# Daily Intelligence Briefing — Tuesday, October 13, 2026

> On 2026-10-13, Threadlinqs published 34 new threat reports and updated 1, 12 rated critical and 16 high, spanning 179 MITRE ATT&CK techniques and 7 named threat actors. Coverage that day added 315 new detection rules and 727 extracted indicators.

- **Edition:** 2026-10-13 (Tuesday)
- **Canonical:** https://intel.threadlinqs.com/debrief/2026-10-13
- **Last updated:** 2026-10-19
- **New threats:** 34 (1 updated)
- **Critical / high:** 12 critical, 16 high, 7 medium, 0 low
- **ATT&CK techniques:** 179
- **Threat actors:** 7
- **Indicators (count only):** 727
- **New detection rules (count only):** 315

## Summary & highlights

Amazon Fire TV Cube 3 Exploit Enables Root Access and Bootloader Unlock (CVE-2026-43499 Ghostlock). CVE-2026-63316: SQL Injection in Payload CMS via in/not_in query parameters. Anthropic Research: Small AI Models Could Autonomously Self-Replicate Across Poorly Secured IoT Devices.

- [TL-2026-3379](https://intel.threadlinqs.com/threat/TL-2026-3379) — Kimsuky 'Operation GitPower': Fake Zoom Installers and Malicious LNK Files Deliver Malware via GitHub/GitLab Staging
- [TL-2026-3385](https://intel.threadlinqs.com/threat/TL-2026-3385) — ICMacOS (Icarus macOS): ClickFix-delivered macOS infostealer evolving into persistent WebSocket RAT (GlowComa / MADHASH)
- [TL-2026-3386](https://intel.threadlinqs.com/threat/TL-2026-3386) — GhostProfile macOS Malware Clones Chrome Profiles to Browse With Victims' Live Logins
- [TL-2026-3389](https://intel.threadlinqs.com/threat/TL-2026-3389) — Apex Arena (REF8801) fake Web3 accelerator spreads CloudSyncD macOS backdoor and multi-stage Windows stealer via malicious npm packages @apexacc/cli and @apexacc/audit
- [TL-2026-3391](https://intel.threadlinqs.com/threat/TL-2026-3391) — MariaDB Server and Connector/C Flaws Enable Code Execution, Data Access and Credential Exposure (CVE-2026-107815, CVE-2026-107821, CVE-2026-102523, CVE-2026-107819)

## Theme of the day

Anubis ransomware struck Fairlife via CitrixBleed, while Apache Struts RCE was actively exploited per CISA KEV. Both severe, exploited attacks dominated the day's threat landscape.

privilege-escalation, no-known-exploitation, windows, no-public-poc, remote-code-execution

## Threats published

- [TL-2026-3398](https://intel.threadlinqs.com/threat/TL-2026-3398) — CRITICAL — Critical Ghostscript Heap Buffer Overflow in JPEG 2000 Output Adapter Enables RCE via Malicious PDFs (CVE-2026-39919)
- [TL-2026-3402](https://intel.threadlinqs.com/threat/TL-2026-3402) — CRITICAL — Progress MarkLogic Server: 31 Vulnerabilities (CVE-2026-9191, CVE-2026-85947 through CVE-2026-85976) Enabling Privilege Escalation, Code Execution and Authentication Bypass
- [TL-2026-3412](https://intel.threadlinqs.com/threat/TL-2026-3412) — CRITICAL — SAP October 2026 Patch Day: Critical Flaws in Cloud SDK for Python, NetWeaver Visual Composer and S/4HANA (CVE-2026-89111, CVE-2026-89110, CVE-2026-89107)
- [TL-2026-3413](https://intel.threadlinqs.com/threat/TL-2026-3413) — CRITICAL — CVE-2026-97229: Critical GitLab Unauthenticated RCE via CI/CD Regex Compiler Integer Overflow
- [TL-2026-3414](https://intel.threadlinqs.com/threat/TL-2026-3414) — CRITICAL — SAP Cloud SDK for Python OAuth2 SSRF credential theft (CVE-2026-89111)
- [TL-2026-3419](https://intel.threadlinqs.com/threat/TL-2026-3419) — CRITICAL — Docker Hub personal access token reassignment flaw (CVE-2026-105445, "GhostPAT") enables user impersonation and image tampering
- [TL-2026-3420](https://intel.threadlinqs.com/threat/TL-2026-3420) — CRITICAL — Ivanti Connect Secure Authentication Bypass by Spoofing Zero-Day (CVE-2026-104935) Exploited in the Wild
- [TL-2026-3433](https://intel.threadlinqs.com/threat/TL-2026-3433) — CRITICAL — Critical FortiSandbox GUI Authentication Bypass (CVE-2026-107656)
- [TL-2026-3443](https://intel.threadlinqs.com/threat/TL-2026-3443) — CRITICAL — October 2026 Microsoft Patch Tuesday: Exploited Windows Shell MotW Bypass (CVE-2026-96951), 1,417 Vulnerabilities Patched
- [TL-2026-3448](https://intel.threadlinqs.com/threat/TL-2026-3448) — CRITICAL — September 2026 CVE Landscape: 94 high-impact vulnerabilities, NetScaler zero-days CVE-2026-88771/CVE-2026-88772, AI-agent-assisted exploitation
- [TL-2026-3456](https://intel.threadlinqs.com/threat/TL-2026-3456) — CRITICAL — CISA KEV Adds Two Vulnerabilities: Microsoft Windows Shell Command Injection (CVE-2026-96951) and Ivanti Connect Secure Authentication Bypass by Spoofing (CVE-2026-104935)
- [TL-2026-3356](https://intel.threadlinqs.com/threat/TL-2026-3356) — CRITICAL — GitLab CE/EE max-severity unauthenticated code execution flaw in CI/CD Regular Expression Compiler (CVE-2026-97229) (update)
- [TL-2026-3379](https://intel.threadlinqs.com/threat/TL-2026-3379) — HIGH — Kimsuky 'Operation GitPower': Fake Zoom Installers and Malicious LNK Files Deliver Malware via GitHub/GitLab Staging
- [TL-2026-3385](https://intel.threadlinqs.com/threat/TL-2026-3385) — HIGH — ICMacOS (Icarus macOS): ClickFix-delivered macOS infostealer evolving into persistent WebSocket RAT (GlowComa / MADHASH)
- [TL-2026-3386](https://intel.threadlinqs.com/threat/TL-2026-3386) — HIGH — GhostProfile macOS Malware Clones Chrome Profiles to Browse With Victims' Live Logins
- [TL-2026-3389](https://intel.threadlinqs.com/threat/TL-2026-3389) — HIGH — Apex Arena (REF8801) fake Web3 accelerator spreads CloudSyncD macOS backdoor and multi-stage Windows stealer via malicious npm packages @apexacc/cli and @apexacc/audit
- [TL-2026-3391](https://intel.threadlinqs.com/threat/TL-2026-3391) — HIGH — MariaDB Server and Connector/C Flaws Enable Code Execution, Data Access and Credential Exposure (CVE-2026-107815, CVE-2026-107821, CVE-2026-102523, CVE-2026-107819)
- [TL-2026-3395](https://intel.threadlinqs.com/threat/TL-2026-3395) — HIGH — C2Looper: New Rust Backdoor Likely Tied to Ransomware Operations, Uses GitHub for C2
- [TL-2026-3409](https://intel.threadlinqs.com/threat/TL-2026-3409) — HIGH — Vexy Ransomware claims Guarufilme (Brazil) - 60 GB exfiltrated
- [TL-2026-3410](https://intel.threadlinqs.com/threat/TL-2026-3410) — HIGH — Fake Claude Installation Page Delivers Malware via ClickFix/InstallFix "Adception" Malvertising Campaign (macOS)
- [TL-2026-3415](https://intel.threadlinqs.com/threat/TL-2026-3415) — HIGH — RSVP to Disaster: Fake Event-Invitation Phishing Delivers ConnectWise ScreenConnect as RAT
- [TL-2026-3416](https://intel.threadlinqs.com/threat/TL-2026-3416) — HIGH — QR-Code Phishing (Quishing) Bypassing Corporate Email Security; Kimsuky QR Spearphishing
- [TL-2026-3417](https://intel.threadlinqs.com/threat/TL-2026-3417) — HIGH — LiteLLM gateway vulnerabilities: missing authorization, SSRF, file read and RCE (CVE-2026-35029, CVE-2026-59823)
- [TL-2026-3424](https://intel.threadlinqs.com/threat/TL-2026-3424) — HIGH — Zoom Clients Certificate Validation Flaws (CVE-2026-108184, CVE-2026-108185) Expose Sensitive Information via Network Access
- [TL-2026-3425](https://intel.threadlinqs.com/threat/TL-2026-3425) — HIGH — VerCellBreak: Vercel Sandbox network-allowlist bypass lets rogue AI agents exfiltrate data via crafted mTLS client certificate AIA extension (no CVE assigned)
- [TL-2026-3430](https://intel.threadlinqs.com/threat/TL-2026-3430) — HIGH — Adobe Patches ~140 Vulnerabilities Across 10 Products (ColdFusion, Content Credentials SDK, Photoshop, Commerce, others)
- [TL-2026-3434](https://intel.threadlinqs.com/threat/TL-2026-3434) — HIGH — XWorm RAT (V6.4-V7.4): Microphone Surveillance and Logged-In Browser Session Hijacking
- [TL-2026-3449](https://intel.threadlinqs.com/threat/TL-2026-3449) — HIGH — Linux SSH Server Attacks Deploying ShellBot, Fisieredoor, XHide Rootkit and XMRig (AhnLab ASEC Q3 2026 Report)
- [TL-2026-3393](https://intel.threadlinqs.com/threat/TL-2026-3393) — MEDIUM — Amazon Fire TV Cube 3 Exploit Enables Root Access and Bootloader Unlock (CVE-2026-43499 Ghostlock)
- [TL-2026-3399](https://intel.threadlinqs.com/threat/TL-2026-3399) — MEDIUM — CVE-2026-63316: SQL Injection in Payload CMS via in/not_in query parameters
- [TL-2026-3418](https://intel.threadlinqs.com/threat/TL-2026-3418) — MEDIUM — Anthropic Research: Small AI Models Could Autonomously Self-Replicate Across Poorly Secured IoT Devices
- [TL-2026-3429](https://intel.threadlinqs.com/threat/TL-2026-3429) — MEDIUM — MFA Coverage Gaps (Cloud-only MFA, VPN, RDP, Windows Logon) Exploited with Stolen Credentials - Akira Affiliate SonicWall VPN Intrusion (Aug 2026)
- [TL-2026-3435](https://intel.threadlinqs.com/threat/TL-2026-3435) — MEDIUM — Microsoft October 2026 Patch Tuesday: 1,118 Vulnerabilities Fixed, Grouped into 15 Risk Cohorts
- [TL-2026-3451](https://intel.threadlinqs.com/threat/TL-2026-3451) — MEDIUM — Q3 2026 Malware Campaigns Targeting Windows Database Servers (MS-SQL/MySQL) - XMRig, Web Shells, VShell, Remote Access Tools
- [TL-2026-3452](https://intel.threadlinqs.com/threat/TL-2026-3452) — MEDIUM — Insider Threat: OpenAI Engineer Arrested for Planting Hidden Audio Recording Device in Executive Conference Room

## Techniques observed

[T1003.001](https://intel.threadlinqs.com/technique/T1003.001), [T1003.002](https://intel.threadlinqs.com/technique/T1003.002), [T1003.006](https://intel.threadlinqs.com/technique/T1003.006), [T1005](https://intel.threadlinqs.com/technique/T1005), [T1014](https://intel.threadlinqs.com/technique/T1014), [T1016](https://intel.threadlinqs.com/technique/T1016), [T1018](https://intel.threadlinqs.com/technique/T1018), [T1020](https://intel.threadlinqs.com/technique/T1020), [T1021.001](https://intel.threadlinqs.com/technique/T1021.001), [T1021.004](https://intel.threadlinqs.com/technique/T1021.004), [T1027](https://intel.threadlinqs.com/technique/T1027), [T1027.010](https://intel.threadlinqs.com/technique/T1027.010), [T1033](https://intel.threadlinqs.com/technique/T1033), [T1036](https://intel.threadlinqs.com/technique/T1036), [T1036.003](https://intel.threadlinqs.com/technique/T1036.003), [T1036.004](https://intel.threadlinqs.com/technique/T1036.004), [T1036.005](https://intel.threadlinqs.com/technique/T1036.005), [T1036.007](https://intel.threadlinqs.com/technique/T1036.007), [T1036.008](https://intel.threadlinqs.com/technique/T1036.008), [T1039](https://intel.threadlinqs.com/technique/T1039), [T1040](https://intel.threadlinqs.com/technique/T1040), [T1041](https://intel.threadlinqs.com/technique/T1041), [T1046](https://intel.threadlinqs.com/technique/T1046), [T1047](https://intel.threadlinqs.com/technique/T1047), [T1048](https://intel.threadlinqs.com/technique/T1048), [T1048.002](https://intel.threadlinqs.com/technique/T1048.002), [T1053.005](https://intel.threadlinqs.com/technique/T1053.005), [T1055](https://intel.threadlinqs.com/technique/T1055), T1055.009, [T1056.001](https://intel.threadlinqs.com/technique/T1056.001), [T1056.002](https://intel.threadlinqs.com/technique/T1056.002), [T1057](https://intel.threadlinqs.com/technique/T1057), [T1059](https://intel.threadlinqs.com/technique/T1059), [T1059.001](https://intel.threadlinqs.com/technique/T1059.001), [T1059.002](https://intel.threadlinqs.com/technique/T1059.002), [T1059.003](https://intel.threadlinqs.com/technique/T1059.003), [T1059.004](https://intel.threadlinqs.com/technique/T1059.004), [T1059.005](https://intel.threadlinqs.com/technique/T1059.005), [T1059.006](https://intel.threadlinqs.com/technique/T1059.006), [T1059.007](https://intel.threadlinqs.com/technique/T1059.007), [T1068](https://intel.threadlinqs.com/technique/T1068), [T1069.002](https://intel.threadlinqs.com/technique/T1069.002), T1070.002, [T1070.004](https://intel.threadlinqs.com/technique/T1070.004), [T1071.001](https://intel.threadlinqs.com/technique/T1071.001), [T1074.001](https://intel.threadlinqs.com/technique/T1074.001), [T1078](https://intel.threadlinqs.com/technique/T1078), [T1078.004](https://intel.threadlinqs.com/technique/T1078.004), [T1080](https://intel.threadlinqs.com/technique/T1080), [T1082](https://intel.threadlinqs.com/technique/T1082), [T1083](https://intel.threadlinqs.com/technique/T1083), [T1087.002](https://intel.threadlinqs.com/technique/T1087.002), [T1090](https://intel.threadlinqs.com/technique/T1090), [T1095](https://intel.threadlinqs.com/technique/T1095), [T1098](https://intel.threadlinqs.com/technique/T1098), [T1102.002](https://intel.threadlinqs.com/technique/T1102.002), [T1105](https://intel.threadlinqs.com/technique/T1105), [T1106](https://intel.threadlinqs.com/technique/T1106), [T1110](https://intel.threadlinqs.com/technique/T1110), [T1110.001](https://intel.threadlinqs.com/technique/T1110.001), [T1110.003](https://intel.threadlinqs.com/technique/T1110.003), [T1111](https://intel.threadlinqs.com/technique/T1111), [T1113](https://intel.threadlinqs.com/technique/T1113), [T1115](https://intel.threadlinqs.com/technique/T1115), [T1119](https://intel.threadlinqs.com/technique/T1119), [T1123](https://intel.threadlinqs.com/technique/T1123), [T1125](https://intel.threadlinqs.com/technique/T1125), [T1132.001](https://intel.threadlinqs.com/technique/T1132.001), [T1133](https://intel.threadlinqs.com/technique/T1133), [T1134](https://intel.threadlinqs.com/technique/T1134), [T1134.001](https://intel.threadlinqs.com/technique/T1134.001), [T1136](https://intel.threadlinqs.com/technique/T1136), [T1136.001](https://intel.threadlinqs.com/technique/T1136.001), [T1136.003](https://intel.threadlinqs.com/technique/T1136.003), [T1140](https://intel.threadlinqs.com/technique/T1140), [T1185](https://intel.threadlinqs.com/technique/T1185), [T1189](https://intel.threadlinqs.com/technique/T1189), [T1190](https://intel.threadlinqs.com/technique/T1190), [T1195.002](https://intel.threadlinqs.com/technique/T1195.002), [T1197](https://intel.threadlinqs.com/technique/T1197), [T1199](https://intel.threadlinqs.com/technique/T1199), [T1203](https://intel.threadlinqs.com/technique/T1203), [T1204](https://intel.threadlinqs.com/technique/T1204), [T1204.001](https://intel.threadlinqs.com/technique/T1204.001), [T1204.002](https://intel.threadlinqs.com/technique/T1204.002), [T1204.004](https://intel.threadlinqs.com/technique/T1204.004), [T1210](https://intel.threadlinqs.com/technique/T1210), [T1211](https://intel.threadlinqs.com/technique/T1211), [T1212](https://intel.threadlinqs.com/technique/T1212), [T1213](https://intel.threadlinqs.com/technique/T1213), [T1213.003](https://intel.threadlinqs.com/technique/T1213.003), T1218.003, [T1219](https://intel.threadlinqs.com/technique/T1219), [T1219.002](https://intel.threadlinqs.com/technique/T1219.002), [T1404](https://intel.threadlinqs.com/technique/T1404), [T1480](https://intel.threadlinqs.com/technique/T1480), [T1485](https://intel.threadlinqs.com/technique/T1485), [T1489](https://intel.threadlinqs.com/technique/T1489), [T1490](https://intel.threadlinqs.com/technique/T1490), [T1496.001](https://intel.threadlinqs.com/technique/T1496.001), [T1497.001](https://intel.threadlinqs.com/technique/T1497.001), [T1499](https://intel.threadlinqs.com/technique/T1499), [T1499.004](https://intel.threadlinqs.com/technique/T1499.004), [T1505.003](https://intel.threadlinqs.com/technique/T1505.003), [T1518](https://intel.threadlinqs.com/technique/T1518), [T1525](https://intel.threadlinqs.com/technique/T1525), [T1528](https://intel.threadlinqs.com/technique/T1528), [T1530](https://intel.threadlinqs.com/technique/T1530), [T1534](https://intel.threadlinqs.com/technique/T1534), [T1539](https://intel.threadlinqs.com/technique/T1539), [T1542](https://intel.threadlinqs.com/technique/T1542), [T1543.001](https://intel.threadlinqs.com/technique/T1543.001), [T1546.004](https://intel.threadlinqs.com/technique/T1546.004), [T1548](https://intel.threadlinqs.com/technique/T1548), [T1548.002](https://intel.threadlinqs.com/technique/T1548.002), [T1548.003](https://intel.threadlinqs.com/technique/T1548.003), [T1550.001](https://intel.threadlinqs.com/technique/T1550.001), [T1550.004](https://intel.threadlinqs.com/technique/T1550.004), [T1552](https://intel.threadlinqs.com/technique/T1552), [T1552.001](https://intel.threadlinqs.com/technique/T1552.001), [T1552.003](https://intel.threadlinqs.com/technique/T1552.003), [T1552.004](https://intel.threadlinqs.com/technique/T1552.004), [T1553](https://intel.threadlinqs.com/technique/T1553), [T1553.001](https://intel.threadlinqs.com/technique/T1553.001), [T1553.005](https://intel.threadlinqs.com/technique/T1553.005), [T1555.001](https://intel.threadlinqs.com/technique/T1555.001), [T1555.003](https://intel.threadlinqs.com/technique/T1555.003), [T1555.005](https://intel.threadlinqs.com/technique/T1555.005), [T1556](https://intel.threadlinqs.com/technique/T1556), [T1557](https://intel.threadlinqs.com/technique/T1557), [T1558](https://intel.threadlinqs.com/technique/T1558), [T1558.003](https://intel.threadlinqs.com/technique/T1558.003), [T1560](https://intel.threadlinqs.com/technique/T1560), [T1560.001](https://intel.threadlinqs.com/technique/T1560.001), [T1564](https://intel.threadlinqs.com/technique/T1564), [T1564.001](https://intel.threadlinqs.com/technique/T1564.001), T1564.002, [T1564.003](https://intel.threadlinqs.com/technique/T1564.003), [T1565](https://intel.threadlinqs.com/technique/T1565), [T1565.001](https://intel.threadlinqs.com/technique/T1565.001), [T1565.002](https://intel.threadlinqs.com/technique/T1565.002), [T1566](https://intel.threadlinqs.com/technique/T1566), [T1566.001](https://intel.threadlinqs.com/technique/T1566.001), [T1566.002](https://intel.threadlinqs.com/technique/T1566.002), [T1566.003](https://intel.threadlinqs.com/technique/T1566.003), [T1567](https://intel.threadlinqs.com/technique/T1567), [T1567.001](https://intel.threadlinqs.com/technique/T1567.001), [T1567.002](https://intel.threadlinqs.com/technique/T1567.002), [T1570](https://intel.threadlinqs.com/technique/T1570), [T1571](https://intel.threadlinqs.com/technique/T1571), [T1572](https://intel.threadlinqs.com/technique/T1572), [T1573.002](https://intel.threadlinqs.com/technique/T1573.002), [T1574.001](https://intel.threadlinqs.com/technique/T1574.001), [T1574.006](https://intel.threadlinqs.com/technique/T1574.006), T1574.008, [T1583.001](https://intel.threadlinqs.com/technique/T1583.001), [T1583.003](https://intel.threadlinqs.com/technique/T1583.003), [T1583.006](https://intel.threadlinqs.com/technique/T1583.006), [T1583.008](https://intel.threadlinqs.com/technique/T1583.008), [T1584](https://intel.threadlinqs.com/technique/T1584), [T1585](https://intel.threadlinqs.com/technique/T1585), [T1585.002](https://intel.threadlinqs.com/technique/T1585.002), [T1587.004](https://intel.threadlinqs.com/technique/T1587.004), [T1588.005](https://intel.threadlinqs.com/technique/T1588.005), [T1588.007](https://intel.threadlinqs.com/technique/T1588.007), T1591.001, [T1592](https://intel.threadlinqs.com/technique/T1592), [T1595.001](https://intel.threadlinqs.com/technique/T1595.001), [T1595.002](https://intel.threadlinqs.com/technique/T1595.002), [T1598.003](https://intel.threadlinqs.com/technique/T1598.003), [T1601](https://intel.threadlinqs.com/technique/T1601), [T1611](https://intel.threadlinqs.com/technique/T1611), [T1614](https://intel.threadlinqs.com/technique/T1614), [T1620](https://intel.threadlinqs.com/technique/T1620), T1638, [T1657](https://intel.threadlinqs.com/technique/T1657), [T1684.001](https://intel.threadlinqs.com/technique/T1684.001), [T1685](https://intel.threadlinqs.com/technique/T1685), [T1688](https://intel.threadlinqs.com/technique/T1688)

## Threat actors

[Akira ransomware affiliate](https://intel.threadlinqs.com/actor/Akira%20ransomware%20affiliate), [Larva-26009](https://intel.threadlinqs.com/actor/Larva-26009), [Kimsuky](https://intel.threadlinqs.com/actor/Kimsuky), [GlowComa](https://intel.threadlinqs.com/actor/GlowComa), [Vexy Ransomware](https://intel.threadlinqs.com/actor/Vexy%20Ransomware), [UTA0576](https://intel.threadlinqs.com/actor/UTA0576), [NightEagle](https://intel.threadlinqs.com/actor/NightEagle)

Nation-state attribution: North Korea

Threat categories: VULNERABILITY, THREAT_INTEL, MALWARE, APT, RANSOMWARE, PHISHING

## Severity breakdown

- critical: 12
- high: 16
- medium: 7
- low: 0

## Indicator & detection coverage

Counts only; indicator values require Red and above, detection rule text requires Blue and above.

- Indicators of compromise: 727 (file 168, network 148, behavioral 105, infrastructure 96, entity 68, tool 56, package 50, malware 35, technique 1)
- New detection rules: 315 (100% of the day’s threats covered)

## More editions

- Previous: [2026-10-12](https://intel.threadlinqs.com/debrief/2026-10-12)
- Next: [2026-10-14](https://intel.threadlinqs.com/debrief/2026-10-14)
- [Archive of daily debriefs](https://intel.threadlinqs.com/debrief/archive)
- [Latest debrief](https://intel.threadlinqs.com/debrief)

Canonical: https://intel.threadlinqs.com/debrief/2026-10-13