DFIRLab
All Briefings
dailyOctober 7, 2026 — October 8, 2026Published 06:03 UTC

Daily Threat Briefing — 2026-10-08

58 findings35 articles6 sections

Updated 20:23 UTCSubscribe
Critical findings
0
High findings
0
New since 06:03 UTC
0
CISA KEV additions
0
First seen in this period
35 Articles307 CVEs2,705 IOCs

First seen in this period: news articles, each counted once · CVEs rated CVSS 7.0+ (NVD, GitHub, WordPress) · new abuse.ch indicators (ThreatFox, URLhaus, Feodo Tracker), dated by abuse.ch.

Priority queue

Act on these first

Critical and high findings from this briefing and its live updates. Most severe first, then newest.

Showing 10 of 61
Browse all 58 findings

Executive summary · as of 06:03 UTC

The situation

Edge and perimeter exploitation dominates this window. The FBI and Secret Service warn that the FortiBleed credential-stealing campaign against Fortinet FortiGate firewalls and SSL VPN gateways is ongoing and global, and that attackers are locking legitimate administrators out. A critical, unauthenticated Atlassian flaw (CVE-2026-21589) affecting Jira, Confluence and Bitbucket is being exploited after a public PoC release. SonicWall issued hotfixes for a maximum-severity (CVSS 10.0) pre-auth SSRF in SMA1000 appliances (CVE-2026-102255). Cisco published a large batch of critical NX-OS, APIC and License On-Prem fixes, including several unauthenticated root RCEs in NX-OS OAM features and NX-API. No new CISA KEV additions were recorded in the window. NVD published 249 entries, 40 of them reviewed here, and the rest of the critical tail is heavy on AI and LLM infrastructure: LMCache, Langflow, Flowise, DB-GPT and PraisonAI.

Live updates

16 updates since 06:03 UTC

  1. International coalition seizes Integrity Tech tools and infrastructure behind China's Flax Typhoon campaign

  2. CISA adds five legacy flaws to KEV, including Apache Struts RCE (CVE-2016-3081) and ONLYOFFICE Docs path traversal RCE (CVE-2021-3199)

  3. Critical CVSS 10 PraisonAI CodeAgent flaw runs LLM-generated code unsandboxed and leaks environment secrets

Updates are added during the day when material new intelligence arrives. They are not part of the executive summary; the next daily briefing recaps them.

Browse the full briefing

58 findings · 6 sections
Findings by severity
  • 13 critical
  • 24 high
  • 13 medium
  • 4 low
  • 4 info
Vulnerabilities12 critical · 5 high

Vulnerabilities & Active Exploitation

Active exploitation is confirmed for Atlassian CVE-2026-21589 and the FortiBleed campaign against Fortinet edge devices. Critical unauthenticated flaws were disclosed in SonicWall SMA1000, Cisco NX-OS, APIC and License On-Prem, and Splunk. AI/LLM infrastructure and developer tooling account for a large share of critical OSV advisories. The window held 249 NVD entries (40 reviewed), 150 OSV advisories (30 reviewed) and 32 WordPress vulnerabilities (30 reviewed). Further high-severity issues not itemized include: - Backstage Scaffolder flaws. - Next.js SSRF in Image Optimization (CVE-2026-94483). - Linux kernel RDMA rxe/siw out-of-bounds issues (CVE-2026-98365, CVE-2026-98323).

Threat Actors3 high · 1 medium · 1 low

Threat Actors & Campaigns

Arrests are tightening around ShinyHunters. Separately, a DNS-registry supply-chain compromise enabled hijacking of Google domains, and leaked chats shed light on Silent Ransom Group's extortion economics. No infrastructure seizure events were recorded in the window.

Malware7 high · 6 medium

Malware & Tradecraft

Exposed AI servers are being monetized by PoeLLM. AI-assisted phishing kits and supply chain attacks continue to mature. abuse.ch logged 1,443 new indicators (ThreatFox 908, URLhaus 535) across 111 families, of which 965 were reviewed. Stealers, IoT botnets and ClearFake/ClickFix web-inject delivery dominate.

  • High severity
    PoeLLM malware hijacks exposed AI servers for cryptomining and scanning (opens the source in a new tab)

    A cryptomining campaign uses PoeLLM malware against exposed AI services. It turns compromised servers into scanners and exploit launchpads for further propagation. Audit internet-exposed inference and orchestration endpoints, given this window's LMCache, Langflow and Flowise flaws.

    Source: RSS
  • High severity
    BlueKit AI-powered phishkit lowers barrier for account hijacking (opens the source in a new tab)

    BlueKit is an AI-powered phishing kit that lets low-skill criminals deploy convincing fake login pages and scam messages for account hijacking in about 10 minutes.

    Source: RSS
  • High severity
    Unit 42: Web3 infrastructure in cloud supply chain attacks (opens the source in a new tab)

    Unit 42 details how threat actors combine Web3 infrastructure with open-source package supply chain attacks to breach enterprise cloud environments.

    Source: RSS
  • High severity
    abuse.ch: Unknown Stealer (157 indicators)

    Unknown Stealer was the top ThreatFox family with 157 new indicators (domains, URLs, ip:port), covering payload delivery and botnet C2. Samples: hxxps://berff3788[.]com/, hxxps://kaliop-weda[.]club/, hxxps://dentre-go[.]com/.

    Source: abuse.ch
  • High severity
    abuse.ch: ClearFake (82 domains)

    ClearFake, a fake browser-update payload-delivery framework, had 82 new domain indicators. Samples: saok[.]store, z4e0sn7r[.]keca[.]store, salgu[.]store.

    Source: abuse.ch
  • High severity
    abuse.ch: IClickFix (57 domains)

    IClickFix had 57 new payload-delivery domains for ClickFix-style lures that trick users into pasting malicious commands. Samples: iron[.]blacklabelfremont[.]com, checkyoubrowse[.]codes, fog[.]blacklabelfremont[.]com.

    Source: abuse.ch
  • High severity
    abuse.ch: Vidar infostealer (53 indicators)

    Vidar had 53 new indicators (URLs, domains, file hashes) covering botnet C2 and payloads. Samples: hxxps://95[.]182[.]97[.]240, hxxps://fo[.]3toto[.]com, hxxps://kb[.]333vip[.]org/. Related stealer activity: Stealc (18) and AMOS macOS stealer (23 hashes).

    Source: abuse.ch
  • Medium severity
    Outlook to block MSIX attachments abused in attacks (opens the source in a new tab)

    Starting in November, Microsoft will add .msix and .msixbundle to the blocked attachment list in Outlook Web and the new Outlook for Windows, citing their abuse in attacks. Consider blocking these at the mail gateway now.

    Source: RSS
  • Medium severity
    Ransomware operators increasingly target backups (opens the source in a new tab)

    Ransomware groups increasingly target backup infrastructure to remove recovery options. Kaseya recommends isolated, immutable and regularly tested backups. This is relevant alongside the Veeam CVE-2025-64393 disclosure.

    Source: RSS
  • Medium severity
    abuse.ch: Mozi IoT botnet (144 indicators)

    Mozi had 144 new malware-download and payload-delivery URLs (URLhaus/ThreatFox). Samples: hxxp://190[.]196[.]253[.]50:10591/Mozi[.]m, hxxp://39[.]34[.]169[.]100:35517/Mozi[.]m, hxxp://223[.]123[.]43[.]69:43133/Mozi[.]7.

    Source: abuse.ch
  • Medium severity
    abuse.ch: Mirai botnet (109 indicators)

    Mirai had 109 new indicators (URLs, ip:port) for malware download and botnet C2, plus 15 further mixed Mirai/Mozi ARM ELF URLs. Samples: hxxp://165[.]98[.]243[.]83:55771/bin[.]sh, hxxp://175[.]43[.]173[.]18:38071/bin[.]sh, hxxp://58[.]47[.]106[.]128:39278/bin[.]sh. Aisuru, another DDoS botnet, added 22 C2 ip:port indicators.

    Source: abuse.ch
  • Medium severity
    abuse.ch: ContagiousDrop (33 indicators)

    ContagiousDrop had 33 new payload-delivery domains and URLs, largely hosted on Vercel. Samples: ext-checkedin[.]vercel[.]app, coreviewer[.]vercel[.]app, valid-dep[.]vercel[.]app.

    Source: abuse.ch
  • Medium severity
    abuse.ch: PureRAT C2 (30 indicators)

    PureRAT had 30 new botnet C2 ip:port indicators. Samples: 91[.]92[.]41[.]66:56003, 217[.]60[.]195[.]46:6767, 202[.]95[.]14[.]80:444. Potassium added a further 29 C2 endpoints.

    Source: abuse.ch
Data Breaches & Leaks1 critical · 8 high · 3 medium

Data Breaches & Leaks

The window recorded 37 breach and leak-site entries, of which 30 were reviewed. Leading items are BYOD's claimed 12M-record Gate exchange leak, including 2FA metadata, and the Arizona courts disclosure covering 1.3M+ individuals. Leak-site activity was broad, from LockBit5, Nightspire, INC Ransom, Qilin, DragonForce, Interlock and others. Victims span legal, finance, healthcare, government, education and energy. No pwnCount or dataClasses were provided for leak-site entries.

Policy3 medium · 2 low · 1 info

Policy, Regulation & Legal

Policy activity in the window spans legal action against an IR vendor, healthcare cyber legislation, AI incident reporting and OT regulation.

Tools & Techniques1 high · 1 low · 3 info

AI Security, Tools & Research

Agentic AI security incidents and defender access programs headline this section, alongside forensic tooling updates.

Sources & Attribution

These briefings are compiled from publicly available threat-intelligence feeds, which may include CISA KEV, NIST NVD, the GitHub Advisory Database (OSV), abuse.ch, and Wordfence Intelligence. Data-breach and credential-leak items may include data from Have I Been Pwned and ransomware.live.

CVE® is a registered trademark of The MITRE Corporation. CVE Records are © The MITRE Corporation, reproduced under the CVE Program Terms of Use. WordPress vulnerability data is provided by Wordfence Intelligence, © Defiant, Inc. Breach data from Have I Been Pwned is licensed under CC BY 4.0.