IFIN

IFIN

@ifin-intel.org

The Independent Federated Intelligence Network. Our mission: Empower organizations to independently collect, analyze, and disseminate relevant cyber threat intelligence through training, open source tools, and a decentralized intelligence sharing network.

247 followers38 following285 posts

IFIN reposted

IFIN
@ifin-intel.org

When IFIN started, we used a legacy server hosted with Digital Ocean for reverse proxy services. Their recent choices to support fascist-adjacent tech and cease supporting open source projects have made that relationship untenable for us. As of tonight, IFIN infrastructure has moved entirely off DO.

IFIN
@ifin-intel.org

When IFIN started, we used a legacy server hosted with Digital Ocean for reverse proxy services. Their recent choices to support fascist-adjacent tech and cease supporting open source projects have made that relationship untenable for us. As of tonight, IFIN infrastructure has moved entirely off DO.

IFIN
@ifin-intel.org

While everyone (including us) was losing their heads about PHP and Brotli, our community was tracking a widespread WhatsApp Phishing campaign in Europe. Domains and TTPs in this excellent thread. ifin.network/t/whats... #ThreatIntel #IFIN

ifin.networkWhatsApp GhostPairing attacks in Europe using the WA.FISHER phishing kitLast Updated: 2026-10-25T14:46:59Z (UTC) What’s Happening A WhatsApp GhostPairing phishing is going around in Europe. Phishing lures are sent from compromised accounts to known contacts. Since August 2026 there is more public reporting on the ballet competition-themed lure in multiple countries. Casting a vote initiates a device-sync and leads to an account takeover. Indicators are available in the public MISP feed (uuid 3b08d9b4-c7e7-4d5b-8632-3d7d213e7298) The WA.FISHER phishing platform ...
IFIN
@ifin-intel.org

We've updated this story to reflect the wider impact of the vulnerable Google Brotli library. Action is likely necessary.

IFIN@ifin-intel.org

Node and Python were feeling left out, so here's an RCE that needs attention. The Node issue, referred to as #Node2Shell, appears fairly exploitable. Check your Node versions and update. Check for affected Python packages as well. ifin.network/t/cve-2... #ThreatIntel

ifin.networkCVE-2026-111497: Brotli Out-of-Bounds Write Impacts Node, PythonLast Updated: 2026-10-23T15:39:23Z (UTC) CVSSv4: N/A On 2026-10-21T07:00:00Z (UTC) NodeJS patched a High severity vulnerability in the runtime involving the Brotli compression decoder. The vulnerability was a buffer overflow that could lead to remote code execution. On 2026-10-22T07:00:00Z (UTC), Imperva published a report demonstrating the remote code execution. Notably, Node was vulnerable in a default state, as was the express request handler. Imperva called this “Node2Shell,” but we wi...
IFIN
@ifin-intel.org

Hey, has IFIN been valuable to you this week? We sure would appreciate some support of the mission. We're a registered nonprofit and rely on community support to keep the lights on! ifin-intel.org/support #ThreaIntelIsMutualAid

IFIN
@ifin-intel.org

Node and Python were feeling left out, so here's an RCE that needs attention. The Node issue, referred to as #Node2Shell, appears fairly exploitable. Check your Node versions and update. Check for affected Python packages as well. ifin.network/t/cve-2... #ThreatIntel

ifin.networkCVE-2026-111497: Brotli Out-of-Bounds Write Impacts Node, PythonLast Updated: 2026-10-23T15:39:23Z (UTC) CVSSv4: N/A On 2026-10-21T07:00:00Z (UTC) NodeJS patched a High severity vulnerability in the runtime involving the Brotli compression decoder. The vulnerability was a buffer overflow that could lead to remote code execution. On 2026-10-22T07:00:00Z (UTC), Imperva published a report demonstrating the remote code execution. Notably, Node was vulnerable in a default state, as was the express request handler. Imperva called this “Node2Shell,” but we wi...
IFIN
@ifin-intel.org

Some caveats on "fairly exploitable." - Imperva only tested arm64 - Exploitation requires multiple tries - Unclear whether failures also constitute a DoS

IFIN
@ifin-intel.org

As promised, we've updated our #PHP2Shell story with detailed observable indicators. These are based on a broad review of working proofs-of-concept, and should yield high-fidelity hunts and detections. They've also been added to our MISP feed. ifin.network/t/cve-2... #ThreatIntel

ifin.networkCVE-2026-109618, CVE-2026-109619: Remote Code Execution in PHPLast Updated: 2026-10-22T05:59:07Z (UTC) What’s Happening On 2026-10-21T07:00:00Z (UTC), PHP published an advisory about two critical vulnerabilities in PHP. CVSSv4: 9.2 for both. These vulnerabilities is being actively exploited in the wild. The GitHub security issue has also now been published. PHP has also published a detailed blog post detailing the timeline of these vulnerabilities’ discovery, remediation, and disclosure. CISA has published an advisory urging immediate patching. Th...
IFIN
@ifin-intel.org

We will have useful detections for #PHP2Shell in our post and in MISP shortly. We're doing rigorous validation to make sure we don't provide nonsense.

IFIN
@ifin-intel.org

After reviewing the "evidence" of exploitation of #PHP2Shell and finding it wanting, we have removed the "EITW" tag from our story.

IFIN
@ifin-intel.org

Our standard for "exploited in the wild" is not sprays against targets. It is direct observables from successful exploitation. That's a higher bar to clear, but for such a scary vulnerability, hardly impossible. So far however, we have not seen that level of evidence.

IFIN
@ifin-intel.org

We now have sufficient confirmation to call these exploited in the wild.

IFIN@ifin-intel.org

The official advisory and patches have been released. We continue to track emergence of proofs-of-concept and exploits. ifin.network/t/cve-2026-1... #PHP2Shell #ThreatIntelligence #ThreatIntel #IFIN

ifin.networkCVE-2026-109618, CVE-2026-109619: Remote Code Execution in PHPCVSSv3: 9.2 Last Updated: 2026-10-21T14:06:57Z (UTC) What’s Happening On 2026-10-21T07:00:00Z (UTC), PHP published an advisory about two critical vulnerabilities in PHP. The GitHub security issu...
IFIN
@ifin-intel.org

If you are able to contact folks at local schools, governments, nonprofits, and other services to warn them about the PHP vulnerabilities, please consider doing so. These locations often do not have dedicated security staff and almost certainly have PHP assets exposed.

IFIN
@ifin-intel.org

Quick heads up: the forum is going to blip for a minute or two while we increase the RAM because uhhhh we've had a *noticeable increase* in traffic the last two days.

IFIN reposted

IFIN
@ifin-intel.org

Replying to @ifin-intel.org

Okay, Edge is updated, and so is Windows curl and PowerShell.

IFIN
@ifin-intel.org

Eight intermediate certificates used by eMudhra/Emsign have been compromised. These certificates are in multiple trust stores. This will require significant manual action to remediate, including the updates of several packages. ifin.network/t/emudhra-in... #ThreatIntel #ThreatIntelligence #IFIN

ifin.networkeMudhra Intermediate Certificates CompromisedLast Updated: 2026-10-20T14:45:34Z (UTC) What’s Happening At 2026-10-20T13:01:00Z (UTC), Mozilla Cryptography Team member Dennis Jackson reported to the Mozilla Google Group about a compromised inter...
IFIN
@ifin-intel.org

We are aware of the upcoming critical vulnerability disclosures in PHP. Watch this post for updates as they are available. ifin.network/t/cve-2... #ThreatIntel #ThreatIntelligence #IFIN

ifin.networkCVE-2026-109618, CVE-2026-109619: Remote Code Execution in PHPCVSSv3: 9.2 Last Updated: 2026-10-20T20:21:25Z (UTC) What’s Happening On 2026-10-20T07:00:00Z (UTC), PHP published an early advisory that two critical CVEs would be published on 2026-10-21T07:00:00Z (UTC). Earlier unsubstantiated reports put the CVSS at 10.0, and claimed that versions back to PHP 5 (8.5 is current) would be impacted. There is still no evidence of that claim. WatchTowr has confirmed the existence and severity of the vulnerabilities. We will update this post as more inform...

IFIN reposted

IFIN
@ifin-intel.org

Eight intermediate certificates used by eMudhra/Emsign have been compromised. These certificates are in multiple trust stores. This will require significant manual action to remediate, including the updates of several packages. ifin.network/t/emudhra-in... #ThreatIntel #ThreatIntelligence #IFIN

ifin.networkeMudhra Intermediate Certificates CompromisedLast Updated: 2026-10-20T14:45:34Z (UTC) What’s Happening At 2026-10-20T13:01:00Z (UTC), Mozilla Cryptography Team member Dennis Jackson reported to the Mozilla Google Group about a compromised inter...

IFIN reposted

IFIN
@ifin-intel.org

Replying to @ifin-intel.org

We've confirmed that Edge remains unpatched as of this writing.

IFIN
@ifin-intel.org

Microsoft 365 tenants have been compromised via a stolen ConnectWise Cloud Backup credential. We have the details and investigation steps you need if you use this application in your environment. ifin.network/t/unaut... #ThreatIntel #ThreatIntelligence #IFIN

ifin.networkUnauthorized Access in ConnectWise Cloud BackupLast Updated: 2026-10-17T16:16:33Z (UTC) What’s Happening Attackers compromised ConnectWise’s Cloud Backup credential and used it to access tenant environments. The credential has broad permissions to perform its functionality, and another related ConnectWise application gave itself Global Administrator in at least one tenant and created additional tenant credentials. Normal access should come from within the azure private ipv6 range, not the observed suspicious ipv4 address. Whether the a...
IFIN
@ifin-intel.org

If your Palo Alto management interface is internet-exposed, you might notice *even more* traffic on it today. But if that was your security posture, maybe you're fine with that. ifin.network/t/cve-2... #ThreatIntel #ThreatIntelligence #IFIN

ifin.networkCVE-2026-0322: Authenticated RCE in PAN-OSLast Updated: 2026-10-14T20:48:45Z (UTC) What’s Happening Palo Alto disclosed a CVSS4 8.6 Authenticated RCE in PAN-OS, their device operating system. Their synopsis: A remote code execution (RCE) vulnerability in the management interface of Palo Alto Networks PAN-OS® software enables an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall. CISA has already added this to the KEV list, so this is a 0-day. Affected Versions/Patches From ...
IFIN
@ifin-intel.org

An Ivanti 0-day auth bypass is being exploited in the wild with significant post-exploitation activity. ifin.network/t/cve-2... #ThreatIntel #ThreatIntelligence #IFIN

ifin.networkCVE-2026-104935: Ivanti Connect Secure Auth Bypass Exploited for Privilege Escalation, Code ExecutionLast Updated: 2026-10-13T16:07:42Z (UTC) What’s Happening Ivanti has disclosed CV3-2026-104935, a CVSS3 8.6 authentication bypass in Ivanti Connect secure. Volexity has a detailed writeup of the exploitation chain. Affected Versions/Patches Version Patched 25.1.1.1 and prior 25.1.1.2 25.1.2.2 and prior 25.1.3.0, 25.1.3.1 22.8R2.4 and prior 22.8R2.5 Patches are available from Ivanti. Actions Patch immediately. The Volexity post contains detailed exploitation and post-explo...

IFIN reposted

IFIN
@ifin-intel.org

IFIN will be submitting commentary in strong opposition to the obviously dangerous requested TLDs in the latest round of applications to ICANN. Anything that is approved and still dangerous will be added to the IFIN Lists for easy blocking.

icann.orgICANN Reveals 2026 Round Applications for New Generic Top-Level Domains ICANN has published the list of new generic top-level domain (gTLD) applications for the New gTLD Program: 2026 Round, revealing applied-for strings and applying entities.
IFIN
@ifin-intel.org

IFIN will be submitting commentary in strong opposition to the obviously dangerous requested TLDs in the latest round of applications to ICANN. Anything that is approved and still dangerous will be added to the IFIN Lists for easy blocking.

icann.orgICANN Reveals 2026 Round Applications for New Generic Top-Level Domains ICANN has published the list of new generic top-level domain (gTLD) applications for the New gTLD Program: 2026 Round, revealing applied-for strings and applying entities.
IFIN
@ifin-intel.org

Commenting before the 27th incentivizes requesters to rescind their application, recouping much of their significant application fee.

IFIN
@ifin-intel.org

Once again: Evidence of exploitation *attempts* Is not Evidence of *exploitation* That's a much higher bar to clear.

IFIN
@ifin-intel.org

I'm tired, boss. A new #Citrix CVE affecting SAML IdP/SP-configured devices is out. ifin.network/t/cve-2... #ThreatIntel #ThreatIntelligence #IFIN

ifin.networkCVE-2026-107406: Somehow, Another Citrix Netscaler SAML VulnerabilityLast Updated: 2026-10-08T21:02:44Z (UTC) What’s Happening Another critical vulnerability in Citrix Netscaler ADCs/Gateways has been published. This CVSS4 9.5 issue is a memory overflow leading to either denial-of-service or remote code execution. No evidence of exploitation is yet public, per Citrix’s advisory. They have published an accompanying blog post with little additional information. Affected Versions and Preconditions Broadly, the vulnerability affects devices configured as SAML...
IFIN
@ifin-intel.org

The Shai-Hulud style attack on tensorlake has a nasty trick up its sleeve: try to cycle the stolen token, and it'll blow away your home folder, if you're not careful. ifin.network/t/tenso... #ThreatIntel #ThreatIntelligence #IFIN

ifin.networkTensorlake Supply-Chain Attack Comes with Booby TrapLast Updated: 2026-10-08T14:52:19Z (UTC) What’s Happening A <span class="hashtag-icon-placeholder"></span>mini-shai-hulud</span> variant has impacted the tensorlake npm package, version 0.5.144. The usual research labs have writeups on this incident. https://socket.dev/blog/tensorlake-compromise https://www.aikido.dev/blog/tensorlake-npm-package-compromised https://www.stepsecurity.io/blog/tensorlake-npm-compromised-hostage-token-worm https://safedep.io/tensorlake-npm-compromise-mini-shai-hulud/ As of this writing, the infected version ha...
IFIN
@ifin-intel.org

Chat, is it bad if your zero-trust VPN device forwards network requests without auth? Asking for thousands of friends. SonicWall SMA1000 devices have a SSRF vulnerability that needs patching. ifin.network/t/cve-2... #IFIN #ThreatIntel #ThreatIntelligence

ifin.networkCVE-2026-102255: Pre-Auth SSRF in SonicWall SMA1000 DevicesLast Updated: 2026-10-07T18:25:18Z (UTC) CVSSv3: 10 On 2026-10-07T07:00:00Z (UTC), SonicWall disclosed 4 vulnerabilities affecting SMA1000 edge devices. These have not been confirmed to be exploited. The most concerning of the 4 is the headline CVE-2026-102255, which allows pre-authenticated server-side request forgery (SSRF) against these edge devices, turning them into essentially a forward proxy into the environment they are supposed to protect. The other CVEs include post-auth RCE, ...
IFIN
@ifin-intel.org

Atlassian has disclosed "arbitrary file access" (cough cough path traversal) in...basically everything. Patches available, but so now is a broad proof-of-concept. Not yet known-exploited, emphasis on "yet." ifin.network/t/cve-2... #IFIN #ThreatIntel #ThreatIntelligence

ifin.networkCVE-2026-21589: Arbitrary File Access in Multiple Atlassian ProductsLast Updated: 2026-10-06T17:20:51Z (UTC) CVSSv3: 9.3 Atlassian has published an advisory regarding a putative path traversal vulnerability in multiple products. We’re saying “putative” because although the remediation is plainly about dots and slashes, the word “traversal” does not appear in the advisory. WatchTowr, as usual, has published a writeup of this vulnerability, including a proof-of-concept. They have demonstrated that the file read in Atlassian Crowd leads credential leakage ...
IFIN
@ifin-intel.org

This is the patch that never ends It goes on and on my friends Some people Started applying it Not knowing what it was And they will keep applying it Forever just because (CVE-2026-88779 advisory and patch included now) ifin.network/t/multi... #Citrix #Netscaler #ThreatIntel #ThreatIntelligence

ifin.networkMultiple Citrix Netscaler 0-Days ExploitedLast Updated: 2026-10-04T04:28:55Z (UTC) What’s Happening Citrix has disclosed 8 critical CVEs. https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096 There’s also an associated blog post. Affected Versions Citrix NetScaler ADC and Citrix NetScaler Gateway 14.1 BEFORE 14.1-73.37 Citrix NetScaler ADC and Citrix NetScaler Gateway 13.1 BEFORE 13.1-64.23 Citrix NetScaler ADC FIPS BEFORE 14.1-73.37 FIPS Citrix NetScaler ADC FIPS and NDcPP BEFORE 13.1-37.279 Indicato...

IFIN reposted

IFIN
@ifin-intel.org

*Sigh* The new reports of further exploitation of Citrix devices and all known observables have been added to our report/MISP feed. ifin.network/t/multi... #Citrix #PitScaler #ThreatIntel #ThreatIntelligence #IFIN

ifin.networkMultiple Citrix Netscaler 0-Days ExploitedLast Updated: 2026-10-02T19:34:34Z (UTC) What’s Happening Citrix has disclosed 8 critical CVEs. https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096 There’s also an associated blog post. Affected Versions Citrix NetScaler ADC and Citrix NetScaler Gateway 14.1 BEFORE 14.1-73.37 Citrix NetScaler ADC and Citrix NetScaler Gateway 13.1 BEFORE 13.1-64.23 Citrix NetScaler ADC FIPS BEFORE 14.1-73.37 FIPS Citrix NetScaler ADC FIPS and NDcPP BEFORE 13.1-37.279 Indicato...
IFIN
@ifin-intel.org

*Sigh* The new reports of further exploitation of Citrix devices and all known observables have been added to our report/MISP feed. ifin.network/t/multi... #Citrix #PitScaler #ThreatIntel #ThreatIntelligence #IFIN

ifin.networkMultiple Citrix Netscaler 0-Days ExploitedLast Updated: 2026-10-02T19:34:34Z (UTC) What’s Happening Citrix has disclosed 8 critical CVEs. https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096 There’s also an associated blog post. Affected Versions Citrix NetScaler ADC and Citrix NetScaler Gateway 14.1 BEFORE 14.1-73.37 Citrix NetScaler ADC and Citrix NetScaler Gateway 13.1 BEFORE 13.1-64.23 Citrix NetScaler ADC FIPS BEFORE 14.1-73.37 FIPS Citrix NetScaler ADC FIPS and NDcPP BEFORE 13.1-37.279 Indicato...