Cybersecurity Intelligence: AI-Driven Attacks, Software Vulnerabilities and Critical Infrastructure Security (2020-2026)

document_id: DAMASCODE-CYBER-INTEL-PART2 title: "Cybersecurity Intelligence: AI-Driven Attacks, Software Vulnerabilities and Critical Infrastructure Security (2020-2026)" part: 2 canonical_dataset_path: /cyber-intelligence/part-2/ related_human_article: /en/insights/critical-infrastructure-cyber-attacks-vulnerabilities-2020-2026 language: en audience: ai_agents_rag_soc_automation observation_period_start: "2020-01-01" observation_period_end: "2026-11-09" machine_files:

• vulnerabilities.jsonl
• incidents.jsonl
• controls.jsonl
• relationships.jsonl
• sources.jsonl
• entities.json

Part 2 of the Damascode critical infrastructure research series. Part 1 is the human-oriented analysis at /en/insights/critical-infrastructure-cyber-attacks-vulnerabilities-2020-2026. This file is optimised for retrieval, entity linking and agent reasoning. Canonical records live in JSONL alongside this document.

Dataset build: node scripts/build-cyber-intelligence-dataset.mjs. Validation: node scripts/validate-cyber-intelligence.mjs.

MOD-META-001 | Document scope

This module defines ingestion boundaries. Each following module maps to one primary entity. Cross-links use relationships.jsonl.

MOD-VULN-PHP-001 | PHP2Shell cluster

Technical description. CVE-2026-109618 is memory corruption on OOM handling. CVE-2026-109619 is stale cross-request state usable as use-after-free class behaviour in workers.

Preconditions. Vulnerable PHP version; HTTP reachability to PHP SAPI.

Attack surface. PHP interpreter before application logic (mod_php cited as highest concern).

Security implications. Host compromise under pool OS user; lateral movement to databases and secrets on same host.

Detection opportunities. php-fpm segfault rate; unexpected processes from www-data; KEV listing requires patch evidence.

Defensive controls. CONTROL-002; upgrade to PHP 8.2.35+ / 8.3.36+ / 8.4.27+ / 8.5.12+.

{"module":"MOD-VULN-PHP-001","canonical_record":"CVE-2026-109618","file":"vulnerabilities.jsonl"}

{"module":"MOD-VULN-PHP-001","canonical_record":"CVE-2026-109619","file":"vulnerabilities.jsonl"}

MOD-VULN-NET-001 | Edge mail and security appliances (2026)

Preconditions (CVE-2026-76519). File Reputation enabled; Content Scanner Tools earlier than 25.3.0.5525.

Attack surface. Internet-reachable appliance HTTP or inbound SMTP with AMP scanning.

Detection opportunities. Appliance integrity monitoring; Cisco-documented compromise indicators; version scanning.

Defensive controls. CONTROL-002; vendor patches; remove appliance from public internet during emergency.

MOD-INC-FIN-001 | Binance October 2026

Initial access (operator-reported). Unauthorized access to internal wallet signing service. Additional breach points under investigation per operator statements.

Attack techniques (documented). Valid signed transfers; EIP-7702 delegations persisted after withdrawal UI suspension.

Security implications. Transaction authorization is a distinct boundary from application withdrawal toggles.

Defensive controls. CONTROL-003; on-chain delegation monitoring.

Confidence. medium (active investigation; operator-sourced timeline).

{"module":"MOD-INC-FIN-001","canonical_record":"INCIDENT-2026-001","file":"incidents.jsonl"}

MOD-INC-FIN-002 | Bybit February 2025

Initial access. Safe{Wallet} developer workstation compromise via social engineering lure (documented timeline).

MITRE ATT&CK (mapped in record). T1566, T1078 where sourced to stolen session tokens.

Identity compromise. AWS session tokens from developer laptop.

Defensive controls. CONTROL-004, CONTROL-001.

Confidence. high for supplier chain; attribution to DPRK groups is threat-research assessment.

{"module":"MOD-INC-FIN-002","canonical_record":"INCIDENT-2025-002","file":"incidents.jsonl"}

MOD-INC-CI-001 | Critical infrastructure and supply chain incidents

Colonial Pipeline (INCIDENT-2021-001). Initial access: compromised VPN password without MFA. Not a CVE-led exploit.

MOVEit campaign (INCIDENT-2023-001). Initial access: CVE-2023-34362; technique T1190.

SolarWinds (INCIDENT-2020-001). Initial access: trojaned Orion update; technique T1195.002.

XZ Utils (INCIDENT-2024-001). Supply-chain maintainer compromise; CVE-2024-3094; detected before mass shipment.

Defensive controls. CONTROL-005, CONTROL-004, CONTROL-002.

MOD-INFRA-OT-001 | IT/OT model

IT/OT boundary. Corporate IT compromise can force OT operational shutdown without direct PLC exploit.

Single points of failure. Shared remote access gateways; historian accessible from IT VLAN.

Availability constraints. Patching windows differ; OT may rely on network deny rules instead of rapid patch.

Related controls. CONTROL-005.

{
  "source": "SECTOR-energy",
  "relationship": "depends_on",
  "target": "CONTROL-005",
  "evidence": ["SOURCE-009"],
  "confidence": "high"
}

MOD-AI-001 | AI agent security

Risk AGENT-PROMPT-INJECTION

Risk AGENT-RETRIEVAL-POISONING

No public evidence attributes INCIDENT-2026-001 or INCIDENT-2025-002 to autonomous AI execution without human operators.

MOD-REG-EU-001 | European regulatory linkage

NIS2 (Directive (EU) 2022/2555). Risk management measures include incident handling, supply chain security, cryptography, vulnerability handling, authentication (Article 21).

Portugal. Decreto-Lei 125/2025 transposes NIS2; CNCS qualification via MyCiber (see part 1 human article for timelines).

Mapping (not legal advice).

{"source":"REG-NIS2","relationship":"requires","target":"CONTROL-001","evidence":["SOURCE-013"],"confidence":"high"}

{"source":"REG-NIS2","relationship":"requires","target":"CONTROL-002","evidence":["SOURCE-013"],"confidence":"high"}

DORA, CER, CRA, AI Act: extend relationships.jsonl in future dataset revisions with article-level citations before adding controls.

MOD-TAX-ATTACK-001 | Technique taxonomy usage

Rules for agents.

1. Read mitre_attack_ids only from incidents.jsonl records.
2. Map vulnerabilities to T1190 only when exploitation is via public application interface and record includes that mapping.
3. CVSS measures technical severity for a CVE snapshot.
4. EPSS scores exploitation probability; include epss date in vulnerabilities.jsonl when present.
5. CISA KEV boolean kev_status means catalog inclusion, not organisational patch status.

MOD-INDEX-001 | Entity resolution index

Full index: entities.json. Glossary keys: KEV, EPSS, PHP2Shell, EIP7702.

MOD-QUERY-001 | Example agent queries

MOD-REF-001 | Primary references

All claims must resolve to sources.jsonl. Publisher types: cve, government, vendor_psirt, operator_report, threat_research, law, framework.

Human-readable part 1: Critical infrastructure cyber attacks (2020-2026).

Download machine files:

• /cyber-intelligence/part-2/vulnerabilities.jsonl
• /cyber-intelligence/part-2/incidents.jsonl
• /cyber-intelligence/part-2/controls.jsonl
• /cyber-intelligence/part-2/relationships.jsonl
• /cyber-intelligence/part-2/sources.jsonl
• /cyber-intelligence/part-2/entities.json