jark after dark

rapid7.comRapid7On October 12, 2026, GitLab published a critical patch release for CVE-2026-97229, an integer overflow or wraparound (CWE-190) in the CI/CD regular expression compiler affecting GitLab Community…

a cluster of serious remote code execution bugs was disclosed in widely used developer libraries this week. three are worth your attention, in pillow, node.js, and the ruby regular-expression engine behind gitlab. www.rapid7.com/blog/post/et...

the pattern across all three matters more than any single bug. the code putting you at risk is code you did not write, pulled in as a dependency and rarely tracked.

patching your own application is not enough on its own, because the remote code execution lives three layers down in a library you did not know you were shipping.

node.js has CVE-2026-111497, dubbed node2shell, a remote code execution proof-of-concept against the bundled brotli decoder. patched in 24.22.1. no confirmed in-the-wild use yet, but the proof-of-concept is public.

gitlab's maximum-severity flaw, CVE-2026-97229 at cvss 10.0, traces upstream. ruby patched three bugs in its regular-expression engine, the root cause behind four critical gitlab remote code execution flaws. patch gitlab, then patch ruby.

pillow, the python imaging library, has CVE-2026-112900, an argument injection in its ghostscript handling of eps files. a filename beginning with a hyphen is read as a ghostscript option, and a crafted chain reaches command execution even under ghostscript's default -dSAFER mode. fixed in 13.0.0.

for a few days in early october, a single threat actor controlled more than 300 tor exit relays and used them to intercept ssh connections passing through. the tor project pulled them out of the network within days of discovery.

two habits blunt this specific attack. never blindly accept an unexpected ssh host key, and use key-based authentication instead of passwords.

the deeper and more important point is to stop treating the anonymity layer as a safe one.

the tor project and its directory authorities flagged the relays badexit and had them out of the consensus by october 5.

what makes this more than a niche incident is misplaced trust. tor exit relays are run by anonymous volunteers, so routing sensitive traffic through them means trusting strangers at the egress point.

users who accepted the unfamiliar host key and typed a password handed that password directly to the threat actor. the attacker then logged in, checked for sudo rights, and installed a backdoor. key-based logins were safe and could not be relayed. password authentication was their whole game.

thehackernews.comAttackers Hijacked Over 300 Tor Exit Relays to Intercept SSH ConnectionsAttackers hijacked over 300 Tor exit relays to intercept SSH connections and steal passwords from users who accepted changed host keys.

the same change also closed the tls-protected mail ports and forced plaintext pop3 and imap, widening the interception beyond ssh. a scan on october 2 found 333 exit relays redirecting to twelve interception servers.

the method was simple. the attacker rewrote each relay's torrc configuration to open port 22 and man-in-the-middle outbound ssh. a researcher known as kaba caught it on october 2 after a changed host-key warning over tor. thehackernews.com/2026/10/atta...

socradar found an exposed command-and-control server that laid bare how affiliates of the inc and the gentlemen ransomware-as-a-service operations are using ai to run intrusions. open directories gave up their source code, logs, credentials, and full ai session history.

strip away the ai hype and this is a story about barriers. the skilled labor of an intrusion now fits inside a prompt a mid-tier affiliate can run, and the one real control, the model refusing, folded the moment someone relabeled the job authorized.

that is the shift worth tracking, not the novelty.

the "wormgpt" label in the logs was a persona prompt, not a jailbroken model.

initial access was unglamorous, exploiting exposed edge software like forticlient ems, simplehelp, and cpanel. the specific cves are not yet detailed in the reporting. total ai api spend ran to roughly US$23,920.

the workflow is human-approved, not autonomous. each campaign gets a victim-specific master prompt, and the model waits for approval at each step, helping plan reconnaissance, determine specific techniques for the attack, generate commands, triage stolen data, and draft reports.

socradar.io/blog/inc-gen...

interestingly, when a model refused a request, the operator did not reach for a different, uncensored llm. it reworded the task so it reads legit, framing it as an "authorized red team assessment request" and tried again.

socradar.ioINC and The Gentlemen Ransomware: Exposed AI InfrastructureSOCRadar Threat Research Unit (STRU) has uncovered an AI-driven intrusion ecosystem run by affiliates of the INC Ransomware and The Gentlemen

the interface was opencode, wired to commercial models through openrouter, including anthropic/claude-opus-4.6 and moonshotai/kimi-k3. researchers pulled 8,257 messages across 133 sessions, plus a custom framework the operators called phantom.

group-ib and nyxlab have detailed k0t, an initial access broker also tracked as cryptofeel, member19, and qazwsxshop, harvesting credentials from enterprise edge devices. more than 70,000 valid usernames and passwords from network gear and ldap dumps have been exposed in the campaign.

group-ib assesses k0t as an access broker tied to the qilin and the gentlemen ransomware operations, though the exact nature of that link is not yet established.

this is why it is so important to fully understand the ecrime ecosystem. what you see here is just the supply side component of a ransomware operation. the layer selling the way in, because affiliates love easy access rather than having to pop exploits themselves.

initial access comes through CVE-2025-64446, a fortiweb path traversal, and CVE-2026-0257, the pan-os and prisma access authentication bypass, or plain brute-forcing of common credentials.

thehackernews.comHackers Breach Enterprise Firewalls and VPNs, Exposing Over 70,000 CredentialsA campaign attributed to k0t exploits exposed network devices, establishes persistent access, and exfiltrates data using Rclone.

persistence runs on remote access tools and the adaptixc2 framework. data is exfiltrated with rclone straight to wasabi s3 and mega.

the targets are fortinet fortigate and fortiweb, and palo alto globalprotect, pan-os, and prisma access. k0t finds them at scale, using fofa and zoomeye to fingerprint exposed devices. thehackernews.com/2026/10/hack...

at 06:59 on july 16, 2025, a scheduled task called pdfopentask woke up inside a ukrainian grain company and ran a line of powershell from a file named temporarydoc.txt.

the connective tissue across the operation is trust. almost every major component of the attack borrowed something defenders already had a reason to allow. the larger trick was making trusted infrastructure carry hostile intent.

voodoo bear did not need a better wiper. it needed control of the systems already trusted to administer the network. once it had that, the company could be made to destroy itself. the payload was ordinary. the intent was military.

at 06:59 on july 16, 2025, a scheduled task called pdfopentask woke up inside a ukrainian grain company and ran a line of powershell from a file named temporarydoc.txt.

on september 17, 2025, the destructive phase landed, and it was almost insultingly ordinary. the wiper was sdelete, a sysinternals secure-delete utility microsoft makes available for legitimate administrators.

voodoo bear pushed it across the environment through the victim's own active directory group policy object (gpo). no bespoke wiper, no exotic payload. it is living-off-the-land tradecraft taken to its logical and nihilistic conclusion.

at 06:59 on july 16, 2025, a scheduled task called pdfopentask woke up inside a ukrainian grain company and ran a line of powershell from a file named temporarydoc.txt.

that new backdoor is the reason this report matters beyond one wiped grain company. what sets mythicratatoskr apart is command-and-control. it does not call home to a server you can block by ip.

it joins yggdrasil, a decentralized mesh network with end-to-end encrypted ipv6 traffic, where every node holds an ed25519 key pair and derives its address from that key. eset calls this the first documented case of a state-aligned actor abusing yggdrasil this way. this is not your father's hack.

at 06:59 on july 16, 2025, a scheduled task called pdfopentask woke up inside a ukrainian grain company and ran a line of powershell from a file named temporarydoc.txt.

that heavier hand is voodoo bear, also known as sandworm across the industry, the gru's destructive adversary linked to unit 74455 and to a decade of wiper campaigns and power-grid attacks against ukraine.

the way in was rather dull yet effective. a spear-phishing email carried a malicious attachment, consistent with cert-ua's own findings. no exploit, no edge-device cve, no clever zero-day.

at 06:59 on july 16, 2025, a scheduled task called pdfopentask woke up inside a ukrainian grain company and ran a line of powershell from a file named temporarydoc.txt.

one russia-aligned threat actor broke in and held the ground for weeks. a second, far more dangerous one arrived at the end to burn it all down.

the group that opened the door is tracked by ukraine's cert-ua as uac-0099, a russia-aligned espionage activity cluster active since at least 2022. eset assesses with high confidence that uac-0099 handled initial access and can operate as an initial access broker for a heavier hand.

at 06:59 on july 16, 2025, a scheduled task called pdfopentask woke up inside a ukrainian grain company and ran a line of powershell from a file named temporarydoc.txt.

sixty-three days later, the company's own management plane was weaponized against itself, pushing a free microsoft utility across the environment to erase its data.

www.welivesecurity.com/en/eset-rese...

f5 labs published new analysis of in-the-wild exploitation of a wordpress chain some are calling wp2shell. the flaws are not new, disclosed on july 17, but the captured payloads are the fresh part.

two things to keep straight. this is wordpress core, not a generic php bug, and the exploitation f5 documents came after the july disclosure, not before.

if you run wordpress, confirm you are on 6.8.6, 6.9.5, or 7.0.2 or later.

f5 labs published new analysis of in-the-wild exploitation of a wordpress chain some are calling wp2shell. the flaws are not new, disclosed on july 17, but the captured payloads are the fresh part.

no auth is needed. the attacker posts nested batch requests to /wp-json/batch/v1, confusing the route dispatcher so it reaches a posts query handler that should have required authentication.

the sql injection then rides the author_exclude parameter. f5 captured a union-based injection and saw the same payload hit multiple sensors. advisories say the chain can reach remote code execution, though f5 did not observe a web shell dropped.

f5 labs published new analysis of in-the-wild exploitation of a wordpress chain some are calling wp2shell. the flaws are not new, disclosed on july 17, but the captured payloads are the fresh part.

www.f5.com/labs/article...

f5.comCVE-2026-63030 and CVE-2026-60137: 'wp2shell' Captured Exploit PayloadSensor Intel Series: August 2026 CVE Trends