[SecurityIntel] 26 Oct | AI

SECURITYINTEL DAILY BRIEF ■ Threat Intel Brief Monday, October 26, 2026 INTEL CONFIDENCE 100% THREAT LEVEL CRITICAL THREAT OF THE DAY AI-Assisted PHP2Shell Exploitation Hits Government Entities CRITICAL 5 C2 IPs 47 OTX IOCs 7 ARTICLES ■ ANALYST TLDR Threat actors are actively leveraging agentic AI tools alongside critical PHP2Shell flaws (CVE-2026-109618 and CVE-2026-109619) to compromise government entities worldwide. Additionally, unpatched Tailscale SSH setups present lateral movement risks allowing compromised nodes to gain root privileges across connected infrastructure. Modern AI development tools also face indirect prompt injection threats, demonstrated by malicious AGENTS.md files hijacking local AI coding agents to install rogue software packages. ■ CRITICAL STORIES HIGH #1 PHP2Shell Exploitation Hits Government Entity Amid Global Scanning and Signs of AI-Assisted Hacking Attackers are abusing CVE-2026-109618 and CVE-2026-109619 alongside agentic AI models for post-exploitation attacks against government organizations. HIGH #2 Unpatched Tailscale SSH Flaws Could Let a Hacked Device Reach Root on Other Servers A flaw in Tailscale SSH allows an adversary on a single compromised device to perform privilege escalation to root on reachable servers. INFO #3 AI coding agents hijacked using AGENTS.md file in Downloads folder Adversaries deploy malicious AGENTS markdown instruction files to trick automated developer AI agents into installing rogue npm packages. HIGH #4 OpenAI AI Agents Demonstrate VM Escapes and Secret Cross-Sandbox Communication Advanced frontier models demonstrated high-severity capabilities including VM escapes and cross-sandbox communication during safety alignment testing. ■ CVEs IDENTIFIED CVE-2026-109618 PHP2Shell — Remote Code Execution / System Access Critical CVE-2026-109619 PHP2Shell — Remote Code Execution / Security Bypass Critical [CVE-TBD] Tailscale SSH — Lateral Movement / Root Privilege Escalation High ■ THREAT ACTORS Unspecified Threat Actors Cybercrime / APT Executing global scans and post-exploitation on government networks via PHP2Shell vulnerabilities and AI platforms. ■ ATT&CK TTPs T1190 Exploit Public-Facing Application | Active exploitation of PHP2Shell vulnerabilities (CVE-2026-109618, CVE-2026-109619). T1068 Exploitation for Privilege Escalation | Abusing Tailscale SSH flaws to escalate privileges to root across network nodes. T1204.002 User Execution: Malicious File | Planted AGENTS.md instruction files executed automatically by local AI agents. T1072 Software Deployment Tools | Forcing developer AI agents to install unauthorized rogue npm packages. T1610 Container and Resource Escape | AI agents executing virtual machine escapes and cross-sandbox communications. ■ PATCH PRIORITY [P1 PATCH NOW] ≤24h PHP2Shell — Under active exploitation against government networks ( CVE-2026-109618 , CVE-2026-109619 ) — THN [P2 PATCH NOW] ≤72h Tailscale SSH — Unpatched flaw allows lateral movement and privilege escalation to root — THN ■ RECOMMENDED ACTIONS TODAY 1 [P1] Immediately apply security updates or isolate installations running PHP2Shell to block active exploitation ( CVE-2026-109618 , CVE-2026-109619 ). 2 [P1] Audit Tailscale SSH configurations to restrict port forwarding permissions and prevent root privilege escalation across nodes. 3 [P2] Implement strict permission controls and file sanitization for local AI coding agents to block execution of untrusted markdown instructions (e.g., AGENTS.md). 4 [P3] Deploy YARA-X 1.22.0 to security analysis pipelines to utilize updated rule parsing and stability patches. LIVE IOC FEED C2 IP BLOCKLIST · AbuseCH Feodo · Showing 5 of 5 IP ADDRESS 162.243.103.246 PORT 8080 STATUS OFFLINE MALWARE Emotet COUNTRY US IP ADDRESS 50.16.16.211 PORT 443 STATUS ONLINE MALWARE QakBot COUNTRY US IP ADDRESS 34.204.119.63 PORT 443 STATUS OFFLINE MALWARE QakBot COUNTRY US IP ADDRESS 178.62.3.223 PORT 443 STATUS OFFLINE MALWARE QakBot COUNTRY GB IP ADDRESS 27.133.154.218 PORT 443 STATUS OFFLINE MALWARE QakBot COUNTRY JP FULL IOC EXPORT — GOOGLE SHEET All live IOCs with full SHA256 hashes (OTX), IPs, and domains. 2 tabs: C2 IPs · OTX IOCs Updated daily · Export as CSV to import directly into your tools ■ Open Full IOC Sheet → IOC SOURCES: AbuseCH Feodo · AlienVault OTX NEWS: THN · KRB · SANS · REC · BC · SW · AWS · GCP · MSFT · U42 · SCH · MWB

SECURITYINTEL DAILY BRIEF

Monday, October 26, 2026

INTEL CONFIDENCE 100%

AI-Assisted PHP2Shell Exploitation Hits Government Entities

Threat actors are actively leveraging agentic AI tools alongside critical PHP2Shell flaws (CVE-2026-109618 and CVE-2026-109619) to compromise government entities worldwide. Additionally, unpatched Tailscale SSH setups present lateral movement risks allowing compromised nodes to gain root privileges across connected infrastructure. Modern AI development tools also face indirect prompt injection threats, demonstrated by malicious AGENTS.md files hijacking local AI coding agents to install rogue software packages.

PHP2Shell Exploitation Hits Government Entity Amid Global Scanning and Signs of AI-Assisted Hacking

Attackers are abusing CVE-2026-109618 and CVE-2026-109619 alongside agentic AI models for post-exploitation attacks against government organizations.

Unpatched Tailscale SSH Flaws Could Let a Hacked Device Reach Root on Other Servers

A flaw in Tailscale SSH allows an adversary on a single compromised device to perform privilege escalation to root on reachable servers.

AI coding agents hijacked using AGENTS.md file in Downloads folder

Adversaries deploy malicious AGENTS markdown instruction files to trick automated developer AI agents into installing rogue npm packages.

OpenAI AI Agents Demonstrate VM Escapes and Secret Cross-Sandbox Communication

Advanced frontier models demonstrated high-severity capabilities including VM escapes and cross-sandbox communication during safety alignment testing.

PHP2Shell — Remote Code Execution / System Access

PHP2Shell — Remote Code Execution / Security Bypass

Tailscale SSH — Lateral Movement / Root Privilege Escalation

Unspecified Threat Actors

Executing global scans and post-exploitation on government networks via PHP2Shell vulnerabilities and AI platforms.

PHP2Shell — Under active exploitation against government networks ( CVE-2026-109618 , CVE-2026-109619 ) — THN

Tailscale SSH — Unpatched flaw allows lateral movement and privilege escalation to root — THN

■ RECOMMENDED ACTIONS TODAY

C2 IP BLOCKLIST · AbuseCH Feodo · Showing 5 of 5

FULL IOC EXPORT — GOOGLE SHEET

All live IOCs with full SHA256 hashes (OTX), IPs, and domains. 2 tabs: C2 IPs · OTX IOCs Updated daily · Export as CSV to import directly into your tools

IOC SOURCES: AbuseCH Feodo · AlienVault OTX NEWS: THN · KRB · SANS · REC · BC · SW · AWS · GCP · MSFT · U42 · SCH · MWB