{ "Event": { "id": 0, "date": "2026-10-14", "threat_level_id": 1, "analysis": 0, "attribute_count": "28", "publish_distribution": 0, "proposal_email_lock": false, "info": "Cyber Daily Brief IOC Report - 2026-10-14 12:15 UTC", "published": false, "uuid": "misp-event-IOC-20261014-121555", "orgc_id": 0, "Orgc": { "name": "Cyber Daily Brief" }, "distribution": 0, "tags": [ "ioc-report::2026-10-14 12:15 UTC", "classification:text", "export:requires-approval::0" ], "sharing_group_id": 0, "disable_correlation": false, "expected_count": 28, "event_level": 1, "analysis_status": "1", "Attribute": [ { "category": "Artefact on host", "type": "cve", "value": "CVE-2026-104935", "to_ids": true, "disable_correlation": false, "comment": "Severity: CRITICAL; Product: Connect Secure (Ivanti); Source: CISA KEV Catalog; URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog; Date: 2026-10-13; Section: CISA KEV (KNOWN EXPLOITED VULNERABILITY); Description: Ivanti Connect Secure contains an authentication bypass by spoofing vulnerability that allows a remote unauthenticated attacker to execute arbitrary commands.", "distribution": 0, "sharing_group_id": 0, "Tag": [ "severity:CRITICAL", "section:CISA KEV (KNOWN EXPLOITED VULNERABILITY)", "tag:kev", "tag:cisa", "tag:active-exploitation" ], "first_seen": "2026-10-13", "last_seen": "2026-10-13" }, { "category": "Artefact on host", "type": "cve", "value": "CVE-2026-96951", "to_ids": true, "disable_correlation": false, "comment": "Severity: CRITICAL; Product: Windows (Microsoft); Source: CISA KEV Catalog; URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog; Date: 2026-10-13; Section: CISA KEV (KNOWN EXPLOITED VULNERABILITY); Description: Microsoft Windows Shell contains a command injection vulnerability that allows an unauthorized attacker to bypass a security feature over a network.", "distribution": 0, "sharing_group_id": 0, "Tag": [ "severity:CRITICAL", "section:CISA KEV (KNOWN EXPLOITED VULNERABILITY)", "tag:kev", "tag:cisa", "tag:active-exploitation" ], "first_seen": "2026-10-13", "last_seen": "2026-10-13" }, { "category": "Artefact on host", "type": "cve", "value": "CVE-2015-5477", "to_ids": true, "disable_correlation": false, "comment": "Severity: CRITICAL; Product: BIND (ISC); Source: CISA KEV Catalog; URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog; Date: 2026-10-08; Section: CISA KEV (KNOWN EXPLOITED VULNERABILITY); Description: ISC BIND contains a data processing errors vulnerability that could allow remote attackers to cause a denial of service via TKEY queries.", "distribution": 0, "sharing_group_id": 0, "Tag": [ "severity:CRITICAL", "section:CISA KEV (KNOWN EXPLOITED VULNERABILITY)", "tag:kev", "tag:cisa", "tag:active-exploitation" ], "first_seen": "2026-10-08", "last_seen": "2026-10-08" }, { "category": "Artefact on host", "type": "cve", "value": "CVE-2016-3081", "to_ids": true, "disable_correlation": false, "comment": "Severity: CRITICAL; Product: Struts (Apache); Source: CISA KEV Catalog; URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog; Date: 2026-10-08; Section: CISA KEV (KNOWN EXPLOITED VULNERABILITY); Description: Apache Struts contains a command injection vulnerability that could allow remote attackers to execute arbitrary code via method:prefix when Dynamic Method Invocation is enabled.", "distribution": 0, "sharing_group_id": 0, "Tag": [ "severity:CRITICAL", "section:CISA KEV (KNOWN EXPLOITED VULNERABILITY)", "tag:kev", "tag:cisa", "tag:active-exploitation" ], "first_seen": "2026-10-08", "last_seen": "2026-10-08" }, { "category": "Artefact on host", "type": "cve", "value": "CVE-2023-22894", "to_ids": true, "disable_correlation": false, "comment": "Severity: CRITICAL; Product: Strapi (Strapi); Source: CISA KEV Catalog; URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog; Date: 2026-10-08; Section: CISA KEV (KNOWN EXPLOITED VULNERABILITY); Description: Strapi contains a cleartext storage of sensitive information vulnerability that could allow attackers with access to the admin panel to discover sensitive user details via the query filter. The impact", "distribution": 0, "sharing_group_id": 0, "Tag": [ "severity:CRITICAL", "section:CISA KEV (KNOWN EXPLOITED VULNERABILITY)", "tag:kev", "tag:cisa", "tag:active-exploitation" ], "first_seen": "2026-10-08", "last_seen": "2026-10-08" }, { "category": "Artefact on host", "type": "cve", "value": "CVE-2021-3199", "to_ids": true, "disable_correlation": false, "comment": "Severity: CRITICAL; Product: Docs (ONLYOFFICE); Source: CISA KEV Catalog; URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog; Date: 2026-10-08; Section: CISA KEV (KNOWN EXPLOITED VULNERABILITY); Description: ONLYOFFICE Docs contains a path traversal vulnerability that can occur when JWT is used, via a /.. sequence in an image upload parameter and could allow for remote code execution.", "distribution": 0, "sharing_group_id": 0, "Tag": [ "severity:CRITICAL", "section:CISA KEV (KNOWN EXPLOITED VULNERABILITY)", "tag:kev", "tag:cisa", "tag:active-exploitation" ], "first_seen": "2026-10-08", "last_seen": "2026-10-08" }, { "category": "Artefact on host", "type": "cve", "value": "CVE-2015-3306", "to_ids": true, "disable_correlation": false, "comment": "Severity: CRITICAL; Product: ProFTPD (ProFTPD); Source: CISA KEV Catalog; URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog; Date: 2026-10-08; Section: CISA KEV (KNOWN EXPLOITED VULNERABILITY); Description: ProFTPD contains an improper access control vulnerability that could allow remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.", "distribution": 0, "sharing_group_id": 0, "Tag": [ "severity:CRITICAL", "section:CISA KEV (KNOWN EXPLOITED VULNERABILITY)", "tag:kev", "tag:cisa", "tag:active-exploitation" ], "first_seen": "2026-10-08", "last_seen": "2026-10-08" }, { "category": "Artefact on host", "type": "cve", "value": "CVE-2026-88779", "to_ids": true, "disable_correlation": false, "comment": "Severity: CRITICAL; Product: NetScaler (Citrix); Source: CISA KEV Catalog; URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog; Date: 2026-10-04; Section: CISA KEV (KNOWN EXPLOITED VULNERABILITY); Description: Citrix NetScaler ADC (formerly Citrix ADC) and Citrix NetScaler Gateway (formerly Citrix Gateway) contain an improper restriction of operations within the bounds of a memory buffer vulnerability that ", "distribution": 0, "sharing_group_id": 0, "Tag": [ "severity:CRITICAL", "section:CISA KEV (KNOWN EXPLOITED VULNERABILITY)", "tag:kev", "tag:cisa", "tag:active-exploitation" ], "first_seen": "2026-10-04", "last_seen": "2026-10-04" }, { "category": "Artefact on host", "type": "cve", "value": "CVE-2026-102490", "to_ids": true, "disable_correlation": false, "comment": "Severity: CRITICAL; Product: Zammad (Zammad GmbH); Source: CISA KEV Catalog; URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog; Date: 2026-10-02; Section: CISA KEV (KNOWN EXPLOITED VULNERABILITY); Description: Zammad GmbH Zammad contains an improper privilege management vulnerability that can allow the local zammad user to escalate privileges to root. This vulnerability can be chained with CVE-2026-102489.", "distribution": 0, "sharing_group_id": 0, "Tag": [ "severity:CRITICAL", "section:CISA KEV (KNOWN EXPLOITED VULNERABILITY)", "tag:kev", "tag:cisa", "tag:active-exploitation" ], "first_seen": "2026-10-02", "last_seen": "2026-10-02" }, { "category": "Artefact on host", "type": "cve", "value": "CVE-2026-102489", "to_ids": true, "disable_correlation": false, "comment": "Severity: CRITICAL; Product: Zammad (Zammad GmbH); Source: CISA KEV Catalog; URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog; Date: 2026-10-02; Section: PHISHING URL; Description: Zammad GmbH Zammad contains a session fixation vulnerability that can lead to remote code execution as the zammad user. This vulnerability can be chained with CVE-2026-102490.", "distribution": 0, "sharing_group_id": 0, "Tag": [ "severity:CRITICAL", "section:PHISHING URL", "tag:kev", "tag:cisa", "tag:active-exploitation" ], "first_seen": "2026-10-02", "last_seen": "2026-10-02" }, { "category": "Other", "type": "other", "value": "https://facebook.tamil.bid/", "to_ids": true, "disable_correlation": false, "comment": "Severity: CRITICAL; Source: OpenPhish; URL: https://facebook.tamil.bid/; Section: PHISHING URL; Description: Active phishing URL: https://facebook.tamil.bid/", "distribution": 0, "sharing_group_id": 0, "Tag": [ "severity:CRITICAL", "section:PHISHING URL", "tag:phishing", "tag:openphish" ], "first_seen": "", "last_seen": "" }, { "category": "Other", "type": "other", "value": "https://tokenimx-cdn-edge-hk07.club/", "to_ids": true, "disable_correlation": false, "comment": "Severity: CRITICAL; Source: OpenPhish; URL: https://tokenimx-cdn-edge-hk07.club/; Section: PHISHING URL; Description: Active phishing URL: https://tokenimx-cdn-edge-hk07.club/", "distribution": 0, "sharing_group_id": 0, "Tag": [ "severity:CRITICAL", "section:PHISHING URL", "tag:phishing", "tag:openphish" ], "first_seen": "", "last_seen": "" }, { "category": "Other", "type": "other", "value": "http://qenfelo-mpt-vuzqari-k6x4pe91.pages.dev/", "to_ids": true, "disable_correlation": false, "comment": "Severity: CRITICAL; Source: OpenPhish; URL: http://qenfelo-mpt-vuzqari-k6x4pe91.pages.dev/; Section: PHISHING URL; Description: Active phishing URL: http://qenfelo-mpt-vuzqari-k6x4pe91.pages.dev/", "distribution": 0, "sharing_group_id": 0, "Tag": [ "severity:CRITICAL", "section:PHISHING URL", "tag:phishing", "tag:openphish" ], "first_seen": "", "last_seen": "" }, { "category": "Other", "type": "other", "value": "http://zunquri-mpt-vafqelo-k4x7pe81.pages.dev/", "to_ids": true, "disable_correlation": false, "comment": "Severity: CRITICAL; Source: OpenPhish; URL: http://zunquri-mpt-vafqelo-k4x7pe81.pages.dev/; Section: PHISHING URL; Description: Active phishing URL: http://zunquri-mpt-vafqelo-k4x7pe81.pages.dev/", "distribution": 0, "sharing_group_id": 0, "Tag": [ "severity:CRITICAL", "section:PHISHING URL", "tag:phishing", "tag:openphish" ], "first_seen": "", "last_seen": "" }, { "category": "Other", "type": "other", "value": "https://sp21ct-kemvi-biz-ranu-pelo.pages.dev/", "to_ids": true, "disable_correlation": false, "comment": "Severity: CRITICAL; Source: OpenPhish; URL: https://sp21ct-kemvi-biz-ranu-pelo.pages.dev/; Section: PHISHING URL; Description: Active phishing URL: https://sp21ct-kemvi-biz-ranu-pelo.pages.dev/", "distribution": 0, "sharing_group_id": 0, "Tag": [ "severity:CRITICAL", "section:PHISHING URL", "tag:phishing", "tag:openphish" ], "first_seen": "", "last_seen": "" }, { "category": "Other", "type": "other", "value": "http://raqfuro-mpt-zelqani-h7d9ka64.pages.dev/", "to_ids": true, "disable_correlation": false, "comment": "Severity: CRITICAL; Source: OpenPhish; URL: http://raqfuro-mpt-zelqani-h7d9ka64.pages.dev/; Section: PHISHING URL; Description: Active phishing URL: http://raqfuro-mpt-zelqani-h7d9ka64.pages.dev/", "distribution": 0, "sharing_group_id": 0, "Tag": [ "severity:CRITICAL", "section:PHISHING URL", "tag:phishing", "tag:openphish" ], "first_seen": "", "last_seen": "" }, { "category": "Other", "type": "other", "value": "https://offiical-s-exous.pages.dev/", "to_ids": true, "disable_correlation": false, "comment": "Severity: CRITICAL; Source: OpenPhish; URL: https://offiical-s-exous.pages.dev/; Section: PHISHING URL; Description: Active phishing URL: https://offiical-s-exous.pages.dev/", "distribution": 0, "sharing_group_id": 0, "Tag": [ "severity:CRITICAL", "section:PHISHING URL", "tag:phishing", "tag:openphish" ], "first_seen": "", "last_seen": "" }, { "category": "Other", "type": "other", "value": "http://sp1ct10-hurrek-biz-rumzo-vemti-wuy.pages.dev/", "to_ids": true, "disable_correlation": false, "comment": "Severity: CRITICAL; Source: OpenPhish; URL: http://sp1ct10-hurrek-biz-rumzo-vemti-wuy.pages.dev/; Section: PHISHING URL; Description: Active phishing URL: http://sp1ct10-hurrek-biz-rumzo-vemti-wuy.pages.dev/", "distribution": 0, "sharing_group_id": 0, "Tag": [ "severity:CRITICAL", "section:PHISHING URL", "tag:phishing", "tag:openphish" ], "first_seen": "", "last_seen": "" }, { "category": "Other", "type": "other", "value": "https://22cu0i-20zkk-7s8-i96d9n-w9z.pages.dev/", "to_ids": true, "disable_correlation": false, "comment": "Severity: CRITICAL; Source: OpenPhish; URL: https://22cu0i-20zkk-7s8-i96d9n-w9z.pages.dev/; Section: DOMAIN; Description: Active phishing URL: https://22cu0i-20zkk-7s8-i96d9n-w9z.pages.dev/", "distribution": 0, "sharing_group_id": 0, "Tag": [ "severity:CRITICAL", "section:DOMAIN", "tag:phishing", "tag:openphish" ], "first_seen": "", "last_seen": "" }, { "category": "Domain and name", "type": "domain", "value": "facebook.tamil", "to_ids": true, "disable_correlation": false, "comment": "Severity: CRITICAL; Source: OpenPhish; URL: https://facebook.tamil.bid/; Section: DOMAIN; Description: Phishing domain: facebook.tamil", "distribution": 0, "sharing_group_id": 0, "Tag": [ "severity:CRITICAL", "section:DOMAIN", "tag:phishing", "tag:openphish", "tag:domain" ], "first_seen": "", "last_seen": "" }, { "category": "Domain and name", "type": "domain", "value": "tokenimx-cdn-edge-hk07.club", "to_ids": true, "disable_correlation": false, "comment": "Severity: CRITICAL; Source: OpenPhish; URL: https://tokenimx-cdn-edge-hk07.club/; Section: DOMAIN; Description: Phishing domain: tokenimx-cdn-edge-hk07.club", "distribution": 0, "sharing_group_id": 0, "Tag": [ "severity:CRITICAL", "section:DOMAIN", "tag:phishing", "tag:openphish", "tag:domain" ], "first_seen": "", "last_seen": "" }, { "category": "Domain and name", "type": "domain", "value": "qenfelo-mpt-vuzqari-k6x4pe91.pages", "to_ids": true, "disable_correlation": false, "comment": "Severity: CRITICAL; Source: OpenPhish; URL: http://qenfelo-mpt-vuzqari-k6x4pe91.pages.dev/; Section: DOMAIN; Description: Phishing domain: qenfelo-mpt-vuzqari-k6x4pe91.pages", "distribution": 0, "sharing_group_id": 0, "Tag": [ "severity:CRITICAL", "section:DOMAIN", "tag:phishing", "tag:openphish", "tag:domain" ], "first_seen": "", "last_seen": "" }, { "category": "Domain and name", "type": "domain", "value": "zunquri-mpt-vafqelo-k4x7pe81.pages", "to_ids": true, "disable_correlation": false, "comment": "Severity: CRITICAL; Source: OpenPhish; URL: http://zunquri-mpt-vafqelo-k4x7pe81.pages.dev/; Section: DOMAIN; Description: Phishing domain: zunquri-mpt-vafqelo-k4x7pe81.pages", "distribution": 0, "sharing_group_id": 0, "Tag": [ "severity:CRITICAL", "section:DOMAIN", "tag:phishing", "tag:openphish", "tag:domain" ], "first_seen": "", "last_seen": "" }, { "category": "Domain and name", "type": "domain", "value": "sp21ct-kemvi-biz-ranu-pelo.pages", "to_ids": true, "disable_correlation": false, "comment": "Severity: CRITICAL; Source: OpenPhish; URL: https://sp21ct-kemvi-biz-ranu-pelo.pages.dev/; Section: DOMAIN; Description: Phishing domain: sp21ct-kemvi-biz-ranu-pelo.pages", "distribution": 0, "sharing_group_id": 0, "Tag": [ "severity:CRITICAL", "section:DOMAIN", "tag:phishing", "tag:openphish", "tag:domain" ], "first_seen": "", "last_seen": "" }, { "category": "Domain and name", "type": "domain", "value": "raqfuro-mpt-zelqani-h7d9ka64.pages", "to_ids": true, "disable_correlation": false, "comment": "Severity: CRITICAL; Source: OpenPhish; URL: http://raqfuro-mpt-zelqani-h7d9ka64.pages.dev/; Section: DOMAIN; Description: Phishing domain: raqfuro-mpt-zelqani-h7d9ka64.pages", "distribution": 0, "sharing_group_id": 0, "Tag": [ "severity:CRITICAL", "section:DOMAIN", "tag:phishing", "tag:openphish", "tag:domain" ], "first_seen": "", "last_seen": "" }, { "category": "Domain and name", "type": "domain", "value": "offiical-s-exous.pages", "to_ids": true, "disable_correlation": false, "comment": "Severity: CRITICAL; Source: OpenPhish; URL: https://offiical-s-exous.pages.dev/; Section: DOMAIN; Description: Phishing domain: offiical-s-exous.pages", "distribution": 0, "sharing_group_id": 0, "Tag": [ "severity:CRITICAL", "section:DOMAIN", "tag:phishing", "tag:openphish", "tag:domain" ], "first_seen": "", "last_seen": "" }, { "category": "Domain and name", "type": "domain", "value": "sp1ct10-hurrek-biz-rumzo-vemti-wuy.pages", "to_ids": true, "disable_correlation": false, "comment": "Severity: CRITICAL; Source: OpenPhish; URL: http://sp1ct10-hurrek-biz-rumzo-vemti-wuy.pages.dev/; Section: DOMAIN; Description: Phishing domain: sp1ct10-hurrek-biz-rumzo-vemti-wuy.pages", "distribution": 0, "sharing_group_id": 0, "Tag": [ "severity:CRITICAL", "section:DOMAIN", "tag:phishing", "tag:openphish", "tag:domain" ], "first_seen": "", "last_seen": "" }, { "category": "Domain and name", "type": "domain", "value": "pages.dev", "to_ids": true, "disable_correlation": false, "comment": "Severity: CRITICAL; Source: OpenPhish; URL: https://22cu0i-20zkk-7s8-i96d9n-w9z.pages.dev/; Section: DOMAIN; Description: Phishing domain: pages.dev", "distribution": 0, "sharing_group_id": 0, "Tag": [ "severity:CRITICAL", "section:DOMAIN", "tag:phishing", "tag:openphish", "tag:domain" ], "first_seen": "", "last_seen": "" } ] } }