DFIRLab
All Briefings
dailyOctober 10, 2026 — October 11, 2026Published 06:02 UTC

Daily Threat Briefing — 2026-10-11

32 findings6 articles5 sections

Updated 04:53 UTCSubscribe
Critical findings
0
High findings
0
New since 06:02 UTC
0
CISA KEV additions
0
First seen in this period
6 Articles206 CVEs1,123 IOCs

First seen in this period: news articles, each counted once · CVEs rated CVSS 7.0+ (NVD, GitHub, WordPress) · new abuse.ch indicators (ThreatFox, URLhaus, Feodo Tracker), dated by abuse.ch.

Priority queue

Act on these first

Critical and high findings from this briefing and its live updates. Most severe first, then newest.

Showing 10 of 45
Browse all 32 findings

Executive summary · as of 06:02 UTC

The situation

This window brought no new CISA KEV additions, but it carried a heavy WordPress vulnerability load and continued fallout from identity and extortion activity. NVD published 206 entries and our WordPress feeds 98. The most urgent issues are a CVSS 10.0 unauthenticated RCE in the SiteVault backup plugin (CVE-2026-42696), unauthenticated authentication bypass and code injection in Wukong_HRM (CVE-2026-108707) and Floci (CVE-2026-108598), and arbitrary file upload flaws in Creator LMS and CodeBard Help Desk. A large batch of unauthenticated PHP Object Injection flaws, all CVSS 9.8, affects roughly 30 commercial WordPress themes plus Booster for WooCommerce and the Payever gateway. Organisations running WordPress should inventory these themes and plugins and prioritise patching or removal.

Live updates

7 updates since 06:02 UTC

  1. The Gentlemen ransomware lists five major victims at once, including MoneyGram, KFC, Confluent, BigID and Placer AI

    • High severityMoneyGram — The Gentlemen (opens the source in a new tab)
    • High severityConfluent — The Gentlemen (opens the source in a new tab)
    • High severityThe Gentlemen also claims KFC, BigID and Placer AI (opens the source in a new tab)
    • High severityEversource Energy — Redact (opens the source in a new tab)

  2. Critical modem OTA stack overflow (CVE-2026-66086, CVSS 9.8) allows remote code execution via malformed SIB1 messages

    • Critical severityCVE-2026-66086: Modem OTA stack overflow via malformed SIB1 messages (CVSS 9.8) (opens the source in a new tab)

  3. Emperador ransomware claims Spelman Logistics breach exposing SSNs, EINs and 57K bank accounts from MVMNT TMS data

Updates are added during the day when material new intelligence arrives. They are not part of the executive summary; the next daily briefing recaps them.

Browse the full briefing

32 findings · 5 sections
Findings by severity
  • 10 critical
  • 16 high
  • 5 medium
  • 1 info
Vulnerabilities9 critical · 1 high

Vulnerabilities

No KEV additions this window. NVD published 206 entries, 40 of which were reviewed, nearly all critical. The window was dominated by WordPress: one CVSS 10.0 RCE, file upload flaws, privilege escalation, and a mass disclosure of PHP Object Injection flaws in themes. Non-WordPress highlights are Wukong_HRM and Floci.

Threat Actors2 high

Threat Actors & Law Enforcement

Law-enforcement pressure on ShinyHunters continues, and AI-agent-driven intrusions against South Korean banks were publicly attributed.

Data Breaches & Leaks1 critical · 9 high

Data Breaches & Leaks

The weak-password failure behind the Danish CPR breach leads this section, followed by 13 new ransomware leak-site postings. The postings span healthcare, the military, legal, manufacturing and government victims. No pwnCount or dataClasses were supplied for the leak-site entries.

Malware4 high · 4 medium

Malware & Indicators

abuse.ch ingested 1,166 new indicators across 101 families: 700 from ThreatFox and 466 from URLhaus. IoT botnets lead by volume. Stealers, C2 frameworks and ClickFix-style web lures remain the most operationally relevant for enterprise SOCs.

  • High severity
    VShell C2 framework: 69 new indicators

    VShell contributed 69 ThreatFox indicators: payloads, payload delivery URLs and botnet C2 (ip:port, hashes). VShell is a post-exploitation framework favoured by China-nexus operators. Sample C2s: - 108[.]165[.]147[.]226:8084 - 38[.]246[.]73[.]29:8084 - 38[.]190[.]196[.]26:9090

    Source: abuse.ch
  • High severity
    Vidar infostealer: 61 new C2/payload indicators

    Vidar infostealer contributed 61 indicators: botnet C2 and payloads across URLs, domains, ip:port and hashes. Samples: - 94[.]237[.]14[.]115:443 - 77[.]42[.]10[.]33:443 - 212[.]147[.]244[.]162:443 Stolen browser credentials feed downstream account takeover.

    Source: abuse.ch
  • High severity
    ClickFix and ClearFake lure infrastructure: 79 domains

    Two web lure families added payload delivery domains: - IClickFix: 43 domains - ClearFake: 36 domains, using fake-update and paste-and-run social engineering via compromised sites Samples: - 832nw30kq5rb0j4onh9tfw[.]beer - jabrzoza[.]eu - tpp6b30z[.]kulonprogo[.]org Monitor for suspicious Run-dialog and PowerShell execution initiated from browsers.

    Source: abuse.ch
  • High severity
    Cobalt Strike: 40 C2 endpoints

    Cobalt Strike contributed 40 ip:port C2 indicators, many clustered on a single host across multiple ports. Samples: - 156[.]67[.]105[.]187:5601 - 156[.]67[.]105[.]187:5011 - 156[.]67[.]105[.]187:3939

    Source: abuse.ch
  • Medium severity
    Mirai and Mozi IoT botnets dominate abuse.ch volume

    Mirai contributed 113 ThreatFox indicators: hashes, ip:port and URLs covering payloads, botnet C2 and payload delivery. Mozi variants added about 108 URLhaus and ThreatFox download URLs. Multi-architecture ELF droppers fetched with wget (for example akuma_* and iran.* builds) added a further ~107 URLs. Samples: - hxxp://222[.]141[.]97[.]98:39460/i - hxxp://85[.]137[.]53[.]167:24380/bins/android/akuma_arm - hxxp://176[.]65[.]139[.]166:8080/iran[.]armv4l

    Source: abuse.ch
  • Medium severity
    PHP web shell delivered via workers.dev: 47 domains

    php.shin_webshell contributed 47 payload delivery domains, abusing Cloudflare Workers subdomains. Samples: - cimovo[.]workers[.]dev - lonulody[.]workers[.]dev - ridiculousgwynne[.]workers[.]dev

    Source: abuse.ch
  • Medium severity
    AMOS macOS stealer: 24 indicators

    AMOS (Atomic macOS Stealer) contributed 24 indicators: payload hashes, delivery domains and URLs, and C2. Sample hashes: - 7a58f0560aebb4c31ad6ead45c15d336a5e00598923f43e25a1a555e37f1b3a2 - e6040ffde33fdbfd13583614e35b60038e5a461d31a1bf2d22dfc3506333391e - 280e8ba4350911ec2908945abc8012332cd86d6bbb769bbe589f22de3aa639b8

    Source: abuse.ch
  • Medium severity
    RAT C2 activity: AsyncRAT, PureRAT, Jackskid

    Several RAT families added botnet C2 indicators: - Jackskid: 14 C2s - AsyncRAT: 13 C2s - PureRAT: 11 C2s Also added: 11 Coinminer payload indicators. Samples: - 157[.]20[.]182[.]14:4443 (AsyncRAT) - 173[.]214[.]167[.]250:7730 (PureRAT) - 8[.]213[.]238[.]72:443 (Jackskid)

    Source: abuse.ch
Tools & Techniques1 medium · 1 info

Tools, Techniques & AI

AI agents feature prominently both as misuse vectors and as defensive tooling.

Sources & Attribution

These briefings are compiled from publicly available threat-intelligence feeds, which may include CISA KEV, NIST NVD, the GitHub Advisory Database (OSV), abuse.ch, and Wordfence Intelligence. Data-breach and credential-leak items may include data from Have I Been Pwned and ransomware.live.

CVE® is a registered trademark of The MITRE Corporation. CVE Records are © The MITRE Corporation, reproduced under the CVE Program Terms of Use. WordPress vulnerability data is provided by Wordfence Intelligence, © Defiant, Inc. Breach data from Have I Been Pwned is licensed under CC BY 4.0.