DFIRLab
All Briefings
weeklyOctober 12, 2026 — October 19, 2026Published 07:04 UTC

Weekly Threat Briefing — 2026-10-12 to 2026-10-19

90 findings161 articles7 sections

Subscribe
Critical findings
0
High findings
0
CISA KEV additions
0
First seen in this period
161 Articles2,699 CVEs15,865 IOCs

First seen in this period: news articles, each counted once · CVEs rated CVSS 7.0+ (NVD, GitHub, WordPress) · CISA KEV catalog additions · new abuse.ch indicators (ThreatFox, URLhaus, Feodo Tracker), dated by abuse.ch.

Priority queue

Act on these first

Critical and high findings from this briefing and its live updates. Most severe first, then newest.

Showing 10 of 57
Browse all 90 findings

Executive summary · as of 07:04 UTC

The situation

Edge and remote-access infrastructure dominated this week. CISA added nine entries to KEV. They include a BeyondTrust Remote Support authentication bypass (CVE-2026-102764), a zero-day exploited since late August that Mandiant attributes to the suspected Chinese espionage cluster ARMORY CASTLE. The others are a PAN-OS root code injection (CVE-2026-0322), Ivanti Connect Secure's sixth exploited bug of the year (CVE-2026-104935), a Cisco Secure Email Gateway arbitrary file write, a chained AhsayCBS auth-bypass/command-injection pair, an Atlassian Data Center file exposure flaw, a Windows Shell security-feature bypass fixed in Microsoft's record 1,413-CVE Patch Tuesday, and an older Fortinet path traversal (CVE-2025-61624). Separate reporting describes in-the-wild exploitation of SiteGuard WAF, Collabora/Nextcloud (CVE-2026-110447) and SonicWall SMA 1000. Unit 42 also described PEERSTITCH, a memory-resident FortiGate implant deployed on 500+ firewalls via CVE-2024-47575. Patch internet-facing appliances first and hunt for compromise on BeyondTrust, Ivanti, PAN-OS and FortiGate devices.

Browse the full briefing

90 findings · 7 sections
Findings by severity
  • 23 critical
  • 34 high
  • 24 medium
  • 5 low
  • 4 info
Vulnerabilities9 critical · 4 high · 2 medium

Actively Exploited Vulnerabilities

Nine KEV additions this week, nearly all affecting edge, remote-access or gateway products, plus several vendor-confirmed in-the-wild exploits reported in the press. Prioritize BeyondTrust RS, PAN-OS, Ivanti Connect Secure, Cisco SEG, AhsayCBS and SonicWall SMA.

Vulnerabilities11 critical · 4 high

Critical Patches & Disclosures

Selected critical (CVSS ≥9.9) disclosures not yet known to be exploited. Additional critical issues affect MariaDB (CVE-2026-92262, CVE-2026-85748, CVE-2026-85746), Progress MarkLogic and IBM i. 2,636 further NVD CVEs, 78 OSV advisories and 266 WordPress vulnerabilities were published in the window beyond those reviewed.

Threat Actors2 critical · 10 high · 4 medium

Threat Actors, Campaigns & Disruptions

Chinese state-aligned exploitation of BeyondTrust, supply-chain intrusions via ConnectWise and AOMEI, and a busy week of law-enforcement disruption of phishing, DPRK IT-worker and cybercrime-market operations.

Malware1 critical · 4 high · 7 medium

Malware & Indicator Trends

abuse.ch added 15,801 indicators across 413 families, led by Vidar, Mirai, IClickFix, VShell and AMOS. Research highlights include the PEERSTITCH FortiGate implant and package-repository malware in npm and the AUR.

  • Critical severity
    PEERSTITCH: memory-resident FortiGate implant via CVE-2024-47575 (opens the source in a new tab)

    Unit 42 found attackers exploiting FortiManager CVE-2024-47575 to reach 500+ firewalls. They deployed PEERSTITCH, a stealthy memory-resident ARM64 implant on FortiGate devices; memory-focused triage is required.

    Source: RSS
  • High severity
    Apex Accelerator (REF8801) malicious npm packages (opens the source in a new tab)

    Elastic's REF8801 analysis shows Apex Accelerator combining convincing Web3 services with malicious npm packages, attacker-controlled AI infrastructure and cross-platform malware delivery.

    Source: RSS
  • High severity
    Fake Claude/ChatGPT/Copilot tools deliver infostealers (opens the source in a new tab)

    ANY.RUN tied 1,258 sandbox analyses (April 15–October 5) to campaigns impersonating Claude, ChatGPT, Copilot and Gemini. The campaigns plant infostealers, hijack browser sessions and phish business accounts, often with ClickFix-style lures aimed at developers.

    Source: RSS
  • High severity
    Vidar infostealer dominates abuse.ch indicators

    4,622 new ThreatFox indicators (URLs, domains, hashes, ip:port) covering botnet C2, payloads and delivery. Vidar is the most active family this week. Samples: hxxps://bok[.]6666k[.]org/, bok[.]6666k[.]org.

    Source: abuse.ch
  • High severity
    IClickFix and ClearFake fake-update/ClickFix delivery infrastructure

    IClickFix logged 746 indicators (domains, URLs, ip:port) and ClearFake 262 (domains, URLs) for payload delivery and C2. Samples: startrekfleetcommand[.]com, hxxps://policysync[.]pro/1kzpao/0G7Xcm07FD8I, hxxps://ingestwebneo[.]com.

    Source: abuse.ch
  • Medium severity
    Fake yay/paru AUR packages push root-level malware (opens the source in a new tab)

    Malicious Arch User Repository packages impersonating the yay and paru AUR helpers pushed malware running with root privileges.

    Source: RSS
  • Medium severity
    Proxyjacking campaign hijacks D-Link and Ubiquiti devices (opens the source in a new tab)

    A proxyjacking campaign hijacked D-Link and Ubiquiti devices in 34 countries, reselling victims' bandwidth through a commercial residential proxy network.

    Source: RSS
  • Medium severity
    Mirai and Mozi IoT botnet activity

    Mirai logged 1,399 indicators (payloads, malware downloads, C2; hashes, URLs, ip:port), plus about 720 Mozi download URLs across MIPS/ARM variants and 68 Aisuru C2s. Samples: 63[.]179[.]162[.]160:16747, hxxp://223[.]123[.]43[.]69:39969/Mozi[.]m.

    Source: abuse.ch
  • Medium severity
    VShell C2 framework infrastructure

    561 VShell payload and C2 indicators (sha256, ip:port). Samples: 38[.]46[.]15[.]202:8989, 43[.]142[.]129[.]189:8084, 23[.]155[.]44[.]118:8443.

    Source: abuse.ch
  • Medium severity
    AMOS macOS stealer

    481 Atomic macOS Stealer (AMOS) indicators (hashes, URLs, domains) for payloads, delivery and C2. Sample: 4e3db5b0ffb6b8293a60248a329930edb2d0caa13166320e31df7eb841d950e0.

    Source: abuse.ch
  • Medium severity
    Remcos, PureRAT and AsyncRAT C2

    Commodity RAT indicators: Remcos 317, PureRAT 144 and AsyncRAT 130 (C2 domains, ip:port, hashes). Samples: www[.]jbnowclassprojecttoday[.]com, 152[.]249[.]49[.]42:56002, fifaclubchamps[.]com.

    Source: abuse.ch
  • Medium severity
    Cobalt Strike and Sliver team servers

    145 Cobalt Strike and 108 Sliver C2 indicators (ip:port, domains, hashes). Samples: 192[.]3[.]166[.]110:443, 38[.]60[.]179[.]31:31337, 135[.]148[.]39[.]225:31337.

    Source: abuse.ch
Tools & Techniques1 high · 3 medium · 3 info

Tools, Techniques & AI Security

AI tooling is both target and attack surface: developer credential theft via Claude Code, agent sandbox escapes, and prompt-injection phishing.

Data Breaches & Leaks11 high · 7 medium

Data Breaches & Leaks

324 breach and leak-site entries were ingested (40 reviewed); pwnCount and dataClasses were not supplied for these entries. N0n leads in volume and in credential-bearing dumps; Helix, Qilin and Settra posted heavily. Major disclosed breaches include Burger King Japan, Ampath (claimed), Vibetech and California students.

Policy1 medium · 5 low · 1 info

Policy, Regulation & Legal

Sanctions on Russian-linked crypto laundering, regulators extending liability to IT vendors, and consumer-protection enforcement.

Sources & Attribution

These briefings are compiled from publicly available threat-intelligence feeds, which may include CISA KEV, NIST NVD, the GitHub Advisory Database (OSV), abuse.ch, and Wordfence Intelligence. Data-breach and credential-leak items may include data from Have I Been Pwned and ransomware.live.

CVE® is a registered trademark of The MITRE Corporation. CVE Records are © The MITRE Corporation, reproduced under the CVE Program Terms of Use. WordPress vulnerability data is provided by Wordfence Intelligence, © Defiant, Inc. Breach data from Have I Been Pwned is licensed under CC BY 4.0.