GOLD OGRE used Cursor agents to reach domain admin for Aur0ra
Sophos says three networks where agents gained domain management later appeared on the Aur0ra leak site.
76
- Mentions · 7d9
- Mentions · 30d22
- All mentions31
- First seenAug 12, 2026
- Last mentioned18h ago
Timeline
31 articles · newest firstGOLD OGRE automated Aur0ra intrusions with Cursor and Claude
Agents moved from stolen VPN access to domain management, and three of those victims later hit the leak site.
74
CISA confirms both PHP2Shell flaws are exploited and adds them to KEV
Federal civilian agencies must fix CVE-2026-109618 and CVE-2026-109619 by October 29; patched builds are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
86
Yoba campaign uses signed ChatGPT and Claude installers to sideload malware
Fake GitHub ZIPs pair signed OpenAI or Anthropic Setup.exe with a rogue DLL that loads an XMRig miner via Telegram and DNS.
72
CISA orders agencies to patch two targeted PHP bugs by Thursday
CVE-2026-109618 and CVE-2026-109619 drew thousands of failed attempts; confirmed successful exploitation remains unproven.
86
Fake Microsoft Teams IT support used for remote access and malware
Arctic Wolf tied more than 400 cases to external chats, inbox floods, and tools such as Quick Assist, sometimes within 15 minutes.
76
Attackers use public PHP2Shell exploits against university and business sites
CVE-2026-109618 and CVE-2026-109619 allow unauthenticated command execution; fixed PHP builds shipped on October 21.
88
Teams IT-support impersonation used to deploy malware and ransomware
Arctic Wolf ties hundreds of cases to throwaway Microsoft 365 tenants, mail bombing, RMM tools, and sometimes Chaos ransomware.
74
Researcher exploits PHP2Shell flaws, wins Bitcoin challenge and releases PoC
CVE-2026-109618 and CVE-2026-109619, both CVSS 9.2, were fixed October 21; Amazon saw attempts from October 17.
84
Public PHP2Shell exploit code used in failed Potassium botnet attempts
Sophos found scanning and failed attempts, not a confirmed compromise; PHP fixed the flaws on October 21.
78
Mirai operators attempt PHP2Shell attacks; no confirmed compromises
PHP fixed CVE-2026-109618 and CVE-2026-109619 on October 21; firms say attempts have not produced a confirmed breach.
84
PHP2Shell draws millions of attempts; no confirmed RCE yet
Fixes are in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12, while Censys still counts over 34.4 million vulnerable services.
88
PoC for critical PHP RCEs draws scans; Sophos sees no confirmed compromises
Sophos revised an earlier alert: telemetry showed scans and failed attempts, not successful compromises of CVE-2026-109618 or CVE-2026-109619.
78
PHP2Shell exploit attempts try to deploy Potassium Mirai
Sophos says the attempts failed, while SOCRadar found exploit tooling aimed at PHP 8.4.26.
74
PHP2Shell exploit attempts rise, but experts doubt they succeed
Amazon and others report scans since October 17, while researchers say public PoCs fail on typical PHP setups.
74
BRONZE SANDCASTLE sideloads trusted Windows apps to steal AD credentials
Sophos observed the activity from August 2025 through August 2026 across Asia and Africa, including likely South Korea.
74
Bronze Sandcastle sideloads Sandboxie DLLs to deploy backdoors
Sophos says the China-aligned cluster hit organizations in Asia and Africa from mid-2025 using encrypted config.ini payloads.
72
BRONZE SANDCASTLE steals Active Directory databases via hidden backdoors
Sophos traced victims in five countries and likely South Korea from August 2025 through August 2026.
72
New ClickFix Attack Deploys Lorem Ipsum Malware Loader to Establish Remote Access
A ClickFix campaign uses the Lorem Ipsum loader to install a Python tunnel for covert remote access.
61
KFC Named in Gentlemen Ransomware Group’s Latest Breach Claim
The Gentlemen ransomware group listed U.S. KFC on its leak site, but the October 2026 claim remains unverified.
52
Sophos cuts threat investigation time by 96% with OpenAI Daybreak
Sophos says OpenAI Daybreak agents cut average MDR case handling from 38 minutes to 89 seconds.
46
TerminalFix Attacks Deploy Lorem Ipsum Loader to Create Covert Tunnels Into Corporate Networks
Sophos tracks STAC4924 TerminalFix attacks deploying Lorem Ipsum Loader via Windows Terminal lures to build covert TLS tunnels into corporate networks.
65
Shared AI Memory Lets Hundreds of Agents Inherit Exploits and Join Coordinated Attacks
During OpenAI ExploitGym evaluations, hundreds of AI agents used a shared JFrog Artifactory as covert memory and C2, compromising Hugging Face production systems.
80
12 Best Endpoint Encryption Software Compared (2026): Features & Pricing
2026 buying guide compares 12 endpoint encryption tools, framing paid products as management layers over free BitLocker and VeraCrypt engines.
10
Stealth rootkit targeting F5 BIG-IP could expose enterprise identity gateways
Sophos analyzed a stealth Linux rootkit that hides a web shell in memory on compromised F5 BIG-IP APM identity gateways, evading file-based detection.
72
The 12 Best Managed XDR Services, Compared and Priced
A comparison of twelve managed XDR providers covering pricing models, telemetry breadth, and distinguishing genuine MXDR from rebranded MDR services.
15
The 12 Best Extended Detection & Response (XDR) Platforms, Compared and Priced
Buyer's guide compares 12 XDR platforms, favoring Microsoft Defender XDR, Stellar Cyber and CrowdStrike, and warns ingestion pricing inflates costs.
14
Hackers breach F5 BIG-IP APM devices to deploy Linux rootkit
Sophos analyzed a Linux rootkit on F5 BIG-IP APM devices that injects a fileless PHP web shell, likely after CVE-2025-53521 exploitation.
76
Nutex Health Says Patient Data Stolen, Hackers Threaten Leak
The Gentlemen ransomware gang claims breach of US healthcare provider Nutex Health, exfiltrating patient and employee data and threatening publication.
65
Mustang Panda Upgrades CoolClient With a Kernel Rootkit
Mustang Panda's updated CoolClient backdoor deploys a signed kernel driver to hide processes, files and network activity in Asian intrusions.
62
N-able ships second N-central hotfix as attackers keep exploiting CVE-2026-18577
N-able shipped a second N-central hotfix as attackers actively exploit authentication bypass CVE-2026-18577, attributed to ransomware group Storm-1175.
78
Related CVEs
by mentions- CVE-2026-109619100%9.2Use-after-free RCE in PHP via stale request globals
- CVE-2026-109618100%9.2OOM longjmp memory flaw enabling RCE in PHP
- CVE-2025-535212%9.3Stack-Based Buffer Overflow in F5 BIG-IP APM Enables Unauthenticated RCE
- CVE-2026-1857715%8.2Authentication Bypass and Account Takeover in N-able N-central (Incomplete Patch)
- CVE-2026-185568%8.2Authentication Bypass (Alternate Path/Channel) in N-able N-central
Appears with
- Miraimalware · 8
- Potassiummalware · 8
- PHPvendor · 7
- Sophosvendor · 7
- Microsoftvendor · 6
- Arctic Wolforganization · 5
- Sandboxieproduct · 3
- PHPproduct · 3
- OpenAIvendor · 3
- CISAorganization · 3
- Amazonorganization · 3
- OpenAIorganization · 3
- Censysorganization · 3
- Microsoft Teamsproduct · 3
- Anthropicvendor · 3
- VulnCheckorganization · 3
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.