markcardiff.tech:/daily-intel/2026-10-24.html
cti@markcardiff:~/daily-intel$ return-to-index | home
Generated: 2026-10-24 08:00:31 UTC
P1: 3
P2: 1
Items: 66

Daily Cyber Threat Intel Brief — 2026-10-24

Generated: 2026-10-24 08:00:31 UTC

Executive summary

  • Collected 66 recent public-source CTI items for technology-only monitoring.
  • Priority distribution: P1=3, P2=1, P3=58, P4=4.
  • Highest-priority item: Metasploit Wrap Up: Langflow, MongoDB, and More (P1, source: Rapid7 Blog).
  • 25 public IOC highlights selected for analyst awareness.

    • Priority technology watch items

  • P1 Metasploit Wrap Up: Langflow, MongoDB, and More — Rapid7 Blog; score 95; technologies: Apache.

    • - This release adds multiple new modules, and 6 of those modules point at a single target: Langflow , the open-source LLM workflow builder. Together they cover an authentication bypass (CVE-2026-93680), 3 unauthenticated remote code execution paths…

  • P1 GitHub release: Nuclei Templates v10.5.1 - Release Notes — ProjectDiscovery Nuclei Templates Releases; score 90; technologies: Ivanti, WordPress.

    • - ### New Templates Added: `68` | CVEs Added: `54` | First-time contributions: `11` ### 🔥 Release Highlights 🔥 - [CVE-2026-109618] PHP2Shell (CVE-2026-109618/CVE-2026-109619) - Active Crash Detection (@lcfr_hax, @assetnote, @princechaddha, @s4e-io) [critical]…

  • P1 CVE-2026-83862 Windows Network Load Balancing Remote Code Execution Vulnerability — Microsoft Security Response Center RSS; score 70; technologies: none explicitly matched.

    • - Corrected the CVSS Attack Vector metric from Network (AV:N) to Adjacent (AV:A) to reflect the requirement for Layer 2 network adjacency. The CVSS base score has decreased from 9.8 to 8.8. This is an informational change only. Customers who have successfully…

  • P2 Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619 (Updated October 23) — Unit 42 Threat Research; score 67; technologies: none explicitly matched.

    • - CVE-2026-109618 and CVE-2026-109619 are Critical vulnerabilities in PHP, a scripting language used globally for web servers and CMS systems. The post Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619 (Updated October 23) appeared…

    Newly exploited vulnerabilities / CVE watch

  • P1 CVE-2026-0768, CVE-2026-0769, CVE-2026-10134, CVE-2026-7873, CVE-2026-93674, CVE-2026-93680: Metasploit Wrap Up: Langflow, MongoDB, and More — technologies: Apache.
  • P1 CVE-2026-104935, CVE-2026-105133, CVE-2026-109618, CVE-2026-109619, CVE-2026-82186, CVE-2026-85097, CVE-2026-85714, CVE-2026-86242, CVE-2026-90774: GitHub release: Nuclei Templates v10.5.1 - Release Notes — technologies: Ivanti, WordPress.
  • P1 CVE-2026-83862: CVE-2026-83862 Windows Network Load Balancing Remote Code Execution Vulnerability — technologies: not watchlist-specific.
  • P2 CVE-2026-109618, CVE-2026-109619: Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619 (Updated October 23) — technologies: not watchlist-specific.
  • P3 CVE-2026-102208: CVE-2026-102208 Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability — technologies: not watchlist-specific.

    • Ransomware and extortion trend notes

  • P3 RansomLook: Commonwealth Community Bank claimed by qilin — Public RansomLook extortion-site listing claim. Group: qilin. Claimed victim/listing: Commonwealth Community Bank. Description excerpt: Banking
  • P3 RansomLook: Trinity Custom Homes claimed by deadlock — Public RansomLook extortion-site listing claim. Group: deadlock. Claimed victim/listing: Trinity Custom Homes. Description excerpt: Trinity Custom Homes is a custom home builder that specializes in building 100% custom,…
  • P3 RansomLook: Sanders Law Group claimed by rhysida — Public RansomLook extortion-site listing claim. Group: rhysida. Claimed victim/listing: Sanders Law Group. Description excerpt: Sanders Law Group DATA SALE LISTING - Sanders Law Group / Sanders Law Firm, PLLC…
  • P3 RansomLook: Company #110 claimed by n0n — Public RansomLook extortion-site listing claim. Group: n0n. Claimed victim/listing: Company #110. Description excerpt: smart grid engineering firm · Spain
  • P3 RansomLook: Madison Honda claimed by interlock — Public RansomLook extortion-site listing claim. Group: interlock. Claimed victim/listing: Madison Honda. Description excerpt: http://www.madisonhonda.com/ Madison Honda, located in Madison, New Jersey, offers a wide…
  • P3 RansomLook: Custom Floors Unlimited claimed by interlock — Public RansomLook extortion-site listing claim. Group: interlock. Claimed victim/listing: Custom Floors Unlimited. Description excerpt: https://customfloorsunlimited.com/ Custom Floors Unlimited designs and installs…
  • P3 RansomLook: whitearmor.cc claimed by whitearmor — Public RansomLook extortion-site listing claim. Group: whitearmor. Claimed victim/listing: whitearmor.cc. Description excerpt: Hi! We now have a clearnet domain for easy-access. WhiteArmor.cc
  • P3 RansomLook: vinsolutions.com claimed by scarlettgroup — Public RansomLook extortion-site listing claim. Group: scarlettgroup. Claimed victim/listing: vinsolutions.com. Description excerpt: VinSolutions is an automotive CRM platform that helps car dealerships manage leads,…
  • P3 RansomLook: von Schaewen claimed by qilin — Public RansomLook extortion-site listing claim. Group: qilin. Claimed victim/listing: von Schaewen. Description excerpt: Industrial Machinery & Equipment
  • P3 RansomLook: Tamponnt claimed by qilin — Public RansomLook extortion-site listing claim. Group: qilin. Claimed victim/listing: Tamponnt. Description excerpt: Business Services
  • P3 RansomLook: zelsior.es claimed by lockbit5 — Public RansomLook extortion-site listing claim. Group: lockbit5. Claimed victim/listing: zelsior.es. Description excerpt: Founded in 2015, we have become the leading firm in comprehensive, technology-driven legal debt…
  • P3 RansomLook: mickeybody.com claimed by chaos — Public RansomLook extortion-site listing claim. Group: chaos. Claimed victim/listing: mickeybody.com. Description excerpt: Mickey Truck Bodies has been family owned and operated since the company was started in High…

    • Malware / infrastructure / abuse feed highlights

  • P3 Feodo Tracker: 1 recommended botnet C2 IPs listed — Public Feodo Tracker recommended IP blocklist snapshot. Sample: 50.16.16.211

    • IOC highlights

    TypeValueContextSource
    cve`CVE-2026-0768`Metasploit Wrap Up: Langflow, MongoDB, and MoreRapid7 Blog
    cve`CVE-2026-0769`Metasploit Wrap Up: Langflow, MongoDB, and MoreRapid7 Blog
    cve`CVE-2026-10134`Metasploit Wrap Up: Langflow, MongoDB, and MoreRapid7 Blog
    cve`CVE-2026-7873`Metasploit Wrap Up: Langflow, MongoDB, and MoreRapid7 Blog
    cve`CVE-2026-93674`Metasploit Wrap Up: Langflow, MongoDB, and MoreRapid7 Blog
    cve`CVE-2026-93680`Metasploit Wrap Up: Langflow, MongoDB, and MoreRapid7 Blog
    cve`CVE-2026-104935`GitHub release: Nuclei Templates v10.5.1 - Release NotesProjectDiscovery Nuclei Templates Releases
    cve`CVE-2026-105133`GitHub release: Nuclei Templates v10.5.1 - Release NotesProjectDiscovery Nuclei Templates Releases
    cve`CVE-2026-109618`GitHub release: Nuclei Templates v10.5.1 - Release NotesProjectDiscovery Nuclei Templates Releases
    cve`CVE-2026-109619`GitHub release: Nuclei Templates v10.5.1 - Release NotesProjectDiscovery Nuclei Templates Releases
    cve`CVE-2026-82186`GitHub release: Nuclei Templates v10.5.1 - Release NotesProjectDiscovery Nuclei Templates Releases
    cve`CVE-2026-85097`GitHub release: Nuclei Templates v10.5.1 - Release NotesProjectDiscovery Nuclei Templates Releases
    cve`CVE-2026-85714`GitHub release: Nuclei Templates v10.5.1 - Release NotesProjectDiscovery Nuclei Templates Releases
    cve`CVE-2026-86242`GitHub release: Nuclei Templates v10.5.1 - Release NotesProjectDiscovery Nuclei Templates Releases
    cve`CVE-2026-90774`GitHub release: Nuclei Templates v10.5.1 - Release NotesProjectDiscovery Nuclei Templates Releases
    ipv4`3.1.8.9`GitHub release: Nuclei Templates v10.5.1 - Release NotesProjectDiscovery Nuclei Templates Releases
    cve`CVE-2026-83862`CVE-2026-83862 Windows Network Load Balancing Remote Code Execution VulnerabilityMicrosoft Security Response Center RSS
    cve`CVE-2026-102208`CVE-2026-102208 Windows Win32 Kernel Subsystem Elevation of Privilege VulnerabilityMicrosoft Security Response Center RSS
    ipv4`50.16.16.211`Feodo Tracker: 1 recommended botnet C2 IPs listedFeodo Tracker Recommended Blocklist
    hash`fdb5a095bea4087c5b7c06fcc21c5c4b`RansomLook: zelsior.es claimed by lockbit5RansomLook Recent Listings
    hash`7753ca4ad05839342d180a93b88f8025`RansomLook: dorsiacademy.it claimed by lockbit5RansomLook Recent Listings
    hash`c62d34417730b751f037f427f4d146b4`RansomLook: mlh.com.lb claimed by lockbit5RansomLook Recent Listings
    hash`c56dbc07b767279a1d139109ae644779`RansomLook: lidoway.com claimed by lockbit5RansomLook Recent Listings
    hash`3031ccf0c827626ab1c94120a175f920b513b1b0b10fe9f865effafff2fffe7c`RansomLook: Hologic, Inc. claimed by metaencryptorRansomLook Recent Listings
    hash`79c257c86a5d070e8f908c768bcf34a2`RansomLook: Hologic, Inc. claimed by metaencryptorRansomLook Recent Listings

    Defensive takeaways

  • Prioritize patch/exposure review for CISA KEV or actively exploited items touching the technology watchlist.
  • Treat public PoC or Nuclei-template activity as a signal to validate internet-facing exposure and logging, not as standalone proof of exploitation.
  • Use IOC highlights as short-lived hunting pivots; prefer behavior and vulnerable-asset validation over broad permanent blocking.

    • Sources checked

  • BleepingComputer Ransomware News: ok new=0 fetched=15
  • CISA Known Exploited Vulnerabilities: ok new=0 fetched=57
  • Cisco Talos Blog: ok new=0 fetched=15
  • Feodo Tracker Recommended Blocklist: ok new=0 fetched=1
  • Huntress Blog: ok new=0 fetched=25
  • Microsoft Security Response Center RSS: ok new=0 fetched=25
  • NVD Recent CVEs: ok new=53 fetched=80
  • ProjectDiscovery Nuclei Templates Releases: ok new=0 fetched=10
  • RansomLook Recent Listings: ok new=1 fetched=50
  • Rapid7 Blog: ok new=0 fetched=20
  • SANS Internet Storm Center: ok new=0 fetched=10
  • Sophos X-Ops: ok new=0 fetched=15
  • The DFIR Report: ok new=0 fetched=10
  • URLhaus Recent URLs: error: HTTP 410 for https://urlhaus.abuse.ch/downloads/csv_recent/: b'<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">\n<html><head>\n<title>410 Gone</title>\n</head><body>\n<h1>Gone</h1>\n<p>The requested resource is no longer avail'
  • Unit 42 Threat Research: ok new=0 fetched=15

    • Limitations

  • Public/open-source collection only; no paid feeds, customer watchlists, credential dumps, or direct dark-web interaction.
  • Technology-only matching can miss relevant items that do not name a tracked product explicitly.
  • Ransomware victim claims are actor/source claims unless independently corroborated.
  • IOC highlights are publicly sourced and should be validated before enforcement in production controls.
    • public/open-source CTI only // technology-watchlist scope // no customer identifiers // IOC highlights require analyst validation