4 casos · pág. 1/1
In late August 2026, Sekoia TDR observed an attacker interact with an unauthenticated Flowise honeypot emulating v2.2.8. The attacker enumerated chatflows and stored credentials, created a rogue "System Status" chatflow with a callback to attacker infrastructure (154.217.251.226), and used prompt injection to turn the LLM agent into an of…
The PHP security team released emergency fixes on October 21, 2026 for two critical core flaws, CVE-2026-109618 and CVE-2026-109619, nicknamed PHP2Shell. Both are rated CVSS v4.0 9.2 and allow unauthenticated remote code execution (RCE) as the web worker account. They can also expose process memory that may hold credentials and API keys (…
This weekly recap covers several concurrent incidents. ConnectWise disabled seven application identities and suspended Cloud Backup after unknown actors abused them to compromise Microsoft 365 tenants. China-nexus Armory Castle (UNC5221 / Warp Panda) exploited BeyondTrust Remote Support flaw CVE-2026-102764 (CVSS 9.3) as a zero-day in lat…
This SentinelOne weekly roundup (Week 43, 2026) covers several separate stories. The most significant is a suspected Chinese state-aligned actor using ARTEX, a Go-based multi-agent LLM penetration testing framework, to compromise ConnectWise Cloud Backup and pivot into downstream Microsoft 365 tenants. The actor reportedly reached privile…
