Weekly Threat Digest

Weekly Threat Digest: 19 to 25 October 2026 | Hive Pro Threat Advisory

Weekly Threat Digest/19 to 25 October 2026

Weekly Threat Digest: BeyondTrust Zero-Day, PHP2Shell and SafePay Ransomware

HiveForce Labs reports five attacks, thirteen exploited vulnerabilities and one tracked adversary for 19 to 25 October 2026, led by the BeyondTrust Remote Support zero-day CVE-2026-102764, PHP2Shell (CVE-2026-109618 and CVE-2026-109619), the Arista VeloCloud zero-day CVE-2026-114625 and SafePay ransomware.

CVE-2026-102764CVE-2026-109618CVE-2026-109619CVE-2026-114625ARMORY CASTLESAWFLYBARECLAWprivcollectSafePayAoki

Published

October 26, 2026

Period

19 - 25 Oct 2026

Attacks

Vulnerabilities

Adversaries

Total CVEs

539.7K

Published (week)

4,087

Exploited

Report type

Weekly digest

01 / Overview

Summary

HiveForce Labs has reported a sharp rise in cybersecurity threats, highlighting the growing complexity and frequency of global cyber incidents. Over the past week, five major attacks were detected, thirteen vulnerabilities were actively exploited, and one threat actor group was closely monitored, signaling a concerning escalation in malicious activity worldwide.

Among the most significant developments, attackers are actively exploiting CVE-2026-102764, a critical authentication bypass flaw in BeyondTrust Remote Support. The suspected China-nexus group Armory Castle used it as a zero-day to plant the SAWFLY web shell, gain root, and harvest stored credentials. Meanwhile, PHP2Shell (CVE-2026-109618 and CVE-2026-109619), two critical flaws in the core PHP engine, let unauthenticated attackers run code on nearly every PHP release since 5.4, and exploitation attempts began before patches were released. At the same time, Arista patched CVE-2026-114625, an exploited zero-day in VeloCloud Orchestrator that lets even a lowest-privileged tenant user become a superuser operator.

In a separate supply chain attack, threat actors used stolen engineer tokens to publish a poisoned LiteLLM release that stole cloud keys, AI API keys, and CI/CD secrets from systems that installed it. SafePay ransomware has also passed 600 victims worldwide, breaking in through stolen credentials and long-known edge-device and backup flaws before wiping backups and encrypting systems. Together, these incidents underscore a growing trend of attacks on trusted infrastructure and the software supply chain, reinforcing the need for timely patching, credential rotation, and layered security defenses.

Exploited vulnerabilities

CVE-2026-102764CVE-2026-106173CVE-2026-109618CVE-2026-109619CVE-2026-114625CVE-2026-115560CVE-2020-3259CVE-2023-20269CVE-2023-27532CVE-2024-40711CVE-2024-40766CVE-2026-111497CVE-2026-101767

02 / Insights

Insights

Two hours of a poisoned LiteLLM release was enough to steal cloud and AI keys.

BeyondTrust zero-day CVE-2026-102764 was exploited for weeks before disclosure, so treat exposed appliances as compromised.

SafePay still breaks in through flaws dating back to 2020, so old bugs never expire.

PHP2Shell lives in the PHP engine, so clean code on unpatched PHP is still exposed.

eMudhra CA keys could be cracked in under a second, so stale trust stores are now a risk.

CVE-2026-114625 needs just a read-only VeloCloud account to reach superuser.

Threat distribution

InfostealerWeb shellProxy tunnelerCredential stealerRansomware

Targeted countries

VietnamSouth KoreaSloveniaCosta RicaPortugalBelizeCroatiaMontenegroTimor-LesteSri LankaNepalFinlandBhutanCubaAlbaniaNauruUnited StatesSyriaSwedenFranceBoliviaCyprusAndorraNetherlandsAfghanistanTrinidad and TobagoMexicoBosnia and HerzegovinaGeorgiaAntigua and BarbudaCzech RepublicNicaraguaMaltaGermanyPakistanUnited Arab EmiratesBrazilNorth MacedoniaArgentinaMoldovaSingaporeDenmarkGreeceBruneiVanuatuAustraliaOmanMyanmarDominicaTuvaluBulgariaGrenadaLiechtensteinAustriaNew ZealandPalauDominican RepublicMalaysiaCambodiaGuatemalaBahamasNorwayLuxembourgPapua New GuineaMongoliaCanadaEcuadorBahrainGuyanaPanamaMaldivesNorth KoreaChileEgyptPeruBangladeshPhilippinesMarshall IslandsHaitiParaguayChinaEl SalvadorPolandBarbadosRomaniaMicronesiaHondurasSamoaColombiaEstoniaBelgiumSaudi ArabiaMonacoQatar

Targeted industries

AerospaceAgricultureAviationBusiness ServicesCharitable Orgs.Critical InfraDefenseEducationEnergyFinancial ServicesFood ServiceGovernmentHealthcareHospital

03 / Analysis

Attack Details

Aoki

Type: Infostealer
Overview: Aoki (aka Aokigahara) is an infostealer, first seen in early 2026, that is still being actively developed. Recent versions add the theft of credential, token and session files from AI coding assistants such as Claude, OpenAI Codex, Cursor, Codeium, Gemini, GitHub Copilot, JetBrains AI Assistant and Kiro, along with AWS credentials. It also steals data from dozens of browsers, cryptocurrency wallets and extensions, password managers, Discord and Telegram clients, gaming platforms, email clients, and VPN and FTP clients. It records which security products are installed. It has no backdoor command list and sends everything it collects to its C&C server through a /gate endpoint.
Affected platform: Windows
Impact: Credential Theft, Token Theft, Session Hijacking, Cryptocurrency Theft, Financial Fraud

SAWFLY

Type: Web shell
Associated actor: ARMORY CASTLE
Overview: A lightweight PHP web shell deployed after successful compromise of BeyondTrust Remote Support appliances, giving interactive remote access and encrypted two-way command-and-control. The actor uses it as the conduit to escalate privileges, take full administrative control of the appliance, and keep persistence that survives reboots.
Delivery method: Exploiting vulnerabilities
Targeted CVE: CVE-2026-102764
Affected platform: BeyondTrust Remote Support ≤26.2.3
Impact: Remote access, persistence

BARECLAW

Type: Proxy tunneler
Associated actor: ARMORY CASTLE
Overview: A custom C-based SOCKS5 proxy tunneler that relays TCP connections between a remote client and destinations through the compromised appliance. The actor modifies the appliance’s HAProxy configuration so the tunneler can be reached directly from the internet.
Delivery method: Exploiting vulnerabilities
Targeted CVE: CVE-2026-102764
Affected platform: BeyondTrust Remote Support ≤26.2.3
Impact: Covert tunnelling, internal pivoting

privcollect

Type: Credential stealer
Overview: privcollect is a Python credential stealer delivered through a supply-chain compromise of LiteLLM 1.107.0 on October 21, 2026. Using stolen GitHub OAuth tokens, attackers built the release from a lookalike repository (Berri-AI/litellm). The package drops startup hooks that run on every Python launch. They steal browser, cloud, CI/CD, SSH, and AI tool credentials, along with process environment variables and LiteLLM proxy API keys. The stolen data is encrypted and exfiltrated to www.litellm[.]dev. A secondary loader polls a GitHub dead drop hourly to fetch and run remote code.
Delivery method: Software supply-chain compromise
Affected platform: LiteLLM (BerriAI) version 1.107.0
Impact: Credential Theft, Data Exfiltration, API Key Theft

SafePay

Type: Ransomware
Overview: SafePay is a ransomware operation active since August 2024 and among the most active of 2026. It has hit at least 600 victims across critical infrastructure sectors in North America, South America, Europe and Australia. It steals data before encryption, then encrypts files with a hybrid of ChaCha20 and RSA and appends the .SafePay extension. Before encrypting, it stops Volume Shadow Copy and factory-resets NAS backup devices.
Delivery method: Stolen credentials, edge-device exploits
Targeted CVE: CVE-2020-3259, CVE-2023-20269, CVE-2023-27532, CVE-2024-40711, CVE-2024-40766
Affected platform: Cisco ASA & FTD, Veeam Backup & Replication, SonicWall SonicOS
Impact: Data theft, encryption, backup destruction

04 / Exploited

Vulnerability Details

CVE ID	Name	Affected product	Status	Actors / attacks	CWE	Associated TTPs
CVE-2026-102764	BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability	BeyondTrust Remote Support (26.2.3 and prior)	Zero-day · CISA KEV	ARMORY CASTLE (aka UNC5221, WARP PANDA); SAWFLY, BARECLAW	`CWE-290`	`T1190`, `T1059`
CVE-2026-106173	Fortinet FortiSIEM Path Traversal Vulnerability	Fortinet FortiSIEM (7.5.0, before 7.5.1)	–	–	`CWE-22`	`T1190`, `T1059`
CVE-2026-109618	PHP2Shell (PHP Out-of-Memory Corruption Vulnerability)	PHP Group PHP (5.4 through 8.5.11)	Celebrity: PHP2Shell	–	`CWE-1325` `CWE-416` `CWE-755` `CWE-824`	`T1190`, `T1059`
CVE-2026-109619	PHP2Shell (PHP Remote Code Execution Vulnerability)	PHP Group PHP (5.4 through 8.5.11)	Celebrity: PHP2Shell	–	`CWE-1325` `CWE-416` `CWE-755` `CWE-824`	`T1190`, `T1059`
CVE-2026-114625	Arista VeloCloud Orchestrator SQL Injection Vulnerability	Arista VeloCloud Orchestrator (VCO) On-Prem (5.2.x before 5.2.3.18, 6.1.x before 6.1.3.10, 6.4.x before 6.4.2.12)	Zero-day · CISA KEV	–	`CWE-89`	`T1190`, `T1068`
CVE-2026-115560	PHP Remote Code Execution Vulnerability	PHP (affected versions not disclosed by vendor)	–	–	–	`T1190`, `T1059`
CVE-2020-3259	Cisco ASA and FTD Information Disclosure Vulnerability	Cisco ASA and FTD	CISA KEV	SafePay Ransomware	`CWE-200`	`T1190`, `T1212`
CVE-2023-20269	Cisco Adaptive Security Appliance and Firepower Threat Defense Unauthorized Access Vulnerability	Cisco Adaptive Security Appliance and Firepower Threat Defense	Zero-day · CISA KEV	SafePay Ransomware	`CWE-288`	`T1190`, `T1110`, `T1133`
CVE-2023-27532	Veeam Backup & Replication Cloud Connect Missing Authentication for Critical Function Vulnerability	Veeam Backup & Replication, Veeam Cloud Connect	CISA KEV	SafePay Ransomware	`CWE-306`	`T1190`, `T1212`
CVE-2024-40711	Veeam Backup and Replication Deserialization Vulnerability	Veeam Backup and Replication	CISA KEV	SafePay Ransomware	`CWE-502`	`T1190`, `T1136.001`
CVE-2024-40766	SonicWall SonicOS Improper Access Control Vulnerability	SonicWall SonicOS	CISA KEV	SafePay Ransomware	`CWE-284`	`T1190`, `T1133`, `T1078`
CVE-2026-111497	Node.js Brotli Decoder Out-of-Bounds Write Vulnerability	Node.js (22.x before 22.23.4, 24.x before 24.22.1, 26.x before 26.12.1, and End-of-Life versions), Bun (before 1.4.4), Google Brotli(1.0.3 through 1.2.0)	Celebrity: Node2Shell	–	`CWE-787` `CWE-252`	`T1190`, `T1059`
CVE-2026-101767	Oracle E-Business Suite SQL Injection Vulnerability	Oracle E-Business Suite (Oracle Application Object Library) 12.2.3 to 12.2.15	–	–	`CWE-287` `CWE-306`	`T1190`, `T1059`

Patch links

CVE-2026-102764www.beyondtrust.com/trust-center/security-advisories/bt26-05
CVE-2026-106173fortiguard.fortinet.com/psirt/FG-IR-26-180
CVE-2026-109618www.php.net/archive/2026.php#2026-10-21-5
CVE-2026-109619www.php.net/archive/2026.php#2026-10-21-5
CVE-2026-114625www.arista.com/en/support/advisories-not…838-security-advisory-0199
CVE-2020-3259sec.cloudapps.cisco.com/security/center/…ftd-info-disclose-9eJtycMB
CVE-2023-20269sec.cloudapps.cisco.com/security/center/…asaftd-ravpn-auth-8LyfCkeC
CVE-2023-27532www.veeam.com/kb4424
CVE-2024-40711www.veeam.com/kb4649
CVE-2024-40766psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0015
CVE-2026-111497nodejs.org/en/blog/release/v22.23.4/
CVE-2026-111497nodejs.org/en/blog/release/v24.22.1/
CVE-2026-111497nodejs.org/en/blog/release/v26.12.1/
CVE-2026-111497bun.com/blog/bun-v1.4.4
CVE-2026-101767www.oracle.com/security-alerts/cpuoct2026.html

05 / Adversaries

Actor Details

ARMORY CASTLE (aka UNC5221, WARP PANDA)

Origin: China (suspected)
Motive: Cyber espionage
Targeted regions: Worldwide
Targeted CVE: CVE-2026-102764
Associated attacks: SAWFLY, BARECLAW
Affected product: BeyondTrust Remote Support
TTPs: TA0042 Resource Development; TA0001 Initial Access; TA0002 Execution; TA0003 Persistence; TA0004 Privilege Escalation; TA0005 Defense Evasion; TA0006 Credential Access; TA0009 Collection; TA0011 Command and Control; T1584 Compromise Infrastructure; T1584.008 Network Devices; T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter; T1059.004 Unix Shell; T1505 Server Software Component; T1505.003 Web Shell; T1098 Account Manipulation; T1548 Abuse Elevation Control Mechanism; T1548.001 Setuid and Setgid; T1078 Valid Accounts; T1070 Indicator Removal; T1070.002 Clear Linux or Mac System Logs; T1070.004 File Deletion; T1555 Credentials from Password Stores; T1005 Data from Local System; T1071 Application Layer Protocol; T1071.001 Web Protocols; T1573 Encrypted Channel; T1090 Proxy; T1572 Protocol Tunneling; T1105 Ingress Tool Transfer; T1219 Remote Access Tools; T1219.002 Remote Desktop Software

06 / Actions

Recommendations

01
Security Teams
Use this digest to prioritize the thirteen exploited vulnerabilities and block the indicators related to the threat actor ARMORY CASTLE and malware Aoki, SAWFLY, BARECLAW, privcollect, and SafePay.
02
Uni5 Users
HivePro Uni5 customers can action this threat digest and get comprehensive insights into their threat exposure on the HivePro Uni5 dashboard by running a scan to discover the assets impacted by the thirteen exploited vulnerabilities, and by testing the efficacy of their security controls by simulating attacks related to the threat actor ARMORY CASTLE and malware Aoki and SafePay in Breach and Attack Simulation (BAS).

07 / Indicators

Indicators of Compromise (IoCs)

Attack	Type	Value
Aoki	SHA256	`752c8e64af60960b85cf00e4bd34eb459e24b7939464f718ec18494df43b4b69` `bf037920d39b85572ec7e53b51f09c28198c2c0afbc7c7d6cf639b1f047caebf` `0adc8e83b2416c275b1283916d70568faddeb6d718eb45f9addfb0938db245b3` `6655b89b9885483d459c73f2a52e3cec121de5c5956172a8676a0f4c2de94999` `780bbdbb119befd4eb16e0c2ec0c64e7bedc1b53ce4f85804aea091a6e3af519` `2fb80e2221bd304e7cd5ac04169e71807ad92d19836f1aaf7885295cb90b2d94` `73dbac0907e8a092cd978f2787ab1994946f5da1e08f2bdbd05ea52e80cdb896` `07bc2e3a1d14743cc44f1dc4c78d15d0f2b458b39fb48422b13df40fc662ba21` `c533570fd7cd7eaf5478317b03ea5750d03797aa4d11ebd96555b6cb708c63f2` `6350dfee6975a9b159c5a57a3e97f757b0b02fd2dc708016fa6d7270e720c865` `36af3acc78058023cdcf9307bc15be640be9425de97e574fdaf42d03d308725b` `039240551f88b0064b2615dffdc1321b1e7c58e3f617ac138a65a6d59400b331` `0e38bd3c30a4ca08641240ce95b5b6ba593e131213ca1b2a28da4e0385fcabc4` `3b4547f0d7549274f366cd9568b3d302c1e80e1b89359da681beb47260ec7975` `b590235493487c51f7050b341c9b2450e4f761ad6055207e4f6daf0cecae271c` `e374f9ff5094f728528efa566c3de1b7fea7d95f497242a01fffa6c70b5eb768` `f779314b1a5a0b297fd4e2a5f9c1e40d387b3e7c401d42324b556a70f813840e`
SAWFLY	SHA256	`dc14e215269a93fdbc4c1a80b984c23faf7af0911c6dbb85309796a6f2ae95fb`
SAWFLY	File Name	`mangoapi.php`
SAWFLY	File Path	`/%SITE_SERVICE_ACCOUNT%/ingredi/app/laravel/public/mangoapi.php`
SAWFLY	HTTP POST Parameter	`_c94mfe`
SAWFLY	YARA Rule	`G_Hunting_Webshell_SAWFLY_1`
BARECLAW	SHA256	`1f19b9a27d79c11bda00a1e8faf74a7fdd683d38ccef1b60df2fd0307e3aa462`
privcollect	SHA256	`03ac2a8b752605d1d7710979c17ff18b03dd978203ba23ba97fd8ce3d6f897ea` `9dd0a3926f96a37eb86cf1ee2310d9be93139cc4ebef3ef9e2efe9531390be25`
SafePay	SHA256	`921df888aaabcd828a3723f4c9f5fe8b8379c6b7067d16b2ea10152300417eae` `6c1d36df94ebe367823e73ba33cfb4f40756a5e8ee1e30e8f0ae55d47e220a6a` `e79608cf1d6b51324c14bef8883054c1238ed5f080222cc464810e6e14adc346` `327b8b61eb446cc4f710771e44484f62b804ae3d262b57a56575053e2df67917` `a0dc80a37eb7e2716c02a94adc8df9baedec192a77bde31669faed228d9ff526`
SafePay	SHA1	`07353237350c35d6dc2c8f143b649cd07c71f62b` `b498a2683640c983bb069fa2ea9e67cef4a3797d` `BBFED53E3BB1F306F4DA97D995CF4AE5B73AD081`
SafePay	IPv4	`77[.]37[.]49[.]40` `167[.]235[.]225[.]149` `5[.]255[.]11[.]134` `37[.]10[.]71[.]188` `88[.]119[.]167[.]239`
SafePay	Email	`ColinSolomon[@]protonmail[.]com`
SafePay	Filename	`locker.dll` `soc.dll` `readme_safepay.txt` `Socks_werfault.exe` `DYRasWtb.exe`
SafePay	Hostname	`WIN-SBOE3CPNALE` `WIN-3IUUOFVTQAR` `WIN-DK18BI83M0S` `WIN-I1HRRJHCEIV`

08 / Mapping

Top MITRE ATT&CK TTPs

T1059

Command and Scripting Interpreter

T1190

Exploit Public-Facing Application

T1005

Data from Local System

T1211

Exploitation for Defense Evasion

T1071

Application Layer Protocol

T1070

Indicator Removal

T1098

Account Manipulation

T1105

Ingress Tool Transfer

T1036

Masquerading

T1070.004

File Deletion

T1499

Endpoint Denial of Service

T1555

Credentials from Password Stores

09 / Reading

Threat Advisories

What Next?

At Hive Pro, it is our mission to detect the most likely threats to your organization and to help you prevent them from happening.

Book a Demo of HivePro

Weekly Threat Digest : 19 to 25 October 2026