Friday, 21 August 2026

Thirteen CVEs in ATutor, none of which will ever be fixed — including an unauthenticated auto-login token forgery that authenticates as any account, administrators included

ATutor is an open-source learning content management system, and the reason this disclosure matters is stated in CERT Polska's own advisory rather than implied: "Product is no longer actively supported and the vulnerabilities have not been fixed. Only version 2.2.4 was tested and confirmed as vulnerable, other versions were not tested but might also be vulnerable" (CERT Polska, 2026-08-20). Thirteen identifiers, CVE-2026-64960 through CVE-2026-64972, and no fixed release for any of them.

The pre-authentication flaw is the one that decides the response. CVE-2026-64961 is an authorization bypass through a user-controlled key, and the mechanism is a check that exists but validates nothing: "Although a token validation check is present in the auto-login functionality, the values required for token validation remain uninitialized in certain code paths. An unauthenticated attacker who can determine a user's identifier and registration timestamp can generate a valid token and authenticate as an existing user, including administrator, without knowing the password." Both inputs are guessable or discoverable rather than secret — a sequential user identifier and a registration time — which is what turns this from a theoretical token weakness into a path to the administrator account from the open internet. A sibling flaw compounds it: CVE-2026-64964 makes account-confirmation email tokens predictable through insufficiently random values.

Two paths to code execution, both after a login. CVE-2026-64966 is a path traversal in ZIP extraction: "An attacker with instructor privileges can upload and extract a specially crafted ZIP archive, causing files to be written outside the intended extraction directory. This allows an attacker to place a server-executable .phtml file in the web root and achieve remote code execution with web server privileges on the underlying server." CVE-2026-64960 gets there more directly — the Gameme module accepts uploads of any type or extension without restriction and stores them somewhere web-accessible before validating the content, so an authenticated user who knows a valid course identifier uploads a script and then requests it over HTTP. Chained behind CVE-2026-64961, neither of these needs a real account at all.

The rest of the set, by class. Server-side request forgery in the import functionality (CVE-2026-64968) lets an authenticated administrator make the server reach arbitrary internal HTTP endpoints and cloud-metadata addresses. Two further path traversals allow cross-course file access where a specific configuration option is enabled (CVE-2026-64963) and arbitrary file reads through the error-log viewer with administrative privileges (CVE-2026-64967). There is a missing authorization check on the test and question import endpoints (CVE-2026-64965), an insecure direct object reference letting any authenticated user — a student included — supply another user's member identifier in a POST request to the profile album endpoint and permanently delete that user's profile picture, including those of instructors and administrators (CVE-2026-64969), which is an integrity effect rather than a disclosure one, cross-site request forgery on profile update (CVE-2026-64962), and three cross-site scripting flaws: stored XSS through registration that fires when an authenticated user views the attacker's public profile (CVE-2026-64970), and reflected XSS in the restore functionality (CVE-2026-64971) and via the popup parameter in preview.php, where injecting a double quote breaks out of the attribute value to append an event handler (CVE-2026-64972).

Why an abandoned niche product still clears the bar for this constituency. Education and research sit inside the profiled remit, and a learning management system holds student and staff identity data while typically running as a long-lived, lightly-owned web application. The usual triage question — can we wait for the vendor's next release? — has no answer here, because the timeline is not set by exploitation signal or by a patch cadence but by the permanent absence of a maintainer. CERT Polska reports no exploitation and publishes no CVSS score for any of the thirteen, and this entry invents neither; what makes the item actionable regardless is that the exposure cannot decay.

Detection. With no patch to apply, the realistic controls are exposure and behaviour. For the pre-auth token forgery the signal is an authenticated session appearing for an account with no preceding credential submission — a successful auto-login request followed immediately by privileged actions, with no corresponding login-form POST or password-reset flow in the application's own access log. For the two upload paths, watch for a request writing a file with a server-executable extension into a web-served directory, followed within seconds by a GET for that same path: the request pair is the signal, and it is visible in web-server access logs without any application instrumentation. The server-side request forgery shows up as outbound HTTP from the web-application host to link-local metadata addresses or internal-only ranges, which a well-behaved learning platform never originates.

UPDATE — the actor behind France's tax-authority theft is linked by media reporting to the Education Ministry intrusion the ministry disclosed on 31 July, and social-security numbers were in scope for a subset of staff

UPDATE · originally covered France's tax authority cut the intruders' accounts in June and July and found no data theft — it took the criminal's sale listing two months later to establish that 678,000 records had already gone (2026-08-15)

the earlier entry recorded that France's Direction générale des Finances publiques confirmed intrusions in June and July 2026 using stolen credentials of a DGFiP agent and of an authorised third party, and that only the attacker's sale listing — two months later — established that data on 678,000 individuals and businesses had gone. The delta is that the same actor's footprint now reaches a second French government system, and that the ministry involved has put its own words to what was taken.

The Education Ministry link. ZeroBytes claimed on 18 August to have absorbed 346 million raw lines from the Ministry of National Education some weeks earlier, asserting it had been detected but not cut off. Contacted directly by franceinfo, the minister's office confirmed the claim corresponds to the fraudulent intrusion into one of its information systems that the ministry had already announced on 31 July (franceinfo, 2026-08-18). The linkage of the two thefts to one actor comes from French media reporting rather than from any authority, and this entry carries it at that weight.

What the ministry itself said about the data is the materially new fact. The information at risk concerns ministry staff who worked in an académie since 2001 — identity elements and professional information, status and functions — and for a portion of them the ministry adds contact details, postal address, telephone number and the French social-security number. It also draws a boundary: that information system contains no banking data, no passwords and no student data. On the actor's separate assertion to hold student records, the ministry's position is that its technical examination continues — pending, not a denial. The social-security-number exposure is the detail this pipeline's DGFiP-only coverage did not carry, and it changes the downstream risk for the affected staff from contactability to identity fraud.

The third breach, and why it is not part of this story. In the same period France's consumer-protection directorate disclosed a separate incident: "Un accès frauduleux à un compte professionnel a permis à un cybercriminel de récupérer des fichiers contenant 3 millions de numéros de téléphone, dont 600 000 inscrits sur Bloctel" — a fraudulent access to a professional account let a cybercriminal retrieve files containing 3 million phone numbers, 600,000 of them registered on the Bloctel telemarketing opt-out list (DGCCRF, 2026-08-12). DGCCRF states no personal data such as name or address was disclosed, that the compromised account was blocked as soon as the incident was noticed and all professional accounts subsequently reviewed, and that the Bloctel database itself was not compromised.

It is worth being explicit about what is not established, because the opposite was circulating: no source names an actor for Bloctel, and none ties it to ZeroBytes. The "same hacker" claim in international coverage traces, through its own hyperlink, to a French broadcast report that discusses only the tax authority and the Education Ministry (OCCRP, 2026-08-20). Nor does any source describe one investigation spanning all three; the national anti-cybercrime unit is placed on the DGFiP breach.

Triage: across the intrusions where a mechanism is stated at all, the access is a legitimate account used by someone who should not have it — an agent's and an authorised third party's credentials at DGFiP, a professional account at DGCCRF. There is no malware, no exploited vulnerability and no CVE anywhere in this cluster, so nothing here produces a detection signal on an endpoint. The discriminator is behavioural on the identity plane: a valid account performing bulk record retrieval at a volume and rate no human workflow generates, from a session that is otherwise unremarkable. The DGFiP case established the harder half of the problem — its own post-intrusion access reviews, run when the accounts were cut, did not reveal that data had already been taken. The Education Ministry case adds the same shape from the other side: the actor's claim to have been detected without being evicted is unaddressed by the ministry's published statements.

Builds on: 2026-08-16/weekly-w33-compromised-party-was-not-the-notifying-party

UPDATE — the Siemens S7 joint advisory read from its own primary: five named detection classes, a gold-copy firmware comparison, and an explicit instruction to pass the mitigations to systems integrators

UPDATE · originally covered Five US agencies warn of an active threat to Siemens S7 PLCs — AI-written Python tooling built on the standard S7 libraries, dressed as legitimate OT monitoring software (2026-08-20)

the earlier entry recorded the five agencies' warning, the targeted controller families, the AI-developed Python tooling built on the standard S7 libraries, and the assessment that the activity is focused on persistent reconnaissance potentially preparing for disruption. It was composed single-source from an outlet's reading of the advisory, because the advisory publishes as a PDF only and the agency's own page refuses every transport available here — and nothing in this environment could turn PDF bytes into text. That capability was added this run, so the primary has now been read. What follows is only what the earlier entry could not carry.

The advisory's scope note comes first, because it changes who should act. Its opening note states this advisory relates to an active threat to Siemens S7 Series programmable logic controllers, and then widens the frame: ongoing PLC targeting activity is broader than Siemens PLCs, all PLC owners and operators should apply relevant mitigations to reduce risk to their devices and systems, and the Siemens-specific content should be understood and applied as one subset of the wider threat landscape. An operator running a different vendor's controllers is inside the advisory's intended audience, not outside it.

Five named detection classes. The agencies direct defenders to hunt for anomalies across five specific axes, and each is a behaviour rather than an indicator:

• Anomalous S7comm behaviour — connections from non-engineering workstations, unusual data block access patterns, and write operations outside change windows. The first of those three is the most valuable and the cheapest to implement, because the set of hosts that legitimately speak S7comm to a controller is small, known, and rarely changes.
• Reconnaissance indicators — sequential IP scanning on port 102, repeated connection attempts with varying parameters, and enumeration of CPU properties.
• Tool artefacts — use of the Snap7 library outside approved engineering workstations, Python scripts with S7comm functionality, and unauthorised monitoring-software installations. This is the detection counterpart to the tooling the earlier entry described: the same libraries that make the attacker's scripts work are the ones whose presence on an unexpected host is the signal.
• Temporal anomalies — S7comm activity out of hours, connection patterns consistent with automated scripting rather than human operators, and configuration changes with no corresponding work order or change ticket.
• Geographic anomalies — connections from countries or address ranges not associated with vendors or integrators.

The hardening sequence, in the order the agencies put it. First, an immediate inventory of all Siemens S7 Series PLCs: verify current firmware on every S7-200, S7-300, S7-400, S7-1200 and S7-1500 controller against a backup gold copy, identify any system directly or indirectly accessible from untrusted networks, and map all engineering workstations with TIA Portal, STEP 7 or S7 programming access. Second, patch as soon as possible, prioritising internet-facing or DMZ-resident controllers, bringing TIA Portal and STEP 7 to current versions, consulting Siemens ProductCERT advisories for known vulnerabilities and their workarounds, and testing every update in a development environment before production. Beyond that the advisory calls for ensuring PLCs are not reachable from the internet, strengthening access controls, monitoring for unauthorised activity, and hardening PLC services — including setting write protection and read/write protection levels on the devices themselves.

The instruction that is easiest to overlook is aimed at the supply chain: entities that rely on systems integrators or third-party managed service providers should share the advisory with those parties and request implementation of the mitigations. For a public-sector operator whose OT estate is maintained under contract, that is the action item, because none of the hardening above happens without the integrator doing it.

Triage: the discriminator running through all five detection classes is which host is speaking, when, and with what tooling — not the S7comm protocol itself, which is exactly what an engineering workstation is supposed to use. A programming session from an approved workstation inside a change window, matching a work order, is normal; the same protocol from a host with no engineering role, or outside a change window, or without a corresponding ticket, is the signal. The gold-copy firmware comparison is the one check that speaks to whether something has already happened rather than whether it is happening now.

Builds on: 2026-08-09/cert-polska-private-apn-pivot-into-ot-chp-plant-shutdown · 2026-08-13/cve-2026-58115-simatic-iot2050-node-red-unauth-root

UPDATE — Toneshell's tenth version abandons custom sockets for WebSocket-over-TLS through WinHTTP, retiring every network signature built on the old channel, and a new hVNC backdoor carries no embedded C2 at all

UPDATE · originally covered Mustang Panda's CoolClient backdoor gains a kernel driver signed with a 2013 certificate that expired in 2014 — and it hides the malware's own C2 traffic by hooking the driver Windows uses to report network state (2026-08-15)

this pipeline covered a CoolClient variant attributed to this actor six days ago, installing a signed kernel driver that filtered its own C2 addresses out of the network data Windows returns to user mode. This is separate research on the same actor from a different lab, and the reason it is worth an update rather than nothing is that one of its two findings retires existing detection content.

Toneshell v10 changes the channel, not just the payload. "Earlier variants relied on custom socket-based communications, while version 10 transitions to secure WebSocket communications using WinHTTP over TLS" (IBM X-Force, 2026-08-20). The implant now speaks through the operating system's own WinHTTP WebSocket routines and additionally queries the user's proxy configuration, so it is proxy-aware. The consequence for a network defender is direct: a signature or filter written against Toneshell's earlier bespoke socket protocol no longer matches anything, and what replaces it is traffic sharing port, protocol and TLS client-stack characteristics with every other WinHTTP-based Windows application and ordinary browser WebSocket session. Detection has to move to the client-stack TLS fingerprint, destination reputation, or endpoint-side visibility of the WebSocket API calls themselves — protocol shape alone no longer discriminates.

X-Force also found three standalone DLL builds of Toneshell v10 reusing the same WebSocket model, command dispatcher and reverse-shell functionality, two of them masquerading under the filename of a PDF-creation component and one as a browser-framework library. Between the dispatcher's command branches sit repeated blocks of wide-character junk strings referencing Harry Potter characters and themes — padding inserted to frustrate analysis.

Havencode: hidden desktop access with nothing to extract from the binary. X-Force had not previously observed this backdoor. Its centre of gravity is hidden Virtual Network Computing, letting an operator connect to an infected machine's desktop and browse it covertly. It ships as a 64-bit DLL alongside a legitimate signed executable and is launched by side-loading, and it takes three modes: a hidden-desktop VNC server on a supplied local port, a view-only mode that attaches to the user's existing desktop to watch without taking input control, and a generic TCP/UDP tunnel the operators used to relay the local VNC server's traffic out to their C2 — though X-Force notes the tunnel may serve any other proxy traffic too.

The detail that matters for hunting is what the file does not hold: "It does not contain any embedded C2 addresses. Instead, the C2 server is provided as command line argument at the time of execution". Static extraction of infrastructure from a recovered sample yields nothing; the address exists only in the process command line at launch, which makes process-creation telemetry with full command-line capture the difference between knowing where it called home and not.

The loader in front of it, which X-Force names Claimloader, copies the side-loading pair into a new installation directory — commonly under the system-wide program-data path — establishes persistence, then recovers embedded shellcode and executes the Toneshell payload by abusing a locale-enumeration API as a callback to transfer execution.

What the deception environment showed that logs would not. X-Force ran two fake victims — an operational technology company specialising in electric grids, and a state-level government agency — and captured the operators live. The evidence of hands-on-keyboard work is mundane and convincing: two commands were mistyped in both incidents, a domain-enumeration command and a wireless-network listing, and on its first attempt the crew launched Havencode with malformed arguments. X-Force's conclusion is that "This evidence is a strong indicator that most of the operator activity was not scripted but performed by hand", corroborated independently by timing — operator-initiated actions fell exclusively within weekday working hours of 08:00 to 18:00 China Standard Time, with activity pausing over a weekend and resuming afterwards. Initial access in the campaign came from a May 2026 email to Indian government recipients carrying a PDF attachment themed as a hydropower cooperation study and imitating Nepal's foreign ministry.

Triage: the side-load pair is the most reliable host-side discriminator, because the legitimate executable is genuinely signed and will pass any signature check — what is anomalous is that binary running from a program-data subdirectory rather than its installed location, with a same-named dependency DLL beside it. For Havencode specifically, look for a process whose command line carries a network address and a local port together with VNC-style mode arguments: the configuration is in the command line by design, so command-line logging is not optional here. On the network side, the honest position is that Toneshell v10's channel is hard to separate from benign WinHTTP WebSocket traffic; the tractable signals are a hidden-desktop VNC session being tunnelled out of a host that has no remote-support tooling deployed, and a rapid sequence of host and network reconnaissance commands — system information, current user, group enumeration, network connections and process listing in quick succession — which X-Force names as the pattern to alert on.

Builds on: 2026-08-17/patchcord-sheetcord-google-sheets-c2-browser-shortcut-hijack

UPDATE — ShieldBreak reproduced on a fully patched Windows Server 2025 with August's updates installed: Defender's own clean engine writes the attacker's DLL into System32, and Microsoft's only change on the day was adding a CWE tag

UPDATE · originally covered UPDATE — Microsoft has acknowledged ShieldBreak and assigned CVE-2026-69414, rating the Defender privilege-escalation bypass 'Exploitation More Likely' with no update yet available (2026-08-18)

this pipeline recorded CVE-2026-69414 three days ago as acknowledged by Microsoft, rated 7.8, publicly disclosed, assessed "Exploitation More Likely", with a security update still being worked on. Two things have changed and neither is a fix.

It works on the current patch level, and that is now independently established. "The LevelBlue OpsCTI and THOR teams reviewed and reproduced the complete ShieldBreak exploitation chain with the August 2026 Patch Tuesday updates installed, confirming the PoC functions as described" (LevelBlue SpiderLabs, 2026-08-19). LevelBlue reports the chain running to SYSTEM from a standard user account on Windows 11 24H2 and Windows Server 2025 with Defender in its default configuration, self-contained and needing no arguments, completing in roughly eight to twelve seconds on an idle system. Queried directly, Microsoft's own record for the CVE shows its most recent revision dated the same day as that report, and the change it describes is the addition of a CWE classification, informational only (MSRC, 2026-08-19) — exploitation still recorded as no, the exploitability assessment unchanged, and the temporal metrics still recording proof-of-concept code available with no official fix.

The mechanism, which is the substance of the delta. The prior entry had the identifier and Microsoft's rating but not how the chain works. LevelBlue reconstructs it in seven stages, and the elegant part is that the attacker never writes to System32 — Defender does.

The exploit first raises its own process and thread priority to improve its odds in a later race, then registers a fake Cloud Files sync provider rooted at a working directory it creates, and creates a placeholder file so Windows treats it as a cloud-resident object not yet downloaded. Its hydration callback is two-faced by design: the first read returns a benign archive, which is what Defender detects; a later read returns the malicious DLL, which is what ends up on disk. Next it resolves native object-manager routines out of ntdll.dll and builds a shadow namespace containing two conflicting symbolic links under the same name — one pointing at the working directory, one at a transaction-log path — giving it a redirection layer that sits above the filesystem. It then loads Defender's own management library directly and resolves that library's scan and clean functions to open Defender's RPC interface, scan the placeholder through the shadow path, and — once Defender has flagged the bait archive — start Defender's own remediation operation against it. A time-of-check-to-time-of-use race, held open with an exclusive lock on a transaction-log file while the symbolic link is swapped underneath, redirects that remediation so Defender's clean engine writes the attacker's DLL into System32. Execution as SYSTEM then comes from a Windows Error Reporting scheduled task loading that DLL through the error-reporting host process.

LevelBlue also places the disclosing persona in a lineage of prior proof-of-concept releases and notes a functional improvement over the immediately preceding one: where the earlier LegacyHive technique needed a helper-account logon to trigger its final stage, ShieldBreak is fully self-contained.

Triage: LevelBlue's own framing is the right instruction — "ShieldBreak is best detected through behavioral correlation rather than any single static indicator", because every component is a legitimate Windows capability. The highest-value single signal is a module load: Defender's management library being loaded by a process outside the small, stable set of Defender's own binaries, especially when that same process then resolves Defender's scan and clean entry points at runtime. Around it, two more composites: an unapproved process registering a cloud sync root and creating a placeholder, then immediately moving into object-manager and Defender API activity; and a standard-user process taking an exclusive lock on a transaction-log file. Each is weak alone — legitimate sync agents register sync roots, and Defender's own processes load its library all day — so the sequence and the identity of the calling process are what separate them. The final stage is the most conventional: a DLL appearing in System32 followed by the error-reporting scheduled task being run on demand, with the payload cleaned up afterwards.

Builds on: 2026-08-12/shieldbreak-defender-rogueplanet-patch-bypass-no-fix