DFIRLab
All Briefings
dailyOctober 15, 2026 — October 16, 2026Published 06:02 UTC

Daily Threat Briefing — 2026-10-16

46 findings31 articles6 sections

Updated 20:33 UTCSubscribe
Critical findings
0
High findings
0
New since 06:02 UTC
0
CISA KEV additions
0
First seen in this period
31 Articles330 CVEs2,411 IOCs

First seen in this period: news articles, each counted once · CVEs rated CVSS 7.0+ (NVD, GitHub, WordPress) · CISA KEV catalog additions · new abuse.ch indicators (ThreatFox, URLhaus, Feodo Tracker), dated by abuse.ch.

Priority queue

Act on these first

Critical and high findings from this briefing and its live updates. Most severe first, then newest.

Showing 10 of 61
Browse all 46 findings

Executive summary · as of 06:02 UTC

The situation

Active exploitation of internet-facing remote-access and collaboration software dominates this window. Threat actors are exploiting a critical command execution flaw in the Collabora Online built-in CODE Server app for Nextcloud (CVE-2026-110447) to backdoor servers. Mandiant reports that the actor ARMORY CASTLE is exploiting BeyondTrust Remote Support (CVE-2026-102764), which was disclosed on October 15. CISA added an Atlassian Data Center file-exposure flaw (CVE-2026-21589) to KEV, covering Bitbucket, Confluence, Jira, Bamboo, Crowd and Fisheye/Crucible. Google shipped fixes for 37 Chrome flaws, seven of them critical, and Mozilla patched two sandbox escapes. Critical unauthenticated flaws in Nutanix Prism Element, Dell Secure Connect Gateway, Wavlink routers and Podman should be patched as a priority.

Live updates

16 updates since 06:02 UTC

  1. Critical CVSS 9.8 jail escape: SCM_RIGHTS descriptor passing can strip FD_RESOLVE_BENEATH (CVE-2026-101306)

  2. Maximum-severity BlockStrap flaw (CVE-2026-103849) in Magento/Adobe Commerce enables PHP code execution; exploitation expected soon

  3. CISA adds Fortinet path traversal CVE-2025-61624 and BeyondTrust Remote Support CVE-2026-102764 to KEV

Updates are added during the day when material new intelligence arrives. They are not part of the executive summary; the next daily briefing recaps them.

Browse the full briefing

46 findings · 6 sections
Findings by severity
  • 12 critical
  • 20 high
  • 12 medium
  • 1 low
  • 1 info
Vulnerabilities11 critical · 5 high

Vulnerabilities & Exploitation

This window saw two actively exploited flaws (Collabora/Nextcloud and BeyondTrust Remote Support) and one new KEV entry (Atlassian Data Center). There were also critical browser fixes and a broad set of critical unauthenticated flaws in edge, container and WordPress software.

Threat Actors1 critical · 2 high · 3 medium

Threat Actors & Campaigns

State-aligned espionage against government Linux and Central Asian targets, ad-delivered zero-click spyware, and financially motivated device hijacking. No infrastructure seizures were reported in the window.

Malware3 high · 6 medium

Malware & Indicators

A software supply-chain attack via fake AUR packages, plus 2,383 new abuse.ch indicators across 109 families, led by Vidar (981) and VShell (301). Of these, 1,909 indicators were provided for analysis.

  • High severity
    Fake Arch Linux AUR packages push root-level malware (opens the source in a new tab)

    A threat actor uploaded AUR packages impersonating the popular helpers yay and paru that install malware with root privileges. Audit Arch systems for recently installed AUR packages from unexpected maintainers.

    Source: RSS
  • High severity
    Vidar infostealer: 981 new indicators

    ThreatFox logged 981 new Vidar indicators (botnet C2 and payload): URLs, domains and MD5/SHA1/SHA256 hashes. This is the window's largest family. Samples: hxxps://ou[.]78royal[.]org/tj, hxxps://ou[.]78royal[.]org/tj/, hxxps://zr[.]78royal[.]org.

    Source: abuse.ch
  • High severity
    VShell backdoor: 301 new indicators

    ThreatFox logged 301 new VShell indicators (payload and C2), as SHA256 hashes and ip:port. Sample hashes: 0c577e4dac135647e24f916088ba35c555e3f47daaf1cd0ae3942e6f68c31d8b, 3389070d2bc1037a231cf832cbb3a6b81545f6876bb4fd8130bac87dbbf5914e, 6c0f2f68a0d4343e1e0abb42101d6ca7bcc8b43207db5c3ead5213f7d89ef802.

    Source: abuse.ch
  • Medium severity
    AMOS (Atomic macOS Stealer): 62 new payload hashes

    ThreatFox logged 62 new SHA256 payload hashes for the macOS AMOS stealer. Samples: 12d5649d59cdd8034def4a74f3db6a2dc24c80a59ca3505a71843d284332a6e9, fdc7fdbc7a64f030002b16436cc2fec5694392a8da77751156a8c28039474c0f, 9eb4c83decf7f9b3f31001de6404ec6c7bc214304b372b3686e6e7118cea4dad.

    Source: abuse.ch
  • Medium severity
    Mirai/Mozi IoT botnets: ~190 new indicators

    IoT botnet activity in the window: - Mirai: 54 ThreatFox indicators (C2 ip:port, payloads). - Mozi: 66 URLhaus MIPS/ARM ELF download URLs. - Multi-arch 'Space' ELF botnet: 68 hiddenbin download URLs. Samples: 85[.]137[.]54[.]178:443, hxxp://scribblebubblebibi[.]top/hiddenbin/Space[.]arm6, hxxp://121[.]202[.]142[.]137:42284/bin[.]sh.

    Source: abuse.ch
  • Medium severity
    Commodity RATs: Remcos, AsyncRAT, PureRAT, ValleyRAT

    New commodity RAT C2 indicators: Remcos 35, AsyncRAT 32, PureRAT 19 and ValleyRAT 16. Indicator types are mostly ip:port and domains. Samples: 217[.]60[.]103[.]76:2404, 128[.]90[.]105[.]55:8081, hxxp://ruimukj[.]top/getinstall64.

    Source: abuse.ch
  • Medium severity
    ClearFake drive-by delivery: 25 new indicators

    ThreatFox logged 25 new ClearFake indicators (domains and URLs) used for fake browser-update payload delivery via compromised sites. Samples: anthonysplumbinganddrain[.]com, demo[.]ilan-muffato[.]fr, uid1q3os[.]bulkpictureframes[.]us.

    Source: abuse.ch
  • Medium severity
    Sliver and Cobalt Strike C2 servers

    ThreatFox logged new post-exploitation C2 servers: Sliver 19 and Cobalt Strike 13 (ip:port). Samples: 164[.]90[.]149[.]44:80, 92[.]118[.]206[.]108:31337, 45[.]87[.]53[.]8:443.

    Source: abuse.ch
  • Medium severity
    php.shin_webshell delivery via workers.dev: 44 domains

    ThreatFox logged 44 payload-delivery domains for php.shin_webshell hosted on Cloudflare workers.dev. Samples: khgzh40665[.]workers[.]dev, quaintailey[.]workers[.]dev, lyzuhumu[.]workers[.]dev.

    Source: abuse.ch
Data Breaches & Leaks10 high

Data Breaches & Leaks

A credential-laden exposed database leads this window, followed by government-sector incidents and 43 ransomware leak-site postings. Of these, 30 were provided for analysis; postings were dominated by Qilin, LockBit5, Akira, INC Ransom, N0n and iah6477. Leak-site entries carry no pwnCount or dataClasses.

Tools & Techniques1 medium · 1 info

Tools, Techniques & Defensive Developments

OT third-party patching risk and new mobile anti-scam controls.

Policy2 medium · 1 low

Policy, Regulation & Law Enforcement

Regulatory action against a predatory 'forensics' firm, international law enforcement action, and a Microsoft lifecycle milestone.

Sources & Attribution

These briefings are compiled from publicly available threat-intelligence feeds, which may include CISA KEV, NIST NVD, the GitHub Advisory Database (OSV), abuse.ch, and Wordfence Intelligence. Data-breach and credential-leak items may include data from Have I Been Pwned and ransomware.live.

CVE® is a registered trademark of The MITRE Corporation. CVE Records are © The MITRE Corporation, reproduced under the CVE Program Terms of Use. WordPress vulnerability data is provided by Wordfence Intelligence, © Defiant, Inc. Breach data from Have I Been Pwned is licensed under CC BY 4.0.