Kaspersky retweeted
๐ฌ Thatโs a wrap on #TheSAS2026.
Another thrilling ride comes to an end - and yes, it was just as good as it looks in this video.
For the analytical minds in our field, a few numbers from this year:
- 180 attendees
- 26 countries
- 30 talks in 2 days
- 120 GB of video content consumed on stage
- 190 audio-cassette badges
- 14 teams in the SAS CTF final
See you next year!
Another thrilling ride comes to an end - and yes, it was just as good as it looks in this video.
For the analytical minds in our field, a few numbers from this year:
- 180 attendees
- 26 countries
- 30 talks in 2 days
- 120 GB of video content consumed on stage
- 190 audio-cassette badges
- 14 teams in the SAS CTF final
See you next year!
0
8
30
3,172
The new PHP vulnerabilities arenโt just an admin headache. Home network storage, smart-home hubs and the sites you sign in to every day can be affected too. Hereโs how to protect your accounts and files ๐ kas.pr/8eue
4
1
11
1,712
New BlackX bootkit used in espionage attacks
Threat actors, likely part of the APT41 cluster, have revamped the previously known BlackLotus bootkit code and deployed it in attacks targeting diplomatic organizations in Central Asia. The BlackX bootkit is used to maintain ly compromised systems and conduct long-term espionage. Data exfiltration occurs via common cloud services such as Google Drive, OneDrive and Yandex Disk.
Notably, the attackers attempt to disable endpoint security products on hosts, including Kaspersky solutions, but our protection remains effective against these attempts.
The Secure Boot bypass vulnerability (CVEโ2023โ24932) exploited in this bootkit was patched in 2023. However, the update requires system administrators to manually complete certain
configuration steps to fully activate the protection. Many organizations have not performed these
manual steps and remained vulnerable.
Kaspersky GReAT expert Georgy Kucherin shared detailed research on BlackX in his talk at the Security Analyst Summit 2026. Watch our video and find IoCs and technical details on Securelist: securelist.com/uefi-bootkit-bโฆ
More on Microsoft's mitigations:
support.microsoft.com/en-us/servicinโฆ
#TheSAS2026 #APT #Windows #bootkit
Threat actors, likely part of the APT41 cluster, have revamped the previously known BlackLotus bootkit code and deployed it in attacks targeting diplomatic organizations in Central Asia. The BlackX bootkit is used to maintain ly compromised systems and conduct long-term espionage. Data exfiltration occurs via common cloud services such as Google Drive, OneDrive and Yandex Disk.
Notably, the attackers attempt to disable endpoint security products on hosts, including Kaspersky solutions, but our protection remains effective against these attempts.
The Secure Boot bypass vulnerability (CVEโ2023โ24932) exploited in this bootkit was patched in 2023. However, the update requires system administrators to manually complete certain
configuration steps to fully activate the protection. Many organizations have not performed these
manual steps and remained vulnerable.
Kaspersky GReAT expert Georgy Kucherin shared detailed research on BlackX in his talk at the Security Analyst Summit 2026. Watch our video and find IoCs and technical details on Securelist: securelist.com/uefi-bootkit-bโฆ
More on Microsoft's mitigations:
support.microsoft.com/en-us/servicinโฆ
#TheSAS2026 #APT #Windows #bootkit
3
5
26
2,535
๐๐ณ ๐๐ผ๐๐ฟ ๐ถ๐ป๐ณ๐ฟ๐ฎ๐๐๐ฟ๐๐ฐ๐๐๐ฟ๐ฒ ๐ฟ๐ฒ๐น๐ถ๐ฒ๐ ๐ผ๐ป ๐ฃ๐๐ฃ, ๐๐ผ๐ ๐๐ต๐ผ๐๐น๐ฑ ๐ฟ๐ฒ๐๐ถ๐ฒ๐ ๐๐ต๐ถ๐ ๐ฎ๐ฑ๐๐ถ๐๐ผ๐ฟ๐ ๐ฝ๐ฟ๐ผ๐บ๐ฝ๐๐น๐.
Newly disclosed critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, may allow unauthenticated RCE. Until patched, affected internet-facing servers may remain exposed.
More on Securelist โ kas.pr/rdt3
#securelist #php
Newly disclosed critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, may allow unauthenticated RCE. Until patched, affected internet-facing servers may remain exposed.
More on Securelist โ kas.pr/rdt3
#securelist #php
0
12
71
8,594
Could this be the vulnerability of the year? @61ack1ynx, Head of Kaspersky GReAT Research Center, APAC & META, on the critical #PHP#PHPws that can lead to remote code execution with no authentication. His advice: โYou cannot wait 10 minutes.โ Patch immediately.
httTheSAS2026 @TheSAScon
httTheSAS2026 @TheSAScon
2
2
10
2,326
Critical PHP kernel vulnerabilities - patch today
Two critical flaws in PHP will be patched urgently today at 14:00 UTC due to premature disclosure before scheduled fixes. Both bugs (CVE-2026-109618 and CVE-2026-109619) carry a CVSSv4 Base Score of 9.2 and can lead to remote code execution on servers running PHP. Affected versions are not yet fully confirmed but likely span PHP 5 through 8.
A demo video of the PHP2Shell exploit is circulating on social media, showing successful attacks on servers running many PHP-based projects, from WordPress to Magento. Preliminary analysis links the flaws to memory corruption and use-after-free vulnerabilities in the PHP core. The attack requires no authentication.
Most experts expect exploitation to begin within 15 minutes of vulnerability details becoming public. Administrators responsible for publicly accessible PHP web servers should clear their schedules tonight for urgent patch deployment.
php.net/archive/2026.pโฆ
Two critical flaws in PHP will be patched urgently today at 14:00 UTC due to premature disclosure before scheduled fixes. Both bugs (CVE-2026-109618 and CVE-2026-109619) carry a CVSSv4 Base Score of 9.2 and can lead to remote code execution on servers running PHP. Affected versions are not yet fully confirmed but likely span PHP 5 through 8.
A demo video of the PHP2Shell exploit is circulating on social media, showing successful attacks on servers running many PHP-based projects, from WordPress to Magento. Preliminary analysis links the flaws to memory corruption and use-after-free vulnerabilities in the PHP core. The attack requires no authentication.
Most experts expect exploitation to begin within 15 minutes of vulnerability details becoming public. Administrators responsible for publicly accessible PHP web servers should clear their schedules tonight for urgent patch deployment.
php.net/archive/2026.pโฆ
9
15
82
6,556
New Lazarus tradecraft: updated malware, abuse of legitimate software and a dash of post-quantum encryption
Kaspersky GReAT researchers today shared details about Lazarus's Operation FlashHole, targeting organizations in South Korea.
This time, attackers abused CrossWeb EX, a tion that is required to access some online banking websites.
Nearly all malware components, except the loader, operate only in memory. Newly identified malware includes TouchHub and ClientHub, which complement already known components such as TouchShift, LPEClient, and Cubridge. In this attack, Lazarus is first observed to employ the SNOW algorithm for encryption and orchestrate C2 traffic for LPEClient through ClientHub, using ML-KEM (CRYSTALS-Kyber), a recently standardized post-quantum algorithm for key encapsulation.
The attack details were shared today during Security Analyst Summit 2026.
Watch our video where Sojun Ryu recaps key details about their new findings, or read the full details at securelist.com/lazarus-operatโฆ
#APT #Lazarus #TheSAS2026
Kaspersky GReAT researchers today shared details about Lazarus's Operation FlashHole, targeting organizations in South Korea.
This time, attackers abused CrossWeb EX, a tion that is required to access some online banking websites.
Nearly all malware components, except the loader, operate only in memory. Newly identified malware includes TouchHub and ClientHub, which complement already known components such as TouchShift, LPEClient, and Cubridge. In this attack, Lazarus is first observed to employ the SNOW algorithm for encryption and orchestrate C2 traffic for LPEClient through ClientHub, using ML-KEM (CRYSTALS-Kyber), a recently standardized post-quantum algorithm for key encapsulation.
The attack details were shared today during Security Analyst Summit 2026.
Watch our video where Sojun Ryu recaps key details about their new findings, or read the full details at securelist.com/lazarus-operatโฆ
#APT #Lazarus #TheSAS2026
2
8
27
3,522
Kaspersky retweeted
After the obligatory cinematic opening, the stage is taken by Geraldine Fasnacht (@GGFasnacht) and Eugene Kaspersky (@e_kaspersky).
Geraldine is a freeride and BASE-jumping pioneer, and Eugene is a relentless explorer of wild and distant places, so they have a lot to discuss r extreme trips, operate in uncertainty, and control chaos.
#TheSAS2026
Geraldine is a freeride and BASE-jumping pioneer, and Eugene is a relentless explorer of wild and distant places, so they have a lot to discuss r extreme trips, operate in uncertainty, and control chaos.
#TheSAS2026
0
1
2
817
Kaspersky retweeted
Welcome & Greetings, SAS-style!
@e_kaspersky takes the stage to welcome everyone to #TheSAS2026.
The formalities won't last long. We've got some security assumptions to break. ๐
@e_kaspersky takes the stage to welcome everyone to #TheSAS2026.
The formalities won't last long. We've got some security assumptions to break. ๐
0
10
8
1,573
A warehouse cyberattack can quickly become a physical problem: stalled conveyors, stranded robots, and rerouted shipments.
Ahead of #TheSAS2026, Haidar Kabibo explains how scanners and Bluetooth printers can open the door to WMS attacks.
securelist.com/paper-unicorn-โฆ
Ahead of #TheSAS2026, Haidar Kabibo explains how scanners and Bluetooth printers can open the door to WMS attacks.
securelist.com/paper-unicorn-โฆ
1
1
9
1,642
๐ง In a year where everything seems to be about more connectivity, #TheSAS2026 went the other way for one #CTF challenge: full airgap.
In this brief walkthrough, Leonid Bezvershenko (@bzvr_) explains the reasoning behind the choice, and why making a challenge harder, more s searchable was exactly the point.
Worth a watch!
In this brief walkthrough, Leonid Bezvershenko (@bzvr_) explains the reasoning behind the choice, and why making a challenge harder, more s searchable was exactly the point.
Worth a watch!
1
1
8
3,855
Where is your organization most exposed? Kaspersky's new risk assessment gives you a personalized heatmap in minutes, plus recommendations on what to address first. Get your free report: kas.pr/48dw
5
0
8
1,942
As of October 14, Kaspersky restored the functionality of most products as well as access to My Kaspersky. Meanwhile, the key protection features of all products worked as usual, with user data remaining safe and secure. The most complete information on the current status can be found on the support page > support.kaspersky.com/faq/service-stโฆ
29
23
107
17,965
Several consumer product features and access to My Kaspersky may be temporarily unavailable due to technical reasons. Weโre working to restore full functionality. Core protection is unaffected, and all user data remains fully secure. We apologize for any inconvenience caused.
102
27
186
27,247
Weโve published an FAQ with details on affected services, what continues to work as normal, and what to do while we restore full functionality.
For the latest information and guidance, please visit: support.kaspersky.com/faq/service-stโฆ
For the latest information and guidance, please visit: support.kaspersky.com/faq/service-stโฆ
14
2
21
8,954
A DDoS attack can cost less than your streaming subscription. Sometimes it's just as cheap as a cup of coffee.
Kaspersky DFI analyzed 256,000+ dark web posts and 148 active DDoS actors to map how cheap disruption has become. Full report: kas.pr/33ij
Kaspersky DFI analyzed 256,000+ dark web posts and 148 active DDoS actors to map how cheap disruption has become. Full report: kas.pr/33ij
31
2
9
11,941
A fake crypto wallet promoted on X. A payload hidden in an iCloud calendar event. A backdoor posing as Finder.
Inside the new MacSync stealer targeting developers and crypto users on macOS:
kas.pr/746b
Inside the new MacSync stealer targeting developers and crypto users on macOS:
kas.pr/746b
2
1
5
7,966
AV-TEST certifies Kaspersky EDR Expert: Approved Advanced EDR (Windows).
Three real-world attack emulations, tracked across the attack chain. In default protective mode, all three attacks were blocked at their initial steps.
Report: av-test.org/en/news/edr-teโฆ
Three real-world attack emulations, tracked across the attack chain. In default protective mode, all three attacks were blocked at their initial steps.
Report: av-test.org/en/news/edr-teโฆ
1
0
10
3,169