{ "Event": { "id": 0, "date": "2026-09-21", "threat_level_id": 1, "analysis": 0, "attribute_count": "28", "publish_distribution": 0, "proposal_email_lock": false, "info": "Cyber Daily Brief IOC Report - 2026-09-21 12:16 UTC", "published": false, "uuid": "misp-event-IOC-20260921-121601", "orgc_id": 0, "Orgc": { "name": "Cyber Daily Brief" }, "distribution": 0, "tags": [ "ioc-report::2026-09-21 12:16 UTC", "classification:text", "export:requires-approval::0" ], "sharing_group_id": 0, "disable_correlation": false, "expected_count": 28, "event_level": 1, "analysis_status": "1", "Attribute": [ { "category": "Artefact on host", "type": "cve", "value": "CVE-2025-39964", "to_ids": true, "disable_correlation": false, "comment": "Severity: CRITICAL; Product: Kernel (Linux); Source: CISA KEV Catalog; URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog; Date: 2026-09-18; Section: CISA KEV (KNOWN EXPLOITED VULNERABILITY); Description: Linux Kernel contains a race condition vulnerability which allows concurrent writes to the same AF_ALG socket causing data to be unpredictably interleaved and creating inconsistencies in the socket's ", "distribution": 0, "sharing_group_id": 0, "Tag": [ "severity:CRITICAL", "section:CISA KEV (KNOWN EXPLOITED VULNERABILITY)", "tag:kev", "tag:cisa", "tag:active-exploitation" ], "first_seen": "2026-09-18", "last_seen": "2026-09-18" }, { "category": "Artefact on host", "type": "cve", "value": "CVE-2026-53266", "to_ids": true, "disable_correlation": false, "comment": "Severity: CRITICAL; Product: Kernel (Linux); Source: CISA KEV Catalog; URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog; Date: 2026-09-18; Section: CISA KEV (KNOWN EXPLOITED VULNERABILITY); Description: Linux Kernel contains an out-of-bounds write vulnerability in the ebtables SNAT target which allows an ARP sender hardware address rewrite to write directly into a nonlinear socket-buffer fragment bac", "distribution": 0, "sharing_group_id": 0, "Tag": [ "severity:CRITICAL", "section:CISA KEV (KNOWN EXPLOITED VULNERABILITY)", "tag:kev", "tag:cisa", "tag:active-exploitation" ], "first_seen": "2026-09-18", "last_seen": "2026-09-18" }, { "category": "Artefact on host", "type": "cve", "value": "CVE-2025-39682", "to_ids": true, "disable_correlation": false, "comment": "Severity: CRITICAL; Product: Kernel (Linux); Source: CISA KEV Catalog; URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog; Date: 2026-09-18; Section: CISA KEV (KNOWN EXPLOITED VULNERABILITY); Description: Linux Kernel contains an improper check for unusual or exceptional conditions vulnerability in the TLS receive path which allows a zero-length record retrieved from the rx_list to bypass the intended ", "distribution": 0, "sharing_group_id": 0, "Tag": [ "severity:CRITICAL", "section:CISA KEV (KNOWN EXPLOITED VULNERABILITY)", "tag:kev", "tag:cisa", "tag:active-exploitation" ], "first_seen": "2026-09-18", "last_seen": "2026-09-18" }, { "category": "Artefact on host", "type": "cve", "value": "CVE-2026-58704", "to_ids": true, "disable_correlation": false, "comment": "Severity: CRITICAL; Product: Pixel (Google); Source: CISA KEV Catalog; URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog; Date: 2026-09-16; Section: CISA KEV (KNOWN EXPLOITED VULNERABILITY); Description: Google Pixel devices contain an improper authorization vulnerability in the cellular modem. A logic error may allow an attacker to bypass permission checks and escalate privileges.", "distribution": 0, "sharing_group_id": 0, "Tag": [ "severity:CRITICAL", "section:CISA KEV (KNOWN EXPLOITED VULNERABILITY)", "tag:kev", "tag:cisa", "tag:active-exploitation" ], "first_seen": "2026-09-16", "last_seen": "2026-09-16" }, { "category": "Artefact on host", "type": "cve", "value": "CVE-2026-76460", "to_ids": true, "disable_correlation": false, "comment": "Severity: CRITICAL; Product: Identity Services Engine (Cisco); Source: CISA KEV Catalog; URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog; Date: 2026-09-16; Section: CISA KEV (KNOWN EXPLOITED VULNERABILITY); Description: Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) contain an incorrect use of privileged APIs vulnerability that could allow an unauthenticated, remote attacker t", "distribution": 0, "sharing_group_id": 0, "Tag": [ "severity:CRITICAL", "section:CISA KEV (KNOWN EXPLOITED VULNERABILITY)", "tag:kev", "tag:cisa", "tag:active-exploitation" ], "first_seen": "2026-09-16", "last_seen": "2026-09-16" }, { "category": "Artefact on host", "type": "cve", "value": "CVE-2026-87886", "to_ids": true, "disable_correlation": false, "comment": "Severity: CRITICAL; Product: Backup (Acronis); Source: CISA KEV Catalog; URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog; Date: 2026-09-16; Section: CISA KEV (KNOWN EXPLOITED VULNERABILITY); Description: Acronis Backup plugin for cPanel & WHM and extension for Plesk contains an incorrect default permissions vulnerability that could allow for privilege escalation.", "distribution": 0, "sharing_group_id": 0, "Tag": [ "severity:CRITICAL", "section:CISA KEV (KNOWN EXPLOITED VULNERABILITY)", "tag:kev", "tag:cisa", "tag:active-exploitation" ], "first_seen": "2026-09-16", "last_seen": "2026-09-16" }, { "category": "Artefact on host", "type": "cve", "value": "CVE-2026-76461", "to_ids": true, "disable_correlation": false, "comment": "Severity: CRITICAL; Product: Secure Email Gateway (Cisco); Source: CISA KEV Catalog; URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog; Date: 2026-09-14; Section: CISA KEV (KNOWN EXPLOITED VULNERABILITY); Description: Cisco AsyncOS software for Cisco Secure Email Gateway (SEG) contains a SQL injection vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileg", "distribution": 0, "sharing_group_id": 0, "Tag": [ "severity:CRITICAL", "section:CISA KEV (KNOWN EXPLOITED VULNERABILITY)", "tag:kev", "tag:cisa", "tag:active-exploitation" ], "first_seen": "2026-09-14", "last_seen": "2026-09-14" }, { "category": "Artefact on host", "type": "cve", "value": "CVE-2026-84869", "to_ids": true, "disable_correlation": false, "comment": "Severity: CRITICAL; Product: ScreenConnect (ConnectWise); Source: CISA KEV Catalog; URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog; Date: 2026-09-11; Section: CISA KEV (KNOWN EXPLOITED VULNERABILITY); Description: ConnectWise ScreenConnect contains both an improper privilege management and missing authorization vulnerability that may allow an attacker to transfer and execute files through an active remote sessi", "distribution": 0, "sharing_group_id": 0, "Tag": [ "severity:CRITICAL", "section:CISA KEV (KNOWN EXPLOITED VULNERABILITY)", "tag:kev", "tag:cisa", "tag:active-exploitation" ], "first_seen": "2026-09-11", "last_seen": "2026-09-11" }, { "category": "Artefact on host", "type": "cve", "value": "CVE-2026-42016", "to_ids": true, "disable_correlation": false, "comment": "Severity: CRITICAL; Product: Artifactory (JFrog); Source: CISA KEV Catalog; URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog; Date: 2026-09-11; Section: CISA KEV (KNOWN EXPLOITED VULNERABILITY); Description: JFrog Artifactory contains an incorrect authorization vulnerability that leads to a privilege escalation attack due to a validation check of the token signature/issuer and not the token\u2019s scope.", "distribution": 0, "sharing_group_id": 0, "Tag": [ "severity:CRITICAL", "section:CISA KEV (KNOWN EXPLOITED VULNERABILITY)", "tag:kev", "tag:cisa", "tag:active-exploitation" ], "first_seen": "2026-09-11", "last_seen": "2026-09-11" }, { "category": "Artefact on host", "type": "cve", "value": "CVE-2026-42018", "to_ids": true, "disable_correlation": false, "comment": "Severity: CRITICAL; Product: Artifactory (JFrog); Source: CISA KEV Catalog; URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog; Date: 2026-09-11; Section: PHISHING URL; Description: JFrog Artifactory contains an improper authentication vulnerability that could return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled, potentially expos", "distribution": 0, "sharing_group_id": 0, "Tag": [ "severity:CRITICAL", "section:PHISHING URL", "tag:kev", "tag:cisa", "tag:active-exploitation" ], "first_seen": "2026-09-11", "last_seen": "2026-09-11" }, { "category": "Other", "type": "other", "value": "https://fedexs.vip/", "to_ids": true, "disable_correlation": false, "comment": "Severity: CRITICAL; Source: OpenPhish; URL: https://fedexs.vip/; Section: PHISHING URL; Description: Active phishing URL: https://fedexs.vip/", "distribution": 0, "sharing_group_id": 0, "Tag": [ "severity:CRITICAL", "section:PHISHING URL", "tag:phishing", "tag:openphish" ], "first_seen": "", "last_seen": "" }, { "category": "Other", "type": "other", "value": "http://harshalkadav19.github.io/spotify", "to_ids": true, "disable_correlation": false, "comment": "Severity: CRITICAL; Source: OpenPhish; URL: http://harshalkadav19.github.io/spotify; Section: PHISHING URL; Description: Active phishing URL: http://harshalkadav19.github.io/spotify", "distribution": 0, "sharing_group_id": 0, "Tag": [ "severity:CRITICAL", "section:PHISHING URL", "tag:phishing", "tag:openphish" ], "first_seen": "", "last_seen": "" }, { "category": "Other", "type": "other", "value": "http://aniket055.github.io/Amazon", "to_ids": true, "disable_correlation": false, "comment": "Severity: CRITICAL; Source: OpenPhish; URL: http://aniket055.github.io/Amazon; Section: PHISHING URL; Description: Active phishing URL: http://aniket055.github.io/Amazon", "distribution": 0, "sharing_group_id": 0, "Tag": [ "severity:CRITICAL", "section:PHISHING URL", "tag:phishing", "tag:openphish" ], "first_seen": "", "last_seen": "" }, { "category": "Other", "type": "other", "value": "https://zara-two-theta.vercel.app/", "to_ids": true, "disable_correlation": false, "comment": "Severity: CRITICAL; Source: OpenPhish; URL: https://zara-two-theta.vercel.app/; Section: PHISHING URL; Description: Active phishing URL: https://zara-two-theta.vercel.app/", "distribution": 0, "sharing_group_id": 0, "Tag": [ "severity:CRITICAL", "section:PHISHING URL", "tag:phishing", "tag:openphish" ], "first_seen": "", "last_seen": "" }, { "category": "Other", "type": "other", "value": "https://zara-self-kappa.vercel.app/", "to_ids": true, "disable_correlation": false, "comment": "Severity: CRITICAL; Source: OpenPhish; URL: https://zara-self-kappa.vercel.app/; Section: PHISHING URL; Description: Active phishing URL: https://zara-self-kappa.vercel.app/", "distribution": 0, "sharing_group_id": 0, "Tag": [ "severity:CRITICAL", "section:PHISHING URL", "tag:phishing", "tag:openphish" ], "first_seen": "", "last_seen": "" }, { "category": "Other", "type": "other", "value": "http://czido.vip/", "to_ids": true, "disable_correlation": false, "comment": "Severity: CRITICAL; Source: OpenPhish; URL: http://czido.vip/; Section: PHISHING URL; Description: Active phishing URL: http://czido.vip/", "distribution": 0, "sharing_group_id": 0, "Tag": [ "severity:CRITICAL", "section:PHISHING URL", "tag:phishing", "tag:openphish" ], "first_seen": "", "last_seen": "" }, { "category": "Other", "type": "other", "value": "http://ayushchauhan0401.github.io/Amazon", "to_ids": true, "disable_correlation": false, "comment": "Severity: CRITICAL; Source: OpenPhish; URL: http://ayushchauhan0401.github.io/Amazon; Section: PHISHING URL; Description: Active phishing URL: http://ayushchauhan0401.github.io/Amazon", "distribution": 0, "sharing_group_id": 0, "Tag": [ "severity:CRITICAL", "section:PHISHING URL", "tag:phishing", "tag:openphish" ], "first_seen": "", "last_seen": "" }, { "category": "Other", "type": "other", "value": "http://www.shopee3589.blogspot.com/", "to_ids": true, "disable_correlation": false, "comment": "Severity: CRITICAL; Source: OpenPhish; URL: http://www.shopee3589.blogspot.com/; Section: PHISHING URL; Description: Active phishing URL: http://www.shopee3589.blogspot.com/", "distribution": 0, "sharing_group_id": 0, "Tag": [ "severity:CRITICAL", "section:PHISHING URL", "tag:phishing", "tag:openphish" ], "first_seen": "", "last_seen": "" }, { "category": "Other", "type": "other", "value": "https://helps-ledgro-logi-usa.pages.dev/", "to_ids": true, "disable_correlation": false, "comment": "Severity: CRITICAL; Source: OpenPhish; URL: https://helps-ledgro-logi-usa.pages.dev/; Section: DOMAIN; Description: Active phishing URL: https://helps-ledgro-logi-usa.pages.dev/", "distribution": 0, "sharing_group_id": 0, "Tag": [ "severity:CRITICAL", "section:DOMAIN", "tag:phishing", "tag:openphish" ], "first_seen": "", "last_seen": "" }, { "category": "Domain and name", "type": "domain", "value": "fedexs.vip", "to_ids": true, "disable_correlation": false, "comment": "Severity: CRITICAL; Source: OpenPhish; URL: https://fedexs.vip/; Section: DOMAIN; Description: Phishing domain: fedexs.vip", "distribution": 0, "sharing_group_id": 0, "Tag": [ "severity:CRITICAL", "section:DOMAIN", "tag:phishing", "tag:openphish", "tag:domain" ], "first_seen": "", "last_seen": "" }, { "category": "Domain and name", "type": "domain", "value": "harshalkadav19.github", "to_ids": true, "disable_correlation": false, "comment": "Severity: CRITICAL; Source: OpenPhish; URL: http://harshalkadav19.github.io/spotify; Section: DOMAIN; Description: Phishing domain: harshalkadav19.github", "distribution": 0, "sharing_group_id": 0, "Tag": [ "severity:CRITICAL", "section:DOMAIN", "tag:phishing", "tag:openphish", "tag:domain" ], "first_seen": "", "last_seen": "" }, { "category": "Domain and name", "type": "domain", "value": "aniket055.github", "to_ids": true, "disable_correlation": false, "comment": "Severity: CRITICAL; Source: OpenPhish; URL: http://aniket055.github.io/Amazon; Section: DOMAIN; Description: Phishing domain: aniket055.github", "distribution": 0, "sharing_group_id": 0, "Tag": [ "severity:CRITICAL", "section:DOMAIN", "tag:phishing", "tag:openphish", "tag:domain" ], "first_seen": "", "last_seen": "" }, { "category": "Domain and name", "type": "domain", "value": "zara-two-theta.vercel", "to_ids": true, "disable_correlation": false, "comment": "Severity: CRITICAL; Source: OpenPhish; URL: https://zara-two-theta.vercel.app/; Section: DOMAIN; Description: Phishing domain: zara-two-theta.vercel", "distribution": 0, "sharing_group_id": 0, "Tag": [ "severity:CRITICAL", "section:DOMAIN", "tag:phishing", "tag:openphish", "tag:domain" ], "first_seen": "", "last_seen": "" }, { "category": "Domain and name", "type": "domain", "value": "zara-self-kappa.vercel", "to_ids": true, "disable_correlation": false, "comment": "Severity: CRITICAL; Source: OpenPhish; URL: https://zara-self-kappa.vercel.app/; Section: DOMAIN; Description: Phishing domain: zara-self-kappa.vercel", "distribution": 0, "sharing_group_id": 0, "Tag": [ "severity:CRITICAL", "section:DOMAIN", "tag:phishing", "tag:openphish", "tag:domain" ], "first_seen": "", "last_seen": "" }, { "category": "Domain and name", "type": "domain", "value": "czido.vip", "to_ids": true, "disable_correlation": false, "comment": "Severity: CRITICAL; Source: OpenPhish; URL: http://czido.vip/; Section: DOMAIN; Description: Phishing domain: czido.vip", "distribution": 0, "sharing_group_id": 0, "Tag": [ "severity:CRITICAL", "section:DOMAIN", "tag:phishing", "tag:openphish", "tag:domain" ], "first_seen": "", "last_seen": "" }, { "category": "Domain and name", "type": "domain", "value": "ayushchauhan0401.github", "to_ids": true, "disable_correlation": false, "comment": "Severity: CRITICAL; Source: OpenPhish; URL: http://ayushchauhan0401.github.io/Amazon; Section: DOMAIN; Description: Phishing domain: ayushchauhan0401.github", "distribution": 0, "sharing_group_id": 0, "Tag": [ "severity:CRITICAL", "section:DOMAIN", "tag:phishing", "tag:openphish", "tag:domain" ], "first_seen": "", "last_seen": "" }, { "category": "Domain and name", "type": "domain", "value": "shopee3589.blogspot", "to_ids": true, "disable_correlation": false, "comment": "Severity: CRITICAL; Source: OpenPhish; URL: http://www.shopee3589.blogspot.com/; Section: DOMAIN; Description: Phishing domain: shopee3589.blogspot", "distribution": 0, "sharing_group_id": 0, "Tag": [ "severity:CRITICAL", "section:DOMAIN", "tag:phishing", "tag:openphish", "tag:domain" ], "first_seen": "", "last_seen": "" }, { "category": "Domain and name", "type": "domain", "value": "helps-ledgro-logi-usa.pages", "to_ids": true, "disable_correlation": false, "comment": "Severity: CRITICAL; Source: OpenPhish; URL: https://helps-ledgro-logi-usa.pages.dev/; Section: DOMAIN; Description: Phishing domain: helps-ledgro-logi-usa.pages", "distribution": 0, "sharing_group_id": 0, "Tag": [ "severity:CRITICAL", "section:DOMAIN", "tag:phishing", "tag:openphish", "tag:domain" ], "first_seen": "", "last_seen": "" } ] } }