DFIRLab
All Briefings
dailyOctober 14, 2026 — October 15, 2026Published 06:03 UTC

Daily Threat Briefing — 2026-10-15

53 findings33 articles6 sections

Updated 21:42 UTCSubscribe
Critical findings
0
High findings
0
New since 06:03 UTC
0
CISA KEV additions
0
First seen in this period
33 Articles418 CVEs2,253 IOCs

First seen in this period: news articles, each counted once · CVEs rated CVSS 7.0+ (NVD, GitHub, WordPress) · CISA KEV catalog additions · new abuse.ch indicators (ThreatFox, URLhaus, Feodo Tracker), dated by abuse.ch.

Priority queue

Act on these first

Critical and high findings from this briefing and its live updates. Most severe first, then newest.

Showing 10 of 68
Browse all 53 findings

Executive summary · as of 06:03 UTC

The situation

Edge and perimeter infrastructure dominated this window. CISA added four actively exploited flaws to KEV: a Palo Alto Networks PAN-OS code-injection zero-day (CVE-2026-0322), a Cisco Secure Email Gateway path traversal giving unauthenticated root (CVE-2026-76519), and a chainable Ahsay AhsayCBS authentication bypass plus command injection pair (CVE-2026-105133/105134). CISA also urged immediate patching of an Ivanti Connect Secure zero-day (CVE-2026-104935), exploited since at least October 1. It is the sixth exploited Ivanti bug this year. Microsoft's record October Patch Tuesday fixed 1,413 vulnerabilities, including one actively exploited Windows flaw and two other zero-days. Juniper disclosed a large batch of critical Junos OS bugs, including unauthenticated root via J-Web and multiple BGP/rpd overflows. Unit 42 documented PEERSTITCH, a memory-resident ARM64 FortiGate implant deployed via FortiManager CVE-2024-47575 against 500+ firewalls. NVD published 414 CVEs in the window (40 reviewed here) and 69 WordPress component vulnerabilities (30 reviewed).

Live updates

16 updates since 06:03 UTC

  1. Critical Podman flaw (CVE-2026-94603, CVSS 10) lets a malicious image annotation disable nearly all container sandboxing

  2. Mandiant: ARMORY CASTLE exploiting newly disclosed BeyondTrust Remote Support flaw CVE-2026-102764

  3. Critical Firefox/Thunderbird sandbox escapes (CVE-2026-109708, CVE-2026-109755) fixed in Firefox 158 and ESR 153.5

Updates are added during the day when material new intelligence arrives. They are not part of the executive summary; the next daily briefing recaps them.

Browse the full briefing

53 findings · 6 sections
Findings by severity
  • 10 critical
  • 25 high
  • 13 medium
  • 2 low
  • 3 info
Vulnerabilities10 critical · 3 high · 1 medium

Vulnerabilities & Exploitation

Four actively exploited flaws were added to CISA KEV, an Ivanti ICS zero-day is under exploitation, and Microsoft shipped a record Patch Tuesday. Juniper disclosed a large critical batch. 414 NVD CVEs and 69 WordPress vulnerabilities were published in the window; the most impactful are summarized here.

Malware6 high · 6 medium

Malware & Campaigns

A stealthy FortiGate implant, AI-brand impersonation infostealer campaigns, a hardware wallet supply-chain scare and new Android banking malware. abuse.ch logged 2,226 indicators across 109 families, dominated by Vidar and ClickFix-style delivery.

  • High severity
    PEERSTITCH: memory-resident ARM64 FortiGate implant deployed via FortiManager CVE-2024-47575 (opens the source in a new tab)

    Unit 42 investigated an intrusion in which attackers exploited FortiManager CVE-2024-47575 to target 500+ firewalls. They deployed PEERSTITCH, a stealthy memory-resident ARM64 implant on FortiGate devices. Memory-only residency limits disk forensics; prioritize live acquisition and FortiManager log review on exposed estates.

    Source: RSS
  • High severity
    Counterfeit Claude, ChatGPT and Copilot tools deliver infostealers to US companies (opens the source in a new tab)

    ANY.RUN tracked campaigns impersonating Claude, ChatGPT, GitHub Copilot, Gemini and other AI brands. They plant infostealers, hijack browser sessions and phish business accounts. 1,258 public sandbox analyses were tied to the activity between April 15 and October 5, 2026, with US companies heavily targeted.

    Source: RSS
  • High severity
    Ledger halts hardware wallet sales across Asia over supply-chain tampering (opens the source in a new tab)

    Ledger asked resellers in Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia and Hong Kong to suspend sales and pull wallets from shelves while it investigates device tampering. Advise users who bought through regional resellers to verify device genuineness.

    Source: RSS
  • High severity
    Hirudo Android malware swaps banking apps for tampered versions (opens the source in a new tab)

    New Android banking malware Hirudo steals bank credentials by replacing legitimate banking apps with modified versions that disable security checks, evading app-integrity protections.

    Source: RSS
  • High severity
    Vidar infostealer: 981 new indicators

    981 new ThreatFox indicators, 44% of the window's abuse.ch volume. Indicator types are URLs, domains and MD5/SHA1/SHA256 hashes; threat types are botnet C2, payload and payload delivery. Samples: hxxps://om[.]77777w[.]net/zl, hxxps://om[.]77777w[.]net/zl/, hxxps://epi[.]77777w[.]net.

    Source: abuse.ch
  • High severity
    IClickFix fake-CAPTCHA delivery: 160 new indicators

    160 new ThreatFox domain/URL indicators (botnet C2, payload delivery) for the fake-CAPTCHA 'paste-and-run' lure family. Samples: year[.]calvinpreschooloffice[.]com, brisk-sail-ridge-dreor[.]pro, liavruizskioo[.]pro. Monitor for Run-dialog/PowerShell execution following browser activity.

    Source: abuse.ch
  • Medium severity
    Fake Calendly 'Meta Careers' pages steal Facebook and Google logins despite 2FA (opens the source in a new tab)

    Recruitment-themed phishing uses fake Calendly interview invitations branded as Meta Careers. The pages harvest Facebook and Google credentials and succeed even when two-factor authentication is enabled.

    Source: RSS
  • Medium severity
    ClearFake: 42 new delivery domains

    42 new ThreatFox domains used for payload delivery via compromised websites showing fake browser updates/verification. Samples: thjduywf[.]asociadospacifico[.]com, amanahsukses[.]uk[.]com, kmxvvkoq[.]enlineaempresarial[.]com[.]mx.

    Source: abuse.ch
  • Medium severity
    IoT botnets (Mozi, Mirai, Aisuru): 150+ new indicators

    IoT botnet indicator volumes: - Mozi (MIPS/ARM ELF): 83 URLhaus malware download URLs. - Mirai: 52 ThreatFox indicators (hashes, ip:port C2, URLs). - Aisuru: 23 ip:port C2s. - Generic ELF/ua-wget droppers: 41 URLs. Samples: hxxp://41[.]142[.]182[.]30:52596/i, hxxp://45[.]198[.]224[.]158/arm6, 164[.]92[.]161[.]236:34567.

    Source: abuse.ch
  • Medium severity
    AMOS macOS stealer: 48 new indicators

    48 new ThreatFox indicators (SHA256 hashes and URLs; payload and payload delivery) for the macOS Atomic Stealer. Samples: b9cc60047e896f844e0fb901c51586c90107df9e83b6f5b6e300ba91ed9f8218, 3267f01be506f81885881ac048702223ddfca3e17cf5cb4257e816fa76f05477, bbab66169a3718001fba30bb464bf48571bd82205b0e10c32ad1e78a92890838.

    Source: abuse.ch
  • Medium severity
    Commodity RATs and Cobalt Strike C2 infrastructure

    New ThreatFox C2 and payload indicators by family: - Remcos: 34 - DCRat: 28 - Cobalt Strike: 22 - AsyncRAT: 21 - PureRAT: 15 - Formbook: 39 hashes - Agent Tesla: 22 hashes Samples: 31[.]40[.]204[.]227:16000 (Remcos), 149[.]88[.]73[.]83:8888 (Cobalt Strike), 181[.]235[.]13[.]54:9002 (DCRat).

    Source: abuse.ch
  • Medium severity
    php.shin_webshell: 50 workers.dev delivery domains

    50 new ThreatFox payload-delivery domains hosted on Cloudflare Workers subdomains. Samples: xuxasi[.]workers[.]dev, joqito[.]workers[.]dev, fycixy[.]workers[.]dev.

    Source: abuse.ch
Threat Actors4 high · 2 medium

Threat Actors & Law Enforcement Actions

Major disruptions hit phishing-as-a-service infrastructure, DPRK IT-worker schemes and a darknet market. The n0n extortion group is running a mass campaign against the maritime sector.

Data Breaches & Leaks12 high · 2 medium

Data Breaches & Leaks

25 breach and leak-site entries were recorded. Credential-bearing infrastructure data (Interior Technologies) and the 559,908-account Crunchbase leak lead. Large identity-document and payroll dumps, the N0n extortion surge and continued LockBit 5, Akira, Qilin and Eclipse activity follow.

Policy2 medium · 2 low

Policy, Regulation & Legal

Sanctions against a cybercrime payment conduit, an insider surveillance case at OpenAI and government oversight actions.

Tools & Techniques3 info

Tools, Techniques & Research

Research and tooling notes on AI-driven threats, offensive testing gaps and forensic investigation platforms.

Sources & Attribution

These briefings are compiled from publicly available threat-intelligence feeds, which may include CISA KEV, NIST NVD, the GitHub Advisory Database (OSV), abuse.ch, and Wordfence Intelligence. Data-breach and credential-leak items may include data from Have I Been Pwned and ransomware.live.

CVE® is a registered trademark of The MITRE Corporation. CVE Records are © The MITRE Corporation, reproduced under the CVE Program Terms of Use. WordPress vulnerability data is provided by Wordfence Intelligence, © Defiant, Inc. Breach data from Have I Been Pwned is licensed under CC BY 4.0.