camera.

Praetorian shows how to defeat ASLR when error output is disabled, why an exposed phpinfo page makes exploitation much easier, and the interpreter code involved. The community php2shell exploit collection now covers 30 RCE profiles.

+2 more on this storyPicking Apart PHP2Shell (AndrewMohawk⁽ⁿᵘˡˡ⁾)
php2shell Exploit Collection Grows to 30 RCE Profiles (Spiros Fraganastasis)

chompie’s pipeline mixes deterministic and AI-led stages and reports results comparable to Anthropic’s using a much less powerful model. Talk video from BSides Canberra.

Rapid7 publishes the technical details, and a Metasploit module is already available.

Pulls the Security Domain Secret from Chrome process memory, decrypts synced passkeys, and forges WebAuthn assertions for account takeover. PoC included.

+1 more on this storypass-ta-key PoC Tool (topotam)

Flaws in GNU Savannah, the hosting platform for core GNU projects, would have let an attacker tamper with Bash at the source.

More this week (31)

Tools and Exploits

A free, open-source repo of initial access exploits, each shipped with a PCAP, a target Docker container and Snort/Suricata rules. New additions every Monday.

A ready-to-use implementation of last week’s SpecterOps research on bypassing LDAP signing through NTLM relay re-authentication.

killa solved James Pavur’s StealMyBitcoin challenge and published the full PoC. LiveOverflow’s PHP2Shell exploit walkthrough for the same challenge is folded in below.

+2 more on this storyBad Sector Labs: Universal PHP RCE Is Not Easily Clanked (Bobby Cooke)
LiveOverflow: Building a PHP2Shell Exploit for StealMyBitcoin (LiveOverflow hextree.io)

LsaIso.exe exposes a named event that tears down VBS credential isolation. With a SYSTEM token, signal it and dump NT hashes straight from LSASS.

+1 more on this storyRuntime Credential Guard Deactivation (Writeup) (S3cur3Th1sSh1t)

Doyensec’s ElectronJS security scanner, previously a commercial product, is now open source.

The demo covers the AWS infrastructure, Terraform deployment, encrypted Beacon traffic and dynamic pre-signed URL refresh.

EvilMog’s ntlmv1-to-4000 script converts captured NTLMv1 for hashcat mode 4000, retiring the ntlmv1 multi tool and its shucking clones. A Hackfest talk on it is coming.

Overwrites one function pointer in an existing TP_IO, TP_ALPC or TP_JOB object and posts a completion packet, so the victim’s own worker thread runs the shellcode. No remote thread and no Get/SetThreadContext.

Lefteris Panos captures call audio through WASAPI loopback and transcribes it with a local model.

Likely a duplicate of CVE-2026-81963 and now fixed, but the author reports it still works on unpatched Windows 11 and Server 2025.

More this week (6)