Cyber Threat Intel Daily Briefing

CYBER THREAT INTEL

DAILY BRIEFING · 2026-10-31 12:15 UTC · REPORT BRIEF-20261031-121529

OPEN // LE

PERIOD: LAST 24 HOURS SOURCES: Ars Technica Security, BBC Technology, BleepingComputer, BleepingComputer (Google News), Cyber Risk & Security, Cyber Threat Intelligence

TOP 10 LATEST CYBERSECURITY STORIES from the last 24 hours.

15

Stories Featured

53

Sources

10

Active KEV CVEs

28

IOC Indicators

Top Stories

Attackers Exploit Critical Drupal Commerce Core Vulnerability CVE-2026-118539

Drupal warns that attackers are exploiting a critical authorization flaw in Commerce Core, putting vulnerable online stores at risk. Drupal warns that threat actors are exploiting a highly critical security flaw, tracked as CVE-2026-118539, in its Commerce Core module. The vulnerability is caused by

          
          SRC: Security Affairs
          Sat, 31 Oct 2026 09:08:58 +0000
          https://securityaffairs.com/202162/security/attackers-exploit-critical-drupal-commerce-core-vulnerability-cve-2026-118539.html
        

Attackers Chain Three Ivanti Connect Secure Flaws to Gain Unauthenticated Root Access

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added two security flaws impacting Ivanti Connect Secure (ICS) to its Known Exploited Vulnerabilities (KEV) catalog, following active exploitation in the wild. The vulnerabilities are listed below – CVE-2026-111357 (CVSS

          
          SRC: The Hacker News
          Sat, 31 Oct 2026 13:57:43 +0530
          https://thehackernews.com/2026/10/attackers-chain-three-ivanti-connect.html
        

A Shared ChatGPT Link Could Run Attacker Code in Your Session and Read Private Chats

A malicious ChatGPT share link could run an attacker's code in the logged-in session of anyone who opened it, allowing them to read their private conversations, researchers at the security firm Parameter showed. The researchers reported the flaw through OpenAI's bug bounty program on October 18, an

          
          SRC: The Hacker News
          Sat, 31 Oct 2026 11:03:41 +0530
          https://thehackernews.com/2026/10/a-shared-chatgpt-link-could-run.html
        

Behind the Scenes of How Operation Blackout Went Down

A recent law enforcement operation to dismantle harmful scam centers was a big success. A threat intelligence expert walks us through what happened and why he wants more of the same.

          
          SRC: DarkReading
          Fri, 30 Oct 2026 19:46:08 GMT
          https://www.darkreading.com/cybersecurity-operations/behind-the-scenes-how-operation-blackout-went-down
        

Bulletproof Host Virtualine Loses Its Domain to FBI Seizure

It allowed customers to host hack-for-hire services, supported ransomware and infostealer operators, and accepted crypto payments. The post Bulletproof Host Virtualine Loses Its Domain to FBI Seizure appeared first on SecurityWeek.

          
          SRC: SecurityWeek
          Fri, 30 Oct 2026 13:36:12 +0000
          https://www.securityweek.com/bulletproof-host-virtualine-loses-its-domain-to-fbi-seizure/
        

China-backed threat group used agentic AI pentesting tool to compromise 140 sensitive targets in 11 days

Vapor Panda targeted more than 200 organizations spanning at least 14 countries, according to CrowdStrike. The ongoing campaign is remarkably successful and operating at shocking speed. The post China-backed threat group used agentic AI pentesting tool to compromise 140 sensitive targets in 11 days

          
          SRC: CyberScoop
          Fri, 30 Oct 2026 21:30:00 +0000
          https://cyberscoop.com/china-vapor-panda-agentic-ai-artex-campaign-crowdstrike/
        

$6.3 Billion Stolen from Binance in Attack Attributed to North Korea

Binance links a $6.3 billion crypto theft to a compromised DevOps laptop, with North Korean hackers blamed by blockchain analysts. Binance was investigating suspicious transfers that early estimates put at up to $5.8 billion. A day later, multiple media outlets reported that the largest cryptocurren

          
          SRC: Security Affairs
          Fri, 30 Oct 2026 18:50:26 +0000
          https://securityaffairs.com/202119/cyber-crime/6-3-billion-stolen-from-binance-in-attack-attributed-to-north-korea.html
        

Chinese Hackers Use AI-Powered ARTEX to Target Over 200 Organizations Worldwide

Chinese state-sponsored threat actors have been observed using a Go-based artificial intelligence (AI)-powered penetration testing framework called ARTEX in attacks aimed at high-value targets simultaneously. The activity has been attributed by CrowdStrike to a China-based "targeted intrusion adver

          
          SRC: The Hacker News
          Fri, 30 Oct 2026 22:28:44 +0530
          https://thehackernews.com/2026/10/chinese-hackers-use-ai-powered-artex-to.html
        

Defense contractor pleads guilty to aiding North Korean remote worker scheme

The 62-year-old allowed co-conspirators to use his identity and top secret security clearance to apply for almost 100 jobs last year. The scheme’s success rate was limited. The post Defense contractor pleads guilty to aiding North Korean remote worker scheme appeared first on CyberScoop.

          
          SRC: CyberScoop
          Fri, 30 Oct 2026 15:14:29 +0000
          https://cyberscoop.com/defense-contractor-guilty-north-korea-scheme-facilitator/
        

Applebee’s exposed customers’ personal data after leaving database password in app

EXCLUSIVE: A security researcher discovered the hardcoded credential in Applebee's app, allowing unrestricted access to customers' personal data.

          
          SRC: TechCrunch Security
          Fri, 30 Oct 2026 21:48:53 +0000
          https://techcrunch.com/2026/10/30/applebees-exposed-customers-personal-data-after-leaving-database-password-in-app/
        

PHP2Shell Attacks Root Palo Alto Firewalls but Fail Against WordPress

Over 22.6 million exposed instances are potentially affected by the critical PHP flaws that have been targeted for over a week. The post PHP2Shell Attacks Root Palo Alto Firewalls but Fail Against WordPress appeared first on SecurityWeek.

          
          SRC: SecurityWeek
          Fri, 30 Oct 2026 15:09:25 +0000
          https://www.securityweek.com/php2shell-attacks-root-palo-alto-firewalls-but-fail-against-wordpress/
        

Syrian Hacker Gets Prison Time in US After Over a Decade on the Run

A US court sentenced Syrian hacker Ahmad Umar Agha to 42 months for pro-Assad attacks on media, businesses, and government entities. The post Syrian Hacker Gets Prison Time in US After Over a Decade on the Run appeared first on SecurityWeek.

          
          SRC: SecurityWeek
          Sat, 31 Oct 2026 11:00:00 +0000
          https://www.securityweek.com/syrian-hacker-gets-prison-time-in-us-after-over-a-decade-on-the-run/
        

Cloudflare Reports 18.2 Million Network-Layer DDoS Attacks in Q3, Up 38%

Threat actors are launching about 8,226 network-layer distributed denial-of-service (DDoS) attacks per hour, Cloudflare revealed Thursday. The web infrastructure and security company said it autonomously mitigated 18.2 million network-layer (L3) DDoS attacks and 14.4 trillion HTTP DDoS requests in

          
          SRC: The Hacker News
          Sat, 31 Oct 2026 10:26:12 +0530
          https://thehackernews.com/2026/10/cloudflare-reports-182-million-network.html
        

Devs Hit by Trojanized Claude Code Extension for Cursor

Two serious security issues hit Cursor on the same day, highlighting the risks for AI-powered integrated development environments (IDEs).

          
          SRC: DarkReading
          Fri, 30 Oct 2026 20:05:58 GMT
          https://www.darkreading.com/cyberattacks-data-breaches/devs-trojanized-claude-code-extension-cursor
        

L’Italia è afflitta da vulnerabilità informatiche, senza una causa chiara

I ricercatori non riescono a spiegare del tutto perché le minacce informatiche in Italia siano così diverse rispetto a quelle di qualsiasi altro Paese.

          
          SRC: DarkReading
          Fri, 30 Oct 2026 15:39:54 GMT
          https://www.darkreading.com/cybersecurity-analytics/cyber-vulnerabilities-besiege-italy-italian
        

Known Exploited — CISA KEV

CVE	Product	Added to KEV
CVE-2026-118527	Connect Secure (Ivanti)	2026-10-30
CVE-2026-111357	Connect Secure (Ivanti)	2026-10-30
CVE-2026-97229	Community Edition and Enterprise Edition (GitLab)	2026-10-29
CVE-2026-76418	Secure Firewall ASA Software and Cisco Secure FTD Software (Cisco)	2026-10-29
CVE-2026-41709	VMware ESX (Broadcom)	2026-10-28
CVE-2026-46300	Kernel (Linux)	2026-10-28
CVE-2026-48356	Commerce and Magento (Adobe)	2026-10-27
CVE-2026-111497	Brotli (Google)	2026-10-27
CVE-2026-109618	PHP (PHP Group)	2026-10-26
CVE-2026-109619	PHP (PHP Group)	2026-10-26

Indicators of Compromise (IOC)

[ SOURCE ] OpenPhish (18 indicator(s))

URLPhishingOpenphish

http://facebook[.]webmau[.]vn/

https://www[.]roblox[.]com[.]kz/users/137614935/profile

http://xmqrb724nhw-zdcynfyn-2d9e0f-pj388a[.]pages[.]dev/

http://8s1q2g-qw999agreg-mbtz1m8p9z2-fsgc12[.]pages[.]dev/

https://2u8m1c-qw144c84y-mbtz8m9p1z2-qwxk[.]pages[.]dev/

https://fylrk4c01pl-bxzgcyhy-1l8j2g-sw511a[.]pages[.]dev/

http://divace-coinsquare[.]zapier[.]app/

http://track[.]map-app[.]my[.]id/gZh

https://hklogin[.]uat[.]mizuhoscfglobal[.]com/oauth2/authorize?response_type=code&client_id=bca4f495-a205-4cb4-8b0a-07f4d88a7584&scope=openid%20email%20profile&state=eDcYeukV-Yqf6Phtrq0XmoQEi3qWjB4ZJVQKd1b3FLQ%3D&redirect_uri=https://hk.uat.mizuhoscfglobal.com/scf/login/oauth2/code/fusionauth&nonce=iKCQAqN9jgh-qbCgvqmDhVVdnmtR3jPBaOvRdNDTzhA&code_challenge=OD8gH4TYyaheiXEdbZvm8F3jH3IIxiWPhce5ThiUTg4&code_challenge_method=S256

DomainPhishingOpenphishDomain

facebook[.]webmau

www[.]roblox

xmqrb724nhw-zdcynfyn-2d9e0f-pj388a[.]pages

qw999agreg-mbtz1m8p9z2-fsgc12[.]pages

qw144c84y-mbtz8m9p1z2-qwxk[.]pages

fylrk4c01pl-bxzgcyhy-1l8j2g-sw511a[.]pages

divace-coinsquare[.]zapier

track[.]map

hklogin[.]uat

Download Indicators of Compromise (IOC)

For SOC/NOC ingestion, threat intelligence platforms, and SIEM integration.

Tags: Daily Briefs