Summary & highlights
DreamHost Forces Email and FTP/SFTP Password Resets Following Undisclosed Security Incident (Oct 2026). Roundcube twofactor_gauthenticator plugin 2FA bypass vulnerabilities (CVE-2026-107145, CVE-2026-107146, CVE-2026-107147). CVE-2026-105987: Stored XSS in KGS Software tia Viewer annotation API (versions before 1.2.8).
Highlights
- TL-2026-4508 — ICMacOS (Icarus macOS) Remote Access Trojan and Infostealer Sold as MaaS at $699/Week Targeting Mac Users
- TL-2026-4510 — EtherHiding Campaign Evolves: Blockchain-Hosted Payloads on 5,400+ Compromised Sites Add Covert WebRTC Data Channel C2
- TL-2026-4511 — ClickFix Campaign Abuses Claude.ai Shared Chats/Artifacts and Google Ads to Deliver AMOS Stealer and Windows .NET RAT
- TL-2026-4514 — Aokigahara Infostealer Targets ChatGPT, Claude, Codex, and Cursor Login Credentials
- TL-2026-4518 — Coruna and DarkSword iOS Spyware Delivered via Instagram Ads, Hijacked Expired Ad/Analytics Domains and Compromised PrestaShop Stores (DeadTag)
Theme of the day
Activity centered on clickfix, windows, credential-theft.
- windows
- credential-theft
- no-cve
- no-known-exploitation
- infostealer
Threats published
48 threat lines in the 2026-10-27 debrief, most severe first; entries marked (update) revise an earlier report. Each links to its full profile.
- Wasmtime Cranelift Sandbox Escape Flaws (CVE-2026-115889, CVE-2026-115893)CRITICAL
- CitrixBleed 2 (CVE-2025-5777) Exploited by Anubis Ransomware Affiliates Alongside Valid VPN Credentials and RMM Tool AbuseCRITICAL
- Critical HashiCorp Consul-k8s ACL Binding Rule Authorization Bypass Allows Cross-Namespace Privilege Escalation (CVE-2026-110720)CRITICAL
- September 2026 Major Cyber Attacks: ShinyHunters FBIJobs/PeopleSoft (CVE-2026-35273), Clop Leak Site Grav CMS Hijack (CVE-2026-42608), PaperCut AI-Agent Campaign, BlueMoon Zero-Day Chain, NetScaler C2 (CVE-2026-88771)CRITICAL
- GoAhead Web Server TLS Vulnerabilities (CVE-2026-115881, CVE-2026-115884) Expose Embedded DevicesCRITICAL
- GitLab CE/EE max-severity unauthenticated code execution via regular expression compiler (Onigmo) integer overflow (CVE-2026-110264)CRITICAL
- CVE-2026-97631: Code-Execution Flaw in TianoCore EDK II UEFI Firmware (PXE ICMP Error Handlers) Affects Most ServersCRITICAL
- Adobe Campaign Classic APSB26-162: Multiple Critical Vulnerabilities (CVE-2026-104351, CVE-2026-104353, CVE-2026-105780 and 5 others)CRITICAL
- ShinyHunters (UNC6240) Exploits Oracle PeopleSoft PeopleTools CVE-2026-35273 Zero-Day to Compromise 100+ Higher-Education Organizations (update)CRITICAL
- Citrix Patches Two Actively Exploited NetScaler Zero-Days (CVE-2026-88771, CVE-2026-88772) (update)CRITICAL
- Warlock Ransomware Attackers Hit Water and Telecom Operators via SharePoint ToolShell Exploitation (Longlegs / Storm-2603) (update)CRITICAL
- October 21 Roundup: PHP2Shell (CVE-2026-109618/109619), LiteLLM 1.107.0 Supply-Chain Backdoor, Palo Alto GlobalProtect CVE-2026-0257 Exploitation (update)CRITICAL
- Python2Shell: Brotli decoder out-of-bounds write in PyPI Brotli/brotlicffi (CVE-2026-111497) (update)CRITICAL
- ICMacOS (Icarus macOS) Remote Access Trojan and Infostealer Sold as MaaS at $699/Week Targeting Mac UsersHIGH
- EtherHiding Campaign Evolves: Blockchain-Hosted Payloads on 5,400+ Compromised Sites Add Covert WebRTC Data Channel C2HIGH
- ClickFix Campaign Abuses Claude.ai Shared Chats/Artifacts and Google Ads to Deliver AMOS Stealer and Windows .NET RATHIGH
- Aokigahara Infostealer Targets ChatGPT, Claude, Codex, and Cursor Login CredentialsHIGH
- Coruna and DarkSword iOS Spyware Delivered via Instagram Ads, Hijacked Expired Ad/Analytics Domains and Compromised PrestaShop Stores (DeadTag)HIGH
- Fake IT Support via Microsoft Teams External Federation Leads to Remote Access and Malware (Chaos / Black Basta-linked)HIGH
- Hijacked Cairn AI Pentesting Agent Panels Used to Install SSH Keys, Poseidon RAT and Steal API Keys (AIA0009 / AIA0010)HIGH
- Infostealer-Driven Claude AI Session Hijacking via Stolen Browser Cookies (Vidar, LummaC2, StealC, RedLine, Acreed, AMOS)HIGH
- PHP2Shell (CVE-2026-109618 / CVE-2026-109619) Weaponized Following Japanese Real Estate Extortion Campaign by kkkkevin777HIGH
- Threat actors targeting internet-exposed PLCs in US water/wastewater sector causing lockouts, disconnections and boil water notices (CISA alert 2026-07-30; Iranian-affiliated PLC campaign AA26-097A)HIGH
- New Sirius Backdoor Variant Delivered via Korean-Language FedEx Tax Invoice Phishing, Uses Fileless .NET Loading and Early Bird APC Injection into msbuild.exe/svchost.exeHIGH
- Tailscale 'Tailworm' Vulnerabilities (11 Findings in Tailscale SSH, App Connectors, Serve, DERP and Headscale) Allowing Root Privilege Escalation (Tailscale v1.104.2, Headscale v0.29.5)HIGH
- Coordinated GitHub API Enumeration and Access Token Abuse Targeting GitHub OrganizationsHIGH
- Ransomware Attack on UNM Health Cancels Surgeries and Diverts Ambulances (BYOD Group Attributed)HIGH
- Infostealers Target AI Service Credentials, Session Tokens and API Keys (Aokigahara, Warden Stealer, StealC)HIGH
- DeadTag campaign: Coruna and DarkSword iPhone exploit kits delivered via expired ad/analytics tags, compromised websites and malicious adsHIGH
- Convertr Plausible analytics script hijacked for payment card skimming (CVE-2026-8467)HIGH
- GMO Internet Onamae Desktop Cloud breach and extortion: 26,739 VPS servers exposed, MetaTrader credentials stolen, customers urged to shut down PCs over ransomware threatHIGH
- Yoba Malware Campaign Abuses Signed ChatGPT and Claude Binaries via Fake GitHub Repositories to Deploy XMRig MinerHIGH
- SkyW4lker: Device-Code Phishing Kit Targeting Microsoft 365 Accounts of American EnterprisesHIGH
- VerCellBreak: Vercel Sandbox network-allowlist bypass lets rogue AI agents exfiltrate data via crafted mTLS client certificate AIA extension (no CVE assigned) (update)HIGH
- Long-running JavaScript loader campaign infects 953 online stores (mostly Magento) via PolyShell (CVE-2026-48356) and SessionReaper (CVE-2025-54236) (update)HIGH
- DreamHost Forces Email and FTP/SFTP Password Resets Following Undisclosed Security Incident (Oct 2026)MEDIUM
- Roundcube twofactor_gauthenticator plugin 2FA bypass vulnerabilities (CVE-2026-107145, CVE-2026-107146, CVE-2026-107147)MEDIUM
- CVE-2026-105987: Stored XSS in KGS Software tia Viewer annotation API (versions before 1.2.8)MEDIUM
- Claude Mythos access expansion (Cyber Verification Program) and vulnerability management implicationsMEDIUM
- Nefilim and Hive Ransomware Affiliate Artem Stryzhak Sentenced to 70 MonthsMEDIUM
- Operation Omegaline: FBI Seizes virtualine.net, Disrupting Omegatech / Virtualine Technologies Bulletproof Hosting (AS202412)MEDIUM
- Covered California Phishing Incident Exposes Licensed Insurance Agent Data (PII incl. SSN/FEIN)MEDIUM
- OpenAI API 'Compaction Smuggling' Flaw Exposes Hidden GPT-5.6 Reasoning TracesMEDIUM
- Windows Print Spooler Heap Overflow in Form Enumeration (InternalEnumForms/CopyIniFormToFormInfo/PackStrings memcpy) — Unpatched, Public 60-Page Exploit Write-UpMEDIUM
- Attackers Abuse Legitimate Infrastructure (Staples, Dell Notification Pipelines) to Distribute Phishing EmailsMEDIUM
- Malicious Android Apps (ZloyRAT, RedWing Stealer) Lure Russian Users via Fuel-Price and Drone-Strike AnxietyMEDIUM
- Korean & Global Financial Sector Threats, September 2026: Phishing-to-Infostealer Chains with Telegram API Exfiltration and LockBit 5.0 / Qilin / Storm Ransomware Claims (AhnLab ASEC)MEDIUM
- CVE-2026-9539: libslirp TCP urgent pointer (sosendoob) out-of-bounds heap read and integer underflow host-memory leakMEDIUM
Techniques observed
264 MITRE ATT&CK and ATLAS techniques appear across the day’s reports.
- AML.T0024
- AML.T0051
- AML.T0053
- AML.T0054
- T1001.003
- T1003
- T1003.001
- T1003.003
- T1005
- T1008
- T1010
- T1016
- T1018
- T1020
- T1021
- T1021.001
- T1021.002
- T1021.004
- T1027
- T1027.006
- T1027.010
- T1027.013
- T1033
- T1036
- T1036.004
- T1036.005
- T1036.008
- T1037.004
- T1040
- T1041
- T1046
- T1047
- T1048
- T1048.002
- T1053.003
- T1053.005
- T1055
- T1055.004
- T1055.012
- T1056
- T1056.002
- T1056.003
- T1057
- T1059
- T1059.001
- T1059.002
- T1059.003
- T1059.004
- T1059.005
- T1059.006
- T1059.007
- T1068
- T1070
- T1070.002
- T1070.004
- T1070.006
- T1071
- T1071.001
- T1071.004
- T1074
- T1078
- T1078.002
- T1078.003
- T1078.004
- T1082
- T1083
- T1087
- T1087.001
- T1087.002
- T1087.004
- T1090
- T1090.003
- T1095
- T1098
- T1098.004
- T1098.007
- T1102.001
- T1105
- T1106
- T1110
- T1110.001
- T1110.003
- T1113
- T1114
- T1114.003
- T1115
- T1119
- T1123
- T1125
- T1132.001
- T1133
- T1136
- T1136.001
- T1136.003
- T1140
- T1176.001
- T1185
- T1187
- T1189
- T1190
- T1195.002
- T1199
- T1203
- T1204
- T1204.001
- T1204.002
- T1204.004
- T1210
- T1211
- T1212
- T1213
- T1213.003
- T1218.005
- T1218.007
- T1219
- T1219.001
- T1219.002
- T1404
- T1409
- T1417.001
- T1417.002
- T1437.001
- T1480
- T1481.002
- T1482
- T1484.001
- T1485
- T1486
- T1489
- T1490
- T1491
- T1491.001
- T1491.002
- T1496.001
- T1496.004
- T1497
- T1497.001
- T1499
- T1499.004
- T1505
- T1505.003
- T1513
- T1516
- T1517
- T1518
- T1518.001
- T1521
- T1528
- T1530
- T1531
- T1537
- T1539
- T1542.001
- T1542.003
- T1543
- T1543.001
- T1543.003
- T1546.004
- T1547.001
- T1547.009
- T1548.001
- T1550
- T1550.001
- T1550.004
- T1552
- T1552.001
- T1552.003
- T1552.004
- T1552.005
- T1552.007
- T1553.002
- T1553.005
- T1554
- T1555
- T1555.001
- T1555.003
- T1555.004
- T1555.005
- T1556
- T1557
- T1558
- T1560
- T1560.001
- T1562.001
- T1564
- T1564.001
- T1565
- T1565.001
- T1566
- T1566.001
- T1566.002
- T1566.003
- T1566.004
- T1567
- T1567.002
- T1568.001
- T1568.002
- T1569.002
- T1570
- T1572
- T1573
- T1573.001
- T1573.002
- T1574.001
- T1574.002
- T1582
- T1583
- T1583.001
- T1583.003
- T1583.004
- T1583.006
- T1583.008
- T1584.004
- T1585
- T1585.001
- T1585.002
- T1585.003
- T1587
- T1587.003
- T1587.004
- T1588.001
- T1588.002
- T1588.005
- T1588.006
- T1589
- T1589.002
- T1590.005
- T1591
- T1592.002
- T1593.003
- T1595
- T1595.002
- T1596.003
- T1596.005
- T1598
- T1598.004
- T1608
- T1608.001
- T1608.004
- T1608.005
- T1608.006
- T1611
- T1614.001
- T1616
- T1620
- T1622
- T1624.001
- T1634.001
- T1636.003
- T1636.004
- T1637.001
- T1646
- T1649
- T1655.001
- T1656
- T1657
- T1658
- T1659
- T1660
- T1665
- T1667
- T1684.001
- T1685
- T1685.005
Threat actors
8 named threat actors across the reports.
Nation-state attribution
- Iran
- Brazil
- China
Threat categories
- DATA_BREACH
- VULNERABILITY
- RANSOMWARE
- THREAT_INTEL
- PHISHING
- MALWARE
- ICS_SCADA
- SUPPLY_CHAIN
Severity breakdown
- critical13
- high22
- medium13
- low0
Indicator & detection coverage
Counts only: the indicator values and detection rule text behind them are tiered.
1112 indicators of compromise · Red and above. Compare plans
- network 355
- file 291
- entity 117
- behavioral 90
- infrastructure 80
- malware 66
- tool 56
- package 55
- technique 2
432 new detection rules (100% of the day’s threats covered) · Blue and above. Compare plans