{
  "Event": {
    "id": 0,
    "date": "2026-11-12",
    "threat_level_id": 1,
    "analysis": 0,
    "attribute_count": "28",
    "publish_distribution": 0,
    "proposal_email_lock": false,
    "info": "Cyber Daily Brief IOC Report - 2026-11-12 12:15 UTC",
    "published": false,
    "uuid": "misp-event-IOC-20261112-121552",
    "orgc_id": 0,
    "Orgc": {
      "name": "Cyber Daily Brief"
    },
    "distribution": 0,
    "tags": [
      "ioc-report::2026-11-12 12:15 UTC",
      "classification:text",
      "export:requires-approval::0"
    ],
    "sharing_group_id": 0,
    "disable_correlation": false,
    "expected_count": 28,
    "event_level": 1,
    "analysis_status": "1",
    "Attribute": [
      {
        "category": "Artefact on host",
        "type": "cve",
        "value": "CVE-2026-124194",
        "to_ids": true,
        "disable_correlation": false,
        "comment": "Severity: CRITICAL; Product: Office (Microsoft); Source: CISA KEV Catalog; URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog; Date: 2026-11-10; Section: CISA KEV (KNOWN EXPLOITED VULNERABILITY); Description: Microsoft Office Outlook contains a missing user interaction for potentially unsafe action vulnerability that allows an unauthorized attacker to perform spoofing over a network.",
        "distribution": 0,
        "sharing_group_id": 0,
        "Tag": [
          "severity:CRITICAL",
          "section:CISA KEV (KNOWN EXPLOITED VULNERABILITY)",
          "tag:kev",
          "tag:cisa",
          "tag:active-exploitation"
        ],
        "first_seen": "2026-11-10",
        "last_seen": "2026-11-10"
      },
      {
        "category": "Artefact on host",
        "type": "cve",
        "value": "CVE-2026-111793",
        "to_ids": true,
        "disable_correlation": false,
        "comment": "Severity: CRITICAL; Product: Webtop Media Transcoder (Openwave Messaging Limited); Source: CISA KEV Catalog; URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog; Date: 2026-11-10; Section: CISA KEV (KNOWN EXPLOITED VULNERABILITY); Description: Openwave Messaging Limited Webtop Media Transcoder contains an incorrect resource transfer between spheres vulnerability that may allow an authenticated user to process and convert unintended document",
        "distribution": 0,
        "sharing_group_id": 0,
        "Tag": [
          "severity:CRITICAL",
          "section:CISA KEV (KNOWN EXPLOITED VULNERABILITY)",
          "tag:kev",
          "tag:cisa",
          "tag:active-exploitation"
        ],
        "first_seen": "2026-11-10",
        "last_seen": "2026-11-10"
      },
      {
        "category": "Artefact on host",
        "type": "cve",
        "value": "CVE-2026-20320",
        "to_ids": true,
        "disable_correlation": false,
        "comment": "Severity: CRITICAL; Product: BroadWorks (Cisco); Source: CISA KEV Catalog; URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog; Date: 2026-11-10; Section: CISA KEV (KNOWN EXPLOITED VULNERABILITY); Description: Cisco BroadWorks contains an improper restriction of XML external entity reference vulnerability that could allow an unauthenticated, remote attacker to read sensitive configuration information on an ",
        "distribution": 0,
        "sharing_group_id": 0,
        "Tag": [
          "severity:CRITICAL",
          "section:CISA KEV (KNOWN EXPLOITED VULNERABILITY)",
          "tag:kev",
          "tag:cisa",
          "tag:active-exploitation"
        ],
        "first_seen": "2026-11-10",
        "last_seen": "2026-11-10"
      },
      {
        "category": "Artefact on host",
        "type": "cve",
        "value": "CVE-2026-111560",
        "to_ids": true,
        "disable_correlation": false,
        "comment": "Severity: CRITICAL; Product: Multiple Products (Barracuda Networks); Source: CISA KEV Catalog; URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog; Date: 2026-11-10; Section: CISA KEV (KNOWN EXPLOITED VULNERABILITY); Description: Barracuda Networks Email Security Gateway (ESG), Load Balancer, Application Delivery Controller (ADC), Message Archiver (BMA), WAF Control Center (WCC), Web Application Firewall (WAF), and Web Securit",
        "distribution": 0,
        "sharing_group_id": 0,
        "Tag": [
          "severity:CRITICAL",
          "section:CISA KEV (KNOWN EXPLOITED VULNERABILITY)",
          "tag:kev",
          "tag:cisa",
          "tag:active-exploitation"
        ],
        "first_seen": "2026-11-10",
        "last_seen": "2026-11-10"
      },
      {
        "category": "Artefact on host",
        "type": "cve",
        "value": "CVE-2026-116606",
        "to_ids": true,
        "disable_correlation": false,
        "comment": "Severity: CRITICAL; Product: Barracuda Email Security Gateway (ESG) (Barracuda Networks); Source: CISA KEV Catalog; URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog; Date: 2026-11-10; Section: CISA KEV (KNOWN EXPLOITED VULNERABILITY); Description: Barracuda Networks Email Security Gateway (ESG) contains an authentication bypass using an alternate path or channel that could allow an unauthenticated remote attacker to invoke a configuration-impor",
        "distribution": 0,
        "sharing_group_id": 0,
        "Tag": [
          "severity:CRITICAL",
          "section:CISA KEV (KNOWN EXPLOITED VULNERABILITY)",
          "tag:kev",
          "tag:cisa",
          "tag:active-exploitation"
        ],
        "first_seen": "2026-11-10",
        "last_seen": "2026-11-10"
      },
      {
        "category": "Artefact on host",
        "type": "cve",
        "value": "CVE-2026-125350",
        "to_ids": true,
        "disable_correlation": false,
        "comment": "Severity: CRITICAL; Product: Chromium (Google); Source: CISA KEV Catalog; URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog; Date: 2026-11-10; Section: CISA KEV (KNOWN EXPLOITED VULNERABILITY); Description: Google Chromium contains a use-after-free vulnerability in the XML component that could allow a remote attacker to execute arbitrary code inside the sandbox via a specially crafted webpage. This vulne",
        "distribution": 0,
        "sharing_group_id": 0,
        "Tag": [
          "severity:CRITICAL",
          "section:CISA KEV (KNOWN EXPLOITED VULNERABILITY)",
          "tag:kev",
          "tag:cisa",
          "tag:active-exploitation"
        ],
        "first_seen": "2026-11-10",
        "last_seen": "2026-11-10"
      },
      {
        "category": "Artefact on host",
        "type": "cve",
        "value": "CVE-2026-102895",
        "to_ids": true,
        "disable_correlation": false,
        "comment": "Severity: CRITICAL; Product: GPUStack (GPUStack); Source: CISA KEV Catalog; URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog; Date: 2026-11-09; Section: CISA KEV (KNOWN EXPLOITED VULNERABILITY); Description: GPUStack contains an improper authentication vulnerability which could allow unauthenticated administrative access, including user and model changes, persistent administrator API-key creation, disclos",
        "distribution": 0,
        "sharing_group_id": 0,
        "Tag": [
          "severity:CRITICAL",
          "section:CISA KEV (KNOWN EXPLOITED VULNERABILITY)",
          "tag:kev",
          "tag:cisa",
          "tag:active-exploitation"
        ],
        "first_seen": "2026-11-09",
        "last_seen": "2026-11-09"
      },
      {
        "category": "Artefact on host",
        "type": "cve",
        "value": "CVE-2026-123158",
        "to_ids": true,
        "disable_correlation": false,
        "comment": "Severity: CRITICAL; Product: OpenSSH (OpenBSD); Source: CISA KEV Catalog; URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog; Date: 2026-11-09; Section: CISA KEV (KNOWN EXPLOITED VULNERABILITY); Description: OpenBSD OpenSSH on Linux contains an unexpected status code or return value vulnerability that could allow for authentication bypass.",
        "distribution": 0,
        "sharing_group_id": 0,
        "Tag": [
          "severity:CRITICAL",
          "section:CISA KEV (KNOWN EXPLOITED VULNERABILITY)",
          "tag:kev",
          "tag:cisa",
          "tag:active-exploitation"
        ],
        "first_seen": "2026-11-09",
        "last_seen": "2026-11-09"
      },
      {
        "category": "Artefact on host",
        "type": "cve",
        "value": "CVE-2026-116779",
        "to_ids": true,
        "disable_correlation": false,
        "comment": "Severity: CRITICAL; Product: FreeSwitch (SignalWire); Source: CISA KEV Catalog; URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog; Date: 2026-11-09; Section: CISA KEV (KNOWN EXPLOITED VULNERABILITY); Description: SignalWire FreeSwitch contains a code injection vulnerability that permits configuration and credential disclosure, arbitrary call control, and command execution.",
        "distribution": 0,
        "sharing_group_id": 0,
        "Tag": [
          "severity:CRITICAL",
          "section:CISA KEV (KNOWN EXPLOITED VULNERABILITY)",
          "tag:kev",
          "tag:cisa",
          "tag:active-exploitation"
        ],
        "first_seen": "2026-11-09",
        "last_seen": "2026-11-09"
      },
      {
        "category": "Artefact on host",
        "type": "cve",
        "value": "CVE-2026-123218",
        "to_ids": true,
        "disable_correlation": false,
        "comment": "Severity: CRITICAL; Product: Aspera Faspex (IBM); Source: CISA KEV Catalog; URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog; Date: 2026-11-09; Section: PHISHING URL; Description: IBM Aspera Faspex contains an incorrect authorization vulnerability that could allow an authenticated user to craft a specific message to bypass authorization, causing privilege escalations.",
        "distribution": 0,
        "sharing_group_id": 0,
        "Tag": [
          "severity:CRITICAL",
          "section:PHISHING URL",
          "tag:kev",
          "tag:cisa",
          "tag:active-exploitation"
        ],
        "first_seen": "2026-11-09",
        "last_seen": "2026-11-09"
      },
      {
        "category": "Other",
        "type": "other",
        "value": "http://support-center-apple.wasmer.app/",
        "to_ids": true,
        "disable_correlation": false,
        "comment": "Severity: CRITICAL; Source: OpenPhish; URL: http://support-center-apple.wasmer.app/; Section: PHISHING URL; Description: Active phishing URL: http://support-center-apple.wasmer.app/",
        "distribution": 0,
        "sharing_group_id": 0,
        "Tag": [
          "severity:CRITICAL",
          "section:PHISHING URL",
          "tag:phishing",
          "tag:openphish"
        ],
        "first_seen": "",
        "last_seen": ""
      },
      {
        "category": "Other",
        "type": "other",
        "value": "http://netflix-ui-clone-vikas.vercel.app/",
        "to_ids": true,
        "disable_correlation": false,
        "comment": "Severity: CRITICAL; Source: OpenPhish; URL: http://netflix-ui-clone-vikas.vercel.app/; Section: PHISHING URL; Description: Active phishing URL: http://netflix-ui-clone-vikas.vercel.app/",
        "distribution": 0,
        "sharing_group_id": 0,
        "Tag": [
          "severity:CRITICAL",
          "section:PHISHING URL",
          "tag:phishing",
          "tag:openphish"
        ],
        "first_seen": "",
        "last_seen": ""
      },
      {
        "category": "Other",
        "type": "other",
        "value": "https://mystorage-admin-signreview.b-cdn.net/",
        "to_ids": true,
        "disable_correlation": false,
        "comment": "Severity: CRITICAL; Source: OpenPhish; URL: https://mystorage-admin-signreview.b-cdn.net/; Section: PHISHING URL; Description: Active phishing URL: https://mystorage-admin-signreview.b-cdn.net/",
        "distribution": 0,
        "sharing_group_id": 0,
        "Tag": [
          "severity:CRITICAL",
          "section:PHISHING URL",
          "tag:phishing",
          "tag:openphish"
        ],
        "first_seen": "",
        "last_seen": ""
      },
      {
        "category": "Other",
        "type": "other",
        "value": "http://rentzimmer2.de/",
        "to_ids": true,
        "disable_correlation": false,
        "comment": "Severity: CRITICAL; Source: OpenPhish; URL: http://rentzimmer2.de/; Section: PHISHING URL; Description: Active phishing URL: http://rentzimmer2.de/",
        "distribution": 0,
        "sharing_group_id": 0,
        "Tag": [
          "severity:CRITICAL",
          "section:PHISHING URL",
          "tag:phishing",
          "tag:openphish"
        ],
        "first_seen": "",
        "last_seen": ""
      },
      {
        "category": "Other",
        "type": "other",
        "value": "http://www.attmail8566575.weebly.com/",
        "to_ids": true,
        "disable_correlation": false,
        "comment": "Severity: CRITICAL; Source: OpenPhish; URL: http://www.attmail8566575.weebly.com/; Section: PHISHING URL; Description: Active phishing URL: http://www.attmail8566575.weebly.com/",
        "distribution": 0,
        "sharing_group_id": 0,
        "Tag": [
          "severity:CRITICAL",
          "section:PHISHING URL",
          "tag:phishing",
          "tag:openphish"
        ],
        "first_seen": "",
        "last_seen": ""
      },
      {
        "category": "Other",
        "type": "other",
        "value": "http://pl-payu-paczka.biz.id/viewer/bWlsbGVubml1bQ/Ml8w/2eDiihr9zO",
        "to_ids": true,
        "disable_correlation": false,
        "comment": "Severity: CRITICAL; Source: OpenPhish; URL: http://pl-payu-paczka.biz.id/viewer/bWlsbGVubml1bQ/Ml8w/2eDiihr9zO; Section: PHISHING URL; Description: Active phishing URL: http://pl-payu-paczka.biz.id/viewer/bWlsbGVubml1bQ/Ml8w/2eDiihr9zO",
        "distribution": 0,
        "sharing_group_id": 0,
        "Tag": [
          "severity:CRITICAL",
          "section:PHISHING URL",
          "tag:phishing",
          "tag:openphish"
        ],
        "first_seen": "",
        "last_seen": ""
      },
      {
        "category": "Other",
        "type": "other",
        "value": "http://pl-payu-paczka.web.id/viewer/bWlsbGVubml1bQ/Ml8w/2eDiihr9zO",
        "to_ids": true,
        "disable_correlation": false,
        "comment": "Severity: CRITICAL; Source: OpenPhish; URL: http://pl-payu-paczka.web.id/viewer/bWlsbGVubml1bQ/Ml8w/2eDiihr9zO; Section: PHISHING URL; Description: Active phishing URL: http://pl-payu-paczka.web.id/viewer/bWlsbGVubml1bQ/Ml8w/2eDiihr9zO",
        "distribution": 0,
        "sharing_group_id": 0,
        "Tag": [
          "severity:CRITICAL",
          "section:PHISHING URL",
          "tag:phishing",
          "tag:openphish"
        ],
        "first_seen": "",
        "last_seen": ""
      },
      {
        "category": "Other",
        "type": "other",
        "value": "http://adspageactiveaccount.pages.dev/creators/appeals/submit-appeal-form/return",
        "to_ids": true,
        "disable_correlation": false,
        "comment": "Severity: CRITICAL; Source: OpenPhish; URL: http://adspageactiveaccount.pages.dev/creators/appeals/submit-appeal-form/return; Section: PHISHING URL; Description: Active phishing URL: http://adspageactiveaccount.pages.dev/creators/appeals/submit-appeal-form/return",
        "distribution": 0,
        "sharing_group_id": 0,
        "Tag": [
          "severity:CRITICAL",
          "section:PHISHING URL",
          "tag:phishing",
          "tag:openphish"
        ],
        "first_seen": "",
        "last_seen": ""
      },
      {
        "category": "Other",
        "type": "other",
        "value": "http://ralka-devon-biz-qenmar-soltek-sp9ct12.pages.dev/appeals/submit-appeal-form/return",
        "to_ids": true,
        "disable_correlation": false,
        "comment": "Severity: CRITICAL; Source: OpenPhish; URL: http://ralka-devon-biz-qenmar-soltek-sp9ct12.pages.dev/appeals/submit-appeal-form/return; Section: DOMAIN; Description: Active phishing URL: http://ralka-devon-biz-qenmar-soltek-sp9ct12.pages.dev/appeals/submit-appeal-form/return",
        "distribution": 0,
        "sharing_group_id": 0,
        "Tag": [
          "severity:CRITICAL",
          "section:DOMAIN",
          "tag:phishing",
          "tag:openphish"
        ],
        "first_seen": "",
        "last_seen": ""
      },
      {
        "category": "Domain and name",
        "type": "domain",
        "value": "support-center-apple.wasmer",
        "to_ids": true,
        "disable_correlation": false,
        "comment": "Severity: CRITICAL; Source: OpenPhish; URL: http://support-center-apple.wasmer.app/; Section: DOMAIN; Description: Phishing domain: support-center-apple.wasmer",
        "distribution": 0,
        "sharing_group_id": 0,
        "Tag": [
          "severity:CRITICAL",
          "section:DOMAIN",
          "tag:phishing",
          "tag:openphish",
          "tag:domain"
        ],
        "first_seen": "",
        "last_seen": ""
      },
      {
        "category": "Domain and name",
        "type": "domain",
        "value": "netflix-ui-clone-vikas.vercel",
        "to_ids": true,
        "disable_correlation": false,
        "comment": "Severity: CRITICAL; Source: OpenPhish; URL: http://netflix-ui-clone-vikas.vercel.app/; Section: DOMAIN; Description: Phishing domain: netflix-ui-clone-vikas.vercel",
        "distribution": 0,
        "sharing_group_id": 0,
        "Tag": [
          "severity:CRITICAL",
          "section:DOMAIN",
          "tag:phishing",
          "tag:openphish",
          "tag:domain"
        ],
        "first_seen": "",
        "last_seen": ""
      },
      {
        "category": "Domain and name",
        "type": "domain",
        "value": "cdn.net",
        "to_ids": true,
        "disable_correlation": false,
        "comment": "Severity: CRITICAL; Source: OpenPhish; URL: https://mystorage-admin-signreview.b-cdn.net/; Section: DOMAIN; Description: Phishing domain: cdn.net",
        "distribution": 0,
        "sharing_group_id": 0,
        "Tag": [
          "severity:CRITICAL",
          "section:DOMAIN",
          "tag:phishing",
          "tag:openphish",
          "tag:domain"
        ],
        "first_seen": "",
        "last_seen": ""
      },
      {
        "category": "Domain and name",
        "type": "domain",
        "value": "rentzimmer2.de",
        "to_ids": true,
        "disable_correlation": false,
        "comment": "Severity: CRITICAL; Source: OpenPhish; URL: http://rentzimmer2.de/; Section: DOMAIN; Description: Phishing domain: rentzimmer2.de",
        "distribution": 0,
        "sharing_group_id": 0,
        "Tag": [
          "severity:CRITICAL",
          "section:DOMAIN",
          "tag:phishing",
          "tag:openphish",
          "tag:domain"
        ],
        "first_seen": "",
        "last_seen": ""
      },
      {
        "category": "Domain and name",
        "type": "domain",
        "value": "attmail8566575.weebly",
        "to_ids": true,
        "disable_correlation": false,
        "comment": "Severity: CRITICAL; Source: OpenPhish; URL: http://www.attmail8566575.weebly.com/; Section: DOMAIN; Description: Phishing domain: attmail8566575.weebly",
        "distribution": 0,
        "sharing_group_id": 0,
        "Tag": [
          "severity:CRITICAL",
          "section:DOMAIN",
          "tag:phishing",
          "tag:openphish",
          "tag:domain"
        ],
        "first_seen": "",
        "last_seen": ""
      },
      {
        "category": "Domain and name",
        "type": "domain",
        "value": "pl-payu-paczka.biz",
        "to_ids": true,
        "disable_correlation": false,
        "comment": "Severity: CRITICAL; Source: OpenPhish; URL: http://pl-payu-paczka.biz.id/viewer/bWlsbGVubml1bQ/Ml8w/2eDiihr9zO; Section: DOMAIN; Description: Phishing domain: pl-payu-paczka.biz",
        "distribution": 0,
        "sharing_group_id": 0,
        "Tag": [
          "severity:CRITICAL",
          "section:DOMAIN",
          "tag:phishing",
          "tag:openphish",
          "tag:domain"
        ],
        "first_seen": "",
        "last_seen": ""
      },
      {
        "category": "Domain and name",
        "type": "domain",
        "value": "pl-payu-paczka.web",
        "to_ids": true,
        "disable_correlation": false,
        "comment": "Severity: CRITICAL; Source: OpenPhish; URL: http://pl-payu-paczka.web.id/viewer/bWlsbGVubml1bQ/Ml8w/2eDiihr9zO; Section: DOMAIN; Description: Phishing domain: pl-payu-paczka.web",
        "distribution": 0,
        "sharing_group_id": 0,
        "Tag": [
          "severity:CRITICAL",
          "section:DOMAIN",
          "tag:phishing",
          "tag:openphish",
          "tag:domain"
        ],
        "first_seen": "",
        "last_seen": ""
      },
      {
        "category": "Domain and name",
        "type": "domain",
        "value": "adspageactiveaccount.pages",
        "to_ids": true,
        "disable_correlation": false,
        "comment": "Severity: CRITICAL; Source: OpenPhish; URL: http://adspageactiveaccount.pages.dev/creators/appeals/submit-appeal-form/return; Section: DOMAIN; Description: Phishing domain: adspageactiveaccount.pages",
        "distribution": 0,
        "sharing_group_id": 0,
        "Tag": [
          "severity:CRITICAL",
          "section:DOMAIN",
          "tag:phishing",
          "tag:openphish",
          "tag:domain"
        ],
        "first_seen": "",
        "last_seen": ""
      },
      {
        "category": "Domain and name",
        "type": "domain",
        "value": "ralka-devon-biz-qenmar-soltek-sp9ct12.pages",
        "to_ids": true,
        "disable_correlation": false,
        "comment": "Severity: CRITICAL; Source: OpenPhish; URL: http://ralka-devon-biz-qenmar-soltek-sp9ct12.pages.dev/appeals/submit-appeal-form/return; Section: DOMAIN; Description: Phishing domain: ralka-devon-biz-qenmar-soltek-sp9ct12.pages",
        "distribution": 0,
        "sharing_group_id": 0,
        "Tag": [
          "severity:CRITICAL",
          "section:DOMAIN",
          "tag:phishing",
          "tag:openphish",
          "tag:domain"
        ],
        "first_seen": "",
        "last_seen": ""
      }
    ]
  }
}