============================================================================== CYBER THREAT INTELLIGENCE - INDICATORS OF COMPROMISE (IOC) LIST ============================================================================== Generated: 2026-11-10 12:15 UTC Report ID: IOC-20261110-121557 Total Indicators: 28 Classification: OPEN - Law Enforcement / DFIR use Sources: CISA KEV Catalog, OpenPhish SUMMARY ------------------------------------------------------------------------------ CISA KEV (Known Exploited Vulnerability): 10 Phishing URL: 9 Domain: 9 Severity: CRITICAL=28 ============================================================================== [CISA KEV (KNOWN EXPLOITED VULNERABILITY)] - 10 indicator(s) ============================================================================== #1 CVE-2026-102895 Severity: CRITICAL Description: GPUStack contains an improper authentication vulnerability which could allow unauthenticated administrative access, including user and model changes, persistent administrator API-key creation, disclosure of worker and cloud-provider secrets, and code Product: GPUStack (GPUStack) Source: CISA KEV Catalog NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-102895 URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog Date: 2026-11-09 Tags: kev,cisa,active-exploitation #2 CVE-2026-123158 Severity: CRITICAL Description: OpenBSD OpenSSH on Linux contains an unexpected status code or return value vulnerability that could allow for authentication bypass. Product: OpenSSH (OpenBSD) Source: CISA KEV Catalog NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-123158 URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog Date: 2026-11-09 Tags: kev,cisa,active-exploitation #3 CVE-2026-116779 Severity: CRITICAL Description: SignalWire FreeSwitch contains a code injection vulnerability that permits configuration and credential disclosure, arbitrary call control, and command execution. Product: FreeSwitch (SignalWire) Source: CISA KEV Catalog NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-116779 URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog Date: 2026-11-09 Tags: kev,cisa,active-exploitation #4 CVE-2026-123218 Severity: CRITICAL Description: IBM Aspera Faspex contains an incorrect authorization vulnerability that could allow an authenticated user to craft a specific message to bypass authorization, causing privilege escalations. Product: Aspera Faspex (IBM) Source: CISA KEV Catalog NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-123218 URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog Date: 2026-11-09 Tags: kev,cisa,active-exploitation #5 CVE-2026-19868 Severity: CRITICAL Description: SonicWall SonicOS SSLVPN contains a use of single-factor authentication vulnerability that may allow a user with valid credentials for an alternate authentication method to bypass SAML authentication controls. Successful exploitation may also bypass Product: SonicOS SSLVPN (SonicWall) Source: CISA KEV Catalog NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-19868 URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog Date: 2026-11-06 Tags: kev,cisa,active-exploitation #6 CVE-2024-27834 Severity: CRITICAL Description: Apple iOS, iPadOS, macOS, Safari, tvOS and watchOS 10.5 contain an improper authentication vulnerability which could allow an attacker with arbitrary read and write capability to bypass pointer authentication. Product: Multiple Products (Apple) Source: CISA KEV Catalog NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-27834 URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog Date: 2026-11-04 Tags: kev,cisa,active-exploitation #7 CVE-2026-119977 Severity: CRITICAL Description: WordPress WordPress Core contains a time-of-check time-of-use (TOCTOU) race condition vulnerability that could allow unauthenticated attackers to execute code on the server during the upgrade window. This is due to predictable, web-accessible staging Product: WordPress Core (WordPress) Source: CISA KEV Catalog NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-119977 URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog Date: 2026-11-03 Tags: kev,cisa,active-exploitation #8 CVE-2026-118527 Severity: CRITICAL Description: Ivanti Connect Secure contains a generation of predictable numbers or identifiers vulnerability that allows a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk. This vulnerability can be chaine Product: Connect Secure (Ivanti) Source: CISA KEV Catalog NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-118527 URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog Date: 2026-10-30 Tags: kev,cisa,active-exploitation #9 CVE-2026-111357 Severity: CRITICAL Description: Ivanti Connect Secure contains a missing authentication for critical function vulnerability that could allow a local authenticated attacker to escalate their privileges. This vulnerability can be chained with CVE-2026-104935 and CVE-2026-118527. Product: Connect Secure (Ivanti) Source: CISA KEV Catalog NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-111357 URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog Date: 2026-10-30 Tags: kev,cisa,active-exploitation #10 CVE-2026-97229 Severity: CRITICAL Description: GitLab Community Edition and Enterprise Edition contain a integer overflow or wraparound vulnerability that could allow an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD confi Product: Community Edition and Enterprise Edition (GitLab) Source: CISA KEV Catalog NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-97229 URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog Date: 2026-10-29 Tags: kev,cisa,active-exploitation ============================================================================== [PHISHING URL] - 9 indicator(s) ============================================================================== #11 https://streamlined-three-995346.framer.app/ Severity: CRITICAL Description: Active phishing URL: https://streamlined-three-995346.framer.app/ Source: OpenPhish URL: https://streamlined-three-995346.framer.app/ Date: Tags: phishing,openphish #12 https://fanpage-case.vercel.app/ Severity: CRITICAL Description: Active phishing URL: https://fanpage-case.vercel.app/ Source: OpenPhish URL: https://fanpage-case.vercel.app/ Date: Tags: phishing,openphish #13 http://pagina-inicial-instagram.vercel.app/ Severity: CRITICAL Description: Active phishing URL: http://pagina-inicial-instagram.vercel.app/ Source: OpenPhish URL: http://pagina-inicial-instagram.vercel.app/ Date: Tags: phishing,openphish #14 https://pagina-inicial-instagram-anesoledar.vercel.app/ Severity: CRITICAL Description: Active phishing URL: https://pagina-inicial-instagram-anesoledar.vercel.app/ Source: OpenPhish URL: https://pagina-inicial-instagram-anesoledar.vercel.app/ Date: Tags: phishing,openphish #15 http://tokeimx-cdnnode-sg16.xyz/ Severity: CRITICAL Description: Active phishing URL: http://tokeimx-cdnnode-sg16.xyz/ Source: OpenPhish URL: http://tokeimx-cdnnode-sg16.xyz/ Date: Tags: phishing,openphish #16 http://gjmrv53hwu-wznxb81fyn-3e1f8g-dm755c.pages.dev/ Severity: CRITICAL Description: Active phishing URL: http://gjmrv53hwu-wznxb81fyn-3e1f8g-dm755c.pages.dev/ Source: OpenPhish URL: http://gjmrv53hwu-wznxb81fyn-3e1f8g-dm755c.pages.dev/ Date: Tags: phishing,openphish #17 http://instagram-session.vercel.app/ Severity: CRITICAL Description: Active phishing URL: http://instagram-session.vercel.app/ Source: OpenPhish URL: http://instagram-session.vercel.app/ Date: Tags: phishing,openphish #18 https://chp-courriersdomicile.bolt.host/ Severity: CRITICAL Description: Active phishing URL: https://chp-courriersdomicile.bolt.host/ Source: OpenPhish URL: https://chp-courriersdomicile.bolt.host/ Date: Tags: phishing,openphish #19 https://coinbaseplogininin.gitbook.io/us Severity: CRITICAL Description: Active phishing URL: https://coinbaseplogininin.gitbook.io/us Source: OpenPhish URL: https://coinbaseplogininin.gitbook.io/us Date: Tags: phishing,openphish ============================================================================== [DOMAIN] - 9 indicator(s) ============================================================================== #20 streamlined-three-995346.framer Severity: CRITICAL Description: Phishing domain: streamlined-three-995346.framer Source: OpenPhish URL: https://streamlined-three-995346.framer.app/ Date: Tags: phishing,openphish,domain #21 fanpage-case.vercel Severity: CRITICAL Description: Phishing domain: fanpage-case.vercel Source: OpenPhish URL: https://fanpage-case.vercel.app/ Date: Tags: phishing,openphish,domain #22 pagina-inicial-instagram.vercel Severity: CRITICAL Description: Phishing domain: pagina-inicial-instagram.vercel Source: OpenPhish URL: http://pagina-inicial-instagram.vercel.app/ Date: Tags: phishing,openphish,domain #23 pagina-inicial-instagram-anesoledar.vercel Severity: CRITICAL Description: Phishing domain: pagina-inicial-instagram-anesoledar.vercel Source: OpenPhish URL: https://pagina-inicial-instagram-anesoledar.vercel.app/ Date: Tags: phishing,openphish,domain #24 tokeimx-cdnnode-sg16.xyz Severity: CRITICAL Description: Phishing domain: tokeimx-cdnnode-sg16.xyz Source: OpenPhish URL: http://tokeimx-cdnnode-sg16.xyz/ Date: Tags: phishing,openphish,domain #25 gjmrv53hwu-wznxb81fyn-3e1f8g-dm755c.pages Severity: CRITICAL Description: Phishing domain: gjmrv53hwu-wznxb81fyn-3e1f8g-dm755c.pages Source: OpenPhish URL: http://gjmrv53hwu-wznxb81fyn-3e1f8g-dm755c.pages.dev/ Date: Tags: phishing,openphish,domain #26 instagram-session.vercel Severity: CRITICAL Description: Phishing domain: instagram-session.vercel Source: OpenPhish URL: http://instagram-session.vercel.app/ Date: Tags: phishing,openphish,domain #27 chp-courriersdomicile.bolt Severity: CRITICAL Description: Phishing domain: chp-courriersdomicile.bolt Source: OpenPhish URL: https://chp-courriersdomicile.bolt.host/ Date: Tags: phishing,openphish,domain #28 coinbaseplogininin.gitbook Severity: CRITICAL Description: Phishing domain: coinbaseplogininin.gitbook Source: OpenPhish URL: https://coinbaseplogininin.gitbook.io/us Date: Tags: phishing,openphish,domain ============================================================================== RECOMMENDED ACTIONS ============================================================================== 1. Search SIEM/network logs for all listed indicators 2. Block listed domains at DNS/proxy immediately 3. Scan endpoints for listed SHA256 hashes 4. Check email gateways for listed sender addresses/links 5. Block listed IP addresses at the firewall 6. Share IOCs with partner agencies and ISACs 7. Update detection rules (Sigma/YARA/Suricata/Splunk) 8. Monitor for indicator rotation (new domains, IP changes) ============================================================================== END OF IOC LIST - IOC-20261110-121557 ==============================================================================