On-Prem Red Team AI — engineering notes from the front line
Deep dives, comparisons and field reports on autonomous red team AI, generative pentesting, deep-packet traffic intelligence, NIS2/DORA, and how to operate them air-gapped.
- eMudhraJavaTLS
Oracle Java CVE-2026-114820: eMudhra Root CAs Pulled From the JDK Trust Store
Oracle's out-of-band Java update removes the compromised eMudhra root CAs from the JDK cacerts trust store. CVE-2026-114820: who is exposed and how to fix it.
7 min read - PHPCVE-2026-115560PHP2Shell
CVE-2026-115560: The PHP RCE the PHP2Shell Patch Doesn't Fix — Check in 2 Minutes
PHP's October 23 advisory: CVE-2026-115560, an RCE path via session upload progress not fixed in 8.5.12/8.4.27/8.3.36/8.2.35. Who is exposed, the one-line mitigation, and a free check script.
6 min read - Collabora OnlineNextcloudCISA KEV
Collabora Online CVE-2026-110447: Built-in CODE Server RCE exploited in the wild
CVE-2026-110447 is a CVSS 9.2 OS command injection in Nextcloud's built-in Collabora CODE Server, exploited since September. Patch to 26.4.303, then hunt.
7 min read - Autonomous AI AgentsRansomwareAI-Powered Attacks
Phantom: Ransomware Affiliates Ran AI Agents Through the Kill Chain
SOCRadar found Phantom, an autonomous AI red-team framework INC and The Gentlemen affiliates used to run intrusions. What the exposed logs actually show.
7 min read - eMudhraCertificate AuthoritySupply Chain
eMudhra CA Keys: Fixing Python, pip, uv and Your Trust Stores
Eight eMudhra CA keys were weak enough to recompute. What's real, what's hype, and how to update certifi, pip, uv and OS trust stores before a MITM.
9 min read - LiteLLMSupply Chain AttackPyPI
LiteLLM 1.107.0 PyPI Compromise: How to Check, Clean and Rotate
LiteLLM 1.107.0 (PyPI, Docker) shipped a stealer that runs on every Python start. Who is exposed, how to check without re-triggering it, what to rotate.
10 min read - Arista VeloCloudSD-WANCVE-2026-114625
Arista VeloCloud CVE-2026-114625: Read-Only Account to Operator, Exploited Now
CVE-2026-114625 is an actively exploited SQL injection in Arista VeloCloud Orchestrator: a read-only tenant becomes operator. Fixed builds, IOCs, remediation.
7 min read - Black OctoberPHP2ShellSupply Chain Attack
Black October 2026: Verified Incident Tracker — What Is Real, What to Patch Today
Black October 2026, verified: PHP2Shell, GitLab CVE-2026-110264, LiteLLM, Railway, Zeabur, eMudhra. What is confirmed, what to patch and rotate today.
14 min read - GitLabCVE-2026-110264Remote Code Execution
GitLab CVE-2026-110264: CVSS 10 unauthenticated RCE through a rendered .org file
GitLab CVE-2026-110264 lets an unauthenticated attacker run code via a crafted Org-mode file. Fixed in 19.5.1, 19.4.3, 19.3.6; the October 12 patch is not enough.
7 min read