Collective Cyber Defense: How to Share Intelligence Safely hubs.li/Q04CwXQR0 from @www.leveragegtm.com @harikri93198221 @riteshcyber and more

PHP2Shell update: the DPRK-nexus campaign has moved from planning to active scanning. CYFIRMA has issued Version 3 of its Early Warning advisory on PHP2Shell (CVE-2026-109618 / CVE-2026-109619, CVSS v4.0 9.2 — unauthenticated RCE in the PHP runtime itself). What’s new since our 22–23 October reporting: 🔴 The operators report a filtered target set of 216 internet-facing hosts that still advertise unpatched PHP — across the US, Japan, South Korea, Thailand, Indonesia, Taiwan, Australia, India, Singapore, UAE, Saudi Arabia and the EU, with government, financial services, logistics, aviation, manufacturing and online transaction platforms prioritised. 🔴 Active weakness checks are being run from a separate set of 21 compromised nodes, deliberately low-volume and paced to stay under rate-based alerting. Roughly a third of the target set had already been touched at the time of collection. 🔴 CYFIRMA observed the same 21 addresses performing web-shell tooling and upload-progress session-poisoning attempts in the hours before this update. They are now published as blocking indicators alongside the 17 source IPs from Version 2. What to do now: ✅ Patch to PHP 8.5.12+ / 8.4.27+ / 8.3.36+ / 8.2.35+ and restart every worker — a reload leaves the stale state in place. ✅ Hosts still bannering an older PHP version are exactly what the operators kept on their list. Isolate what you can’t patch within hours; Apache mod_php first. ✅ Hunt back to 17 October across extended time windows — this scanning is designed not to trip volume alerts. No launch date has been stated. The next adversary milestone is their shortlist of highest-confidence hosts. The channel remains under continuous monitoring, and the advisory will be re-issued on any launch statement or confirmed exploitation. #PHP2Shell #ThreatIntelligence #EarlyWarning #Lazarus #DPRK #CVE2026109618 #CVE2026109619 #CYFIRMA #DecodingThreats #CYFIRMA #CYFIRMAresearch #ETLM #ExternalThreatLandscapeManagement cyfirma.com/research/cyfirma…

#PHP2Shell is about to go from opportunistic to targeted. #CYFIRMA has surfaced a #Korean-speaking threat actor, assessed with moderate confidence to be linked to the #Lazarus ecosystem, coordinating sector- and country-prioritised exploitation of the two critical #PHP runtime flaws known as PHP2Shell (#CVE2026109618 / #CVE2026109619, CVSS v4.0 9.2, unauthenticated #RCE). What makes this different from the scanning everyone is already seeing: ▪️ Deliberate targeting: government and financial institutions first, then logistics, ports, airports, and manufacturing ▪️ Priority geographies: US, Japan, Korea, Thailand, Indonesia, Australia, Taiwan, India, Singapore, UAE, Saudi Arabia and the EU ▪️ Disciplined tradecraft: public PoCs ranked with a local AI model, lab-validated before use, no noisy scanning ▪️ 15 pieces of staging infrastructure already shared; first filtered target list due by 25 October The flaw sits in the PHP runtime itself, not in any CMS or framework, so updating WordPress, Drupal, Magento, or Laravel does not fix it. One multipart POST can reach code execution before any application code runs. What to do now: ✅ Patch to PHP 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 and restart every worker (a reload is not enough) ✅ Isolate anything you cannot patch within hours; Apache mod_php first ✅ Hunt back to 17 October 2026 ✅ Deploy the IOCs, Sigma and YARA content in the report Full advisory (TLP: CLEAR) with 33 IOCs, detection rules, and interim controls. #CyberSecurity #ThreatIntelligence #DPRK #CYFIRMA #CYFIRMA #ExternalThreatLandscapeManagement #ETLM cyfirma.com/research/cyfirma…

Why Basic Cybersecurity Practices Fail—and How to Fix Them hubs.li/Q04BQk2b0 from @riteshcyber @harikri93198221 and more

Seven Ways Tech Leaders Are Designing AI Agents To Prevent Mistakes hubs.li/Q04BQhJ10 from @wittycircuitry @riteshcyber and more

In The Age Of AI, Does Your Cyber Awareness Training Know What Attackers Are Preparing? hubs.li/Q04BlTQr0 Written by @riteshcyber of @cyfirma

How to Protect Help Desks and Employees From Impersonation Attacks hubs.li/Q04BcZTk0 from @harikri93198221 @www.leveragegtm.com @riteshcyber and more

How To Fight AI Scams On A Small-Business Budget hubs.li/Q04BcYlM0 from @riteshcyber @m_francis @sibaspadhi @malwarebytes @icerideshare @Wissen_Infotech @breetapp and more

#PodcastAlert | How has the attack surface and threat landscape evolved today? Kumar Ritesh, Founder, Chairman & CEO, CYFIRMA, highlights this in conversation with Vinayak Godse, CEO, DSCI, in this episode of #SecurityChips podcast on "How Defenders Can Get Ahead of Attackers?", while emphasizing its impact on and key learnings for predictive threat intelligence. 👉 Tune in now on DSCI channels to listen to the full episode: dsci.in/dsci-podcast 👉 Watch the complete episode at: youtube.com/playlist?list=PL… #DSCI #CyberSecurity #AISecurity #DataProtection | @cyfirma | @godvinayak

How to Pressure-Test Cyber Readiness Before a Real Attack hubs.li/Q04zBcZR0 from @riteshcyber and more

AI Risk Debt: Where It Builds and How Security Leaders Can Reduce It hubs.li/Q04z4Sb20 from @www.leveragegtm.com @riteshcyber and more

#PodcastAlert | In the latest episode of #SecurityChips podcast on 'How Defenders Can Get Ahead of Attackers?', Kumar Ritesh, Founder, Chairman & CEO, CYFIRMA, joins Vinayak Godse, CEO, DSCI, to discuss how predictive threat intelligence can help organizations move from reacting to threats to anticipating them. Listen to the full episode to explore proactive strategies for staying ahead of evolving adversaries. 👉 Tune in now on DSCI channels to listen to the full episode: dsci.in/dsci-podcast 👉 Watch the complete episode at: youtube.com/playlist?list=PL… #DSCI #CyberSecurity #OTSecurity #AISecurity #DataProtection | @cyfirma | @godvinayak

Practical Ways Spatial Computing Could Improve Daily Life hubs.li/Q04yGqd30 from @MavaniDhyey @accediait @dieboldnixdorf @Wissen_Infotech @tiaginc @riteshcyber and more

Cloud Forensics: How to Prepare Before a Cyber Incident hubs.li/Q04ygZss0 from @riteshcyber @www.leveragegtm.com and more

External AI Agents: How Security Leaders Can Reduce Cyber Risk hubs.li/Q04y02mQ0 from @LeverageGTM, @riteshcyber and more

🌟 Editor's Choice 🌟 "Where a honeypot is a prop, a deception environment is a stage. " Read more from @riteshcyber, Founder & CEO at @cyfirma: hubs.li/Q04xdRM90

How To Evaluate The Business Value Of Immersive Experiences hubs.li/Q04xJ8-n0 from @akhilesh_a3 @riteshcyber @MavaniDhyey and more

Design Choices That Reduce User Friction And Digital Fatigue hubs.li/Q04xhF-p0 from @riteshcyber @karthik_sj @WillConaway1 and more

Software Supply Chain Security: Preventing Downstream Compromise hubs.li/Q04xdGvK0 from @harikri93198221 @riteshcyber @www.leveragegtm.com and more

Beyond Patching: How to Balance CVE Remediation With Real Risk Reduction hubs.li/Q04wt1Yr0 from @riteshcyber and more