@2Workly

Helping SOC, detection, and CTI teams stay ahead with cybersecurity news, CTI reporting, and IOC coverage they can act on.

2workly.com
Joined August 2026
  • Tweets998
  • Following0
  • Followers2
Adversaries use Teams external chat and mail bombing to impersonate IT support, abusing Quick Assist and AnyDesk to drop Chaos ransomware. Block external Teams federation and monitor unauthorized RMM thehackernews.com/2026/10/at… 2workly.com

Attackers Use Microsoft Teams IT Support Scams to Deploy Malware and Ransomware

Attackers abuse Microsoft Teams external chats and fake IT support identities to gain remote access, deploy malware, and steal data.

thehackernews.com
CVE-2026-111497 (CVSS 9.2) hits the Brotli decoder across Node.js, Bun, and Envoy. Decompressing malformed input corrupts process memory, enabling RCE. Upgrade Node.js to 22.23.4, 24.22.1, or 26.12.1 rapid7.com/blog/post/etr-cve… 2workly.com

CVE-2026-111497: Critical out-of-bounds write in the Node.js Brotli decoder

On October 21, 2026, the Node.js Project published a security advisory for CVE-2026-111497, an out-of-bounds write in the Brotli decoder bundled with Node.js. The vulnerability affects the Node.js...

rapid7.com
PHP2Shell (CVE-2026-109618/19) impacts OT platforms across Siemens, Schneider, and ABB. With active exploitation underway, isolate exposed web management ports now. Intel & enforcement: 2workly.com Details: securityweek.com/industrial-… #2workly

2Workly - Cyber Threat Intelligence Platform

2Workly - Cyber Threat Intelligence Platform. Independent cybersecurity and cyber threat intelligence reporting — threat campaigns, indicators of compromise (IOCs), detection, and enforcement — for...

2workly.com
ScarlettGroup claimed a breach of Genesys internal CRM and LMS systems, exposing enterprise contact details. Watch for downstream impersonation and targeted phishing. Enforce threat intel at 2workly.com Source: securityweek.com/genesys-hac… #2workly

2Workly - Cyber Threat Intelligence Platform

2Workly - Cyber Threat Intelligence Platform. Independent cybersecurity and cyber threat intelligence reporting — threat campaigns, indicators of compromise (IOCs), detection, and enforcement — for...

2workly.com
PHP2Shell (CVE-2026-109618) moved from worker crashes to working RCE shells. Honeypots logged 35 shells via a 4-stage HTTP chain leaking memory to bypass ASLR. Prioritize patching vulnerable PHP instances securityweek.com/php2shell-e… 2workly.com

PHP2Shell Exploitation Moves From Probes to Working Shells 

Attackers successfully exploited the PHP2Shell flaws against honeypots, launching 35 shells from two IP addresses on October 24.

securityweek.com
1
5
CERT-UA warns hackers are hijacking Dahua cameras via predictable Easy4IP cloud serials and auth-bypass bugs CVE-2021-33044 and CVE-2021-33045, bypassing perimeter firewalls. Disable P2P cloud access and therecord.media/ukraine-cert… 2workly.com

Ukraine warns hackers are exploiting Chinese-made Dahua surveillance cameras

CERT-UA says it has identified cases in which hackers compromised Dahua internet-connected cameras and video recorders, changed their settings and created unauthorized user accounts.

therecord.media
Two CVSS 9.9 Wasmtime bugs (CVE-2026-115889, CVE-2026-115893) allow sandbox escapes via Cranelift compiler flaws. Rebuild embedded runtimes to fixed versions (36.0.19, 48.0.7, 49.0.4, 50.0.0). thehackernews.com/2026/10/tw… 2workly.com #2workly

Two Critical Wasmtime Flaws Could Let Malicious WebAssembly Modules Escape Sandboxes

Wasmtime fixes two critical Cranelift flaws that could let attacker-controlled WebAssembly modules escape sandboxes, including an ARM64-only bug.

thehackernews.com
1
LiteLLM version 1.107.0 on PyPI contained credential-harvesting malware after an unrevoked key gave attackers repo access. Stolen AWS keys were tested within hours. Rotate all tokens on affected hosts therecord.media/litellm-hack… 2workly.com

Popular AI tool LiteLLM says unrevoked key allowed hackers to target users

LiteLLM, an open-source tool widely used by artificial intelligence developers, said a key accidentally exposed in May was behind a supply-chain attack that is believed to have hit tens of thousands...

therecord.media
The Gheist campaign abuses stolen GitHub tokens to dump secrets in base32 via Actions logs and delete runs. Detect user agent gheist and OIDC role assumptions on ci-sync-* branches. Intel: thehackernews.com/2026/10/gh… Enforce: 2workly.com #2workly

Gheist Uses Stolen GitHub Tokens to Steal Private Repository Secrets via Actions Logs

Gheist uses stolen GitHub tokens to extract secrets through Actions logs, planting over 13,500 branches across 850 compromised accounts.

thehackernews.com
3
HTTP headers leak scanner origins: Accept-Charset (GBK) and Accept-Language (zh-CN) exposed automated probing against web logins from AS7456 (165.154.29[.]93). Pivot on header telemetry before IPs cycle isc.sans.edu/diary/rss/33442 2workly.com

Looking for a Language [Guest Diary] - SANS ISC

Looking for a Language [Guest Diary], Author: Guy Bruneau

isc.sans.edu
CVE-2026-111497 (Node2Shell) in Google's Brotli decoder enables RCE across Node.js, .NET, and Python when decompressing untrusted inputs. Rebuild images and restart running services. Details: securityweek.com/node2shell-… Intel: 2workly.com #2workly

Node2Shell Brotli Flaw Triggers Patching Across Microsoft, Node.js, Python Packages

An out-of-bounds write in Google’s Brotli decoder affects Node.js, .NET, PowerShell, and Python packages, and can lead to code execution.

securityweek.com
AitM token spraying hit 79 orgs, replaying stolen M365 tokens from 193.26.115[.]0/24 to register rogue Entra devices. Turn identity indicators into active enforcement with 2workly.com. Source: thehackernews.com/2026/10/mi… #2workly

2Workly - Cyber Threat Intelligence Platform

2Workly - Cyber Threat Intelligence Platform. Independent cybersecurity and cyber threat intelligence reporting — threat campaigns, indicators of compromise (IOCs), detection, and enforcement — for...

2workly.com
Attackers target AI agents using planted AGENTS.md files in Downloads to install MALFEX malware (function-color npm package) and hijack configs. Monitor edits to ~/.codex/config.toml. Intel: 2workly.com Source: thehackernews.com/2026/10/ma… #2workly

2Workly - Cyber Threat Intelligence Platform

2Workly - Cyber Threat Intelligence Platform. Independent cybersecurity and cyber threat intelligence reporting — threat campaigns, indicators of compromise (IOCs), detection, and enforcement — for...

2workly.com
1
25
Unpatched flaws in Tailscale SSH allow compromised nodes to hit root Unix sockets via port forwarding, gaining root on peer servers without credentials. Restrict ACLs to 1:1 pairs and disable SSH forwarding thehackernews.com/2026/10/un… 2workly.com

Unpatched Tailscale SSH Flaws Could Let a Hacked Device Reach Root on Other Servers

Unpatched Tailscale SSH flaws could let attackers gain root on permitted servers from a compromised device when port forwarding is enabled.

thehackernews.com
2
PHP2Shell (CVE-2026-109618) under active exploitation. Look for POST 500 errors, PHP heap corruption, and Apache crashes. Honeypot probe marker: p2s-rider. Details: thehackernews.com/2026/10/ph… Intel: 2workly.com #2workly

PHP2Shell Exploitation Attempts Continue Amid Suspected N. Korea Global Scanning Activity

Attackers exploited PHP2Shell to access MFA secrets and password hashes at a European government entity, with signs of agentic AI use.

thehackernews.com
2
OpenAI red-teaming disclosed CVE-2026-111497 (CVSS 9.2), an RCE in Brotli affecting Envoy, Istio, and Node.js, plus microVM escapes via DNS flaws. Patch proxy stacks now. Details: thehackernews.com/2026/10/op… Intel: 2workly.com #2workly

OpenAI AI Agents Demonstrate VM Escapes and Secret Cross-Sandbox Communication

OpenAI resumed frontier AI training without live internet access after agents bypassed sandbox controls and uncovered isolation weaknesses.

thehackernews.com
1
Cloudflare logged millions of exploitation attempts within hours of PHP2Shell disclosure. As exploit discovery accelerates, perimeter exposure windows collapse. Enforce edge blocks early. Source: CTI desk wired.com/story/kernel-panic… 2workly.com

The PHP Meltdown Shows How AI Makes Bugs More Exploitable

Security researchers used AI tools to help uncover years-old vulnerabilities in the PHP web scripting language. Then the AI-assisted attacks began.

wired.com
1
LiteLLM hijacked to push poisoned v1.107.0 via an unrevoked master key. Attacker exfiltrated secrets via CI workflows to webhook[.]site and beaconed to litellm[.]dev. Block the IOCs: thehackernews.com/2026/10/le… Intel: 2workly.com #2workly

Leaked LiteLLM Master Key Let Attackers Steal GitHub Tokens and Hijack Release Pipeline

An unrevoked LiteLLM master key enabled GitHub token theft and a malicious PyPI release that steals credentials and installs a backdoor.

thehackernews.com
Eye Security neutralized CVE-2026-30612 (CVSS 9.8), an RCE risk in legacy Time4Popcorn updaters running as root/SYSTEM. Hunt for Updater.exe, PT.updd, and egress to popcorntimeupd[.]xyz. Details: Intel thehackernews.com/2026/10/re… 2workly.com

Researchers Push Over 2 Million Updates to Remotely Disable Popcorn Time Updater That Could Fuel a...

Eye Security sent over 2 million updates to disable Time4Popcorn's vulnerable updater, which could install unverified code with elevated privileges.

thehackernews.com
2
CVE-2026-111497 in Google's Brotli decoder impacts Node.js, Bun, Envoy, and Python. Crafted compressed streams allow memory corruption via incoming requests or client fetches. Patch runtimes or block thehackernews.com/2026/10/br… 2workly.com

Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software

Brotli decoder flaw CVE-2026-111497 affects Node.js, Bun, Python packages and Envoy; code execution was demonstrated on one Node.js build.

thehackernews.com
5
Load more