Weekly Cyber Roundup Covers PHP2Shell Exploitation, Oracle Scanning and More
Summary
The roundup covers reported PHP2Shell exploitation, scanning for a patched Oracle flaw, ransomware prosecutions, data breaches, camera compromises, a payment-card skimmer and an information stealer targeting AI and developer credentials.
Key points
- Palo Alto Networks warned of active exploitation of two PHP flaws in PAN-OS firewalls; Dream reported an apparent Chinese AI-assisted campaign that rooted 25 servers, including one in a U.S. government-affiliated environment.
- Defused reported scanning and exploratory exploitation attempts against Oracle E-Business Suite; Oracle said it had patched the flaw and reported prior attacks on unpatched systems.
- The U.S. sentenced Artem Stryzhak to 70 months in prison for ransomware attacks as an affiliate of Hive and Nefilim, which prosecutors said caused more than $100 million in losses.
- A breach of Germany’s AfD reportedly exposed 345,000 email addresses and hundreds of gigabytes of emails and attachments. The party blamed a hosting provider and said only a few mailboxes were copied; details cited from a journalist’s account were not officially confirmed.
- CERT-UA warned of unauthorized access to Dahua cameras and recorders, including altered settings and unauthorized accounts; it cited weak or default passwords, outdated firmware and Dahua’s Easy4IP service as possible avenues.
- Sansec attributed a payment-card skimmer on Convertr checkout pages to a Brazilian Magecart group and said researchers suspect exploitation of a Plausible Community Edition flaw.
- Check Point described Aokigahara, a Windows information stealer that targets AI and developer tools for tokens, session data, API keys and other credentials; it also recommended revoking compromised sessions and rotating exposed credentials.
Article Details
- Event Type
- Cybersecurity incident and law-enforcement roundup
- Impact
- The roundup reports active exploitation of vulnerabilities affecting PAN-OS firewalls and Oracle E-Business Suite; ransomware attacks attributed to Hive and Nefilim that caused more than $100 million in losses; a breach exposing AfD emails and 345,000 email addresses; compromised Dahua cameras; a Convertr checkout-page skimming incident that stole payment and personal information; and Aokigahara malware targeting credentials and sensitive data. Law-enforcement actions included the seizure of Virtualine's domain and an international operation that reported 1,462 arrests.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | 1x0[.]is | Attacker-controlled server that received payment-card and personal information stolen by the Convertr checkout skimmer. |
| DOMAIN | virtualine[.]net | Domain seized by the FBI for a bulletproof hosting service prosecutors said hosted criminal infrastructure, including phishing and hack-for-hire activity. |
MITRE ATT&CK
T1005 · Data from Local SystemAokigahara searches local application files for tokens, session data, configuration files, API keys, and other information.T1110.001 · Password GuessingAttackers reportedly accessed Dahua cameras using weak or default passwords.T1190 · Exploit Public-Facing ApplicationAttackers exploited vulnerabilities in internet-accessible PAN-OS firewalls and reportedly attempted exploitation of an Oracle E-Business Suite vulnerability.
CVE
CVE-2025-61882theft campaigns. Since August 2025, the Clop extortion group has exploited another EBS vulnerability, CVE-2025-61882, in attacks affecting organizations including Logitech, GlobalLogic and The Washington Post, as wellCVE-2026-101767Tracked as CVE-2026-101767, the vulnerability affects a core component of EBS's Application Object Library. It enables unauthenticated attackers with HTTP network access to compromise vulnerable systems throughCVE-2026-109618PHP2Shell flaws comprise the PHP memory corruption vulnerability CVE-2026-109618 and the PHP stale internal request-state vulnerability CVE-2026-109619. Both of the flaws carry a CVSS v4 rating of 9.2 (see: Critical PHPCVE-2026-109619corruption vulnerability CVE-2026-109618 and the PHP stale internal request-state vulnerability CVE-2026-109619. Both of the flaws carry a CVSS v4 rating of 9.2 (see: Critical PHP Patches Address 'Very, Very BadCVE-2026-8467Researchers suspect attackers exploited CVE-2026-8467, a critical vulnerability in Plausible Community Edition, the open-source analytics software Convertr uses. The flaw allows unauthenticated attackers to execute
People
Caroline MoolenaarFBI Special Agent whose affidavit described the pricing of Virtualine's hosting services.John Allen Kurrle Jr.Former U.S. defense contractor who admitted helping North Korean IT workers obtain remote jobs using fraudulent identities and enabling remote access to company-issued devices.Lilith WittmannHer analysis of the AfD breach, partly based on conversations with the hackers, was cited in reporting about the intrusion and leaked data.
Threat Actors
Artem Aleksandrovych StryzhakThe U.S. Department of Justice sentenced him for ransomware attacks as an affiliate of Hive and Nefilim; the article reports his attacks caused losses as part of more than $100 million attributed to the groups' attacks.ClopThe article reports that the group exploited CVE-2025-61882 in attacks on organizations beginning in August 2025.HiveRansomware group for which Artem Stryzhak was an early affiliate; he deployed its ransomware against seven victims, according to the article.NefilimRansomware group that Artem Stryzhak joined around June 2021 as an affiliate; he agreed to pay the group's administrators a share of extorted ransoms.ShinyHuntersThe article says the group abused a PeopleSoft zero-day to execute code remotely and steal data.Volodymyr TymoshchukIdentified in the article as an administrator of Nefilim, whose affiliate arrangement with Artem Stryzhak involved sharing ransom proceeds.
Malware
Aokigaharaaided North Korean IT workers, a Magecart hijack, Interpol helped fight cybercrime in Africa, the Aokigahara stealer targeted AI credentials.Hive ransomwarefor attacking hospitals, government entities, law firms and businesses worldwide as an affiliate of the Hive and Nefilim ransomware groups, whose attacks caused more than $100 million in losses.Nefilimhospitals, government entities, law firms and businesses worldwide as an affiliate of the Hive and Nefilim ransomware groups, whose attacks caused more than $100 million in losses.
Vendors
Check Pointsensitive business data, authentication tokens and cloud infrastructure, researchers at Check Point Software Technologies said.ConvertrMagecart Group Hijacks Convertr Checkout PagesDahuaattacks, Germany's far-right Alternative für Deutschland data breach, Ukraine warned about Chinese-made Dahua cameras, a U.S. defense contractor aided North Korean IT workers, a Magecart hijack, Interpol helped fightOracleexploited PHP2Shell, the FBI shutdown the Virtualline bulletproof hosting domain, hackers scanned for an Oracle flaw. A Ukrainian man imprisoned for ransomware attacks, Germany's far-right Alternative für DeutschlandPalo Alto NetworksPalo Alto Networks warned in a security alert last updated Thursday that attackers are actively exploited two recently patched vulnerabilities in PHP, which exist in all recent versions of the PAN-OS operating systemPlausibleResearchers suspect attackers exploited CVE-2026-8467, a critical vulnerability in Plausible Community Edition, the open-source analytics software Convertr uses. The flaw allows unauthenticated attackers to executeSansecpayment card details and personal information from shoppers at Brazilian online stores, security firm Sansec reported.
Products
Amazon Web Servicesdeveloper credentials, including Git access data, SSH private keys and configuration files for Amazon Web Services, Microsoft Azure and Google Cloud. These credentials could provide access to private codeChatGPT Desktopmanagers and email applications. Its distinctive feature is its focus on AI tools, including ChatGPT Desktop, Claude, OpenAI Codex, Cursor, Windsurf, GitHub Copilot and Gemini CLI.Claudeand email applications. Its distinctive feature is its focus on AI tools, including ChatGPT Desktop, Claude, OpenAI Codex, Cursor, Windsurf, GitHub Copilot and Gemini CLI.ConvertrMagecart Group Hijacks Convertr Checkout PagesCursorIts distinctive feature is its focus on AI tools, including ChatGPT Desktop, Claude, OpenAI Codex, Cursor, Windsurf, GitHub Copilot and Gemini CLI.Easy4IPThe primary entry point is Easy4IP, a Dahua cloud service that lets users reach cameras remotely using the device’s serial number. Because those numbers follow a predictable pattern, hackers can guess them in bulk andGemini CLIon AI tools, including ChatGPT Desktop, Claude, OpenAI Codex, Cursor, Windsurf, GitHub Copilot and Gemini CLI.GitHub Copilotfeature is its focus on AI tools, including ChatGPT Desktop, Claude, OpenAI Codex, Cursor, Windsurf, GitHub Copilot and Gemini CLI.Google CloudGit access data, SSH private keys and configuration files for Amazon Web Services, Microsoft Azure and Google Cloud. These credentials could provide access to private code repositories and cloud environments if theyMicrosoft Azureincluding Git access data, SSH private keys and configuration files for Amazon Web Services, Microsoft Azure and Google Cloud. These credentials could provide access to private code repositories and cloudOpenAI Codexapplications. Its distinctive feature is its focus on AI tools, including ChatGPT Desktop, Claude, OpenAI Codex, Cursor, Windsurf, GitHub Copilot and Gemini CLI.Oracle E-Business SuiteThreat actors are scanning the internet for systems vulnerable to a recently patched critical flaw in Oracle E-Business Suite, targeting unpatched systems.PAN-OSactively exploited two recently patched vulnerabilities in PHP, which exist in all recent versions of the PAN-OS operating system that runs its next-generation firewalls, whether they're deployed on physical hardwarePeopleSoft SuiteOracle's PeopleSoft Suite has also faced exploitation. In June, the company issued emergency mitigations for a critical zero-day vulnerability abused by the ShinyHunters extortion group to execute code remotely andPHPFirewalls that run PHP under the hood are getting popped by attackers wielding exploits for the PHP2Shell vulnerability.Plausible Community EditionResearchers suspect attackers exploited CVE-2026-8467, a critical vulnerability in Plausible Community Edition, the open-source analytics software Convertr uses. The flaw allows unauthenticated attackers to executeWindsurfdistinctive feature is its focus on AI tools, including ChatGPT Desktop, Claude, OpenAI Codex, Cursor, Windsurf, GitHub Copilot and Gemini CLI.
Tools
Countries
AngolaIn Angola, authorities shut down two illegal cryptocurrency mining centers, arrested nine people and seized more than 2,000 mining devices. Nigerian investigators also targeted phishing and business email compromiseGermanyhosting domain, hackers scanned for an Oracle flaw. A Ukrainian man imprisoned for ransomware attacks, Germany's far-right Alternative für Deutschland data breach, Ukraine warned about Chinese-made Dahua cameras, aJapanthat rooted 25 servers, including systems in a U.S. government-affiliated environment," as well as in Japan, South Korea and Taiwan. For the infiltrated U.S. government environment, attackers gained access to theSouth Korea25 servers, including systems in a U.S. government-affiliated environment," as well as in Japan, South Korea and Taiwan. For the infiltrated U.S. government environment, attackers gained access to theSpainThe 36-year-old, formerly of Barcelona, Spain, joined Nefilim around June 2021, agreeing to pay the group's administrators, including Volodymyr Tymoshchuk, 20% of the ransoms he extorted in exchange for access to theTaiwanincluding systems in a U.S. government-affiliated environment," as well as in Japan, South Korea and Taiwan. For the infiltrated U.S. government environment, attackers gained access to the organization's ActiveUgandaUganda recorded the largest number of arrests, with 365 foreign nationals detained as authorities dismantled two transnational fraud networks. Investigators said the groups operated call centers and used fraudulentUkraineman imprisoned for ransomware attacks, Germany's far-right Alternative für Deutschland data breach, Ukraine warned about Chinese-made Dahua cameras, a U.S. defense contractor aided North Korean IT workers, aUnited Statesfar-right Alternative für Deutschland data breach, Ukraine warned about Chinese-made Dahua cameras, a U.S. defense contractor aided North Korean IT workers, a Magecart hijack, Interpol helped fight cybercrime in
Industries
Cryptocurrency miningIn Angola, authorities shut down two illegal cryptocurrency mining centers, arrested nine people and seized more than 2,000 mining devices. Nigerian investigators also targeted phishing and business email compromiseDefenseAlternative für Deutschland data breach, Ukraine warned about Chinese-made Dahua cameras, a U.S. defense contractor aided North Korean IT workers, a Magecart hijack, Interpol helped fight cybercrime in Africa,E-commerceA Brazilian cybercrime group compromised an analytics script used by e-commerce platform Convertr to steal payment card details and personal information from shoppers at Brazilian online stores, security firm SansecGovernmentwhat appeared to be a Chinese AI-assisted campaign that rooted 25 servers, including systems in a U.S. government-affiliated environment," as well as in Japan, South Korea and Taiwan. For the infiltrated U.S.Healthcareaffiliates, deploying its ransomware against seven victims, including law firms, a dental office and a healthcare provider during the novel coronavirus pandemic. The FBI gave one of those victims a decryption keyOil and gasextorted in exchange for access to the ransomware. His attacks included a June 2021 data theft from an oil and gas transportation company.