Unauthorized relays disable Codex and Claude Code sandboxes at 12 firms
A post-install script points the genuine CLIs at relay servers, swaps API keys, and sets danger-full-access; abuse has not been observed.
62
Country
Taiwan
- Mentions · 7d26
- Mentions · 30d60
- All mentions79
- First seenAug 12, 2026
- Last mentioned8h ago
Timeline
79 articles · newest firstSuspected Chinese actor roots PAN-OS firewalls via chained PHP2Shell
The chain rooted 25 servers in four countries and reached a US government Active Directory domain, Unit 42 says.
86
Palo Alto confirms PHP2Shell attacks on exposed PAN-OS management
Unit 42 verified tools that pair the PHP flaws with kernel bug CVE-2026-46300 for root; about 0.02% of the installed base was exposed.
86
Grey-market relays reroute Codex and Claude Code traffic
Symantec says lookalike-domain scripts disable sandboxes and send prompts, files and tokens through operator servers at about a dozen firms.
74
php2shell RCE confirmed on honeypots and some network appliances
Public PoCs often fail unless tuned to one PHP build, but shared appliance images let one exploit hit many devices.
82
Attackers chain PHP2Shell with Fragnesia kernel bug for root
Dream Security says the chain rooted Palo Alto firewalls and reached Active Directory on 25 servers, three tied to the US government.
84
Reports say PHP2Shell bugs were exploited, including on firewalls
GreyNoise reports at least six successful hits; Dream claims 24 firewalls and two US-linked servers were compromised.
84
Suspected Chinese attackers rooted 25 servers with custom PHP2Shell chain
The chain hit PAN-OS 12.1 and 12.2 from October 23; Dream says remote access likely remains.
84
Warp Panda used VMware ESX zero-day; firewalls rooted and crashed
CISA set November 11 and October 31 federal deadlines; Cisco says CVE-2026-76418 is crashing firewalls with no workaround.
84
CISA warns Fragnesia Linux flaw is chained in PHP2Shell attacks
Agencies must patch CVE-2026-46300 by Saturday 10; researchers say the chain rooted 25 servers, including three US government-affiliated hosts.
88
Chained PHP2Shell exploit roots 25 firewalls, including US government systems
Dream says a custom PHP2Shell build plus the Fragnesia kernel bug yielded unauthenticated root and Active Directory access.
78
Arizona residents resist new data centers over scarce water
TSMC’s Arizona complex uses nearly 5 million gallons a day, while some hyperscale sites use about 1.5 million.
28
Unauthorized AI relay disables Codex and Claude Code sandboxes
Symantec says the relay has installed genuine CLIs at a dozen organizations, mostly in mainland China, since early 2026.
52
PHP2Shell flaws exploited on exposed Palo Alto management interfaces
Unauthenticated RCE hits internet-facing PAN-OS management; CISA set an October 31 deadline for kernel bug CVE-2026-46300.
88
Attackers chain PHP2Shell flaws to root 25 firewall servers
Dream says the chain, including kernel flaw CVE-2026-46300, rooted devices in the US, Japan, Taiwan, and South Korea in under 15 minutes.
76
NUUO Crystal Server 3.19.0.85 allows unauthenticated PHP upload to RCE
Uploaded PHP can execute through FastCGI as the web service account, rated 9.8 Critical.
66
Moxa MAR-2000 firmware ping condition allows command injection
A saved monitoring field is reused by a scheduled ping thread for recurring command execution.
48
Attackers chain PHP2Shell and kernel exploits for root on 25 servers
Dream says custom exploits for CVE-2026-109618, CVE-2026-109619 and CVE-2026-46300 reached government-affiliated firewalls and Active Directory.
76
PHP2Shell campaign roots 25 servers, including U.S. government-linked hosts
Dream says a custom exploit plus a Linux kernel bug rooted firewalls in the U.S., Japan, Taiwan, and South Korea.
86
China-linked hackers root firewalls via PHP2Shell and Fragnesia
Dream says attackers exploited 25 of 19,000 internet-facing firewalls on October 23-24 and planted root webshells on 24.
80
ESET maps APT activity from April through September 2026
China-, Iran-, North Korea- and Russia-aligned groups hit governments, semiconductors, drones, crypto firms and Ukraine.
72
CyberStrikeAI’s 44 agents automated attacks on Japan organizations
Other listed targets included Taiwan, Hong Kong, the UK, France, Italy, Qatar, and Colombia.
74
Caseway CEO says expansion is shifting to Taiwan and Europe
The founder says a September 8 US directive halted new American sales while two existing US customers remain.
28
Suspected North Korean campaign targets 216 vulnerable PHP hosts
Cyfirma links a Lazarus-linked group using AI-ranked public exploits to monitor and scan 216 unpatched PHP hosts via private I2P channel.
75
PHP2Shell exploited at a European government entity, Unit 42 says
Within two hours the attackers reached password hashes, MFA secrets, and an NTLM-relay path toward Domain Admin.
86
Schmidt essay likens OpenAI and Anthropic to colonial trading companies
A Foreign Affairs essay argues debt, minerals, chips and a Taiwan risk constrain the US-China AI race.
34
BRONZE SANDCASTLE sideloads trusted Windows apps to steal AD credentials
Sophos observed the activity from August 2025 through August 2026 across Asia and Africa, including likely South Korea.
74
Bronze Sandcastle sideloads Sandboxie DLLs to deploy backdoors
Sophos says the China-aligned cluster hit organizations in Asia and Africa from mid-2025 using encrypted config.ini payloads.
72
BRONZE SANDCASTLE steals Active Directory databases via hidden backdoors
Sophos traced victims in five countries and likely South Korea from August 2025 through August 2026.
72
Moxa AIG-302 ThingsPro Edge through 1.4.0 can leak keys
An unauthenticated adjacent attacker can abuse a hard-coded key; a logged-in user can read the secrets API.
64
RTX Spark Ignites Global Celebration as New Windows PCs Arrive
NVIDIA RTX Spark Windows laptops with Blackwell GPUs and up to 128GB memory are now on sale from $2,399.
42
UAT-11985 Uses Fake Event Invites to Target Taiwan Research Affiliates With Google AitM Phishing
Cisco Talos says UAT-11985 uses fake event invites and Google AitM phishing against Taiwan research affiliates.
64
E Ink Launches Latest Version of Color EPaper Platform, E Ink Kaleido 4
E Ink launched Kaleido 4 color ePaper, first used in Hanvon Technology’s M10C II notebook.
3
Be There for the Beginning: Celebrate the Launch of NVIDIA RTX Spark
NVIDIA invites fans to Oct. 16 events launching RTX Spark PCs for local AI, creators, and gaming.
42
More Than Three Quarters of Small Business Owners Say AI Makes Them More Productive, But Most Need More Guidance
Meta-commissioned YouGov survey finds 84% of APAC small businesses use AI, but most want guidance.
18
n0n Group Puts Dozens of Global Ports and Shipping on Its Leak Site
Extortion group n0n listed 38 global ports, terminals, and shipping firms on its leak site.
76
12th October – Threat Intelligence Report
Check Point's weekly report covers a Denmark registry breach of 8.8 million people, ransomware, and exploited enterprise flaws.
82
Google AitM Phishing Kit Uses WebSockets to Bypass MFA in Real Time
Cisco Talos says UAT-11985 uses a Google AiTM kit to steal sessions from Taiwan-linked researchers.
68
Hackers Use AI-Generated Event Lures to Steal Google Accounts and Bypass MFA
UAT-11985 used likely AI-written event invites and an AiTM kit to steal Google sessions from Taiwan researchers.
72
Google Data Centers around the world
Google lists data center sites across Asia, Europe, and the Americas, including many still in development.
4
Related CVEs
by mentions- CVE-2026-109619100%9.2Use-after-free RCE in PHP via stale request globals
- CVE-2026-109618100%9.2OOM longjmp memory flaw enabling RCE in PHP
- CVE-2026-4630016%7.8Shared-frag marker loss in Linux kernel skb coalescing (LPE)
- CVE-2015-330699%10.0Arbitrary file read/write via ProFTPD 1.3.5 mod_copy
- CVE-2021-319930%9.8Path Traversal RCE in ONLYOFFICE Document Server
- CVE-2016-308197%8.1Command injection RCE in Apache Struts Dynamic Method Invocation
- CVE-2015-5477100%7.5Remote denial of service in ISC BIND via TKEY queries
- CVE-2023-228944%4.9Sensitive-data leak in Strapi admin query filters (through 4.5.5)
- CVE-2026-5504070%9.1Authentication Bypass in Microsoft SharePoint Server
- CVE-2014-6278100%—Remote OS Command Injection in GNU Bash via Crafted Environment (Shellshock-family)
Appears with
- Microsoftvendor · 16
- CISAorganization · 15
- Dreamorganization · 11
- Palo Alto Networksvendor · 9
- DeepSeekai model · 8
- Kimiai model · 8
- PHPproduct · 8
- Flax Typhoonthreat actor · 8
- Cisco Talosorganization · 7
- Linux kernelproduct · 7
- Miraimalware · 7
- Symantecorganization · 7
- FishHubproduct · 6
- Integrity Technology Grouporganization · 6
- FBIorganization · 6
- Microsoftorganization · 6
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.