Acronis Threat Research Unit researchers uncovered a state-linked espionage campaign exploiting a critical Gitea RCE vulnerability. A Chinese-speaking threat actor tracked as Red Heron weaponized the security flaw against exposed servers across multiple continents. The attackers breached self-hosted developer platforms to steal private repositories, harvest credentials, and deploy stealthy rootkits. TL;DR Threat actors are actively weaponizing a critical remote code execution…

Sophos X-Ops has found an advanced Linux rootkit that can conceal a PHP web shell completely in server memory, which makes it harder for traditional security tools to detect.  The malware was analyzed in infected environments consisting of F5 BIG-IP Access Policy Manager (APM) and was discovered by Sophos as Linux/Agnt-IC. “The malware targets deployments featuring Apache, libphp, APR module loading, BIG-IP APM webtop components, and BIG-IP upgrade workflows, suggesting it was developed for specific environments,” Sophos reported. About the research The research was posted on September 7, 2026, and shows how the rootkit interferes with the PHP runtime and Apache web server to deploy malicious code without making major modifications to authentic PHP files stored on the device. A Web Shell That Does Not Remain on Disk One significant feature of the malware is that it can install malicious PHP code directly into the running web server’s memory. Generally, threat actors planting a PHP web shell would also modify or make a PHP file on the server. Security teams can then detect the malicious file via antivirus scans, manual investigation, or file-integrity monitoring. The rootkit detailed by Sophos takes another approach. It changes how PHP files are shown to the running Apache process while the original files on disk are left unchanged. This means that a file scan could demonstrate that a PHP is authentic even when the server is actively running malicious code. Rootkit Hooks PHP and Apache Researchers at Sophos discovered that the implant deploys various sophisticated approaches to take command over the web server. It integrates into the device’s startup process and surveys Apache activity to find out when the PHP module is loaded.  After this, the malware can bring its own web-shell functionality and change the in-memory PHP environment.  The installed web shell gets specially tailored HTTP requests and runs commands given by the threat actor. Sophos also found the implant deploying a Unix domain to socket to offer another path of communicating with an infected system and launching a shell.  This combination allows attackers several ways of maintaining access while covering the traces left on the filesystem. Hard to detect The attack has become a problem for experts as the malware does not always have to alter files to attack a server. Security teams should check beyond traditional file-integrity check and analyze memory activity, network traffic and running processes. Sophos recommends that security teams look beyond conventional file-integrity checks and examine network traffic, running processes and memory activity.

At a glance Factor Details Actor or Group UAT-10147 (Suspected Chinese-speaking group) Activity Type SEO fraud monetization, credential theft, and process injection via malware deployment Targets or Victims Internet-facing IIS and Linux servers Scale Unknown number of global victims Status Currently active and monitored by cybersecurity researchers Source Cisco Talos TL;DR The suspected Chinese-speaking cybercrime group UAT-10147 deploys the SPECTRE cross-platform implant to compromise global IIS and Linux servers.

employing AI to improve attacks read more about UAT-10147 Uses AI to Scale Server Attacks Deploys SPECTRE With EDR Bypass and Linux Rootkit

This week’s cybersecurity roundup shows attackers increasingly abusing trusted tools, cloud features, and legitimate services instead of forcing obvious break-ins. From Pwn2Own Berlin 2026 zero-days and Composer token leakage to Storm-2949 cloud abuse, Gunra ransomware, OrBit rootkit activity, and AI-driven intrusions, the pattern is faster, stealthier, and built around normal workflows....

Rough Monday. Somebody poisoned a trusted download again, somebody else turned cloud servers into public housing, and a few crews are still getting into boxes with bugs that should’ve died years ago — the same old holes, same lazy access paths, same “how the hell is this still open” feeling. One report this week basically reads like a guy tripped over root access by accident and decided to stay

The leaked source code reveals VoidLink as a multigenerational, hybrid LKM–eBPF Linux rootkit developed with AI-assisted workflows that provides ICMP-based covert C2, delayed initialization, anti-debugging, module masquerading, and memfd-aware boot persistence. The analysis documents eBPF Netlink-buffer "swallowing" to hide ss entries, multiple kernel-targeted hooking strategies across CentOS 7 to kernel 5/6, and operational artifacts tied to Alibaba Cloud infrastructure. #VoidLink #AlibabaCloud