{ "Event": { "id": 0, "date": "2026-10-19", "threat_level_id": 1, "analysis": 0, "attribute_count": "28", "publish_distribution": 0, "proposal_email_lock": false, "info": "Cyber Daily Brief IOC Report - 2026-10-19 12:15 UTC", "published": false, "uuid": "misp-event-IOC-20261019-121547", "orgc_id": 0, "Orgc": { "name": "Cyber Daily Brief" }, "distribution": 0, "tags": [ "ioc-report::2026-10-19 12:15 UTC", "classification:text", "export:requires-approval::0" ], "sharing_group_id": 0, "disable_correlation": false, "expected_count": 28, "event_level": 1, "analysis_status": "1", "Attribute": [ { "category": "Artefact on host", "type": "cve", "value": "CVE-2026-102764", "to_ids": true, "disable_correlation": false, "comment": "Severity: CRITICAL; Product: Remote Support (BeyondTrust); Source: CISA KEV Catalog; URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog; Date: 2026-10-16; Section: CISA KEV (KNOWN EXPLOITED VULNERABILITY); Description: BeyondTrust Remote Support contains an authentication bypass by spoofing vulnerability that could allow a remote attacker to perform file operations on the appliance.", "distribution": 0, "sharing_group_id": 0, "Tag": [ "severity:CRITICAL", "section:CISA KEV (KNOWN EXPLOITED VULNERABILITY)", "tag:kev", "tag:cisa", "tag:active-exploitation" ], "first_seen": "2026-10-16", "last_seen": "2026-10-16" }, { "category": "Artefact on host", "type": "cve", "value": "CVE-2025-61624", "to_ids": true, "disable_correlation": false, "comment": "Severity: CRITICAL; Product: Multiple Products (Fortinet); Source: CISA KEV Catalog; URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog; Date: 2026-10-16; Section: CISA KEV (KNOWN EXPLOITED VULNERABILITY); Description: FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager contain a path traversal vulnerability that may allow an authenticated attacker with admin profile and at least read-write permissions to write or", "distribution": 0, "sharing_group_id": 0, "Tag": [ "severity:CRITICAL", "section:CISA KEV (KNOWN EXPLOITED VULNERABILITY)", "tag:kev", "tag:cisa", "tag:active-exploitation" ], "first_seen": "2026-10-16", "last_seen": "2026-10-16" }, { "category": "Artefact on host", "type": "cve", "value": "CVE-2026-21589", "to_ids": true, "disable_correlation": false, "comment": "Severity: CRITICAL; Product: Multiple Products (Atlassian); Source: CISA KEV Catalog; URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog; Date: 2026-10-15; Section: CISA KEV (KNOWN EXPLOITED VULNERABILITY); Description: Multiple Atlassian products (Bitbucket Data Center ,Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible and Fisheye)", "distribution": 0, "sharing_group_id": 0, "Tag": [ "severity:CRITICAL", "section:CISA KEV (KNOWN EXPLOITED VULNERABILITY)", "tag:kev", "tag:cisa", "tag:active-exploitation" ], "first_seen": "2026-10-15", "last_seen": "2026-10-15" }, { "category": "Artefact on host", "type": "cve", "value": "CVE-2026-105134", "to_ids": true, "disable_correlation": false, "comment": "Severity: CRITICAL; Product: AhsayCBS (Ahsay); Source: CISA KEV Catalog; URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog; Date: 2026-10-14; Section: CISA KEV (KNOWN EXPLOITED VULNERABILITY); Description: Ahsay AhsayCBS contains a command injection vulnerability that could allow a remote attacker to execute operating system commands via manipulation of the random parameter in the Replication Receiver c", "distribution": 0, "sharing_group_id": 0, "Tag": [ "severity:CRITICAL", "section:CISA KEV (KNOWN EXPLOITED VULNERABILITY)", "tag:kev", "tag:cisa", "tag:active-exploitation" ], "first_seen": "2026-10-14", "last_seen": "2026-10-14" }, { "category": "Artefact on host", "type": "cve", "value": "CVE-2026-76519", "to_ids": true, "disable_correlation": false, "comment": "Severity: CRITICAL; Product: Secure Email Gateway (Cisco); Source: CISA KEV Catalog; URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog; Date: 2026-10-14; Section: CISA KEV (KNOWN EXPLOITED VULNERABILITY); Description: Cisco Secure Email Gateway contains a relative path traversal vulnerability that could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system.", "distribution": 0, "sharing_group_id": 0, "Tag": [ "severity:CRITICAL", "section:CISA KEV (KNOWN EXPLOITED VULNERABILITY)", "tag:kev", "tag:cisa", "tag:active-exploitation" ], "first_seen": "2026-10-14", "last_seen": "2026-10-14" }, { "category": "Artefact on host", "type": "cve", "value": "CVE-2026-105133", "to_ids": true, "disable_correlation": false, "comment": "Severity: CRITICAL; Product: AhsayCBS (Ahsay); Source: CISA KEV Catalog; URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog; Date: 2026-10-14; Section: CISA KEV (KNOWN EXPLOITED VULNERABILITY); Description: Ahsay AhsayCBS contains an improper authentication vulnerability that could allow a remote attacker to bypass authentication via manipulation of the random parameter in the API component\u2019s checkSysPwd", "distribution": 0, "sharing_group_id": 0, "Tag": [ "severity:CRITICAL", "section:CISA KEV (KNOWN EXPLOITED VULNERABILITY)", "tag:kev", "tag:cisa", "tag:active-exploitation" ], "first_seen": "2026-10-14", "last_seen": "2026-10-14" }, { "category": "Artefact on host", "type": "cve", "value": "CVE-2026-0322", "to_ids": true, "disable_correlation": false, "comment": "Severity: CRITICAL; Product: PAN-OS (Palo Alto Networks); Source: CISA KEV Catalog; URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog; Date: 2026-10-14; Section: CISA KEV (KNOWN EXPLOITED VULNERABILITY); Description: Palo Alto Networks PAN-OS contains a code injection vulnerability that could allow an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall.", "distribution": 0, "sharing_group_id": 0, "Tag": [ "severity:CRITICAL", "section:CISA KEV (KNOWN EXPLOITED VULNERABILITY)", "tag:kev", "tag:cisa", "tag:active-exploitation" ], "first_seen": "2026-10-14", "last_seen": "2026-10-14" }, { "category": "Artefact on host", "type": "cve", "value": "CVE-2026-104935", "to_ids": true, "disable_correlation": false, "comment": "Severity: CRITICAL; Product: Connect Secure (Ivanti); Source: CISA KEV Catalog; URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog; Date: 2026-10-13; Section: CISA KEV (KNOWN EXPLOITED VULNERABILITY); Description: Ivanti Connect Secure contains an authentication bypass by spoofing vulnerability that allows a remote unauthenticated attacker to execute arbitrary commands.", "distribution": 0, "sharing_group_id": 0, "Tag": [ "severity:CRITICAL", "section:CISA KEV (KNOWN EXPLOITED VULNERABILITY)", "tag:kev", "tag:cisa", "tag:active-exploitation" ], "first_seen": "2026-10-13", "last_seen": "2026-10-13" }, { "category": "Artefact on host", "type": "cve", "value": "CVE-2026-96951", "to_ids": true, "disable_correlation": false, "comment": "Severity: CRITICAL; Product: Windows (Microsoft); Source: CISA KEV Catalog; URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog; Date: 2026-10-13; Section: CISA KEV (KNOWN EXPLOITED VULNERABILITY); Description: Microsoft Windows Shell contains a command injection vulnerability that allows an unauthorized attacker to bypass a security feature over a network.", "distribution": 0, "sharing_group_id": 0, "Tag": [ "severity:CRITICAL", "section:CISA KEV (KNOWN EXPLOITED VULNERABILITY)", "tag:kev", "tag:cisa", "tag:active-exploitation" ], "first_seen": "2026-10-13", "last_seen": "2026-10-13" }, { "category": "Artefact on host", "type": "cve", "value": "CVE-2015-5477", "to_ids": true, "disable_correlation": false, "comment": "Severity: CRITICAL; Product: BIND (ISC); Source: CISA KEV Catalog; URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog; Date: 2026-10-08; Section: PHISHING URL; Description: ISC BIND contains a data processing errors vulnerability that could allow remote attackers to cause a denial of service via TKEY queries.", "distribution": 0, "sharing_group_id": 0, "Tag": [ "severity:CRITICAL", "section:PHISHING URL", "tag:kev", "tag:cisa", "tag:active-exploitation" ], "first_seen": "2026-10-08", "last_seen": "2026-10-08" }, { "category": "Other", "type": "other", "value": "http://xunqelo-mpt-favzari-h4d8me63.pages.dev/", "to_ids": true, "disable_correlation": false, "comment": "Severity: CRITICAL; Source: OpenPhish; URL: http://xunqelo-mpt-favzari-h4d8me63.pages.dev/; Section: PHISHING URL; Description: Active phishing URL: http://xunqelo-mpt-favzari-h4d8me63.pages.dev/", "distribution": 0, "sharing_group_id": 0, "Tag": [ "severity:CRITICAL", "section:PHISHING URL", "tag:phishing", "tag:openphish" ], "first_seen": "", "last_seen": "" }, { "category": "Other", "type": "other", "value": "http://sp23ct-ravem-biz-zulok-pelun.pages.dev/", "to_ids": true, "disable_correlation": false, "comment": "Severity: CRITICAL; Source: OpenPhish; URL: http://sp23ct-ravem-biz-zulok-pelun.pages.dev/; Section: PHISHING URL; Description: Active phishing URL: http://sp23ct-ravem-biz-zulok-pelun.pages.dev/", "distribution": 0, "sharing_group_id": 0, "Tag": [ "severity:CRITICAL", "section:PHISHING URL", "tag:phishing", "tag:openphish" ], "first_seen": "", "last_seen": "" }, { "category": "Other", "type": "other", "value": "http://zunqari-mpt-xavfelo-h6d4pe82.pages.dev/", "to_ids": true, "disable_correlation": false, "comment": "Severity: CRITICAL; Source: OpenPhish; URL: http://zunqari-mpt-xavfelo-h6d4pe82.pages.dev/; Section: PHISHING URL; Description: Active phishing URL: http://zunqari-mpt-xavfelo-h6d4pe82.pages.dev/", "distribution": 0, "sharing_group_id": 0, "Tag": [ "severity:CRITICAL", "section:PHISHING URL", "tag:phishing", "tag:openphish" ], "first_seen": "", "last_seen": "" }, { "category": "Other", "type": "other", "value": "https://www.webulpob.com/", "to_ids": true, "disable_correlation": false, "comment": "Severity: CRITICAL; Source: OpenPhish; URL: https://www.webulpob.com/; Section: PHISHING URL; Description: Active phishing URL: https://www.webulpob.com/", "distribution": 0, "sharing_group_id": 0, "Tag": [ "severity:CRITICAL", "section:PHISHING URL", "tag:phishing", "tag:openphish" ], "first_seen": "", "last_seen": "" }, { "category": "Other", "type": "other", "value": "https://io-bridge-terzor.pineapple.page/", "to_ids": true, "disable_correlation": false, "comment": "Severity: CRITICAL; Source: OpenPhish; URL: https://io-bridge-terzor.pineapple.page/; Section: PHISHING URL; Description: Active phishing URL: https://io-bridge-terzor.pineapple.page/", "distribution": 0, "sharing_group_id": 0, "Tag": [ "severity:CRITICAL", "section:PHISHING URL", "tag:phishing", "tag:openphish" ], "first_seen": "", "last_seen": "" }, { "category": "Other", "type": "other", "value": "http://sergio738-updates-donmsg.mdbgo.io/", "to_ids": true, "disable_correlation": false, "comment": "Severity: CRITICAL; Source: OpenPhish; URL: http://sergio738-updates-donmsg.mdbgo.io/; Section: PHISHING URL; Description: Active phishing URL: http://sergio738-updates-donmsg.mdbgo.io/", "distribution": 0, "sharing_group_id": 0, "Tag": [ "severity:CRITICAL", "section:PHISHING URL", "tag:phishing", "tag:openphish" ], "first_seen": "", "last_seen": "" }, { "category": "Other", "type": "other", "value": "https://abcgil.com/EN/owa/", "to_ids": true, "disable_correlation": false, "comment": "Severity: CRITICAL; Source: OpenPhish; URL: https://abcgil.com/EN/owa/; Section: PHISHING URL; Description: Active phishing URL: https://abcgil.com/EN/owa/", "distribution": 0, "sharing_group_id": 0, "Tag": [ "severity:CRITICAL", "section:PHISHING URL", "tag:phishing", "tag:openphish" ], "first_seen": "", "last_seen": "" }, { "category": "Other", "type": "other", "value": "https://flnd-my-report-ld.com/a.php", "to_ids": true, "disable_correlation": false, "comment": "Severity: CRITICAL; Source: OpenPhish; URL: https://flnd-my-report-ld.com/a.php; Section: PHISHING URL; Description: Active phishing URL: https://flnd-my-report-ld.com/a.php", "distribution": 0, "sharing_group_id": 0, "Tag": [ "severity:CRITICAL", "section:PHISHING URL", "tag:phishing", "tag:openphish" ], "first_seen": "", "last_seen": "" }, { "category": "Other", "type": "other", "value": "https://lphone-localizar-apagado.us/a.php", "to_ids": true, "disable_correlation": false, "comment": "Severity: CRITICAL; Source: OpenPhish; URL: https://lphone-localizar-apagado.us/a.php; Section: DOMAIN; Description: Active phishing URL: https://lphone-localizar-apagado.us/a.php", "distribution": 0, "sharing_group_id": 0, "Tag": [ "severity:CRITICAL", "section:DOMAIN", "tag:phishing", "tag:openphish" ], "first_seen": "", "last_seen": "" }, { "category": "Domain and name", "type": "domain", "value": "xunqelo-mpt-favzari-h4d8me63.pages", "to_ids": true, "disable_correlation": false, "comment": "Severity: CRITICAL; Source: OpenPhish; URL: http://xunqelo-mpt-favzari-h4d8me63.pages.dev/; Section: DOMAIN; Description: Phishing domain: xunqelo-mpt-favzari-h4d8me63.pages", "distribution": 0, "sharing_group_id": 0, "Tag": [ "severity:CRITICAL", "section:DOMAIN", "tag:phishing", "tag:openphish", "tag:domain" ], "first_seen": "", "last_seen": "" }, { "category": "Domain and name", "type": "domain", "value": "sp23ct-ravem-biz-zulok-pelun.pages", "to_ids": true, "disable_correlation": false, "comment": "Severity: CRITICAL; Source: OpenPhish; URL: http://sp23ct-ravem-biz-zulok-pelun.pages.dev/; Section: DOMAIN; Description: Phishing domain: sp23ct-ravem-biz-zulok-pelun.pages", "distribution": 0, "sharing_group_id": 0, "Tag": [ "severity:CRITICAL", "section:DOMAIN", "tag:phishing", "tag:openphish", "tag:domain" ], "first_seen": "", "last_seen": "" }, { "category": "Domain and name", "type": "domain", "value": "zunqari-mpt-xavfelo-h6d4pe82.pages", "to_ids": true, "disable_correlation": false, "comment": "Severity: CRITICAL; Source: OpenPhish; URL: http://zunqari-mpt-xavfelo-h6d4pe82.pages.dev/; Section: DOMAIN; Description: Phishing domain: zunqari-mpt-xavfelo-h6d4pe82.pages", "distribution": 0, "sharing_group_id": 0, "Tag": [ "severity:CRITICAL", "section:DOMAIN", "tag:phishing", "tag:openphish", "tag:domain" ], "first_seen": "", "last_seen": "" }, { "category": "Domain and name", "type": "domain", "value": "www.webulpob", "to_ids": true, "disable_correlation": false, "comment": "Severity: CRITICAL; Source: OpenPhish; URL: https://www.webulpob.com/; Section: DOMAIN; Description: Phishing domain: www.webulpob", "distribution": 0, "sharing_group_id": 0, "Tag": [ "severity:CRITICAL", "section:DOMAIN", "tag:phishing", "tag:openphish", "tag:domain" ], "first_seen": "", "last_seen": "" }, { "category": "Domain and name", "type": "domain", "value": "io-bridge-terzor.pineapple", "to_ids": true, "disable_correlation": false, "comment": "Severity: CRITICAL; Source: OpenPhish; URL: https://io-bridge-terzor.pineapple.page/; Section: DOMAIN; Description: Phishing domain: io-bridge-terzor.pineapple", "distribution": 0, "sharing_group_id": 0, "Tag": [ "severity:CRITICAL", "section:DOMAIN", "tag:phishing", "tag:openphish", "tag:domain" ], "first_seen": "", "last_seen": "" }, { "category": "Domain and name", "type": "domain", "value": "sergio738-updates-donmsg.mdbgo", "to_ids": true, "disable_correlation": false, "comment": "Severity: CRITICAL; Source: OpenPhish; URL: http://sergio738-updates-donmsg.mdbgo.io/; Section: DOMAIN; Description: Phishing domain: sergio738-updates-donmsg.mdbgo", "distribution": 0, "sharing_group_id": 0, "Tag": [ "severity:CRITICAL", "section:DOMAIN", "tag:phishing", "tag:openphish", "tag:domain" ], "first_seen": "", "last_seen": "" }, { "category": "Domain and name", "type": "domain", "value": "abcgil.com", "to_ids": true, "disable_correlation": false, "comment": "Severity: CRITICAL; Source: OpenPhish; URL: https://abcgil.com/EN/owa/; Section: DOMAIN; Description: Phishing domain: abcgil.com", "distribution": 0, "sharing_group_id": 0, "Tag": [ "severity:CRITICAL", "section:DOMAIN", "tag:phishing", "tag:openphish", "tag:domain" ], "first_seen": "", "last_seen": "" }, { "category": "Domain and name", "type": "domain", "value": "flnd-my-report-ld.com", "to_ids": true, "disable_correlation": false, "comment": "Severity: CRITICAL; Source: OpenPhish; URL: https://flnd-my-report-ld.com/a.php; Section: DOMAIN; Description: Phishing domain: flnd-my-report-ld.com", "distribution": 0, "sharing_group_id": 0, "Tag": [ "severity:CRITICAL", "section:DOMAIN", "tag:phishing", "tag:openphish", "tag:domain" ], "first_seen": "", "last_seen": "" }, { "category": "Domain and name", "type": "domain", "value": "lphone-localizar-apagado.us", "to_ids": true, "disable_correlation": false, "comment": "Severity: CRITICAL; Source: OpenPhish; URL: https://lphone-localizar-apagado.us/a.php; Section: DOMAIN; Description: Phishing domain: lphone-localizar-apagado.us", "distribution": 0, "sharing_group_id": 0, "Tag": [ "severity:CRITICAL", "section:DOMAIN", "tag:phishing", "tag:openphish", "tag:domain" ], "first_seen": "", "last_seen": "" } ] } }