Front Page

Exploitation & Anti-Forensics

The Zero-Day That Scored 2.7: Warp Panda Weaponised a Logging Gap to Blind the Hypervisor Audit Trail

CrowdStrike disclosed on October 28 that the China-nexus actor it tracks as Warp Panda had used CVE-2026-41709 as a zero-day against US organisations, law firms among them. The flaw is an insufficient logging weakness (CWE-778) in VMware ESX: an actor already holding administrative privileges can carry out certain operations without those operations being written to the audit trail. Broadcom rates it 2.7 — Low — and fixed it on July 29 in VMSA-2026-0006 alongside four more serious bugs, after a report from CrowdStrike's Ian Barton. CISA added it to KEV on October 28 with a November 11 due date.

It grants no access and escalates nothing, which is exactly why it scored 2.7 and why most estates patched it in July without noticing. Its value to the operator is purely forensic. Warp Panda's pattern is initial access through an internet-facing edge device, a pivot to vCenter, then BRICKSTORM and SharpStorm implants, Microsoft 365 session-token theft and newly registered MFA devices — and the hypervisor log is the one record a guest-level compromise cannot reach. Forensic priority: CVSS measures what a bug does to the system, not what it does to your evidence. If a timeline across an early-2026 window rests on ESX audit data, absence of events is not evidence of absence — corroborate from vCenter, the SIEM and network telemetry the hypervisor does not control.

Research & Media Authentication

Ninety-One Per Cent Against Sixty-Nine, and Not One Wrong Answer: An AI Expert System Tested Against Twenty Examiners

Magnet Forensics launched the Magnet AI Research Lab on October 27, its stated purpose being to put the accuracy and reliability of AI-driven forensic output on a peer-reviewed footing. The first publication, in the Journal of Forensic Sciences, set fourteen video files — camera originals, edited clips, social media re-encodes, AI-generated media and files built to resist classification — against twenty trained examiners and the expert system in Magnet Verify, both measured against known ground truth. The system scored 91 per cent to the human average of 69, and made no incorrect classification at all.

Read the abstention rather than the headline gap. The system declined to reach a determination wherever the data did not support one, which is the behaviour a Rule 702 challenge actually probes, and the opposite of the confident wrong answer that makes AI output dangerous in a report. Two caveats belong in any citation of it: the study evaluates its sponsor's own product and the authors disclose Magnet funding, and fourteen files is a thin corpus to generalise from. Forensic priority: the finding worth carrying forward is not that a tool beat examiners but that published, falsifiable validation data now exists for one — which is what you will be asked for under cross-examination.

Threat Bulletin

Active Exploit

CVE-2026-119977 — WordPress Core. Versions 4.7.0 through 7.1.3 stage a full core upgrade in predictable, web-reachable paths under wp-content/upgrade, and a time-of-check/time-of-use race there hands an unauthenticated attacker remote code execution during the seconds the package is unpacked. Fixed in 7.1.4 on October 28; Wordfence scores it 8.1 while WordPress's own advisory rates the race Low. CISA KEV November 3, due November 6. Forensic Note: The window is seconds long and no plugin is involved — hunt unexpected PHP files under wp-content/upgrade and requests to that path in web logs.

Active Exploit

CVE-2026-46300 — Linux kernel, tracked as Fragnesia. A local privilege escalation disclosed in May 2026 and added to KEV on October 28 with an October 31 due date. Dream reported a China-nexus operation chaining it behind last week's PHP2Shell flaws to take root on around twenty-five internet-facing Palo Alto Networks firewalls across the US, Japan, Taiwan and South Korea, planting webshells and pulling credentials from domain controllers; Unit 42 independently verified the tooling. Forensic Note: This KEV entry carries a BOD 26-04 forensic triage requirement — triage the appliance before you patch it, because patching is a rebuild.

Malware Spotlight

Skyw4lker — ANY.RUN published analysis on October 27 of a device-code phishing kit aimed at Microsoft 365, with 618 sandbox submissions between June and October 21 and roughly 46 per cent of them from the US. It steals no password and drops no file: a lure document and CAPTCHA gate send the victim to Microsoft's genuine sign-in page to approve an attacker-initiated device-code request, while an obfuscated front end and PHP backend poll for completion and record IP and geolocation. ANY.RUN ties it to the Gabagool kit, likely the same developer. The only artefact is an Entra ID device-code sign-in from infrastructure the user never visited.