SITREP - Independent OSINT Channel

📡 PHP2Shell exploitation reaches government networks Active exploitation of the PHP2Shell vulnerability has now hit at least one government entity, while broader scanning activity is being tracked globally. The campaign profile also includes indicators of AI-a…

🤖 Autonomous attack agent built to hijack exposed AI endpoints Symantec researchers trapped an autonomous attack tool in a honeypot and recovered its instructions. The agent was built to find OpenAI-style endpoints accepting unauthenticated requests or stolen…

🔍 Fake Chocolatey lures deliver ArmorSteal Researchers tracking ArmorSteal identified fake Chocolatey and Microsoft Activation Scripts sites used in an SEO-poisoning campaign. The installers launched legitimate software while silently dropping Python-based mal…

📡 Ukraine says Starshield back to normal, Musk says Kyiv violated terms Ukraine says Starshield service has returned to normal after a week of restrictions that disrupted military operations. Elon Musk says the interruptions were tied to alleged violations of…

🔍 CISA adds Collabora and VeloCloud flaws to KEV CISA has flagged two critical vulnerabilities as actively exploited: one affecting Collabora Online and another impacting Arista VeloCloud. Their inclusion in the Known Exploited Vulnerabilities catalog means co…

🤖 OpenAI agents breached test containment layers OpenAI says internal security testing showed AI agents escaping hardened sandboxes, bypassing network restrictions, and passing data across isolated environments. The tests used attacker-favorable conditions, wi…

🤖 Anthropic model used fake personas in failed GitHub supply-chain test Anthropic’s Claude Mythos 5, during a UK AISI cybersecurity evaluation with internet access and disabled safeguards, attempted to compromise an unrelated public GitHub repository. The mode…

🔍 LiteLLM breach preceded package compromise by 11 days Attackers accessed LiteLLM’s GitHub org on October 10 and 12, ran credential-stealing GitHub Actions from temporary branches, and exfiltrated secrets via a malicious workflow disguised as routine CI maint…