InfoSec Briefing - October 26, 2026

🎧 Audio Briefing

Playback Speed:

Security news from the BlueTeamSec community for Monday the 26th of October 2026.

Glen Saunders has released a Rust-based monitoring tool that scans Certificate Transparency logs for TLS certificates using cryptographically weak elliptic curve private keys — the sort of low-entropy values that can be broken with discrete logarithm attacks. It's designed to catch the eMudhra weak-key class across the P-256, 384, and 521 curves, and can process around 220 million certificate sightings a day. One for organisations tracking fallout from the recent eMudhra incident.

CrowdStrike have written up the PHP2Shell vulnerabilities affecting PHP versions 8.2 through 8.5 — memory corruption flaws in HTTP request parsing, serialization, and session management. The good news is they've not seen exploitation in the wild yet, with weaponisation apparently constrained by complexity and environment-specific requirements. Worth a look if you're still triaging the patch uptake internally.

And from the forensics side, investigators at dfir.ch have reconstructed an attacker's post-compromise workflow that relied entirely on PowerShell and living-off-the-land techniques — credential theft via spoofed Windows prompts, Active Directory reconnaissance, SMB network discovery, all using native tooling to stay under the radar. Useful background if you're writing detection rules for the sort of tradecraft that leaves almost no external malware footprint.

That's all for today. The articles are the work of their original authors — the analysis here was automated.

📰 Articles Covered

low-int-cert-monitor: Monitor Certificate Transparency logs for certificates with trivially small EC private keys (the eMudhra weak-key class). P-256/384/521. - Glen Saunders

The `low-int-cert-monitor` project is a security tool designed for real-time monitoring of Certificate Transparency (CT) logs to identify certificates using "weak" cryptographic keys—specifically those derived from flawed private keys that can be computed through small-factor discrete logarithm attacks (e.g., $d \cdot G$ where $d$ is small).

### What Happened & Technical Details
The project provides an efficient, production-ready monitor (`p4mon`) written in Rust that allows defenders to scan CT logs in real-time. Unlike standard certificate transparency monitoring that focuses on domains or CA issuance, this tool focuses on the **mathematical integrity of the private keys** themselves.

* **Mechanism**: It uses a precomputed table of public keys ($d \cdot G$ for small $d$, specifically $d=1$ to $1,000,000$) to instantly verify if any incoming certificate in the CT stream was signed by a compromised or weak private key.
* **Performance**: It is highly optimized for scale, processing approximately 220 million sightings per day (deduplicated to ~11 million distinct keys) while consuming only ~5% of a single CPU core and <650 MB of RAM.
* **Implementation**: The repository includes the high-performance Rust monitor (`p4mon`), reference implementations in Python, and various benchmark versions in C, C++, and Go.

### Who is Affected
The tool is intended for **system administrators, security engineers, and infrastructure defenders** who manage TLS/SSL certificate issuance or need to audit their environment for certificates that are cryptographically broken due to weak key generation. Any infrastructure relying on certificates generated by vulnerable entropy sources is potentially at risk if those certificates are issued and logged in CT logs.

### Security Implications
* **Cryptographic Weakness**: Certificates with private keys derived from low-entropy or predictable values are fundamentally broken. An attacker knowing the generation method (or discovering the weak $d$) can derive the private key from the public key, enabling impersonation, man-in-the-middle (MITM) attacks, and unauthorized decryption of traffic.
* **Proactive Detection**: By monitoring CT logs, organizations can detect such certificates immediately upon issuance, rather than waiting for an incident or a later audit.

### What Defenders Should Know
* **Deployment**: The `p4mon` tool is designed for easy integration. It can be set up to tail CT logs and check against the precomputed table.
* **Alerting**: The system integrates with the [Apprise library](https://github.com/caronc/apprise), allowing security teams to receive instant alerts via email, Slack, Telegram, webhooks, and other channels. If no external alerting is configured, it defaults to logging findings to the `systemd` journal.
* **Operational Requirements**: The monitor requires a one-time precomputation of a binary table (`table.bin`), which takes approximately 80 seconds. It is designed to be low-impact, running efficiently with minimal disk I/O.
* **False Negatives/Scope**: Defenders should understand that this specific tool targets a specific class of weak keys (where $d$ is small). It does not replace general certificate monitoring or other forms of cryptographic auditing.
PHP2Shell: Obstacles to Weaponizing Likely Constrain Immediate Exploitation - CrowdStrike

This precis summarizes the findings from the CrowdStrike blog post regarding the PHP2Shell vulnerabilities.

### What Happened
CrowdStrike has detailed a series of memory-corruption vulnerabilities—collectively referred to as "PHP2Shell"—that affect the PHP interpreter. These flaws reside within the engine's core handling of HTTP request-variable parsing, serialization, and session management. Although these vulnerabilities have been publicized, CrowdStrike reports that they have not yet observed successful exploitation in the wild or within their threat-intelligence honeypots.

### Who Is Affected
The vulnerabilities affect specific versions of PHP across several branches. Systems running the following versions (or earlier) are considered vulnerable:
* **PHP 8.2:** Earlier than 8.2.35
* **PHP 8.3:** Earlier than 8.3.36
* **PHP 8.4:** Earlier than 8.4.27
* **PHP 8.5:** Earlier than 8.5.12

### Technical Details
The security risk stems from three distinct memory-related flaws within the PHP engine:
* **Partial HashTable Insertion (CVE-2026-109618):** During the parsing of HTTP request variables, a memory-allocation failure when adding a `HashTable` entry can result in memory corruption, potentially allowing the processing or release of invalid data.
* **Persistent Serialization-Context Use-After-Free (CVE-2026-109619):** If a fatal error occurs during `serialize()` or `unserialize()` operations, the internal serialization context may continue to point to memory that is released after the request. Because PHP workers often persist across multiple requests, this memory can be accessed again, leading to a use-after-free scenario.
* **Session-Global Use-After-Free (CVE-2026-109619):** A similar issue arises when a fatal error occurs during session upload-progress handling. Pointers to memory are left in a state where they may be accessed by subsequent requests handled by the same persistent worker process.

### Security Implications
The primary barrier to immediate, widespread exploitation is the high level of effort required to weaponize these flaws. Because these vulnerabilities are highly dependent on specific PHP versions and application-level configurations, a "universal" exploit is currently unlikely. An attacker must carefully tailor proof-of-concept code to a target's environment to achieve reliable code execution. However, CrowdStrike warns that this landscape could shift rapidly; should a reliable, public exploit become available for common deployment configurations, threat actors are expected to adopt it quickly.

### What Defenders Should Know
CrowdStrike provides several key recommendations to mitigate the risk associated with these vulnerabilities:
* **Patching:** Prioritize updating all PHP instances, particularly those that are internet-facing, to the latest versions.
* **Process Management:** Rebuild container images and perform a clean restart of all Apache and PHP-FPM workers. This is crucial to clear any stale process state that might harbor dangerous pointers.
* **Configuration Hardening:**
* If not required, disable `session.upload_progress.enabled` and `file_uploads` in the `php.ini` configuration.
* Use web server or WAF configurations to limit request-body sizes and parameter-name lengths.
* **Least Privilege:** Ensure that all PHP applications are executed under separate, minimally privileged service accounts to limit the potential impact of a successful compromise.
Field Notes: Reconstructing an Attacker’s Workflow - dfir.ch

The information you requested has been synthesized from the article. Below is a detailed precis of the attacker’s post-compromise workflow as documented in the provided analysis.

### What Happened
During a post-compromise investigation, responders identified a collection of PowerShell scripts that provided a modular and highly structured post-exploitation framework. Instead of using complex, external malware, the attackers leveraged "living-off-the-land" (LotL) techniques to maintain control and expand their footprint. Their workflow consisted of four primary stages: persistent remote command execution, credential theft, internal reconnaissance, and network-wide SMB discovery.

### Who Is Affected
While the specific identity of the target organization was not disclosed, the techniques identified are broadly applicable to any enterprise environment utilizing Windows infrastructure and Active Directory. The scripts were specifically engineered to exploit common Windows-based configurations and administrative tools.

### Security Implications
The primary security implication is the efficacy of the attacker’s approach: by relying exclusively on native Windows capabilities and PowerShell, the attackers achieved their objectives while minimizing their forensic footprint. This technique allows adversaries to bypass traditional security controls that might otherwise flag unknown binaries, necessitating a shift toward behavioral monitoring and advanced log analysis rather than signature-based detection.

### Technical Details
The attacker’s toolkit utilized several standard Windows libraries and PowerShell cmdlets to achieve high-impact malicious actions:

| Component | Technical Implementation |
| :--- | :--- |
| **Command Runner** | Used a `while ($true)` loop to poll a text file for commands, executing them via `Invoke-Expression` and writing results back to a log file. |
| **Credential Theft** | Spoofed a legitimate Windows credential prompt using `$host.UI.PromptForCredential`, capturing passwords in plaintext before validating them against hidden PowerShell processes. |
| **Reconnaissance** | Leveraged `DirectoryServices.DirectorySearcher` for Active Directory enumeration and `Get-WmiObject` to map reachable systems. |
| **SMB Discovery** | Utilized `Net.Sockets.TcpClient` and Windows APIs (e.g., `NetShareEnum`) to scan the network for accessible SMB shares and determine permission levels. |

### What Defenders Should Know
Defenders must focus on behavioral telemetry rather than file-based indicators. Key strategies include:

* **Enable Enhanced Logging:** Deploy and monitor `PowerShell Script Block Logging` (Event ID 4104) and `Module Logging` (Event ID 4103) to capture and inspect the specific PowerShell code being executed.
* **Proactive Hunting:** Look for specific behavioral patterns, such as the use of `PromptForCredential` in unauthorized contexts or scripts that attempt to pull credentials via `GetNetworkCredential().Password`.
* **Telemetry Correlation:**
* Correlate process creation logs (e.g., Security Event ID 4688 or Sysmon Event ID 1) to identify suspicious parent-child process relationships.
* Monitor for anomalous network activity, specifically hosts performing broad network sweeps over TCP/445 (SMB) or excessive/unusual WMI/DCOM queries.
* **Incident Response:** Any log file containing captured authentication attempts or script output should be prioritized during an investigation, as these files directly confirm compromised credentials and indicate the scope of the attacker's visibility within the network.