SECURITYINTEL DAILY BRIEF ■ ThreatIntel BriefTuesday, October 27, 2026 INTEL CONFIDENCE 100% | THREAT LEVEL CRITICAL |
|
THREAT OF THE DAY Active PHP2Shell and HTTP2Shell Brotli Vulnerability Exploitation | CRITICAL |
|
5 C2 IPs | 80 OTX IOCs | 36 ARTICLES |
|
■ ANALYST TLDR Widespread exploitation of critical Brotli compression library vulnerabilities across PHP, Node.js, and Microsoft .NET ecosystems (dubbed HTTP2Shell and PHP2Shell) has rapidly transitioned from active probes to working remote shell deployments. Simultaneously, adversary-in-the-middle (AitM) session token-replay attacks have breached 97 Microsoft 365 accounts across 79 organizations, alongside ongoing IT support impersonation scams delivering ransomware via Microsoft Teams. Industrial vendors, surveillance hardware (Dahua), and over 900 Magento e-commerce storefronts are also experiencing targeted script injections and credential tampering campaigns. |
|
■ CRITICAL STORIES Active Exploitation of Critical Brotli Library Flaws (PHP2Shell / HTTP2Shell) Threat actors are actively launching remote shells against web applications running affected PHP, Node.js, and Microsoft .NET runtimes via memory corruption flaws in the embedded Brotli decoder. |
Microsoft 365 Token-Replay AitM Attacks Compromise 79 Organizations Attackers leveraged adversary-in-the-middle proxy relays to capture sign-in sessions and replay stolen M365 authentication tokens to hijack accounts across dozens of organizations. |
Over 900 Online Stores Infected in Obfuscated E-Commerce Skimmer Campaign A long-running campaign injected scanner-evading JavaScript loaders into 953 online stores, predominantly running Magento, to steal sensitive customer financial data. |
CERT-UA Warns of Hackers Hijacking Dahua Surveillance Devices Cybercriminals are actively compromising internet-connected Dahua security cameras and digital video recorders in Ukraine to alter system configurations and establish unauthorized admin accounts. |
|
■ CVEs IDENTIFIED CVE-2026-111497 PHP (Windows Official Packages) — Brotli compression library memory corruption leading to Remote Code Execution |
[CVE-TBD] Node.js (C Brotli Decoder) — HTTP2Shell memory corruption vulnerability enabling Remote Code Execution |
[CVE-TBD] Microsoft .NET Framework / Core — Broccoli2Shell / Node2Shell memory corruption leading to Remote Code Execution |
[CVE-TBD] Bytecode Alliance Wasmtime — WebAssembly runtime memory flaws enabling host sandbox escape |
|
■ THREAT ACTORS ARTEX AI Cybercrime Group | Cybercrime Syndicate |
Used the ARTEX AI pentesting framework to breach over 90 South Korean organizations and steal 8.2 million records. |
AitM Proxy Operators | Cybercrime / Espionage |
Executed AitM relay attacks capturing session tokens to compromise 97 Microsoft 365 accounts across 79 organizations. |
Magecart E-Commerce Skimming Actor | Cybercrime |
Injected scanner-evading JavaScript skimmer scripts across 953 online stores, primarily targeting Magento platforms. |
|
|
|
■ ATT&CK TTPs | T1190 | | Exploit Public-Facing Application | Launching working remote shells against web applications exploiting Brotli library vulnerabilities |
| T1566.002 | | Phishing: Spearphishing Link | Impersonating IT support personnel via Microsoft Teams external chat features to deliver malware |
| T1539 | | Steal Web Session Cookie | Replaying stolen M365 authentication session tokens captured through AitM proxy relays |
| T1059.007 | | Command and Scripting Interpreter: JavaScript | Injecting stealthy, scanner-evading loader scripts into e-commerce web applications |
| T1078 | | Valid Accounts | Creating unauthorized user and administrator accounts on Dahua surveillance devices |
| T1555 | | Credentials from Password Stores | Stealing 2FA passcodes and session credentials via modified uCreator Android apps |
|
■ PATCH PRIORITY PHP 8.2-8.5 (Windows) — Actively exploited Brotli memory corruption flaw (CVE-2026-111497) — THN |
Microsoft .NET — Emergency update for critical Brotli memory corruption RCE (Broccoli2Shell) — BC |
Node.js — Critical memory corruption flaw in Brotli C decoder (HTTP2Shell) — BC |
Apple OS Suite — Patch now to address 304 security vulnerabilities in October release — SANS |
|
|
|
■ RECOMMENDED ACTIONS TODAY | 1 | [P1] Immediately upgrade Windows deployments of PHP 8.2-8.5 to fix CVE-2026-111497 and apply emergency Microsoft .NET and Node.js Brotli updates to stop active HTTP2Shell/PHP2Shell RCE exploitation. |
| 2 | [P1] Disable external chat creation in Microsoft Teams or enforce strict domain allowlists to neutralize social engineering and malware delivery campaigns targeting support personnel. |
| 3 | [P1] Implement Conditional Access policies in Microsoft 365 requiring compliant devices and strict token binding to invalidate stolen session tokens used in AitM replay attacks. |
| 4 | [P2] Audit Magento and general e-commerce web application files for unauthorized obfuscated JavaScript skimmers and unexpected outbound connection attempts. |
| 5 | [P2] Review connected Dahua IP cameras and video recorders to remove unauthorized accounts, update firmware, and isolate administrative interfaces behind secure VPNs. |
|
|
|
C2 IP BLOCKLIST · AbuseCH Feodo · Showing 5 of 5 IP ADDRESS 162.243.103.246 | PORT 8080 | STATUS OFFLINE | MALWARE Emotet | COUNTRY US |
IP ADDRESS 50.16.16.211 | PORT 443 | STATUS ONLINE | MALWARE QakBot | COUNTRY US |
IP ADDRESS 34.204.119.63 | PORT 443 | STATUS OFFLINE | MALWARE QakBot | COUNTRY US |
IP ADDRESS 178.62.3.223 | PORT 443 | STATUS OFFLINE | MALWARE QakBot | COUNTRY GB |
IP ADDRESS 27.133.154.218 | PORT 443 | STATUS OFFLINE | MALWARE QakBot | COUNTRY JP |
|
FULL IOC EXPORT — GOOGLE SHEET All live IOCs with full SHA256 hashes (OTX), IPs, and domains. 2 tabs: C2 IPs · OTX IOCs
Updated daily · Export as CSV to import directly into your tools ■ Open Full IOC Sheet → |
|
IOC SOURCES: AbuseCH Feodo · AlienVault OTX
NEWS: THN · KRB · SANS · REC · BC · SW · AWS · GCP · MSFT · U42 · SCH · MWB |