CyberSecurity.PH #050

CyberSecurity.PH is now supported by the PSA Intelligence Cyber Risks

Learn more

uCreator: Rentable Android Spyware - Can Target GCash, Telegram,  and Various Messaging Platforms

Cybersecurity researchers have identified a commercial Android-based Spyware-as-a-Service (SaaS) platform known as uCreator (internally called YingGai). The tool targets users of major messaging platforms like Telegram and WeChat, as well as digital wallets and financial apps like GCash and MoMo. While victims have been identified globally, the platform’s primary focus appears to be users in China and Southeast Asia. 

The attack chain begins with threat actors convincing victims through social engineering to download a "repackaged" and tampered application (Telegram, WeChat, etc.) from outside the official Google Play Store. Alternatively, threat actors can convince victims to launch their real messaging app through a separate, unsafe application (container). Once the user opens this modified app, the uCreator spyware runs in the background. Because the spyware hides deep inside the app's normal activities, it can secretly steal sensitive information such as Telegram Two-Factor Authentication (2FA) passwords, capturing the data.

PSA Intelligence notes that while the spyware has the technical capability to compromise financial applications like GCash, there have been currently no observed or reported instances of GCash users actually being targeted in these campaigns. 

General Availability of Cybercrime Tools

PSA Intelligence notes that while these types of commercial cybercrime tools are not new, the general availability of “as-a-service” models significantly lower the barrier to entry for cyberattacks. By utilizing these platforms, threat actors with minimal technical skills but sufficient monetary resources can simply rent the infrastructure to launch these malicious scalable campaigns. 

Because modern messaging apps, such as WhatsApp, Telegram, and WeChat, are frequently linked to digital wallets, banking services, and one-time passcodes, taking over these accounts grants threat actors access to a victim’s financial assets and digital identity. PSA strongly advises clients operating with Android-based devices to only download applications from official app stores and strictly avoid unofficial or third-party sources.

More Reading: uCreator: virtualization-based Android Spyware Platform Targeting WeChat, Telegram and Other Messaging Apps

Three South Korean Financial Firms Disclose Unauthorized Access and Data Breaches

Three South Korean financial firms, Daishin Securities, Mirae Asset Global Investments, and cryptocurrency exchange Bithumb, reported customer data breaches on October 28, with the Financial Supervisory Service (FSS) indicating that cyberattacks have hit 16 financial firms this month. Daishin Securities disclosed that personal information of over 38,000 customers was compromised, Bithumb confirmed its internal mobile groupware system was hacked with personal information leaked, and Mirae Asset Global Investments confirmed unauthorized external access to its systems. 

South Korea has faced a series of cyberattacks starting earlier this month. While no state-sponsored advanced persistent threat (APT) was attributed to these attacks, cybersecurity firm CrowdStrike attributed it to a China-based threat actor linked to a Distributed Denial-of-Service (DDoS)-for-hire group. The threat actor reportedly used an artificial intelligence (AI) powered penetration testing tool known as ARTEX to breach internal systems. 

PSA Intelligence notes that there is an observed increase in APTs using agentic AI-powered tools while complementing traditional offensive capabilities to target vulnerable institutions. Recent incidents in the region highlight threat actors orchestrating criminal and financially motivated cyberattacks, while experimenting with AI tools in their operations. 

Frontier models are now being used to accelerate search for zero-day vulnerabilities and multi-step attack chains against known softwares, and pace much faster than traditional approaches. This development allows threat actors to find, plan, and exploit security vulnerabilities with unprecedented speed, scale, and sophistication. 

Furthermore, the risk associated with a data leak is that it can be used to drive a successful social engineering campaign, as information can be used to fabricate customized lures that are believable. In 2025 for instance, South Korea logged a cumulative 1.2 trillion won (USD 941 million) in damages due to voice phishing alone. This means that accelerated information acquisition provides threat actors an equally accelerated process for exploitation.

PHP Update: CISA Confirms Active Exploitation of Two PHP2Shell Vulnerabilities; PHP Warns of a Third ‘Special Condition’ Vulnerability

The United States (US) Cybersecurity and Infrastructure Security Agency (CISA) confirmed active exploitation of two PHP2Shell vulnerabilities - Common Vulnerabilities and Exposures (CVE) 2026-109618 and CVE-2026-109619 - adding them to its Known Exploited Vulnerabilities (KEV) Catalog on October 26, 2026. This follows the release of a patch by the PHP security team on October 21, 2026, which was immediately followed by numerous, but unsuccessful exploitation attempts using agentic artificial intelligence (AI) platforms by threat actors. The disclosures have raised significant concern across enterprise security, system administration, and web technology sectors due to the widespread impact of these vulnerabilities, prompting advisories from several software vendors. 

For an understanding of these vulnerabilities and their impact on the modern web,PSA Intelligence previously issued a special advisory regarding the PHP vulnerability on October 22, 2026, which is available here.

Two days after the released security patches for CVE-2026-109618 and CVE-2026-109619, PHP released an ‘informal advisory’ on October 23, warning of another vulnerability identified as CVE-2026-115560. PHP noted that this flaw affects web applications that are “configured in an unusual way” and was tagged as an “unlikely risk”. 

As per the PHP, all PHP installations running versions 8.1or older are at risk. PHP, while still widely used across the internet, is one of the older web languages. According to web technology trackers, PHP is found in 70 to 75 percent of all websites on the internet. Popular internet platforms built on PHP include WordPress, Joomla, Drupal, Magento, Wikipedia, and Flickr. 

Data from cybersecurity research organization Censys indicates that as of October 29, 2026, over 30 million vulnerable PHP services remain active globally, with the US hosting the highest concentration of exposed instances.

Unattributed Scanning Tied to Suspected North Korean Threat Actors

Although no threat actor group has officially claimed responsibility for any attempted PHP2Shell exploit, cybersecurity firm CYFIRMA has identified a suspected campaign staging infrastructure against global PHP deployments with moderate confidence links to the North Korean threat group Lazarus. CYFIRMA described the campaign as “low-and-slow,” scanning 216 vulnerable hosts across the US, Japan, Thailand, Indonesia, South Korea, Australia, Taiwan, India, Singapore, United Arab Emirates (UAE), Saudi Arabia, and the European Union (EU).

Mitigation Strategy

PHP has already released security updates and advised clients to immediately apply the patch, but noted that end-of-life versions, which include PHP 8.1 and below, will not receive any patch and advises anyone running these deprecated instances to immediately upgrade to PHP 8.2+ so the patch can be applied.

PSA Intelligence notes that simply updating a PHP powered website is easier said than done, as many underlying frameworks or legacy systems cannot be updated to the latest version or lack support for modern scripting languages.If immediate update is not feasible, PHP Foundation has provided measures clients can follow to lessen exposure. 

For full details, please refer to the PHP Foundation's Advisory and look for further updates on their blog site. For more information on the vulnerabilities, refer to the National Vulnerability Database (NVD) entries for CVE-2026-109618, CVE-2026-109619 and CVE-2026-115560.

Critical 'HTTP2Shell' Brotli Vulnerability Allows Remote Code Execution, Prompting Release of Emergency Patches

A critical memory-corruption vulnerability known as “HTTP2Shell” was identified in instances of Google’s Brotli. Tracked as Common Vulnerabilities and Exposures (CVE) 2026-111497, the flaw may lead to unauthorized privilege escalation and remote code execution (RCE). The vulnerability is said to affect Brotli versions 1.0.3 through 1.0.9, 1.1.0, and 1.2.0.

Brotli is a widely used open-source data compression algorithm, actively maintained by Google, that is responsible for making web traffic smaller and faster. The algorithm is adopted by all major web browsers, such as Chrome, Firefox, Safari, and Edge, and is also widely used by various platforms such as Microsoft’s .NET, Node.js, various Python HTTP clients, as well as Palo Alto Network’s PAN-OS and Prisma Cloud Clients. 

The vulnerability carries a critical Common Vulnerability Scoring System (CVSS) score of 9.2 and occurs when threat actors deploy a specially crafted trigger to enable a memory buffer overflow in affected systems that may potentially lead to RCE and privilege escalation. This allows threat actors to access sensitive internal system files and potentially leads to an administrative takeover.

To address this, affected users must patch and update their Brotli instances to newer versions listed as follows:

• Google Brotli 1.0.10, 1.1.1, 1.2.1
• Node.js 22.23.4, 24.22.1, 26.12.1
• Python Brotli 1.2.1
• Python brotlicffi 1.2.1.0

If immediately updating is not feasible, it is advised to remove Brotli support from Python applications and block further Brotli requests. For full details, refer to the National Vulnerability Database (NVD) entry for CVE-2026-111497.

Ransomware Groups Actively Exploit Palo Alto Networks Flaw Bypassing MFA

Palo Alto Networks’ Unit 42 has recently disclosed active exploitation of a known vulnerability by various ransomware groups. The vulnerability tracked as Common Vulnerabilities and Exposures (CVE)-2026-0257 is an authentication bypass vulnerability affecting GlobalProtect Portal in Palo Alto’s PAN-OS and Prisma Access. The vulnerability was patched by Palo Alto Networks in May 2026 and was added to CISA’s Known Exploited Vulnerabilities (KEV) catalog in the same month. 

The vulnerability affects firewalls with GlobalProtect Portal, which is a centralized management and authentication interface hosted on Palo Alto Networks’ infrastructure that includes PAN-OS firewall deployments as well as its Prisma Cloud Application platforms. 

Unit 42 stated that active exploitation was attributed to groups such as Qilin (Spikey Scorpius) and INC (Tarnished Scorpius) for financially-motivated attacks. 

The vulnerability carries a critical Common Vulnerability Scoring System (CVSS) score of 7.8 and occurs when threat actors exploit an authentication override cookie issue to gain an initial foothold, allowing them to bypass multifactor authentication (MFA) to establish an unauthorized virtual private network (VPN) session, allowing threat actors access to the system.

To address the issue, Palo Alto Networks users are advised to immediately upgrade their systems to safe and secure versions listed on Palo Alto Networks’ website. Furthermore, users are encouraged to disable authentication override and use a dedicated certificate for authentication override cookies. For more information, check Palo Alto Networks’ advisory and refer to the National Vulnerability Database (NVD) entry for CVE-2026-0257.