At a glance Malware family PSK Agent (Go-based RAT), a shell-script dropper, and a PHP webshell Threat actor Unnamed; likely Chinese-speaking, per Imperva (moderate confidence) Targets Magento and Adobe Commerce stores in Western Europe, North America, and Asia-Pacific Delivery vector StyleSmuggler exploitation of CVE-2026-75650 Key capabilities Remote command execution, SOCKS5 proxying, DNS victim tracking, persistence TL;DR Between September 9 and 13, 2026, Imperva detected attacks that dropped the PSK Agent RAT on Magento and Adobe Commerce stores.

TL;DR ThreatMon recovered an exposed attacker workspace with 1,357 files that track AhsayCBS webshell access. Of 189 webshell probes, 134 got live responses. The operator's tools then tried to turn that access into SOCKS proxy tunnels routed through a shared VPS. What happened AhsayCBS is a backup management platform that many managed service providers use. In October 2026, researchers reported CVE-2026-105133 and CVE-2026-105134.

TL;DR ThreatMon recovered an exposed attacker workspace with 1,357 files that track AhsayCBS webshell access. Of 189 webshell probes, 134 got live responses. The operator's tools then tried to turn that access into SOCKS proxy tunnels routed through a shared VPS. What happened AhsayCBS is a backup management platform that many managed service providers use. In October 2026, researchers reported CVE-2026-105133 and CVE-2026-105134.

Introduction: Underground Marketplace Listing Raises Concerns Over Malaysian Government Infrastructure A threat actor operating on an underground cybercrime forum is advertising alleged unauthorized access to a web server associated with Malaysia's customs infrastructure, alongside a database reportedly belonging to the country's customs authority. The listing, highlighted by Dark Web Intelligence on November 1, 2026, offers the alleged access and database for $1,500.

Palo Alto Networks just disclosed a long-running cyber-espionage campaign targeting government agencies and related infrastructure. The operator—tracked as CL-UNK-1211—ran activity from Oct 2025 through Apr 2026, focusing on two big goals: stealing credentials and digging intelligence from government email + databases. What’s especially creepy: the malware appears to be AI-assisted. Researchers found multi-language PHP/Shell/JS/Bash/Python code with “conversation-style” comments that narrate logic and reasoning step-by-step—plus lots of Base64-encoded commands and a toolchain that looks partially assembled automatically. After initial access, attackers deploy a Webshell for Linux control, then maintain persistence by abusing PHP’s auto_prepend_file to load malicious code before other scripts. They also hijack the bootstrapping flow by modifying .bashrc to intercept sudo, fake password prompts, and redirect execution—so admins see “normal” command outcomes. Backdoor coverage includes SysGoRAT (Go-based, cross-platform) with WebSocket C2, interactive shells, directory browsing, proxies, and persistence via systemd/cron/Windows login keys. They even treat mail servers as the intel hub—mapping victims to social accounts (Facebook/Instagram/X/Douyin/LinkedIn) and trying mass export of inboxes. #CyberEspionage #ThreatIntel #PaloAltoNetworks #GovernmentSecurity #Malware #AIThreats

The June 23, 2026, episode of the SANS Internet Storm Center’s Storm Cast, hosted by Johannes Ulrich in Jacksonville, Florida, highlighted a newly discovered PHP webshell on GitHub marketed as 'hard to detect,' though its evasion relies on being too recent for signature-based detection. The episode emphasized that webshells are typically deployed via unauthorized file upload or remote code execution vulnerabilities to establish persistent access on web servers. GitHub implemented security changes to its pull request workflows, restricting automatic execution of actions when pull requests originate from forks to mitigate supply chain attacks, though users can opt out with manual security measures. Cloudflare introduced private access tokens as a privacy-preserving alternative to CAPTCHAs, allowing browsers to prove human identity via digitally signed tokens without repeated challenges, though the standard remains incomplete. The discussion also covered a FortiGate firewall breach, where attackers exploited unpatched devices to intercept TLS traffic and harvest credentials, underscoring the risk of assuming only direct data on compromised gateways is exposed. The episode concluded by noting the absence of Thursday and Friday podcasts that week.

MakeSense starts with a WordPress site for a web agency, with a voice call widget that transcribes recordings in the browser. I’ll find an audio file in a listable uploads directory where a user reads their password aloud, and use it to log in. That user can view contact submissions, so I’ll reverse engineer the encrypted voice channel to submit arbitrary transcriptions, using it for XSS against an administrator bot to create my own admin account and get a shell through the plugin editor. A password in the WordPress config gets me the next user. For root, I’ll abuse an OCR web app running as root that saves recognized text to any filename, drawing PHP into an image to get execution. In Beyond Root I’ll look at the bot that didn’t care about mixed content, and how exactly a backdoored WordPress plugin gets triggered.

TL;DR Attackers are exploiting CVE-2026-102785, a YOOtheme Pro vulnerability that scores the maximum 10.0 on CVSS 4.0. Palo Alto Networks Unit 42 confirmed in-the-wild attacks on October 26. The flaw gives unauthenticated attackers remote code execution on the web server. A flaw in YOOtheme Pro's image handler lets anyone write a PHP webshell to a public folder. Automated scanners began dropping webshells two days after the patch shipped.

Quick Answer: Can a file that looks like an image, PDF, or CSS contain malware on a WordPress site? Yes. On a hacked WordPress site, attackers routinely hide

Introduction: A Critical Vulnerability Moves Into the Active Exploitation Spotlight A critical security flaw affecting the built-in Collabora CODE Server application for Nextcloud has been added to the U.S. Cybersecurity and Infrastructure Security Agency’s (CISA) Known Exploited Vulnerabilities (KEV) catalog, increasing the urgency for organizations running vulnerable installations. Tracked as CVE-2026-110447, the vulnerability allows operating system command injection and has been associated with reports of attackers deploying webshells on compromised servers.

A complete server engineering guide to securing PHP 8.x production environments against php2shell payloads, CGI argument injection, unauthenticated RCE vulnerabilities, and unauthorized file execution.