Skip to navigation

Daily Cyber Threat Intelligence Briefing

The Threadlinqs daily debrief is a free daily cyber threat intelligence briefing: a curated summary of every threat added or updated in the last 24 hours, with detection coverage and MITRE ATT&CK mapping.

Edition . Data as of .

2026-11-12: 8 new threats, 99 new detections (Splunk SPL / Microsoft KQL / Sigma). Platform totals: 3855 threats, 35134 detections.

Titan Quest: Anniversary Edition heap overflow in .lvl/.pfx file parsing exploited via malicious custom maps (no CVE). SnakeKeylogger infostealer delivered via quote-request phishing emails (JavaScript/PowerShell chain, process hollowing into aspnet_compiler.exe). Lookalike Microsoft Teams domains delivered via search ads, AI search answers and SEO poisoning (no phishing email).

Cyber threats in this daily briefing

  • [MEDIUM] TL-2026-5832 — Titan Quest: Anniversary Edition heap overflow in .lvl/.pfx file parsing exploited via malicious custom maps (no CVE)
  • [MEDIUM] TL-2026-5833 — SnakeKeylogger infostealer delivered via quote-request phishing emails (JavaScript/PowerShell chain, process hollowing into aspnet_compiler.exe)
  • [MEDIUM] TL-2026-5834 — Lookalike Microsoft Teams domains delivered via search ads, AI search answers and SEO poisoning (no phishing email)
  • [HIGH] TL-2026-5828 — Node.js November 2026 Security Releases Patch 16 Vulnerabilities (HTTP/2 crashes, HTTPS heap/TLS key leak CVE-2026-123864, TLS client-certificate auth bypass)
  • [HIGH] TL-2026-5830 — Microsoft AI-Assisted Research Discloses 59 Linux Kernel Bug Reports (33 CVEs) Incl. 21-Year-Old cls_u32 Flaw CVE-2026-74544; Local Root LPE Exploits Confirmed for 8 CVEs
  • [HIGH] TL-2026-5838 — SignDrop: Unpatched Windows CLFS Zero-Day Enables Local Privilege Escalation to SYSTEM (No CVE)
  • [HIGH] TL-2026-5840 — Palo Alto Networks PAN-OS (Panorama) Code Injection RCE as Root - CVE-2026-0330
  • [HIGH] TL-2026-5841 — PureRAT and PureLogs Campaign Targeting Japanese Organizations (Phishing, Donut Loader, BYOVD via Lenovo-signed BootRepair.sys)
  • [HIGH] TL-2026-5752 — Citrus Ransomware: VLESS tunnels, Sn00py encryption and LLM-assisted scripting (CVE-2026-54121, CVE-2020-1337) (update)
  • [HIGH] TL-2026-5823 — SCKit Campaign: Rogue ScreenConnect Clients Deployed Across 288 Devices at 48 Organizations via Hijacked ScreenConnect Panels and RMM+ Extension (update)
  • [CRITICAL] TL-2026-5797 — CVE-2026-119618: Critical Unauthenticated RCE via Race Condition in Apache HTTP Server mod_http2 assign_headers() (update)

Recent debriefs

Browse the archive of every daily debrief.

Detection query text and IOC values unlock per threat with TL Creds; the Threadlinqs MCP server (Purple) serves them to AI agents. Machine-readable overview: /llms.txt.

Platform

How the platform works, on threadlinqs.com: platform overview.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats