Daily Cyber Threat Intel Brief — 2026-10-17

Generated: 2026-10-17 08:00:54 UTC

Executive summary

Priority technology watch items

- Researchers warn that hackers could soon exploit a maximum-severity vulnerability (CVE-2026-103849) affecting Magento and Adobe Commerce, potentially allowing them to execute arbitrary PHP code on store servers. [...]

- Double free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

- Double free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

- Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

- Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

- Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

- Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

- This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.

- This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.

- Public RansomLook extortion-site listing claim. Group: the gentlemen. Claimed victim/listing: Netcore Unbxd. Description excerpt: netcoreunbxd.com Netcore Unbxd AI product-discovery platform for enterprise e-commerce: smart site search, 1:1 personalization,…

- Public RansomLook extortion-site listing claim. Group: the gentlemen. Claimed victim/listing: Museum Siam. Description excerpt: museumsiam.org Museum Siam museum in Bangkok run by NDMI under the public organization OKMD — the .org domain is real, but it's a…

- Public RansomLook extortion-site listing claim. Group: the gentlemen. Claimed victim/listing: North Bridge Venture Partners. Description excerpt: northbridge.com North Bridge Venture Partners one of Boston's most storied venture capital firms, founded in 1994…

- Public RansomLook extortion-site listing claim. Group: the gentlemen. Claimed victim/listing: St Peters Anglican Primary School. Description excerpt: stpeters.sa.edu.au St Peter's Anglican Grammar independent Anglican co-ed school in Campbelltown, NSW (est.…

- Public RansomLook extortion-site listing claim. Group: the gentlemen. Claimed victim/listing: Sladek Partners. Description excerpt: ak-sladek_cz Sladek & Partners Prague law firm operating as Mgr. Ivana Sládková, advokát (IČO 66252946), with 24 years of…

- Public RansomLook extortion-site listing claim. Group: the gentlemen. Claimed victim/listing: Ecuadors National Police. Description excerpt: policia.gob.ec Ecuador's National Police country's main law enforcement agency — 180 years old (institutionalized…

- Overview On October 12, 2026, GitLab released 19.4.2 , 19.3.5 , and 19.2.8 to fix CVE-2026-97229 , an integer overflow in its CI/CD regular-expression handling. The issue was reported through HackerOne by joaxcar . GitLab assigned it a CVSS score of 10.0 and…

Newly exploited vulnerabilities / CVE watch

Ransomware and extortion trend notes

Malware / infrastructure / abuse feed highlights

IOC highlights

Defensive takeaways

Sources checked

Limitations