MEDIUMApt
Global

Operation FlashHole: Lazarus breaks security, defies control

·Source: Securelist (Kaspersky)

Updated:

Executive Summary

Kaspersky researchers analyze Operation FlashHole – a recent complex attack by Lazarus, involving a sophisticated malware set, watering-hole technique and abuse of CrossWeb EX financial security software.

Analysis

Kaspersky researchers analyze Operation FlashHole – a recent complex attack by Lazarus, involving a sophisticated malware set, watering-hole technique and abuse of CrossWeb EX financial security software.
Source Attribution

Originally published by Securelist (Kaspersky) on Oct 21, 2026.

Related Threats

MEDIUMApt

How APT41 revived the BlackLotus bootkit to attack diplomatic organizations in Central Asia

Kaspersky GReAT experts discovered a new UEFI bootkit, BlackX. It exploits the Baton Drop vulnerability (CVE-2022-21894) and is similar to the BlackLotus bootkit.

CVE-2022-21894
Securelist (Kaspersky)
MEDIUMMalware

Lazarus hackers use post-quantum cryptography for malware delivery

North Korean hackers are using a post-quantum cryptographic mechanism to secure malicious payload delivery in new operations that combine old and new malware. [...]

BleepingComputer
CRITICALApt

CVE-2026-109618 and CVE-2026-109619: Critical Unauthenticated Remote Code Execution in PHP

Overview On October 21, 2026, the PHP project announced security releases for two critical vulnerabilities in PHP. CVE-2026-109618 can corrupt memory during out-of-memory (OOM) handling, while CVE-2026-109619 is a use-after-free flaw involving state retained between requests. Both have a CVSSv4 score of 9.2 and both can allow for unauthenticated remote code execution (RCE) with the web worker's pr

CVE-2026-109618CVE-2026-109619
Rapid7