DFIRLab
All Briefings
dailyOctober 18, 2026 — October 19, 2026Published 06:02 UTC

Daily Threat Briefing — 2026-10-19

43 findings3 articles5 sections

Updated 14:33 UTCSubscribe
Critical findings
0
High findings
0
New since 06:02 UTC
0
CISA KEV additions
0
First seen in this period
3 Articles37 CVEs2,146 IOCs

First seen in this period: news articles, each counted once · CVEs rated CVSS 7.0+ (NVD, GitHub, WordPress) · new abuse.ch indicators (ThreatFox, URLhaus, Feodo Tracker), dated by abuse.ch.

Priority queue

Act on these first

Critical and high findings from this briefing and its live updates. Most severe first, then newest.

Showing 10 of 49
Browse all 43 findings

Executive summary · as of 06:02 UTC

The situation

The most urgent item this window is active exploitation of an OS command injection flaw in SiteGuard Server Edition. Attackers can run commands as root or SYSTEM on affected servers, so any internet-exposed SiteGuard deployment should be treated as at risk until patched and checked for compromise. NVD published 37 high or critical CVEs. The most notable are: - A hardcoded cluster-admin token in Vanus (CVE-2026-111998, CVSS 9.8). - Unauthenticated access-control bypasses in Google OSS Agent Mesh (CVE-2026-103091 and CVE-2026-102503). - A critical GeoWebServer.exe issue (CVE-2026-108983). - A cluster of Gitea CI/CD and authentication flaws that expose repository secrets, weaken runner container isolation and bypass enrolled MFA.

Live updates

6 updates since 06:02 UTC

  1. Firefox/Thunderbird Web Serial sandbox escape (CVE-2026-109745, CVSS 9.6) fixed in Firefox 158 and ESR 153.5

  2. F5 issues out-of-band patches for three critical NGINX flaws enabling remote code execution

  3. Hackers steal customer credentials from Russian hosting provider FirstVDS via server-management software flaw

Updates are added during the day when material new intelligence arrives. They are not part of the executive summary; the next daily briefing recaps them.

Browse the full briefing

43 findings · 5 sections
Findings by severity
  • 7 critical
  • 28 high
  • 7 medium
  • 1 info
Vulnerabilities7 critical · 8 high · 2 medium

Vulnerabilities & Exploitation

No KEV additions this window. SiteGuard WAF command injection is the only vulnerability reported as exploited in the wild. NVD published 37 high or critical CVEs, led by: - Vanus default credentials. - Google Agent Mesh auth bypasses. - A critical GeoWebServer issue. - A Gitea CI/CD and MFA cluster. - Multiple critical WordPress plugin flaws. WPScan added 14 plugin entries, most of them medium severity. Lower-profile SQLi and authentication issues in GitHub-hosted projects (dotnet eShop, light0011 cms, Hospital Management System, Online-Examination-System) and a cgltf heap write (CVE-2026-112018) were also published.

Malware6 high · 4 medium

Malware & Infrastructure Indicators

abuse.ch recorded 2,126 new indicators (ThreatFox 1,603, URLhaus 523) across 90 families; 1,719 were included in this summary. Infostealers (Vidar, AMOS), IoT botnets (Mirai, Mozi) and ClickFix lure infrastructure dominate. Tofsee spam-botnet C2 on port 427 (20 indicators) was also observed.

  • High severity
    Vidar infostealer C2 surge (329 indicators)

    Vidar was the top family, with 329 new ThreatFox indicators (URLs and domains), all botnet C2. Samples: hxxps://g0[.]9nawin[.]org/v1/, hxxps://e[.]88idn[.]net, e[.]88idn[.]net. Block these at the proxy and hunt for browser credential-store access by unusual processes.

    Source: abuse.ch
  • High severity
    Mirai and Mozi IoT botnet distribution (292 + 88 indicators, plus ELF variants)

    Mirai accounted for 292 indicators (URLs, hashes, ip:port, domains) across C2, payload and download roles; Mozi added 88 more. URLhaus also listed tagged ELF variants: 55 MIPS Mozi, 38 'boatnet' Mirai builds and 31 ARM Mirai/Mozi. Samples: hxxp://176[.]65[.]139[.]131/0c0et52nq5kb/assets/js/jb1l4atpfr?token=XW88kueSeM3WQHw1uxCEDNCWiiJwBzyA, hxxp://153[.]117[.]32[.]82:40061/Mozi[.]a, hxxp://94[.]154[.]43[.]7/hiddenbin/boatnet[.]arm6.

    Source: abuse.ch
  • High severity
    ClickFix-style lure infrastructure: IClickFix (172) and ClearFake (26)

    IClickFix contributed 172 payload-delivery domains and ClearFake 26 domains/URLs, both linked to fake-CAPTCHA and fake-update lures that trick users into pasting commands. Samples: 1022studio[.]com, adelheid-gloeser[.]fr, bociljp[.]online. Consider restricting Win+R/PowerShell use by standard users and alerting on clipboard-launched commands.

    Source: abuse.ch
  • High severity
    AMOS macOS infostealer (115 indicators)

    AMOS (Atomic macOS Stealer) had 115 indicators (hashes, URLs, domains) covering payload, delivery and C2. Sample hashes: ff49f74421a908b1ff2a4537d8607f71e68359eb7d4c4c2c96562f79137217ac, 35e354dda1bc49446eda9c1f9e9b807ddccbd6aa71cedaf600fdd9c221de10b5, 21b282512597e9121548cd0bed1375c674cf15082a98592f6ee97334842b346a.

    Source: abuse.ch
  • High severity
    Commodity RAT C2: Remcos (112), AsyncRAT, PureRAT, ValleyRAT

    New RAT infrastructure was published for four families: - Remcos: 112 indicators, e.g. backdoor[.]go99[.]games and backdoor[.]02go8[.]com. - AsyncRAT: 19 indicators, e.g. 104[.]254[.]90[.]122:29245. - PureRAT: 19 C2s, mostly on port 4443. - ValleyRAT: 12 C2s and hashes.

    Source: abuse.ch
  • High severity
    Sliver (48) and Cobalt Strike (34) C2 servers

    Sliver: 48 C2 ip:port indicators, predominantly on default port 31337 (167[.]99[.]227[.]197:31337, 130[.]94[.]1[.]88:31337, 80[.]78[.]28[.]56:31337). Cobalt Strike: 34 team servers on ports 80/443, e.g. 8[.]217[.]91[.]135:443. Any internal beaconing to these addresses should be treated as hands-on-keyboard intrusion.

    Source: abuse.ch
  • Medium severity
    Unknown Loader cluster (238 indicators)

    238 indicators (domains, hashes, ip:port) were attributed to an unidentified loader handling payload delivery and C2. Samples: 47ce866bc6022d4e2a791d73cff0a71ec37fa327646dd9099d38701135c5b9b6, 63feaeb42751c41c33afe388dbc3450e66f59fdf9b680c3889efd8e4f60493ce, 0254d77fb5b0561bc5a2e9a01cf47e8387f73adb9e18ff336867186c89cd660f.

    Source: abuse.ch
  • Medium severity
    php.shin_webshell delivery via workers.dev and GCP (31 indicators)

    php.shin_webshell had 31 payload-delivery domains abusing Cloudflare Workers and Google Cloud hosting: 7w3h1e8nfj[.]workers[.]dev, xawipo[.]workers[.]dev, 54[.]5[.]200[.]35[.]bc[.]googleusercontent[.]com.

    Source: abuse.ch
  • Medium severity
    SMSspy Android banking/SMS stealer with mParivahan lure (27 indicators)

    SMSspy, an Android SMS-stealing malware, had 27 indicators using mParivahan (Indian transport service) lures and Firebase backends. Samples: mparivahan[.]hs[.]vc, myuse-60542[.]firebasestorage[.]app, myuse-60542-default-rtdb[.]asia-southeast1[.]firebasedatabase[.]app.

    Source: abuse.ch
  • Medium severity
    GitLab-hosted malware payloads (CheatSheet, 13 indicators)

    URLhaus listed 13 malicious EXE downloads hosted in GitLab raw repositories and tagged CheatSheet. Samples: hxxps://gitlab[.]com/sixtons/edge/-/raw/main/stage_2[.]exe, hxxps://gitlab[.]com/brisslands/decode/-/raw/main/7M260NMM3NQF[.]exe, hxxps://gitlab[.]com/brisslands/decode/-/raw/main/505HFZIN80F5[.]exe.

    Source: abuse.ch
Threat Actors2 high

Threat Actor Activity

No law-enforcement takedowns this window. Extortion activity was led by N0n and a bulk Settra posting, with Qilin, Helix, Cloak, iah6477 and Emperador also active.

  • High severity
    N0n extortion group: high posting tempo, focus on access secrets and network maps

    N0n posted 11 victims in 24 hours. Five are anonymised 'Company #89–93' entries pending exposure (healthcare support, IT services in South Korea, biotech, sports betting analytics, home services). Named victims, all marked NOT PAID and EXPOSED, are: - Finzly (payment infrastructure secrets and cloud keys). - Amagi Media Labs (broadcast site network maps). - SMIC's US arm. - A Massachusetts tax practice. - An entry titled Telecom Egypt but described as a computer training academy. The group prioritises infrastructure secrets that enable follow-on access.

    Source: Manual
  • High severity
    Settra: exposé-style extortion batch of eight victims

    Settra published eight victims within minutes: Marvinpac, Passavant E&E, Acclaim Companies, Binsky & Snyder, Konsis, Monroe Roadways, Adapt Global and exo.inc. Postings are written as investigative exposés alleging fraud, sanctions or contracting issues to raise reputational pressure. They include executives' SSNs, banking details and patient-related data. Victims are mainly in the US and Europe.

    Source: Manual
Data Breaches & Leaks12 high

Data Breaches & Leaks

32 leak-site entries were added; 30 were reviewed here. None included pwnCount or structured dataClasses. The most damaging claims involve infrastructure access secrets (Finzly, Amagi), SSNs and tax data (Acclaim, Fox Hill practice), and payroll records (SMIC US).

Policy1 medium · 1 info

Policy, Insider Risk & Industry

Insider misuse of patient records in the NHS and shifts in the security workforce market.

Sources & Attribution

These briefings are compiled from publicly available threat-intelligence feeds, which may include CISA KEV, NIST NVD, the GitHub Advisory Database (OSV), abuse.ch, and Wordfence Intelligence. Data-breach and credential-leak items may include data from Have I Been Pwned and ransomware.live.

CVE® is a registered trademark of The MITRE Corporation. CVE Records are © The MITRE Corporation, reproduced under the CVE Program Terms of Use. WordPress vulnerability data is provided by Wordfence Intelligence, © Defiant, Inc. Breach data from Have I Been Pwned is licensed under CC BY 4.0.