UEFI rootkits: BlackX, firmware implants and the limits of a clean rebuild
An investigation of UEFI rootkits and bootkits: persistence layers, campaign evidence, attribution limits, forensic artefacts and recovery beyond a Windows rebuild.
Threat intelligence, decoded.
Evidence-led cyber threat intelligence for defenders. Incident reports, actor profiles and vulnerability analysis — written for the people who have to act on it.
// Latest reporting
APT41
APT41 tradecraft, verified vendor names and persistence, with Kaspersky’s medium-confidence BlackX assessment distinguished from the separate FishMonger reporting.
BeyondTrust and Bomgar attacks expose the persistence risk in trusted remote access
Mandiant's BeyondTrust findings show how appliance compromise becomes persistent access. The SolarWinds comparison concerns trust and recovery, without implying common attribution.
EDK II UEFI flaw CVE-2026-97631: finding exposed PXE boot paths and verifying firmware fixes
CVE-2026-97631 exposes vulnerable EDK II systems during PXE network boot. The urgent questions are network reachability, the firmware build and whether its vendor has shipped the fix.
APT28
ESET reports Sednit activity in April–September 2026. This APT28 profile separates recurrent mail and router operations from documented LoJax firmware persistence and measured surveillance duration.
Brotli CVE-2026-111497 extends beyond Node.js to Python, .NET and PHP dependencies
Brotli's CVE-2026-111497 is now in CISA's exploited-vulnerability catalogue. Exposure depends on the decoder and data path, with distinct fixes for Node.js, Python, .NET and PHP Windows builds.
PHP2Shell enters the KEV catalogue: exploitation, patching and verifying runtime coverage
CISA lists PHP's CVE-2026-109618 and CVE-2026-109619 as exploited. Complete remediation requires patched serving runtimes, worker restarts and checks for distribution backports.
Node.js October security release fixes Brotli memory corruption, TLS validation and DNS flaws
Node.js fixes ten vulnerabilities across supported release lines, including Brotli memory corruption, hostname verification errors and repeated random values in application snapshots.
PHP session upload progress notice: identifying the exposed configuration
PHP's 23 October notice identifies a narrow session configuration exposed to a further code execution vector and recommends disabling upload progress pending a regular bugfix release.
Monthly threat review: September 2026
September brought NetScaler exploitation, renewed PeopleSoft attacks and identity-led intrusion reporting, while CISA added 43 vulnerabilities to KEV.
NetScaler September exploitation: web shells, internal access and credential recovery
NCSC and Mandiant document exploited NetScaler flaws and post-exploitation access, making patching, appliance investigation and coordinated credential recovery urgent.
Renewed PeopleSoft exploitation exposes gaps in temporary firewall mitigations
Mandiant reports renewed PeopleSoft exploitation by its UNC6240 cluster, highlighting unpatched servers, firewall-rule bypass, web shells and exposed application credentials.