@2Workly

Helping SOC, detection, and CTI teams stay ahead with cybersecurity news, CTI reporting, and IOC coverage they can act on.

2workly.com
Joined August 2026
  • Tweets1K
  • Following0
  • Followers2
Include

Only show posts containing:

Exclude

Hide posts containing:

Time range
-
Minimum likes
ASD severed an Amadey C2 panel controlling 180k hosts. Disconnecting C2 stops active loader tasks, but does not revoke stolen session cookies already exfiltrated. Prioritize identity invalidation. thehackernews.com/2026/10/au… 2workly.com #2workly

Australia Gets Into Amadey Malware Backend, Cuts Off Access to 180,000 Infected Computers

Australia's ASD says it disconnected an Amadey malware operator from 180,000 infected computers worldwide after accessing the operation's backend.

thehackernews.com
CVE-2026-30612: Abandoned Popcorn Time updaters polled expired HTTP domains to run unsigned code as SYSTEM/root. Shadowserver sinkholed the domains, but full uninstallation is required. Sweep endpoints now securityweek.com/dead-popcor… 2workly.com

Dead Popcorn Time Updater Put Millions of Computers at Risk of Takeover

Running at system boot, it periodically polled the update domain to execute any code served, with full privileges.

securityweek.com
PHP2Shell is now confirmed exploited, and the Node.js Brotli bug is forcing patches everywhere. Patching doesn't tell you who got in first. Here's our workflow for turning threat reports into tested, correctly tagged Sigma rules 2workly.com/insights/writing…

Writing Sigma rules from threat reports:

Turn a CTI report into tested Sigma rules: extract behaviors, map log sources, validate with sigma-cli, and use current ATT&CK tags after the v19 split.

2workly.com
2
Blue Initiative launched an index of 30,000 maritime IT/OT flaws, highlighting 580+ known exploited vulnerabilities mapped from CISA KEV. Prioritize sector-specific exposure. securityweek.com/maritime-co… 2workly.com #2workly

Maritime Coalition Launches Free Vulnerability Database for Ship and Port Systems

Blue Initiative indexes nearly 30,000 IT and OT vulnerabilities relevant to ships and ports, 37 of them in maritime-specific products.

securityweek.com
CISA added PHP2Shell flaws CVE-2026-109618 and CVE-2026-109619 to KEV following confirmed unauthenticated RCE exploitation in honeypots. Patch affected PHP builds immediately. Intel: 2workly.com Source: thehackernews.com/2026/10/ci… #2workly

2Workly - Cyber Threat Intelligence Platform

2Workly - Cyber Threat Intelligence Platform. Independent cybersecurity and cyber threat intelligence reporting — threat campaigns, indicators of compromise (IOCs), detection, and enforcement — for...

2workly.com
4
LiteLLM v1.107.0 was backdoored via a leaked key. The package executes on Python startup, harvesting cloud credentials and spawning an hourly Unix backdoor. Audit developer environments and CI/CD pipelines thehackernews.com/2026/10/we… 2workly.com

⚡ Weekly Recap: This2Shell, That2Shell, Everything's an RCE? Rogue AI, Supply Chain Chaos and More

This week's cybersecurity recap: Critical RCE flaws, millions of exploit attempts, rogue AI agents, supply chain attacks, leaked keys, and more.

thehackernews.com
4
CVE-2026-111497 hits the Brotli library in Node.js and Python, but zero in-the-wild exploitation is observed. Prioritize exposure and input paths over alert volume. Intel to enforcement: 2workly.com Source: cyberscoop.com/brotli-critic… #2workly

2Workly - Cyber Threat Intelligence Platform

2Workly - Cyber Threat Intelligence Platform. Independent cybersecurity and cyber threat intelligence reporting — threat campaigns, indicators of compromise (IOCs), detection, and enforcement — for...

2workly.com
4
Microsoft preview binaries for WESP show wesp.sys moving EDR telemetry to user mode, but early builds lack synchronous process blocking APIs. Details: elastic.co/security-labs/blo… Intel: 2workly.com #2workly #EDR

Windows Endpoint Security Platform: Inside wesp.sys

Microsoft is moving EDR out of the Windows kernel. A kernel debugging session shows what the Windows Endpoint Security Platform can and can't do just now.

elastic.co
Attackers compromised 950+ Magento stores, injecting evasive JS into cms_block tables via CVE-2026-48356. Server-side fingerprinting blocks security scanners. Audit database tables directly and enforce CSP thehackernews.com/2026/10/ha… 2workly.com

Hackers Infect 953 Online Stores With Scanner-Evading JavaScript, Mostly on Magento

Hackers infected 953 online stores with JavaScript loaders hidden in Magento CMS blocks, using bot filtering to evade security scanners.

thehackernews.com
PHP patched Brotli RCE flaw CVE-2026-111497 in Windows builds. Verification note: php -v does not change; check SHA-256 hashes or the -1 suffix. Alternatively, disable cURL response decompression. Source thehackernews.com/2026/10/ph… 2workly.com

PHP Issues Second Windows Security Update in Five Days to Fix Brotli Code Execution Flaw

PHP updates Windows builds 8.2 through 8.5 to fix a Brotli flaw that could enable code execution through automatic cURL decompression.

thehackernews.com
1
Adversaries use Teams external chat and mail bombing to impersonate IT support, abusing Quick Assist and AnyDesk to drop Chaos ransomware. Block external Teams federation and monitor unauthorized RMM thehackernews.com/2026/10/at… 2workly.com

Attackers Use Microsoft Teams IT Support Scams to Deploy Malware and Ransomware

Attackers abuse Microsoft Teams external chats and fake IT support identities to gain remote access, deploy malware, and steal data.

thehackernews.com
CVE-2026-111497 (CVSS 9.2) hits the Brotli decoder across Node.js, Bun, and Envoy. Decompressing malformed input corrupts process memory, enabling RCE. Upgrade Node.js to 22.23.4, 24.22.1, or 26.12.1 rapid7.com/blog/post/etr-cve… 2workly.com

CVE-2026-111497: Critical out-of-bounds write in the Node.js Brotli decoder

On October 21, 2026, the Node.js Project published a security advisory for CVE-2026-111497, an out-of-bounds write in the Brotli decoder bundled with Node.js. The vulnerability affects the Node.js...

rapid7.com
PHP2Shell (CVE-2026-109618/19) impacts OT platforms across Siemens, Schneider, and ABB. With active exploitation underway, isolate exposed web management ports now. Intel & enforcement: 2workly.com Details: securityweek.com/industrial-… #2workly

2Workly - Cyber Threat Intelligence Platform

2Workly - Cyber Threat Intelligence Platform. Independent cybersecurity and cyber threat intelligence reporting — threat campaigns, indicators of compromise (IOCs), detection, and enforcement — for...

2workly.com
ScarlettGroup claimed a breach of Genesys internal CRM and LMS systems, exposing enterprise contact details. Watch for downstream impersonation and targeted phishing. Enforce threat intel at 2workly.com Source: securityweek.com/genesys-hac… #2workly

2Workly - Cyber Threat Intelligence Platform

2Workly - Cyber Threat Intelligence Platform. Independent cybersecurity and cyber threat intelligence reporting — threat campaigns, indicators of compromise (IOCs), detection, and enforcement — for...

2workly.com
3
PHP2Shell (CVE-2026-109618) moved from worker crashes to working RCE shells. Honeypots logged 35 shells via a 4-stage HTTP chain leaking memory to bypass ASLR. Prioritize patching vulnerable PHP instances securityweek.com/php2shell-e… 2workly.com

PHP2Shell Exploitation Moves From Probes to Working Shells 

Attackers successfully exploited the PHP2Shell flaws against honeypots, launching 35 shells from two IP addresses on October 24.

securityweek.com
1
5
CERT-UA warns hackers are hijacking Dahua cameras via predictable Easy4IP cloud serials and auth-bypass bugs CVE-2021-33044 and CVE-2021-33045, bypassing perimeter firewalls. Disable P2P cloud access and therecord.media/ukraine-cert… 2workly.com

Ukraine warns hackers are exploiting Chinese-made Dahua surveillance cameras

CERT-UA says it has identified cases in which hackers compromised Dahua internet-connected cameras and video recorders, changed their settings and created unauthorized user accounts.

therecord.media
4
Two CVSS 9.9 Wasmtime bugs (CVE-2026-115889, CVE-2026-115893) allow sandbox escapes via Cranelift compiler flaws. Rebuild embedded runtimes to fixed versions (36.0.19, 48.0.7, 49.0.4, 50.0.0). thehackernews.com/2026/10/tw… 2workly.com #2workly

Two Critical Wasmtime Flaws Could Let Malicious WebAssembly Modules Escape Sandboxes

Wasmtime fixes two critical Cranelift flaws that could let attacker-controlled WebAssembly modules escape sandboxes, including an ARM64-only bug.

thehackernews.com
2
LiteLLM version 1.107.0 on PyPI contained credential-harvesting malware after an unrevoked key gave attackers repo access. Stolen AWS keys were tested within hours. Rotate all tokens on affected hosts therecord.media/litellm-hack… 2workly.com

Popular AI tool LiteLLM says unrevoked key allowed hackers to target users

LiteLLM, an open-source tool widely used by artificial intelligence developers, said a key accidentally exposed in May was behind a supply-chain attack that is believed to have hit tens of thousands...

therecord.media
The Gheist campaign abuses stolen GitHub tokens to dump secrets in base32 via Actions logs and delete runs. Detect user agent gheist and OIDC role assumptions on ci-sync-* branches. Intel: thehackernews.com/2026/10/gh… Enforce: 2workly.com #2workly

Gheist Uses Stolen GitHub Tokens to Steal Private Repository Secrets via Actions Logs

Gheist uses stolen GitHub tokens to extract secrets through Actions logs, planting over 13,500 branches across 850 compromised accounts.

thehackernews.com
3
HTTP headers leak scanner origins: Accept-Charset (GBK) and Accept-Language (zh-CN) exposed automated probing against web logins from AS7456 (165.154.29[.]93). Pivot on header telemetry before IPs cycle isc.sans.edu/diary/rss/33442 2workly.com

Looking for a Language [Guest Diary] - SANS ISC

Looking for a Language [Guest Diary], Author: Guy Bruneau

isc.sans.edu
Load more