{
  "Event": {
    "id": 0,
    "date": "2026-10-15",
    "threat_level_id": 1,
    "analysis": 0,
    "attribute_count": "28",
    "publish_distribution": 0,
    "proposal_email_lock": false,
    "info": "Cyber Daily Brief IOC Report - 2026-10-15 12:15 UTC",
    "published": false,
    "uuid": "misp-event-IOC-20261015-121518",
    "orgc_id": 0,
    "Orgc": {
      "name": "Cyber Daily Brief"
    },
    "distribution": 0,
    "tags": [
      "ioc-report::2026-10-15 12:15 UTC",
      "classification:text",
      "export:requires-approval::0"
    ],
    "sharing_group_id": 0,
    "disable_correlation": false,
    "expected_count": 28,
    "event_level": 1,
    "analysis_status": "1",
    "Attribute": [
      {
        "category": "Artefact on host",
        "type": "cve",
        "value": "CVE-2026-105134",
        "to_ids": true,
        "disable_correlation": false,
        "comment": "Severity: CRITICAL; Product: AhsayCBS (Ahsay); Source: CISA KEV Catalog; URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog; Date: 2026-10-14; Section: CISA KEV (KNOWN EXPLOITED VULNERABILITY); Description: Ahsay AhsayCBS contains a command injection vulnerability that could allow a remote attacker to execute operating system commands via manipulation of the random parameter in the Replication Receiver c",
        "distribution": 0,
        "sharing_group_id": 0,
        "Tag": [
          "severity:CRITICAL",
          "section:CISA KEV (KNOWN EXPLOITED VULNERABILITY)",
          "tag:kev",
          "tag:cisa",
          "tag:active-exploitation"
        ],
        "first_seen": "2026-10-14",
        "last_seen": "2026-10-14"
      },
      {
        "category": "Artefact on host",
        "type": "cve",
        "value": "CVE-2026-76519",
        "to_ids": true,
        "disable_correlation": false,
        "comment": "Severity: CRITICAL; Product: Secure Email Gateway (Cisco); Source: CISA KEV Catalog; URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog; Date: 2026-10-14; Section: CISA KEV (KNOWN EXPLOITED VULNERABILITY); Description: Cisco Secure Email Gateway contains a relative path traversal vulnerability that could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system.",
        "distribution": 0,
        "sharing_group_id": 0,
        "Tag": [
          "severity:CRITICAL",
          "section:CISA KEV (KNOWN EXPLOITED VULNERABILITY)",
          "tag:kev",
          "tag:cisa",
          "tag:active-exploitation"
        ],
        "first_seen": "2026-10-14",
        "last_seen": "2026-10-14"
      },
      {
        "category": "Artefact on host",
        "type": "cve",
        "value": "CVE-2026-105133",
        "to_ids": true,
        "disable_correlation": false,
        "comment": "Severity: CRITICAL; Product: AhsayCBS (Ahsay); Source: CISA KEV Catalog; URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog; Date: 2026-10-14; Section: CISA KEV (KNOWN EXPLOITED VULNERABILITY); Description: Ahsay AhsayCBS contains an improper authentication vulnerability that could allow a remote attacker to bypass authentication via manipulation of the random parameter in the API component\u2019s checkSysPwd",
        "distribution": 0,
        "sharing_group_id": 0,
        "Tag": [
          "severity:CRITICAL",
          "section:CISA KEV (KNOWN EXPLOITED VULNERABILITY)",
          "tag:kev",
          "tag:cisa",
          "tag:active-exploitation"
        ],
        "first_seen": "2026-10-14",
        "last_seen": "2026-10-14"
      },
      {
        "category": "Artefact on host",
        "type": "cve",
        "value": "CVE-2026-0322",
        "to_ids": true,
        "disable_correlation": false,
        "comment": "Severity: CRITICAL; Product: PAN-OS (Palo Alto Networks); Source: CISA KEV Catalog; URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog; Date: 2026-10-14; Section: CISA KEV (KNOWN EXPLOITED VULNERABILITY); Description: Palo Alto Networks PAN-OS contains a code injection vulnerability that could allow an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall.",
        "distribution": 0,
        "sharing_group_id": 0,
        "Tag": [
          "severity:CRITICAL",
          "section:CISA KEV (KNOWN EXPLOITED VULNERABILITY)",
          "tag:kev",
          "tag:cisa",
          "tag:active-exploitation"
        ],
        "first_seen": "2026-10-14",
        "last_seen": "2026-10-14"
      },
      {
        "category": "Artefact on host",
        "type": "cve",
        "value": "CVE-2026-104935",
        "to_ids": true,
        "disable_correlation": false,
        "comment": "Severity: CRITICAL; Product: Connect Secure (Ivanti); Source: CISA KEV Catalog; URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog; Date: 2026-10-13; Section: CISA KEV (KNOWN EXPLOITED VULNERABILITY); Description: Ivanti Connect Secure contains an authentication bypass by spoofing vulnerability that allows a remote unauthenticated attacker to execute arbitrary commands.",
        "distribution": 0,
        "sharing_group_id": 0,
        "Tag": [
          "severity:CRITICAL",
          "section:CISA KEV (KNOWN EXPLOITED VULNERABILITY)",
          "tag:kev",
          "tag:cisa",
          "tag:active-exploitation"
        ],
        "first_seen": "2026-10-13",
        "last_seen": "2026-10-13"
      },
      {
        "category": "Artefact on host",
        "type": "cve",
        "value": "CVE-2026-96951",
        "to_ids": true,
        "disable_correlation": false,
        "comment": "Severity: CRITICAL; Product: Windows (Microsoft); Source: CISA KEV Catalog; URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog; Date: 2026-10-13; Section: CISA KEV (KNOWN EXPLOITED VULNERABILITY); Description: Microsoft Windows Shell contains a command injection vulnerability that allows an unauthorized attacker to bypass a security feature over a network.",
        "distribution": 0,
        "sharing_group_id": 0,
        "Tag": [
          "severity:CRITICAL",
          "section:CISA KEV (KNOWN EXPLOITED VULNERABILITY)",
          "tag:kev",
          "tag:cisa",
          "tag:active-exploitation"
        ],
        "first_seen": "2026-10-13",
        "last_seen": "2026-10-13"
      },
      {
        "category": "Artefact on host",
        "type": "cve",
        "value": "CVE-2015-5477",
        "to_ids": true,
        "disable_correlation": false,
        "comment": "Severity: CRITICAL; Product: BIND (ISC); Source: CISA KEV Catalog; URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog; Date: 2026-10-08; Section: CISA KEV (KNOWN EXPLOITED VULNERABILITY); Description: ISC BIND contains a data processing errors vulnerability that could allow remote attackers to cause a denial of service via TKEY queries.",
        "distribution": 0,
        "sharing_group_id": 0,
        "Tag": [
          "severity:CRITICAL",
          "section:CISA KEV (KNOWN EXPLOITED VULNERABILITY)",
          "tag:kev",
          "tag:cisa",
          "tag:active-exploitation"
        ],
        "first_seen": "2026-10-08",
        "last_seen": "2026-10-08"
      },
      {
        "category": "Artefact on host",
        "type": "cve",
        "value": "CVE-2016-3081",
        "to_ids": true,
        "disable_correlation": false,
        "comment": "Severity: CRITICAL; Product: Struts (Apache); Source: CISA KEV Catalog; URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog; Date: 2026-10-08; Section: CISA KEV (KNOWN EXPLOITED VULNERABILITY); Description: Apache Struts contains a command injection vulnerability that could allow remote attackers to execute arbitrary code via method:prefix when Dynamic Method Invocation is enabled.",
        "distribution": 0,
        "sharing_group_id": 0,
        "Tag": [
          "severity:CRITICAL",
          "section:CISA KEV (KNOWN EXPLOITED VULNERABILITY)",
          "tag:kev",
          "tag:cisa",
          "tag:active-exploitation"
        ],
        "first_seen": "2026-10-08",
        "last_seen": "2026-10-08"
      },
      {
        "category": "Artefact on host",
        "type": "cve",
        "value": "CVE-2023-22894",
        "to_ids": true,
        "disable_correlation": false,
        "comment": "Severity: CRITICAL; Product: Strapi (Strapi); Source: CISA KEV Catalog; URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog; Date: 2026-10-08; Section: CISA KEV (KNOWN EXPLOITED VULNERABILITY); Description: Strapi contains a cleartext storage of sensitive information vulnerability that could allow attackers with access to the admin panel to discover sensitive user details via the query filter. The impact",
        "distribution": 0,
        "sharing_group_id": 0,
        "Tag": [
          "severity:CRITICAL",
          "section:CISA KEV (KNOWN EXPLOITED VULNERABILITY)",
          "tag:kev",
          "tag:cisa",
          "tag:active-exploitation"
        ],
        "first_seen": "2026-10-08",
        "last_seen": "2026-10-08"
      },
      {
        "category": "Artefact on host",
        "type": "cve",
        "value": "CVE-2021-3199",
        "to_ids": true,
        "disable_correlation": false,
        "comment": "Severity: CRITICAL; Product: Docs (ONLYOFFICE); Source: CISA KEV Catalog; URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog; Date: 2026-10-08; Section: PHISHING URL; Description: ONLYOFFICE Docs contains a path traversal vulnerability that can occur when JWT is used, via a /.. sequence in an image upload parameter and could allow for remote code execution.",
        "distribution": 0,
        "sharing_group_id": 0,
        "Tag": [
          "severity:CRITICAL",
          "section:PHISHING URL",
          "tag:kev",
          "tag:cisa",
          "tag:active-exploitation"
        ],
        "first_seen": "2026-10-08",
        "last_seen": "2026-10-08"
      },
      {
        "category": "Other",
        "type": "other",
        "value": "http://sp22ct-zarur-biz-loru-kemu.pages.dev/",
        "to_ids": true,
        "disable_correlation": false,
        "comment": "Severity: CRITICAL; Source: OpenPhish; URL: http://sp22ct-zarur-biz-loru-kemu.pages.dev/; Section: PHISHING URL; Description: Active phishing URL: http://sp22ct-zarur-biz-loru-kemu.pages.dev/",
        "distribution": 0,
        "sharing_group_id": 0,
        "Tag": [
          "severity:CRITICAL",
          "section:PHISHING URL",
          "tag:phishing",
          "tag:openphish"
        ],
        "first_seen": "",
        "last_seen": ""
      },
      {
        "category": "Other",
        "type": "other",
        "value": "https://sp33ct-fenaru-biz-kelovi-maneto.pages.dev/",
        "to_ids": true,
        "disable_correlation": false,
        "comment": "Severity: CRITICAL; Source: OpenPhish; URL: https://sp33ct-fenaru-biz-kelovi-maneto.pages.dev/; Section: PHISHING URL; Description: Active phishing URL: https://sp33ct-fenaru-biz-kelovi-maneto.pages.dev/",
        "distribution": 0,
        "sharing_group_id": 0,
        "Tag": [
          "severity:CRITICAL",
          "section:PHISHING URL",
          "tag:phishing",
          "tag:openphish"
        ],
        "first_seen": "",
        "last_seen": ""
      },
      {
        "category": "Other",
        "type": "other",
        "value": "https://buzqari-mpt-felvuno-p4d9ka86.pages.dev/",
        "to_ids": true,
        "disable_correlation": false,
        "comment": "Severity: CRITICAL; Source: OpenPhish; URL: https://buzqari-mpt-felvuno-p4d9ka86.pages.dev/; Section: PHISHING URL; Description: Active phishing URL: https://buzqari-mpt-felvuno-p4d9ka86.pages.dev/",
        "distribution": 0,
        "sharing_group_id": 0,
        "Tag": [
          "severity:CRITICAL",
          "section:PHISHING URL",
          "tag:phishing",
          "tag:openphish"
        ],
        "first_seen": "",
        "last_seen": ""
      },
      {
        "category": "Other",
        "type": "other",
        "value": "http://mt1xv-55n-xil2-hbkcy-30-09-2026-hh.pages.dev/",
        "to_ids": true,
        "disable_correlation": false,
        "comment": "Severity: CRITICAL; Source: OpenPhish; URL: http://mt1xv-55n-xil2-hbkcy-30-09-2026-hh.pages.dev/; Section: PHISHING URL; Description: Active phishing URL: http://mt1xv-55n-xil2-hbkcy-30-09-2026-hh.pages.dev/",
        "distribution": 0,
        "sharing_group_id": 0,
        "Tag": [
          "severity:CRITICAL",
          "section:PHISHING URL",
          "tag:phishing",
          "tag:openphish"
        ],
        "first_seen": "",
        "last_seen": ""
      },
      {
        "category": "Other",
        "type": "other",
        "value": "http://sp22ct-vemak-biz-keli-pazu.pages.dev/",
        "to_ids": true,
        "disable_correlation": false,
        "comment": "Severity: CRITICAL; Source: OpenPhish; URL: http://sp22ct-vemak-biz-keli-pazu.pages.dev/; Section: PHISHING URL; Description: Active phishing URL: http://sp22ct-vemak-biz-keli-pazu.pages.dev/",
        "distribution": 0,
        "sharing_group_id": 0,
        "Tag": [
          "severity:CRITICAL",
          "section:PHISHING URL",
          "tag:phishing",
          "tag:openphish"
        ],
        "first_seen": "",
        "last_seen": ""
      },
      {
        "category": "Other",
        "type": "other",
        "value": "https://sp18ct10-bavlek-biz-vunero.pages.dev/",
        "to_ids": true,
        "disable_correlation": false,
        "comment": "Severity: CRITICAL; Source: OpenPhish; URL: https://sp18ct10-bavlek-biz-vunero.pages.dev/; Section: PHISHING URL; Description: Active phishing URL: https://sp18ct10-bavlek-biz-vunero.pages.dev/",
        "distribution": 0,
        "sharing_group_id": 0,
        "Tag": [
          "severity:CRITICAL",
          "section:PHISHING URL",
          "tag:phishing",
          "tag:openphish"
        ],
        "first_seen": "",
        "last_seen": ""
      },
      {
        "category": "Other",
        "type": "other",
        "value": "https://lerveta-kxt-borvani-r5t9dp71.pages.dev/",
        "to_ids": true,
        "disable_correlation": false,
        "comment": "Severity: CRITICAL; Source: OpenPhish; URL: https://lerveta-kxt-borvani-r5t9dp71.pages.dev/; Section: PHISHING URL; Description: Active phishing URL: https://lerveta-kxt-borvani-r5t9dp71.pages.dev/",
        "distribution": 0,
        "sharing_group_id": 0,
        "Tag": [
          "severity:CRITICAL",
          "section:PHISHING URL",
          "tag:phishing",
          "tag:openphish"
        ],
        "first_seen": "",
        "last_seen": ""
      },
      {
        "category": "Other",
        "type": "other",
        "value": "http://sp18ct10-murlek-biz-qanavi.pages.dev/",
        "to_ids": true,
        "disable_correlation": false,
        "comment": "Severity: CRITICAL; Source: OpenPhish; URL: http://sp18ct10-murlek-biz-qanavi.pages.dev/; Section: PHISHING URL; Description: Active phishing URL: http://sp18ct10-murlek-biz-qanavi.pages.dev/",
        "distribution": 0,
        "sharing_group_id": 0,
        "Tag": [
          "severity:CRITICAL",
          "section:PHISHING URL",
          "tag:phishing",
          "tag:openphish"
        ],
        "first_seen": "",
        "last_seen": ""
      },
      {
        "category": "Other",
        "type": "other",
        "value": "https://sp22ct-nelok-biz-kavi-zaru-e8p.pages.dev/",
        "to_ids": true,
        "disable_correlation": false,
        "comment": "Severity: CRITICAL; Source: OpenPhish; URL: https://sp22ct-nelok-biz-kavi-zaru-e8p.pages.dev/; Section: DOMAIN; Description: Active phishing URL: https://sp22ct-nelok-biz-kavi-zaru-e8p.pages.dev/",
        "distribution": 0,
        "sharing_group_id": 0,
        "Tag": [
          "severity:CRITICAL",
          "section:DOMAIN",
          "tag:phishing",
          "tag:openphish"
        ],
        "first_seen": "",
        "last_seen": ""
      },
      {
        "category": "Domain and name",
        "type": "domain",
        "value": "sp22ct-zarur-biz-loru-kemu.pages",
        "to_ids": true,
        "disable_correlation": false,
        "comment": "Severity: CRITICAL; Source: OpenPhish; URL: http://sp22ct-zarur-biz-loru-kemu.pages.dev/; Section: DOMAIN; Description: Phishing domain: sp22ct-zarur-biz-loru-kemu.pages",
        "distribution": 0,
        "sharing_group_id": 0,
        "Tag": [
          "severity:CRITICAL",
          "section:DOMAIN",
          "tag:phishing",
          "tag:openphish",
          "tag:domain"
        ],
        "first_seen": "",
        "last_seen": ""
      },
      {
        "category": "Domain and name",
        "type": "domain",
        "value": "sp33ct-fenaru-biz-kelovi-maneto.pages",
        "to_ids": true,
        "disable_correlation": false,
        "comment": "Severity: CRITICAL; Source: OpenPhish; URL: https://sp33ct-fenaru-biz-kelovi-maneto.pages.dev/; Section: DOMAIN; Description: Phishing domain: sp33ct-fenaru-biz-kelovi-maneto.pages",
        "distribution": 0,
        "sharing_group_id": 0,
        "Tag": [
          "severity:CRITICAL",
          "section:DOMAIN",
          "tag:phishing",
          "tag:openphish",
          "tag:domain"
        ],
        "first_seen": "",
        "last_seen": ""
      },
      {
        "category": "Domain and name",
        "type": "domain",
        "value": "buzqari-mpt-felvuno-p4d9ka86.pages",
        "to_ids": true,
        "disable_correlation": false,
        "comment": "Severity: CRITICAL; Source: OpenPhish; URL: https://buzqari-mpt-felvuno-p4d9ka86.pages.dev/; Section: DOMAIN; Description: Phishing domain: buzqari-mpt-felvuno-p4d9ka86.pages",
        "distribution": 0,
        "sharing_group_id": 0,
        "Tag": [
          "severity:CRITICAL",
          "section:DOMAIN",
          "tag:phishing",
          "tag:openphish",
          "tag:domain"
        ],
        "first_seen": "",
        "last_seen": ""
      },
      {
        "category": "Domain and name",
        "type": "domain",
        "value": "mt1xv-55n-xil2-hbkcy-30-09-2026-hh.pages",
        "to_ids": true,
        "disable_correlation": false,
        "comment": "Severity: CRITICAL; Source: OpenPhish; URL: http://mt1xv-55n-xil2-hbkcy-30-09-2026-hh.pages.dev/; Section: DOMAIN; Description: Phishing domain: mt1xv-55n-xil2-hbkcy-30-09-2026-hh.pages",
        "distribution": 0,
        "sharing_group_id": 0,
        "Tag": [
          "severity:CRITICAL",
          "section:DOMAIN",
          "tag:phishing",
          "tag:openphish",
          "tag:domain"
        ],
        "first_seen": "",
        "last_seen": ""
      },
      {
        "category": "Domain and name",
        "type": "domain",
        "value": "sp22ct-vemak-biz-keli-pazu.pages",
        "to_ids": true,
        "disable_correlation": false,
        "comment": "Severity: CRITICAL; Source: OpenPhish; URL: http://sp22ct-vemak-biz-keli-pazu.pages.dev/; Section: DOMAIN; Description: Phishing domain: sp22ct-vemak-biz-keli-pazu.pages",
        "distribution": 0,
        "sharing_group_id": 0,
        "Tag": [
          "severity:CRITICAL",
          "section:DOMAIN",
          "tag:phishing",
          "tag:openphish",
          "tag:domain"
        ],
        "first_seen": "",
        "last_seen": ""
      },
      {
        "category": "Domain and name",
        "type": "domain",
        "value": "sp18ct10-bavlek-biz-vunero.pages",
        "to_ids": true,
        "disable_correlation": false,
        "comment": "Severity: CRITICAL; Source: OpenPhish; URL: https://sp18ct10-bavlek-biz-vunero.pages.dev/; Section: DOMAIN; Description: Phishing domain: sp18ct10-bavlek-biz-vunero.pages",
        "distribution": 0,
        "sharing_group_id": 0,
        "Tag": [
          "severity:CRITICAL",
          "section:DOMAIN",
          "tag:phishing",
          "tag:openphish",
          "tag:domain"
        ],
        "first_seen": "",
        "last_seen": ""
      },
      {
        "category": "Domain and name",
        "type": "domain",
        "value": "lerveta-kxt-borvani-r5t9dp71.pages",
        "to_ids": true,
        "disable_correlation": false,
        "comment": "Severity: CRITICAL; Source: OpenPhish; URL: https://lerveta-kxt-borvani-r5t9dp71.pages.dev/; Section: DOMAIN; Description: Phishing domain: lerveta-kxt-borvani-r5t9dp71.pages",
        "distribution": 0,
        "sharing_group_id": 0,
        "Tag": [
          "severity:CRITICAL",
          "section:DOMAIN",
          "tag:phishing",
          "tag:openphish",
          "tag:domain"
        ],
        "first_seen": "",
        "last_seen": ""
      },
      {
        "category": "Domain and name",
        "type": "domain",
        "value": "sp18ct10-murlek-biz-qanavi.pages",
        "to_ids": true,
        "disable_correlation": false,
        "comment": "Severity: CRITICAL; Source: OpenPhish; URL: http://sp18ct10-murlek-biz-qanavi.pages.dev/; Section: DOMAIN; Description: Phishing domain: sp18ct10-murlek-biz-qanavi.pages",
        "distribution": 0,
        "sharing_group_id": 0,
        "Tag": [
          "severity:CRITICAL",
          "section:DOMAIN",
          "tag:phishing",
          "tag:openphish",
          "tag:domain"
        ],
        "first_seen": "",
        "last_seen": ""
      },
      {
        "category": "Domain and name",
        "type": "domain",
        "value": "sp22ct-nelok-biz-kavi-zaru-e8p.pages",
        "to_ids": true,
        "disable_correlation": false,
        "comment": "Severity: CRITICAL; Source: OpenPhish; URL: https://sp22ct-nelok-biz-kavi-zaru-e8p.pages.dev/; Section: DOMAIN; Description: Phishing domain: sp22ct-nelok-biz-kavi-zaru-e8p.pages",
        "distribution": 0,
        "sharing_group_id": 0,
        "Tag": [
          "severity:CRITICAL",
          "section:DOMAIN",
          "tag:phishing",
          "tag:openphish",
          "tag:domain"
        ],
        "first_seen": "",
        "last_seen": ""
      }
    ]
  }
}