DFIRLab
All Briefings
dailyOctober 12, 2026 — October 13, 2026Published 06:03 UTC

Daily Threat Briefing — 2026-10-13

50 findings24 articles6 sections

Updated 20:33 UTCSubscribe
Critical findings
0
High findings
0
New since 06:03 UTC
0
CISA KEV additions
0
First seen in this period
24 Articles255 CVEs2,576 IOCs

First seen in this period: news articles, each counted once · CVEs rated CVSS 7.0+ (NVD, GitHub, WordPress) · new abuse.ch indicators (ThreatFox, URLhaus, Feodo Tracker), dated by abuse.ch.

Priority queue

Act on these first

Critical and high findings from this briefing and its live updates. Most severe first, then newest.

Showing 10 of 62
Browse all 50 findings

Executive summary · as of 06:03 UTC

The situation

The most urgent items this window are an actively exploited, maximum-severity SSRF flaw in SonicWall SMA 1000 appliances and a CVSS 10 unauthenticated remote code execution bug in GitLab CE/EE (CVE-2026-97229) in the CI/CD regular expression compiler. GitLab has told customers to patch immediately. Further critical disclosures need prioritised patching: - an AnyDesk heap overflow (CVE-2026-109390) that allows root code execution on Linux without user approval; - an SAP Cloud SDK for Python OAuth2 SSRF that exfiltrates client credentials (CVE-2026-89111); - an HAProxy Data Plane API authentication bypass; - hard-coded or default credentials in Rapyd Admin and Perforce Helix Authentication Service; - a batch of IBM, SAP and Progress MarkLogic flaws. Multiple SOHO routers from Edimax, Linksys, Netcore and TRENDnet received CVSS 9.9–10 command injection CVEs with public exploits, likely fodder for the Mirai and Mozi activity abuse.ch keeps tracking. NVD published 257 entries in the window, of which 40 critical ones were reviewed here. No new CISA KEV additions were ingested.

Live updates

16 updates since 06:03 UTC

  1. Adobe publishes a batch of CVSS 9.9–10 Experience Manager and Commerce code-execution flaws

  2. Microsoft's October 2026 Patch Tuesday fixes a record 1,411 flaws, including one actively exploited zero-day

  3. Fortinet FortiSIEM 7.5.0 path traversal enabling code execution leads a batch of new critical CVEs in Podman, Argo CD, Ivanti and ArcGIS

Updates are added during the day when material new intelligence arrives. They are not part of the executive summary; the next daily briefing recaps them.

Browse the full briefing

50 findings · 6 sections
Findings by severity
  • 12 critical
  • 22 high
  • 14 medium
  • 2 info
Vulnerabilities12 critical · 3 high · 1 medium

Critical Vulnerabilities & Active Exploitation

Two maximum-severity issues lead: SonicWall SMA 1000 (actively exploited) and GitLab CE/EE unauthenticated RCE. Critical flaws also landed in AnyDesk, SAP, HAProxy, IBM and Progress MarkLogic, alongside hard-coded and default credentials in Rapyd Admin and Perforce HAS. SOHO routers received public exploits, and AI agent frameworks lacked authentication. NVD published 257 entries in the window, of which 40 critical were reviewed here; no CISA KEV additions were ingested.

Malware6 high · 5 medium

Malware & Campaigns

Supply-chain compromise spanned hardware (Ledger implants) and software (malicious npm packages in REF8801). Varonis profiled AvisLoader, a ClickFix-delivered loader with encrypted P2P C2. abuse.ch recorded 2,520 new indicators across 131 families, of which 1,822 were supplied for this briefing. GitHub-hosted SmartLoader/Stealc lures and Vidar dominated, with ClickFix/ClearFake delivery and IoT botnets close behind.

  • High severity
    AvisLoader: ClickFix-delivered Windows loader with encrypted P2P C2 (opens the source in a new tab)

    Varonis researchers detail AvisLoader, a new Windows loader built to resist disruption: - delivered via ClickFix lures; - persists through shortcut (LNK) modification; - supports remote command execution; - uses encrypted peer-to-peer communications to make C2 takedown harder. Hunt for clipboard-pasted PowerShell/cmd execution from Run dialogs and new startup shortcuts.

    Source: RSS
  • High severity
    Elastic REF8801: Apex Accelerator malicious npm packages target Web3 developers (opens the source in a new tab)

    Elastic Security Labs exposes REF8801, the 'Apex Accelerator' operation. It pairs convincing Web3 services with malicious npm packages and attacker-controlled AI infrastructure to deliver cross-platform malware, targeting developers. Audit npm dependencies and developer endpoints for related packages.

    Source: RSS
  • High severity
    Ledger confirms hardware spy implant in reseller-distributed wallets (opens the source in a new tab)

    Ledger confirmed that some devices distributed through Southeast Asian reseller CryptoBilis carried a hardware implant that drained users' cryptocurrency wallets. Buy hardware wallets only from official channels and treat reseller-sourced devices as untrusted.

    Source: RSS
  • High severity
    FakeGit / SmartLoader / Stealc GitHub-hosted lures (612 indicators)

    URLhaus logged 612 malware_download URLs for zip archives hosted on raw.githubusercontent.com, tagged FakeGit, luajit, SmartLoader and Stealc. They masquerade as software and code projects to deliver LuaJIT-based SmartLoader leading to Stealc. Samples: - hxxps://raw[.]githubusercontent[.]com/logespandu/expo-apple-maps-sheet/HEAD/components/tab-bar/sheet-expo-maps-apple-v2[.]7[.]zip - hxxps://raw[.]githubusercontent[.]com/Uzaird47/java_backend/HEAD/src/com/backend-java-3[.]5-beta[.]5[.]zip - hxxps://raw[.]githubusercontent[.]com/wccws/Ravana/HEAD/face_swap/native/tests/Software_v3[.]1[.]zip

    Source: abuse.ch
  • High severity
    Vidar infostealer C2 and payloads (481 indicators)

    ThreatFox logged 481 new Vidar infostealer indicators (botnet_cc and payload): URLs, domains and MD5/SHA1/SHA256 hashes. Samples: hxxps://rrj[.]6666k[.]org/, rrj[.]6666k[.]org.

    Source: abuse.ch
  • High severity
    IClickFix and ClearFake web-inject delivery infrastructure (153 indicators)

    ThreatFox logged 124 IClickFix and 29 ClearFake payload_delivery indicators (ip:port, domains, URLs), reflecting continued fake-CAPTCHA/browser-update lures on compromised sites. These are consistent with AvisLoader's delivery method. Samples: startrekfleetcommand[.]com, hxxps://policysync[.]pro/1kzpao/0G7Xcm07FD8I, hxxps://ingestwebneo[.]com.

    Source: abuse.ch
  • Medium severity
    Mirai and Mozi IoT botnet indicators (240+ indicators)

    IoT botnet activity remained steady: - ThreatFox: 123 Mirai indicators (sha256 hashes, ip:port C2). - URLhaus: 80 Mozi ELF download URLs (MIPS and ARM) plus 38 generic ELF/ua-wget droppers. This activity aligns with the newly published router exploits. Samples: hxxp://60[.]18[.]71[.]175:56620/bin[.]sh, hxxp://176[.]65[.]139[.]76/bins/arm, 14dee44a96cd02d3c74c39a195943fc46e839057224800a1937f73ccca303889.

    Source: abuse.ch
  • Medium severity
    DanaBot C2 servers (57 indicators)

    ThreatFox logged 57 DanaBot botnet_cc ip:port indicators clustered on ports 25200/25201. Samples: 154[.]82[.]149[.]37:25201, 154[.]86[.]11[.]119:25201, 154[.]86[.]11[.]120:25200.

    Source: abuse.ch
  • Medium severity
    Cobalt Strike and commodity RAT C2 (Remcos, PureRAT, AsyncRAT, ValleyRAT)

    ThreatFox logged new C2 and payload indicators for: - Cobalt Strike (29) - Remcos (27) - PureRAT (24) - AsyncRAT (21) - ValleyRAT (21) Samples: 43[.]136[.]92[.]170:8080, 185[.]137[.]93[.]64:2700, fifaclubchamps[.]com.

    Source: abuse.ch
  • Medium severity
    AMOS (Atomic macOS Stealer) payloads (27 indicators)

    ThreatFox logged 27 AMOS macOS stealer payload and payload_delivery indicators (sha256 hashes, URLs). Samples: 7bbf23b90e5e056e9f8c3cd41d5dad712dad036d1fb5ba30f50758817ab04dba, 4e3db5b0ffb6b8293a60248a329930edb2d0caa13166320e31df7eb841d950e0.

    Source: abuse.ch
  • Medium severity
    php.shin_webshell delivery via Cloudflare Workers (43 indicators)

    ThreatFox logged 43 payload_delivery domains for php.shin_webshell abusing Cloudflare workers.dev subdomains. Samples: varynuky[.]workers[.]dev, sikyxuxo[.]workers[.]dev, 944i66mcky[.]workers[.]dev.

    Source: abuse.ch
Threat Actors2 high · 3 medium

Threat Actors, Incidents & Law Enforcement

Operational disruptions hit European food retail, with attackers manipulating supermarket refrigeration controls in France and Ahold Delhaize taking systems offline. Law-enforcement actions this window targeted a ransomware negotiator and an Empire Market operator. Kinetic strikes on Yandex data centers also caused broad Russian cloud outages.

Data Breaches & Leaks11 high · 1 medium

Data Breaches & Leaks

No credential or infostealer dumps with pwnCount data were ingested this window. The most credential-relevant event is the weak-password exposure of almost 9 million records. Of 73 new breach and leak-site postings (30 reviewed), healthcare, legal and maritime logistics victims carry the highest sensitivity. Interlock, Play, Orova and Qilin were the most prolific groups.

Policy3 medium

Policy, Regulation & Industry

This window brought a GDPR-era enforcement action against ad-tech data sharing, an upcoming Windows end-of-support deadline, and AI safety containment changes following real-world incidents.

Tools & Techniques1 medium · 2 info

Tools, Techniques & DFIR Practice

AI assistants are emerging as a phishing target via prompt injection. Also covered: field mobile forensics tooling relevant to DFIR triage.

Sources & Attribution

These briefings are compiled from publicly available threat-intelligence feeds, which may include CISA KEV, NIST NVD, the GitHub Advisory Database (OSV), abuse.ch, and Wordfence Intelligence. Data-breach and credential-leak items may include data from Have I Been Pwned and ransomware.live.

CVE® is a registered trademark of The MITRE Corporation. CVE Records are © The MITRE Corporation, reproduced under the CVE Program Terms of Use. WordPress vulnerability data is provided by Wordfence Intelligence, © Defiant, Inc. Breach data from Have I Been Pwned is licensed under CC BY 4.0.