Attackers seize 25 network devices linked to US entity
Security researchers report hackers compromised 25 network defense devices globally in October 2026 using PHP and Linux kernel flaws alongside AI tools.
Stock photo for illustration only, not from the actual event
- Security researchers detected a global attack campaign targeting 25 network systems.
- Attackers leveraged PHP vulnerabilities and Linux kernel issues to gain management control.
- Three compromised devices were found in an environment linked to a US organization.
- Code structure analysis suggests artificial intelligence may have been used to build the tools.
Cybersecurity researchers have detailed an attack campaign targeting network defense devices across 25 systems globally, combining PHP vulnerabilities and a Linux kernel issue to gain full control over exposed management pages.
The attack targeted devices running specific software versions from an unnamed major manufacturer. The attackers combined two flaws in the software used by the devices with another flaw in their underlying operating system to gain complete control over them. Dream observed the activity on October 25, 2026, and its findings were published by The Hacker News on October 28.
According to Dream, the attackers used the FOFA service to identify approximately 19,000 devices with web-accessible management pages, with about 5,000 of them revealing their software versions. These checks led to the selection of 240 target devices.
Stock photo for illustration only, not from the actual event
The attackers initially took control of 24 devices and later added one more, bringing the total to 25. Two of the initial devices were located in an environment associated with a US organization. The first device stopped working on October 23, 2026, at 18:14 UTC and did not come back online, while the second was taken over on October 24 at 10:09 UTC.
This campaign highlights the severe risks of exposing administrative interfaces to the public internet. By combining automated reconnaissance tools with multi-flaw exploits, threat actors can efficiently bridge the gap from edge device compromise to internal network penetration, presenting a continuous threat to global organizational security.
Through the second device, the attackers established a connection to the organization's internal network. At 11:35 UTC on the same day, they took control of a third device reachable solely through this connection. They targeted the internal account management system, attempting to discover service passwords, record users, test organization-related credentials, and create hidden accounts.
Dream found evidence that the perpetrators obtained login credentials and registered accounts, though it remains unclear if they secured working passwords or successfully created hidden accounts. The attack infrastructure included Anthropic's Claude Code, FOFA credentials, and the aiscan tool configured with DeepSeek and Kimi models. Dream noted that the structure, comments, and similarities across nearly 40 programs suggest AI may have been utilized in their creation, serving as an indicator rather than definitive proof.
Source: Dev.to
Found something wrong in this article? Report an issue with this article
Comments
Leave a Comment