markcardiff.tech:/daily-intel/2026-10-22.html
cti@markcardiff:~/daily-intel$ return-to-index | home
Generated: 2026-10-22 08:00:39 UTC
P1: 4
P2: 12
Items: 250

Daily Cyber Threat Intel Brief — 2026-10-22

Generated: 2026-10-22 08:00:39 UTC

Executive summary

  • Collected 250 recent public-source CTI items for technology-only monitoring.
  • Priority distribution: P1=4, P2=12, P3=222, P4=12.
  • Highest-priority item: CVE-2026-109618 and CVE-2026-109619: Critical Unauthenticated Remote Code Execution in PHP (P1, source: Rapid7 Blog).
  • 20 public IOC highlights selected for analyst awareness.

    • Priority technology watch items

  • P1 CVE-2026-109618 and CVE-2026-109619: Critical Unauthenticated Remote Code Execution in PHP — Rapid7 Blog; score 107; technologies: Apache.

    • - Overview On October 21, 2026, the PHP project announced security releases for two critical vulnerabilities in PHP. CVE-2026-109618 can corrupt memory during out-of-memory (OOM) handling, while CVE-2026-109619 is a use-after-free flaw involving state retained…

  • P1 Critical PHP Vulnerability (CVE-2026-109618, CVE-2026-109619) [infocon yellow], (Wed, Oct 21st) — SANS Internet Storm Center; score 79; technologies: none explicitly matched.

    • - PHP.net announced that it will release a critical update today. We decided to change the infoCon to YELLOW due to the widespread use of PHP, the expected severity of the flaw (CVSS 9.4), and the availability of early PoC exploits ahead of the patch becoming…

  • P1 CVE-2026-97783 Microsoft Office SharePoint Spoofing Vulnerability — Microsoft Security Response Center RSS; score 75; technologies: SharePoint.

    • - The vulnerability associated with this CVE was fixed in July, however was inadvertently not included with that release. Microsoft recommends updating to the most current release of the SharePoint server.

  • P1 CVE-2026-69902 Windows NTFS Remote Code Execution Vulnerability — Microsoft Security Response Center RSS; score 70; technologies: none explicitly matched.

    • - Updated an acknowledgement. This is an informational change only.

  • P2 Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619 — Unit 42 Threat Research; score 67; technologies: none explicitly matched.

    • - CVE-2026-109618 and CVE-2026-109619 are Critical vulnerabilities in PHP, a scripting language used globally for web servers and CMS systems. The post Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619 appeared first on Unit 42 .

  • P2 RansomLook: W.A claimed by whitearmor — RansomLook Recent Listings; score 65; technologies: none explicitly matched.

    • - Public RansomLook extortion-site listing claim. Group: whitearmor. Claimed victim/listing: W.A. Description excerpt: Hello, We are WhiteArmor, an organization focused on data-theft extortion, with further motive to expand in to ransomware operations when…

  • P2 Rapid Response: php2shell, Leaked Critical PHP Vulnerabilities (CVE-2026-109618 & CVE-2026-109619) — Huntress Blog; score 65; technologies: none explicitly matched.

    • - Two critical PHP RCEs, CVE-2026-109618 and CVE-2026-109619, leaked before the patch. Learn what's known, who's exposed, and how to prepare now.

  • P2 PHP ships emergency patches for critical PHP2Shell flaws — BleepingComputer Ransomware News; score 62; technologies: none explicitly matched.

    • - The PHP security team released emergency security patches for two critical remote code execution (RCE) vulnerabilities (CVE-2026-109618 and CVE-2026-109619) tracked collectively as PHP2Shell. [...]

  • P2 URLhaus: malware_download URL observed (online) — URLhaus Recent URLs; score 60; technologies: none explicitly matched.

    • - Public URLhaus recent URL. Threat=malware_download; tags=FakeGit,github,SmartLoader,zip; url=https://github.com/bhuwan070/Ecommerce/raw/master/public/Software-1.0-beta.1.zip

  • P2 Q3 2026 Threat Update: Attackers Are Exploiting Vulnerabilities Within 3 Days — Rapid7 Blog; score 60; technologies: none explicitly matched.

    • - Three days is the average time between a high-severity vulnerability becoming public and its exploitation, according to the latest Quarterly Threat Landscape Report from Rapid7. And 71% of the exploitation tracked in Q3 occurred within the first seven days.…

  • P2 URLhaus: malware_download URL observed (online) — URLhaus Recent URLs; score 60; technologies: none explicitly matched.

    • - Public URLhaus recent URL. Threat=malware_download; tags=FakeGit,github,SmartLoader,zip; url=https://github.com/cursorjerry01-source/renodx/raw/HEAD/tests/3.9.zip

  • P2 CISA: SafePay ransomware hit over 600 critical infrastructure orgs — BleepingComputer Ransomware News; score 57; technologies: none explicitly matched.

    • - The Cybersecurity and Infrastructure Security Agency (CISA) says the SafePay ransomware gang has breached over 600 critical infrastructure organizations worldwide since 2024. [...]

  • P2 RansomLook: Weld Re 8 School District claimed by the gentlemen — RansomLook Recent Listings; score 53; technologies: none explicitly matched.

    • - Public RansomLook extortion-site listing claim. Group: the gentlemen. Claimed victim/listing: Weld Re 8 School District. Description excerpt: weld8.org Weld Re-8 School District public school district founded in 1914 in Fort Lupton, Colorado, serving about…

  • P2 RansomLook: (SELL) Lucid Motors Data Auction: 5 TB of Engineering Data & Source Code claimed by sovcali — RansomLook Recent Listings; score 53; technologies: none explicitly matched.

    • - Public RansomLook extortion-site listing claim. Group: sovcali. Claimed victim/listing: (SELL) Lucid Motors Data Auction: 5 TB of Engineering Data & Source Code. Description excerpt: To international automakers, technology-hungry competitors in China and the…

  • P2 URLhaus: malware_download URL observed (online) — URLhaus Recent URLs; score 52; technologies: none explicitly matched.

    • - Public URLhaus recent URL. Threat=malware_download; tags=CoinMiner,R2SHELL React2Shell CVE-2025-55182 loader elf exe nodejs; url=http://44.197.240.5/vltrig-loader-linux

  • P2 URLhaus: malware_download URL observed (online) — URLhaus Recent URLs; score 52; technologies: none explicitly matched.

    • - Public URLhaus recent URL. Threat=malware_download; tags=R2SHELL React2Shell CVE-2025-55182 loader elf exe nodejs; url=http://44.197.240.5/vltrig-loader.exe

    Newly exploited vulnerabilities / CVE watch

  • P1 CVE-2026-109618, CVE-2026-109619: CVE-2026-109618 and CVE-2026-109619: Critical Unauthenticated Remote Code Execution in PHP — technologies: Apache.
  • P1 CVE-2026-109618, CVE-2026-109619: Critical PHP Vulnerability (CVE-2026-109618, CVE-2026-109619) [infocon yellow], (Wed, Oct 21st) — technologies: not watchlist-specific.
  • P1 CVE-2026-97783: CVE-2026-97783 Microsoft Office SharePoint Spoofing Vulnerability — technologies: SharePoint.
  • P1 CVE-2026-69902: CVE-2026-69902 Windows NTFS Remote Code Execution Vulnerability — technologies: not watchlist-specific.
  • P2 CVE-2026-109618, CVE-2026-109619: Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619 — technologies: not watchlist-specific.
  • P2 CVE-2026-109618, CVE-2026-109619: Rapid Response: php2shell, Leaked Critical PHP Vulnerabilities (CVE-2026-109618 & CVE-2026-109619) — technologies: not watchlist-specific.
  • P2 CVE-2026-109618, CVE-2026-109619: PHP ships emergency patches for critical PHP2Shell flaws — technologies: not watchlist-specific.
  • P2 CVE-2025-55182: URLhaus: malware_download URL observed (online) — technologies: not watchlist-specific.
  • P2 CVE-2025-55182: URLhaus: malware_download URL observed (online) — technologies: not watchlist-specific.
  • P3 CVE-2026-83709: CVE-2026-83709 Windows NTLM Elevation of Privilege Vulnerability — technologies: not watchlist-specific.
  • P3 CVE-2025-55182: URLhaus: malware_download URL observed (offline) — technologies: not watchlist-specific.
  • P3 CVE-2025-55182: URLhaus: malware_download URL observed (offline) — technologies: not watchlist-specific.
  • P3 CVE-2025-55182: URLhaus: malware_download URL observed (online) — technologies: not watchlist-specific.
  • P3 CVE-2025-55182: URLhaus: malware_download URL observed (online) — technologies: not watchlist-specific.
  • P3 CVE-2025-55182: URLhaus: malware_download URL observed (online) — technologies: not watchlist-specific.
  • P3 CVE-2025-55182: URLhaus: malware_download URL observed (online) — technologies: not watchlist-specific.
  • P3 CVE-2025-55182: URLhaus: malware_download URL observed (offline) — technologies: not watchlist-specific.
  • P3 CVE-2025-55182: URLhaus: malware_download URL observed (offline) — technologies: not watchlist-specific.

    • Ransomware and extortion trend notes

  • P2 RansomLook: W.A claimed by whitearmor — Public RansomLook extortion-site listing claim. Group: whitearmor. Claimed victim/listing: W.A. Description excerpt: Hello, We are WhiteArmor, an organization focused on data-theft extortion, with further motive to…
  • P2 Q3 2026 Threat Update: Attackers Are Exploiting Vulnerabilities Within 3 Days — Three days is the average time between a high-severity vulnerability becoming public and its exploitation, according to the latest Quarterly Threat Landscape Report from Rapid7. And 71% of the exploitation tracked in Q3…
  • P2 CISA: SafePay ransomware hit over 600 critical infrastructure orgs — The Cybersecurity and Infrastructure Security Agency (CISA) says the SafePay ransomware gang has breached over 600 critical infrastructure organizations worldwide since 2024. [...]
  • P2 RansomLook: Weld Re 8 School District claimed by the gentlemen — Public RansomLook extortion-site listing claim. Group: the gentlemen. Claimed victim/listing: Weld Re 8 School District. Description excerpt: weld8.org Weld Re-8 School District public school district founded in 1914 in…
  • P2 RansomLook: (SELL) Lucid Motors Data Auction: 5 TB of Engineering Data & Source Code claimed by sovcali — Public RansomLook extortion-site listing claim. Group: sovcali. Claimed victim/listing: (SELL) Lucid Motors Data Auction: 5 TB of Engineering Data & Source Code. Description excerpt: To international automakers,…
  • P3 RansomLook: Updates. claimed by whitearmor — Public RansomLook extortion-site listing claim. Group: whitearmor. Claimed victim/listing: Updates.. Description excerpt: Hi all; spots within the group are still open. If you're looking to join, you can find our…
  • P3 RansomLook: Company #109 claimed by n0n — Public RansomLook extortion-site listing claim. Group: n0n. Claimed victim/listing: Company #109. Description excerpt: plumbing and kitchen products distribution · Cincinnati, Ohio, United States
  • P3 RansomLook: Company #108 claimed by n0n — Public RansomLook extortion-site listing claim. Group: n0n. Claimed victim/listing: Company #108. Description excerpt: media production (audio description and accessibility media) · Montreal, Quebec, Canada
  • P3 RansomLook: Company #107 claimed by n0n — Public RansomLook extortion-site listing claim. Group: n0n. Claimed victim/listing: Company #107. Description excerpt: fuel trading and construction materials · Bulgaria
  • P3 RansomLook: Company #106 claimed by n0n — Public RansomLook extortion-site listing claim. Group: n0n. Claimed victim/listing: Company #106. Description excerpt: Financial Advisory & Restructuring (US) · Chicago, Illinois, USA
  • P3 RansomLook: Company #105 claimed by n0n — Public RansomLook extortion-site listing claim. Group: n0n. Claimed victim/listing: Company #105. Description excerpt: diamond and lab grown diamond trading · New York, New York, United States
  • P3 RansomLook: Company #104 claimed by n0n — Public RansomLook extortion-site listing claim. Group: n0n. Claimed victim/listing: Company #104. Description excerpt: Legal Services - Family Law (US) · California, USA

    • Malware / infrastructure / abuse feed highlights

  • P2 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=FakeGit,github,SmartLoader,zip; url=https://github.com/bhuwan070/Ecommerce/raw/master/public/Software-1.0-beta.1.zip
  • P2 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=FakeGit,github,SmartLoader,zip; url=https://github.com/cursorjerry01-source/renodx/raw/HEAD/tests/3.9.zip
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=github,SalatStealer,zip; url=https://github.com/SourcePharaoh87/proxY/releases/download/1.10.2/proxy.zip
  • P3 Feodo Tracker: 1 recommended botnet C2 IPs listed — Public Feodo Tracker recommended IP blocklist snapshot. Sample: 50.16.16.211
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=botnetdomain,elf,mirai,modat,ua-wget; url=http://yaniatbisb.duckdns.org/main_x86_64
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=botnetdomain,elf,mirai,modat,ua-wget; url=http://yaniatbisb.duckdns.org/main_arm
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=botnetdomain,elf,mirai,modat,ua-wget; url=http://yaniatbisb.duckdns.org/main_ppc
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=botnetdomain,elf,mirai,modat,ua-wget; url=http://yaniatbisb.duckdns.org/main_x86
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=botnetdomain,elf,mirai,modat,ua-wget; url=http://yaniatbisb.duckdns.org/main_arm6
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=botnetdomain,elf,mirai,modat,ua-wget; url=http://yaniatbisb.duckdns.org/main_sh4
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=botnetdomain,elf,mirai,modat,ua-wget; url=http://yaniatbisb.duckdns.org/main_mips
  • P3 URLhaus: malware_download URL observed (online) — Public URLhaus recent URL. Threat=malware_download; tags=botnetdomain,elf,mirai,modat,ua-wget; url=http://yaniatbisb.duckdns.org/main_arm5

    • IOC highlights

    TypeValueContextSource
    cve`CVE-2026-109618`CVE-2026-109618 and CVE-2026-109619: Critical Unauthenticated Remote Code Execution in PHPRapid7 Blog
    cve`CVE-2026-109619`CVE-2026-109618 and CVE-2026-109619: Critical Unauthenticated Remote Code Execution in PHPRapid7 Blog
    cve`CVE-2026-97783`CVE-2026-97783 Microsoft Office SharePoint Spoofing VulnerabilityMicrosoft Security Response Center RSS
    cve`CVE-2026-69902`CVE-2026-69902 Windows NTFS Remote Code Execution VulnerabilityMicrosoft Security Response Center RSS
    cve`CVE-2025-55182`URLhaus: malware_download URL observed (online)URLhaus Recent URLs
    ipv4`44.197.240.5`URLhaus: malware_download URL observed (online)URLhaus Recent URLs
    cve`CVE-2026-83709`CVE-2026-83709 Windows NTLM Elevation of Privilege VulnerabilityMicrosoft Security Response Center RSS
    ipv4`194.163.143.72`URLhaus: malware_download URL observed (offline)URLhaus Recent URLs
    ipv4`85.215.219.126`URLhaus: malware_download URL observed (online)URLhaus Recent URLs
    ipv4`158.220.105.179`URLhaus: malware_download URL observed (online)URLhaus Recent URLs
    ipv4`138.197.174.121`URLhaus: malware_download URL observed (offline)URLhaus Recent URLs
    ipv4`50.16.16.211`Feodo Tracker: 1 recommended botnet C2 IPs listedFeodo Tracker Recommended Blocklist
    ipv4`166.0.100.70`URLhaus: malware_download URL observed (offline)URLhaus Recent URLs
    ipv4`198.44.46.58`URLhaus: malware_download URL observed (online)URLhaus Recent URLs
    ipv4`130.94.3.67`URLhaus: malware_download URL observed (online)URLhaus Recent URLs
    hash`b23808f4f924e441ec58891cb18fb6c4`RansomLook: FuG-Gruppe claimed by lamashtuRansomLook Recent Listings
    hash`6b08b44b54e028d4fa14065150b08494`RansomLook: MECA-PRECIS claimed by lamashtuRansomLook Recent Listings
    hash`22a8552383fdf42535512a5019ac49bc`RansomLook: WEPOS Chemie claimed by lamashtuRansomLook Recent Listings
    hash`f8a127a637f3db88cfe314cd01f97637`RansomLook: Gräfliches Hofbrauhaus Freising claimed by lamashtuRansomLook Recent Listings
    hash`ac6c36b4a325ff0f108ba220b70e6ec9`RansomLook: VERGI Muenster claimed by lamashtuRansomLook Recent Listings

    Defensive takeaways

  • Prioritize patch/exposure review for CISA KEV or actively exploited items touching the technology watchlist.
  • Treat public PoC or Nuclei-template activity as a signal to validate internet-facing exposure and logging, not as standalone proof of exploitation.
  • Use IOC highlights as short-lived hunting pivots; prefer behavior and vulnerable-asset validation over broad permanent blocking.

    • Sources checked

  • BleepingComputer Ransomware News: ok new=0 fetched=15
  • CISA Known Exploited Vulnerabilities: ok new=0 fetched=59
  • Cisco Talos Blog: ok new=0 fetched=15
  • Feodo Tracker Recommended Blocklist: ok new=0 fetched=1
  • Huntress Blog: ok new=0 fetched=25
  • Microsoft Security Response Center RSS: ok new=0 fetched=25
  • NVD Recent CVEs: ok new=43 fetched=80
  • ProjectDiscovery Nuclei Templates Releases: ok new=0 fetched=10
  • RansomLook Recent Listings: ok new=7 fetched=50
  • Rapid7 Blog: ok new=0 fetched=20
  • SANS Internet Storm Center: ok new=0 fetched=10
  • Sophos X-Ops: ok new=0 fetched=15
  • The DFIR Report: ok new=0 fetched=10
  • URLhaus Recent URLs: error: HTTP 410 for https://urlhaus.abuse.ch/downloads/csv_recent/: b'<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">\n<html><head>\n<title>410 Gone</title>\n</head><body>\n<h1>Gone</h1>\n<p>The requested resource is no longer avail'
  • Unit 42 Threat Research: ok new=0 fetched=15

    • Limitations

  • Public/open-source collection only; no paid feeds, customer watchlists, credential dumps, or direct dark-web interaction.
  • Technology-only matching can miss relevant items that do not name a tracked product explicitly.
  • Ransomware victim claims are actor/source claims unless independently corroborated.
  • IOC highlights are publicly sourced and should be validated before enforcement in production controls.
    • public/open-source CTI only // technology-watchlist scope // no customer identifiers // IOC highlights require analyst validation