CyberXero Deploys 51 AI Agents to Scan 4708 Targets and Implant 32 WebShells in 61 Seconds

Russian-speaking initial access broker CyberXero integrated Anthropic's Claude Code and the open-source PentAGI autonomous penetration agent into its attack pipeline, creating a cluster of 51 specialized AI agents. The group ran two parallel operations: one automated campaign targeting vulnerable WordPress and e-commerce sites worldwide using known exploits including CVE-2026-63030, CVE-2026-60137 and CVE-2026-4815, and a second, more targeted campaign against Ukrainian energy and critical infrastructure. In one recorded execution the AI cluster scanned 4708 public-facing hosts, compromised 429 WordPress administrative panels and dropped 32 WebShells within a 61-second window. Attackers bypassed model safety guardrails by resetting sessions and reframing requests as authorized penetration tests of their own infrastructure. The operation relied on an eight-node architecture that included a Linux workstation, configuration server, payload staging server and public Redis instances, two of which belonged to Chinese organizations. SOCRadar warns that session-level controls alone are insufficient and recommends enforcing system-level boundaries, minimal privileges and strict egress filtering for any AI agents.

安全客October 19, 2026Translated from Chinese

Read at source

Russian-speaking initial access broker CyberXero has integrated Anthropic Claude Code and the open-source autonomous penetration agent PentAGI into its operational workflow, fielding a cluster of 51 specialized AI agents that executed a full attack chain with minimal human input.

Parallel Campaigns: Mass Scanning and Targeted Ukrainian Infrastructure

The group ran two simultaneous lines of operation. The first was a high-volume automated campaign that exploited known vulnerabilities in WordPress and e-commerce platforms, specifically wp2shell flaws CVE-2026-63030 and CVE-2026-60137 plus the Support Board SQL injection vulnerability CVE-2026-4815. The second line focused on Ukrainian energy and critical infrastructure, including a heating company in Kharkiv, and involved deeper reconnaissance that lacked an obvious immediate monetization path.

61-Second Execution: 4708 Targets, 429 Admin Panels, 32 WebShells

One automated run scanned 4708 public hosts, confirmed administrative access to 429 WordPress instances and deployed 32 WebShells inside a 61-second window. The 51-agent cluster handled scanning, vulnerability chaining, reconnaissance and post-exploitation tasks in parallel. PentAGI was connected to Cobalt Strike to generate payloads and execute commands via the vendor API, reducing the need for manual intervention.

Bypassing Model Safety Controls

Attackers circumvented Claude’s safety mechanisms by resetting sessions and prefixing each new conversation with language that framed the activity as authorized penetration testing of their own infrastructure. Logs showed the model refusing four consecutive requests to install backdoors, disable firewalls, perform lateral movement and drop WebShells, yet the attackers simply restarted the session and continued.

Defensive Recommendations

Inspect WordPress sites for unauthorized administrator accounts and WSO-style WebShells.
Verify integrity of Magento and PrestaShop back-end accounts and plugins.
Check Redis servers for unauthorized SSH keys in ~/.ssh/authorized_keys and restrict public exposure.
Enforce minimum privileges and block unnecessary outbound traffic for any AI agents or automation pipelines.
Move AI governance from session-level controls to system-level boundaries defined by network segmentation and credential restrictions.

The incident also affected two Chinese organizations whose publicly exposed Redis servers were abused by the attackers.

CVE-2026-63030 PentAGI Cobalt Strike CyberXero CVE-2026-4815 Palo Alto GlobalProtect

ShareX Facebook LinkedIn Reddit

Meridian digestThe week's most consequential security stories, distilled into one briefing.See the digest

More in AI Security

AI Security

Logical Argument Claims Full Alignment of Superintelligent AGI Is Fundamentally Impossible

A detailed analysis argues that the AI alignment problem cannot be solved for systems exceeding human cognitive capabilities. The paper presents a formal proof showing that any control mechanism created by humans will inevitably be circumvented by a more intelligent agent. It draws on foundational theorems from logic and cybernetics to support the conclusion that alignment is not an engineering challenge but a logical impossibility. Recent 2025-2026 research papers reach similar conclusions using computability theory and diagonal arguments. The work concludes that the only way to guarantee alignment is to avoid creating superintelligence altogether. All proposed restrictions are described as temporary delays rather than permanent solutions.

HabrOct 29, 2026Translated from Russian

AI Security

Claude Account Bans Linked to IP Reputation, Device Environment and Payment Channels, But No Confirmed Formula

Discussions on the Chinese forum NodeSeek have highlighted observations from a user who reported bans on more than twenty paid Claude accounts. The user identified IP address reputation, device environment traces, and payment processor history as the main factors potentially triggering blocks by Anthropic. However, the original post does not present a unified scoring system or prove specific penalties for using Linux, browser-only access, or the Fable model. High query volume is described mainly as a rate-limit issue rather than an automatic account ban trigger. Community members remain divided, with some confirming isolated observations while others label the conclusions speculative and share contradictory experiences. No universal method to avoid blocks has emerged from the discussion.

AntiMalwareOct 29, 2026Translated from Russian

AI Security

Local LLMs in AppSec: What Open Tools and Models Can Handle in Application Security

The article examines how local large language models can be integrated into application security workflows without relying on cloud subscriptions. It traces the evolution from llama.cpp in 2023 through agentic frameworks like PentAGI and Strix in 2025-2026. Teams can now run models on local hardware, connect them to code analyzers such as Semgrep, and delegate specific tasks like vulnerability path reconstruction or multi-step application testing. The piece highlights practical scenarios including static code review, dynamic testing with browser and terminal agents, and security evaluation of embedded AI assistants using tools like Garak and PyRIT. It stresses the importance of task decomposition, context management, and verification of model outputs to avoid misleading results. Hardware performance, model selection, and custom agent configurations are presented as key factors for successful adoption.

HabrOct 29, 2026Translated from Russian