DFIRLab
All Briefings
dailyOctober 9, 2026 — October 10, 2026Published 06:05 UTC

Daily Threat Briefing — 2026-10-10

47 findings26 articles6 sections

Updated 04:53 UTCSubscribe
Critical findings
0
High findings
0
New since 06:05 UTC
0
CISA KEV additions
0
First seen in this period
26 Articles200 CVEs2,163 IOCs

First seen in this period: news articles, each counted once · CVEs rated CVSS 7.0+ (NVD, GitHub, WordPress) · new abuse.ch indicators (ThreatFox, URLhaus, Feodo Tracker), dated by abuse.ch.

Priority queue

Act on these first

Critical and high findings from this briefing and its live updates. Most severe first, then newest.

Showing 10 of 52
Browse all 47 findings

Executive summary · as of 06:05 UTC

The situation

Edge-device exploitation dominates this window. Attackers began exploiting the maximum-severity SonicWall SMA1000 flaw CVE-2026-102255 three days after Tuesday's patch. Two AhsayCBS backup-platform vulnerabilities that remain unpatched are being used to drop webshells and cryptominers. Citrix is urging immediate patching of a new critical NetScaler ADC/Gateway RCE. Vulnerability volume was high: 185 NVD, 65 OSV and 47 WordPress entries were published, and only a subset was supplied for this briefing. The supplied set includes a CVSS 10 webshell-upload flaw in the Zombify WordPress plugin, remote heap corruption in FalkorDB and a cluster of authentication and RCE flaws in Nginx UI. It also covers hard-coded credentials and deserialization flaws in the grid-monitoring software openPDC/openHistorian. No new CISA KEV additions were recorded.

Live updates

11 updates since 06:05 UTC

  1. INC Ransom claims attack on Winnipeg's Health Sciences Centre, alleging the largest healthcare data breach

  2. Critical Wukong_HRM auth bypass (CVE-2026-108707) lets unauthenticated attackers access all HR API endpoints and employee data

  3. Royal Thai Air Force listed on 'thegentlemen' ransomware leak site; DexCom claimed by Redact group

Updates are added during the day when material new intelligence arrives. They are not part of the executive summary; the next daily briefing recaps them.

Browse the full briefing

47 findings · 6 sections
Findings by severity
  • 10 critical
  • 22 high
  • 10 medium
  • 2 low
  • 3 info
Vulnerabilities9 critical · 10 high · 1 medium · 1 info

Vulnerabilities & Exploitation

Three perimeter platforms require emergency action: SonicWall SMA1000 (actively exploited), AhsayCBS (exploited, unpatched) and Citrix NetScaler (critical RCE). The window held 185 NVD, 65 OSV and 47 WordPress vulnerability entries; the items below cover the supplied subset. They are dominated by WordPress file-upload and SQLi flaws, FalkorDB memory corruption, Nginx UI and Vikunja auth flaws, and OT-relevant openPDC issues. No CISA KEV additions occurred this window.

Threat Actors4 high · 3 medium · 1 low

Threat Actors & Law Enforcement

Law enforcement actions against ShinyHunters and Qilin headline this window, alongside a major ransomware outage at a Japanese cloud provider. A credible leak of Silent Ransom Group internals also surfaced.

Malware3 high · 4 medium

Malware & Commodity Threats

abuse.ch logged 1,864 new indicators across 109 families (ThreatFox 1,318, URLhaus 546); 1,229 were supplied. Fake-CAPTCHA/ClickFix delivery infrastructure dominates, mirrored by a new Claude-themed malvertising campaign. IoT botnets, stealers and RATs round out the volume.

  • High severity
    Malvertising abuses Google Ads and Bing redirects to push fake Claude ClickFix attacks (opens the source in a new tab)

    Attackers are placing Google search ads that use legitimate Bing search-result redirects as click URLs. The ads lead to fake Claude installers that deliver ClickFix lures, tricking users into pasting and running malicious commands. To counter this: - Block unsanctioned AI-tool installers. - Hunt for explorer.exe or Run-dialog spawned PowerShell/mshta. - Educate users who install AI tools.

    Source: RSS
  • High severity
    IClickFix and ClearFake lead abuse.ch volume with 553 delivery domains

    ThreatFox recorded payload-delivery domains for two fake-CAPTCHA/fake-update frameworks: - IClickFix: 289 domains, e.g. pobruog[.]wiki, electronic72[.]pro, namanami[.]top. - ClearFake: 264 domains, e.g. asea4ied[.]ruut[.]store, stnnik2[.]sa-sharepoint[.]com, www[.]bk8casinothai[.]com. These are the two largest families this window. Feed them into DNS/proxy blocklists.

    Source: abuse.ch
  • High severity
    Infostealers: Vidar, AMOS and unidentified stealers

    Infostealer indicators logged this window: - Vidar: 30 C2 URLs, domains and hashes, e.g. hxxps://xt[.]4toto[.]net, hxxps://xt[.]33pedia[.]org. - Generic 'stealler': 30 payload hashes. - Unknown Stealer: 20, e.g. hxxps://madrid-9[.]club/, hxxps://lemanruss[.]website/. - AMOS macOS stealer: 17 payload hashes, e.g. 708329a7a39e5391fe3e938933e5758b685d080146c0b703f1805e179d2bae8d. Stealer infections feed credential-based intrusions like those seen in recent SaaS breaches.

    Source: abuse.ch
  • Medium severity
    IoT botnets: Mirai, Mozi and Aisuru infrastructure

    IoT botnet indicators from ThreatFox and URLhaus: - Mirai: 164 indicators (hashes, ip:port C2, URLs), e.g. sample hash e31d19f453770baf75143b352675a1cc12982cf8821929ff88badfc134f97b36. - Mozi: 84 MIPS/ARM ELF download URLs, e.g. hxxp://219[.]154[.]155[.]199:35205/i. - ELF wget droppers: 42 URLs, e.g. hxxp://103[.]238[.]235[.]250:9999/wj0s[.]arm7. - Aisuru: 12 C2s, e.g. 45[.]135[.]194[.]116:8001.

    Source: abuse.ch
  • Medium severity
    RAT and C2 frameworks: VShell, ValleyRAT, Remcos, Formbook

    ThreatFox logged remote-access and C2 indicators across several families: - VShell: 51 indicators, e.g. 139[.]196[.]95[.]22:8084, 130[.]94[.]93[.]147:8084. - ValleyRAT: 20 indicators, e.g. 47[.]76[.]121[.]209:22011, hxxp://fafdafaf[.]shop/getinstall64. - Remcos: 14 C2/download indicators, e.g. 192[.]3[.]73[.]139:14646. - Formbook: 14. - CrossRAT: 12 payload hashes.

    Source: abuse.ch
  • Medium severity
    Game-cheat lures on GitHub and IRAHook via Dropbox/Discord

    URLhaus logged two lure-based delivery campaigns: - 'CheatSheet': 48 GitHub-hosted malicious executables posing as game cheats, spoofers and script executors, e.g. hxxps://github[.]com/skannyraws/Roblox-Script-Executor/raw/HEAD/Wave[.]exe. - IRAHook: 25 bundle.zip payloads hosted on Dropbox and Discord CDN. Both campaigns target users with lure software and abuse trusted hosting.

    Source: abuse.ch
  • Medium severity
    php.shin_webshell delivery via workers.dev subdomains

    ThreatFox logged 37 php.shin_webshell payload-delivery domains abusing Cloudflare Workers subdomains, e.g. juynu31926[.]workers[.]dev, javeqe[.]workers[.]dev. Unknown Loader added 56 domains, URLs and hashes, e.g. zainyapparels[.]com.

    Source: abuse.ch
Data Breaches & Leaks1 critical · 5 high

Data Breaches & Leaks

73 breach and leak entries were recorded (30 supplied), all ransomware leak-site postings without pwnCount or dataClasses. The most severe are claimed healthcare data dumps (Astrana Health, D.W. McMillan Memorial Hospital) and government and critical-infrastructure victims. Disclosed breaches at ASOS and iRhythm were also reported.

Tools & Techniques1 medium · 1 low · 2 info

Tools, Techniques & AI Security

AI-agent abuse is emerging as a social-engineering and authorization risk. Defensive AI adoption in MDR is maturing, and new mobile forensics tooling is available for DFIR practitioners.

Policy1 medium

Policy & Platform Changes

A Microsoft platform change will cut off unsupported Windows systems from security updates next year.

Sources & Attribution

These briefings are compiled from publicly available threat-intelligence feeds, which may include CISA KEV, NIST NVD, the GitHub Advisory Database (OSV), abuse.ch, and Wordfence Intelligence. Data-breach and credential-leak items may include data from Have I Been Pwned and ransomware.live.

CVE® is a registered trademark of The MITRE Corporation. CVE Records are © The MITRE Corporation, reproduced under the CVE Program Terms of Use. WordPress vulnerability data is provided by Wordfence Intelligence, © Defiant, Inc. Breach data from Have I Been Pwned is licensed under CC BY 4.0.