China-linked actors are chaining PHP2Shell with firewall exploits to root US government servers. An Oracle EBS zero-day is under active probing with unauthenticated SQL injection leading to remote code execution. And Anthropic disclosed that an unreleased AI model autonomously chained browser and OS vulnerabilities into working exploits - no human guidance required. Meanwhile, CISA added the Brotli decoder flaw to KEV with a Thursday deadline, and Lazarus deployed post-quantum encryption in a live campaign for the first time.

Four stories for your calls today. The PHP2Shell chain is the one your agency customers will ask about first.

In the News

China-Linked Actors Chain PHP2Shell and Firewall Exploits to Root US Government Servers

China-linked threat actors are exploiting a combination of PHP2Shell and firewall vulnerabilities to achieve root-level access on US government servers. The attack chain targets perimeter devices - firewalls and edge appliances that sit between the internet and internal networks. This is not a theoretical proof-of-concept. The exploitation is confirmed against production government infrastructure, which makes this the concrete attack scenario behind last week’s CISA Known Exploited Vulnerabilities deadline for perimeter device patching.

The campaign underscores a persistent gap in enterprise security: most endpoint detection and response tools do not cover firewall operating systems. Once an attacker achieves root on a perimeter device, they operate below the visibility line of standard security tooling. Network detection and response, firmware integrity monitoring, and strict segmentation between perimeter device management planes and production networks are the compensating controls that matter here.

For organizations running mixed-vendor perimeter infrastructure, the immediate action is to verify firmware versions against CISA KEV entries, enable integrity verification where available, and monitor for anomalous outbound connections from management interfaces. The technique maps to MITRE ATT&CK T1190 (Exploit Public-Facing Application) chained with T1068 (Exploitation for Privilege Escalation).

What defenders should do: Audit all perimeter device firmware against current CISA KEV entries. Enable firmware integrity verification. Monitor management plane interfaces for anomalous outbound connections. Segment management networks from production traffic.

Source: SecurityWeek

Oracle EBS Zero-Day CVE-2026-101767 Under Active Probing - Unauthenticated SQLi to RCE

CVE-2026-101767 is an unauthenticated SQL injection vulnerability in Oracle E-Business Suite that chains to remote code execution. Honeypot operators are logging active probing attempts against EBS endpoints, which strongly suggests that weaponized exploit code is already circulating in attacker communities. Oracle EBS runs finance, procurement, and HR functions at a significant portion of Fortune 500 organizations - the data behind these systems is exactly the kind of target that drives board-level risk conversations.

The unauthenticated vector is the critical detail. Attackers do not need stolen credentials to begin exploitation. Any internet-facing EBS instance - or any instance reachable from a compromised internal host - is a viable target. The SQL injection provides the initial foothold, and the chain to RCE means full server compromise, not just data exfiltration.

Compensating controls while Oracle patches are tested and deployed include web application firewall rules tuned for SQL injection patterns targeting EBS-specific endpoints, database activity monitoring on EBS backend databases, and network segmentation between EBS application servers and database tiers. The technique maps to MITRE ATT&CK T1190 (Exploit Public-Facing Application) and T1059 (Command and Scripting Interpreter) for the RCE chain.

What defenders should do: Apply Oracle Critical Patch Update immediately. Deploy WAF virtual patching for SQL injection patterns on EBS endpoints. Segment EBS application and database tiers. Monitor database audit logs for anomalous query patterns.

Source: SecurityWeek

Anthropic AI Model Chains Browser and OS Flaws Into Working Exploits Autonomously

Anthropic disclosed that an unreleased AI model autonomously chained vulnerabilities across Chrome, Safari, Windows, and Linux into working exploits - without human guidance at any stage. This is the first public demonstration of end-to-end autonomous exploit chaining across multiple platforms. The model identified individual vulnerabilities, determined how they could be combined, and produced functional exploit code that achieved code execution on target systems.

This shifts the AI threat timeline conversation from theoretical to operational. The practical implication is not that AI replaces human attackers tomorrow - it is that vulnerability management SLAs designed around human-speed exploitation no longer reflect the actual threat model. When an autonomous system can chain disclosed vulnerabilities into working exploits faster than most organizations can test and deploy patches, the window between disclosure and exploitation compresses to a timeline that monthly patch cycles cannot cover.

The defensive response is not fundamentally new, but the urgency increases. Exposure management with exploit-probability scoring - prioritizing patches based on whether a vulnerability is likely to be weaponized, not just its CVSS score - becomes the primary control. Automated patch orchestration that can push critical updates within hours, not weeks, is the operational capability that closes the gap.

What defenders should do: Shift from CVSS-based to exploit-probability-based patch prioritization. Implement automated patch orchestration for critical vulnerability classes. Reduce mean time to remediate for internet-facing and browser-adjacent attack surfaces.

Source: The Hacker News

CISA Adds Brotli Decoder Flaw CVE-2026-111497 to KEV - Thursday Deadline

CISA confirmed active exploitation of CVE-2026-111497 (CVSS 9.2), a critical vulnerability in the Brotli decoder that affects Node.js, .NET, PowerShell, and Python. The flaw - dubbed “Node2Shell” - is now on the Known Exploited Vulnerabilities catalog with a Thursday remediation deadline. Palo Alto Networks published an impact statement confirming PAN-OS exposure, which means this vulnerability touches both application runtimes and network security infrastructure.

The breadth of affected platforms is the challenge. Brotli is a compression library embedded in runtimes and frameworks across virtually every enterprise technology stack. Identifying where Brotli decoder libraries are embedded requires software composition analysis - checking dependency trees, not just top-level application versions. Organizations that lack a software bill of materials for production applications will struggle to confirm whether they are exposed.

What defenders should do: Run software composition analysis across production environments to identify Brotli decoder dependencies. Patch Node.js, .NET, PowerShell, and Python runtimes. Check vendor impact statements for NGFW and other network infrastructure. Meet the Thursday CISA KEV deadline.

Source: BleepingComputer

Defender Action Items

  • Perimeter devices: Audit all firewall and edge appliance firmware against current CISA KEV entries. Enable firmware integrity verification. Monitor management plane interfaces for anomalous outbound connections. This is the direct response to the PHP2Shell chain targeting US government infrastructure.
  • Oracle EBS: Apply the Critical Patch Update for CVE-2026-101767 immediately. Deploy WAF virtual patching for SQL injection on EBS-specific endpoints. Segment EBS application and database tiers. Monitor database audit logs for anomalous query volumes.
  • Brotli decoder (CVE-2026-111497): Run software composition analysis to locate embedded Brotli libraries. Patch Node.js, .NET, PowerShell, and Python runtimes. Check NGFW vendor impact statements - Palo Alto has confirmed PAN-OS exposure. Thursday CISA deadline.
  • Tailscale: If running Tailscale SSH in production, update to 1.104.4 immediately. Tailworm flaws enable root privilege escalation on connected systems. (SecurityWeek)
  • Dahua cameras: Disable P2P connectivity on Dahua IP cameras. Enforce strong authentication. Segment physical security camera networks from production infrastructure. (The Hacker News)

Detection Queries

The following Splunk SPL query detects potential SQL injection probing against Oracle EBS web endpoints - specifically looking for common SQLi payloads in HTTP request URIs targeting EBS servlet paths. Tune the OA_HTML and OA_MEDIA path filters to match your EBS deployment. Expect a low false positive rate in environments that do not use automated testing tools against EBS.

index=web sourcetype=access_combined
  (uri_path="*/OA_HTML/*" OR uri_path="*/OA_MEDIA/*")
  (uri_query="*UNION+SELECT*" OR uri_query="*%27+OR+*" OR uri_query="*;+DROP+*" OR uri_query="*WAITFOR+DELAY*" OR uri_query="*xp_cmdshell*")
| stats count by src_ip, uri_path, uri_query, status
| where count > 5
| sort -count

For environments using KQL (Microsoft Sentinel), this equivalent query covers the same detection surface:

CommonSecurityLog
| where RequestURL has_any ("OA_HTML", "OA_MEDIA")
| where RequestURL has_any ("UNION SELECT", "' OR ", "; DROP ", "WAITFOR DELAY", "xp_cmdshell")
| summarize AttemptCount=count() by SourceIP, RequestURL, DeviceAction
| where AttemptCount > 5
| order by AttemptCount desc

References

Subscribe to it-learn Brief

Get it-learn Brief in your inbox (Mon–Fri) - Daily cybersecurity news, SE angles, and detection queries.