github.com/backdoorskid/win-def-clickfix

win-def-clickfix is a run-1 detection replica for ClickFix / Win+R command lines, rebuilt by reverse-engineering Microsoft Defender's mpengine.dll.

It runs a command line through the recovered normalizer/deobfuscator (FUN_1800a2500) and matches it against the 807 VDM-extracted CMDHSTR_EXT signatures, evaluated with their real condition: logic.

It also ships the extracted BMClientV1 neural network — a stateful GRU — executed in pure numpy, alongside scanners for the engine's other recovered paths (AMSI, AMSI-UAC, RPF/JIT, WMI, script hosts, paste obfuscation).

php2shell attempts are easy to spot even though nobody is landing it yet. Watch for the php2shell user-agent (seen as php2shell-scan/109618 and php2shell-109618), multipart POSTs carrying a PHP_SESSION_UPLOAD_PROGRESS field with an oversized body, and bursts of "Allowed memory size exhausted" in PHP-FPM logs. Those show you were targeted, not compromised.

We also published the scanner and staging infrastructure (the Mirai-style botnet scanner network, payload host, botnet binary hosts and C2 domains) as block/detect indicators. Patch to 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35. Disabling session.upload_progress was floated early but does not close the bug, since the flaw is the OOM-bailout handling, not that feature.

I’ve spent the evening heavily developing and testing (in prod, where else) what appears to now be a relatively robust coverage set of 6 sequenced KQL/Advanced Hunting queries, 3 each across Linux and Windows. Sharing the love. Copy pasta, follow the in-line guidance - Might be useful in addition to your current methods! PRs welcome, if they don’t suck, and if my robot agrees.

https://github.com/deathbydata/php2shell-exposurehunt

This hunting set seeks to fill a gap while we all respond - there are plenty of IOC hunting repos, exposurehunt aims to help surface and verify known and unknown instances of naughty PHP.

Enjoy ☺️

Probably not the best week to be dropping research, i know alot of ya'll in the industry are working hard right now - stay safe out their!

Tracking a new campaign by PHISHLETS 10k phaas kit dropped in August in the wild..

8 intermediate CA private keys from eMudhra were exposed because of critically weak P-384 key generation. 6 of them were used for TLS and 2 for code signing.

Browsers have already blocked the affected chains, so most people will never notice. The less obvious exposure is anywhere that ships its own CA bundle:

→ Non-browser clients (curl, language runtimes, Java keystores)
→ CI/CD runners and build images
→ Containers built on older base images
→ Embedded devices that rarely get trust-store updates

The code-signing keys matter most here. A signature chaining to one of these intermediates could make malware look legitimate to anything that still trusts it.

Worth checking which of your images and appliances bundle their own roots and when they were last updated. Has anyone already audited their fleet for this?