markcardiff.tech:/daily-intel/2026-10-27.html
cti@markcardiff:~/daily-intel$ return-to-index | home
Generated: 2026-10-27 08:00:32 UTC
P1: 3
P2: 13
Items: 108

Daily Cyber Threat Intel Brief — 2026-10-27

Generated: 2026-10-27 08:00:32 UTC

Executive summary

  • Collected 108 recent public-source CTI items for technology-only monitoring.
  • Priority distribution: P1=3, P2=13, P3=80, P4=12.
  • Highest-priority item: CVE-2026-111497: Critical out-of-bounds write in the Node.js Brotli decoder (P1, source: Rapid7 Blog).
  • 12 public IOC highlights selected for analyst awareness.

    • Priority technology watch items

  • P1 CVE-2026-111497: Critical out-of-bounds write in the Node.js Brotli decoder — Rapid7 Blog; score 77; technologies: none explicitly matched.

    • - Overview On October 21, 2026, the Node.js Project published a security advisory for CVE-2026-111497 , an out-of-bounds write in the Brotli decoder bundled with Node.js. The vulnerability affects the Node.js 26.x , 24.x , and 22.x release lines. Node.js rates…

  • P1 PHP2Shell security flaws now sucessfully exploited in the wild — BleepingComputer Ransomware News; score 74; technologies: none explicitly matched.

    • - Two critical RCE vulnerabilities (CVE-2026-109618 and CVE-2026-109619), collectively tracked as PHP2Shell, have been successfully exploited in the wild. [...]

  • P1 CVE-2026-83519 Windows Error Reporting Remote Code Execution Vulnerability — Microsoft Security Response Center RSS; score 70; technologies: none explicitly matched.

    • - Updated an acknowledgement. This is an informational change only.

  • P2 RansomLook: FPT Software claimed by the gentlemen — RansomLook Recent Listings; score 53; technologies: none explicitly matched.

    • - Public RansomLook extortion-site listing claim. Group: the gentlemen. Claimed victim/listing: FPT Software. Description excerpt: fptsoftware.com FPT Software is the largest IT services company in Southeast Asia, founded in 1999 in Hanoi with 1.34 billion…

  • P2 RansomLook: Zhito Technology claimed by dragonforce — RansomLook Recent Listings; score 53; technologies: none explicitly matched.

    • - Public RansomLook extortion-site listing claim. Group: dragonforce. Claimed victim/listing: Zhito Technology. Description excerpt: Provider and developer of smart logistics solutions and autonomous driving systems intended to serve the vehicle industry. The…

  • P2 RansomLook: ImmoVia Hausverwaltung claimed by the gentlemen — RansomLook Recent Listings; score 53; technologies: none explicitly matched.

    • - Public RansomLook extortion-site listing claim. Group: the gentlemen. Claimed victim/listing: ImmoVia Hausverwaltung. Description excerpt: immovia-hausverwaltung.de ImmoVia Hausverwaltung GmbH is a German property management company registered in November…

  • P2 RansomLook: SuperScale claimed by the gentlemen — RansomLook Recent Listings; score 53; technologies: none explicitly matched.

    • - Public RansomLook extortion-site listing claim. Group: the gentlemen. Claimed victim/listing: SuperScale. Description excerpt: superscale.com SuperScale is a Slovak game growth platform founded in 2015 in Bratislava, helping over 500 mobile game studios scale…

  • P2 RansomLook: SAP claimed by the gentlemen — RansomLook Recent Listings; score 53; technologies: none explicitly matched.

    • - Public RansomLook extortion-site listing claim. Group: the gentlemen. Claimed victim/listing: SAP. Description excerpt: sap.com SAP Latin America and Caribbean is the regional arm of SAP SE, the world's largest enterprise software company, managing operations…

  • P2 RansomLook: Unisa Shoes claimed by the gentlemen — RansomLook Recent Listings; score 53; technologies: none explicitly matched.

    • - Public RansomLook extortion-site listing claim. Group: the gentlemen. Claimed victim/listing: Unisa Shoes. Description excerpt: unisa.es Unisa Shoes is a Spanish footwear company founded in 1973 in Elche, Alicante, with 52 years of history across three…

  • P2 RansomLook: Acodafe claimed by the gentlemen — RansomLook Recent Listings; score 53; technologies: none explicitly matched.

    • - Public RansomLook extortion-site listing claim. Group: the gentlemen. Claimed victim/listing: Acodafe. Description excerpt: acodafe.com Acodafe S.L. is a Spanish IT services company founded in 2009 in Mataró, Barcelona, providing managed IT, network…

  • P2 RansomLook: SoftwareOne claimed by the gentlemen — RansomLook Recent Listings; score 53; technologies: none explicitly matched.

    • - Public RansomLook extortion-site listing claim. Group: the gentlemen. Claimed victim/listing: SoftwareOne. Description excerpt: softwareone.com SoftwareOne Turkiye is the Turkish arm of SoftwareOne Holding AG, a Swiss-listed global software and cloud…

  • P2 RansomLook: Grupo Sanirent claimed by the gentlemen — RansomLook Recent Listings; score 53; technologies: none explicitly matched.

    • - Public RansomLook extortion-site listing claim. Group: the gentlemen. Claimed victim/listing: Grupo Sanirent. Description excerpt: sanirent.com.mx Grupo Sanirent is a 100 percent Mexican company founded in 1983 in Mexico City, the national leader in portable…

  • P2 RansomLook: Incomelec claimed by the gentlemen — RansomLook Recent Listings; score 53; technologies: none explicitly matched.

    • - Public RansomLook extortion-site listing claim. Group: the gentlemen. Claimed victim/listing: Incomelec. Description excerpt: incomelec.com Incomelec is a Colombian company founded in 2006 in Bogota, the Latin American leader in pedestrian, vehicle and…

  • P2 RansomLook: Vietnam Airlines claimed by the gentlemen — RansomLook Recent Listings; score 53; technologies: none explicitly matched.

    • - Public RansomLook extortion-site listing claim. Group: the gentlemen. Claimed victim/listing: Vietnam Airlines. Description excerpt: vietnamairlines.com Revenue $4.4 Billion Vietnam Airlines is the national flag carrier of Vietnam, founded in 1956 and listed…

  • P2 RansomLook: Spontini claimed by the gentlemen — RansomLook Recent Listings; score 53; technologies: none explicitly matched.

    • - Public RansomLook extortion-site listing claim. Group: the gentlemen. Claimed victim/listing: Spontini. Description excerpt: spontinimilano.com Spontini is a Milanese pizza by the slice chain founded in 1953, now run by the third generation of the Innocenti…

  • P2 RansomLook: Inside Passage Electric Cooperative, Inc claimed by dragonforce — RansomLook Recent Listings; score 53; technologies: none explicitly matched.

    • - Public RansomLook extortion-site listing claim. Group: dragonforce. Claimed victim/listing: Inside Passage Electric Cooperative, Inc. Description excerpt: In 2004, Tlingit & Haida Regional Electric Authority was re-organized to an electric cooperative which…

    Newly exploited vulnerabilities / CVE watch

  • P1 CVE-2026-111497: CVE-2026-111497: Critical out-of-bounds write in the Node.js Brotli decoder — technologies: not watchlist-specific.
  • P1 CVE-2026-109618, CVE-2026-109619: PHP2Shell security flaws now sucessfully exploited in the wild — technologies: not watchlist-specific.
  • P1 CVE-2026-83519: CVE-2026-83519 Windows Error Reporting Remote Code Execution Vulnerability — technologies: not watchlist-specific.
  • P3 CVE-2026-70054: CVE-2026-70054 Windows NetBIOS Elevation of Privilege Vulnerability — technologies: not watchlist-specific.
  • P3 CVE-2026-69923: CVE-2026-69923 Windows AI Elevation of Privilege Vulnerability — technologies: not watchlist-specific.
  • P3 CVE-2026-96311: CVE-2026-96311 Windows Network List Service Tampering Vulnerability — technologies: not watchlist-specific.
  • P3 CVE-2026-69926: CVE-2026-69926 Desktop Window Manager Elevation of Privilege Vulnerability — technologies: not watchlist-specific.
  • P3 CVE-2026-96234: CVE-2026-96234 .NET Information Disclosure Vulnerability — technologies: not watchlist-specific.

    • Ransomware and extortion trend notes

  • P2 RansomLook: FPT Software claimed by the gentlemen — Public RansomLook extortion-site listing claim. Group: the gentlemen. Claimed victim/listing: FPT Software. Description excerpt: fptsoftware.com FPT Software is the largest IT services company in Southeast Asia, founded…
  • P2 RansomLook: Zhito Technology claimed by dragonforce — Public RansomLook extortion-site listing claim. Group: dragonforce. Claimed victim/listing: Zhito Technology. Description excerpt: Provider and developer of smart logistics solutions and autonomous driving systems…
  • P2 RansomLook: ImmoVia Hausverwaltung claimed by the gentlemen — Public RansomLook extortion-site listing claim. Group: the gentlemen. Claimed victim/listing: ImmoVia Hausverwaltung. Description excerpt: immovia-hausverwaltung.de ImmoVia Hausverwaltung GmbH is a German property…
  • P2 RansomLook: SuperScale claimed by the gentlemen — Public RansomLook extortion-site listing claim. Group: the gentlemen. Claimed victim/listing: SuperScale. Description excerpt: superscale.com SuperScale is a Slovak game growth platform founded in 2015 in Bratislava,…
  • P2 RansomLook: SAP claimed by the gentlemen — Public RansomLook extortion-site listing claim. Group: the gentlemen. Claimed victim/listing: SAP. Description excerpt: sap.com SAP Latin America and Caribbean is the regional arm of SAP SE, the world's largest…
  • P2 RansomLook: Unisa Shoes claimed by the gentlemen — Public RansomLook extortion-site listing claim. Group: the gentlemen. Claimed victim/listing: Unisa Shoes. Description excerpt: unisa.es Unisa Shoes is a Spanish footwear company founded in 1973 in Elche, Alicante, with…
  • P2 RansomLook: Acodafe claimed by the gentlemen — Public RansomLook extortion-site listing claim. Group: the gentlemen. Claimed victim/listing: Acodafe. Description excerpt: acodafe.com Acodafe S.L. is a Spanish IT services company founded in 2009 in Mataró, Barcelona,…
  • P2 RansomLook: SoftwareOne claimed by the gentlemen — Public RansomLook extortion-site listing claim. Group: the gentlemen. Claimed victim/listing: SoftwareOne. Description excerpt: softwareone.com SoftwareOne Turkiye is the Turkish arm of SoftwareOne Holding AG, a…
  • P2 RansomLook: Grupo Sanirent claimed by the gentlemen — Public RansomLook extortion-site listing claim. Group: the gentlemen. Claimed victim/listing: Grupo Sanirent. Description excerpt: sanirent.com.mx Grupo Sanirent is a 100 percent Mexican company founded in 1983 in…
  • P2 RansomLook: Incomelec claimed by the gentlemen — Public RansomLook extortion-site listing claim. Group: the gentlemen. Claimed victim/listing: Incomelec. Description excerpt: incomelec.com Incomelec is a Colombian company founded in 2006 in Bogota, the Latin American…
  • P2 RansomLook: Vietnam Airlines claimed by the gentlemen — Public RansomLook extortion-site listing claim. Group: the gentlemen. Claimed victim/listing: Vietnam Airlines. Description excerpt: vietnamairlines.com Revenue $4.4 Billion Vietnam Airlines is the national flag carrier…
  • P2 RansomLook: Spontini claimed by the gentlemen — Public RansomLook extortion-site listing claim. Group: the gentlemen. Claimed victim/listing: Spontini. Description excerpt: spontinimilano.com Spontini is a Milanese pizza by the slice chain founded in 1953, now run by…

    • Malware / infrastructure / abuse feed highlights

  • P3 Feodo Tracker: 1 recommended botnet C2 IPs listed — Public Feodo Tracker recommended IP blocklist snapshot. Sample: 50.16.16.211

    • IOC highlights

    TypeValueContextSource
    cve`CVE-2026-111497`CVE-2026-111497: Critical out-of-bounds write in the Node.js Brotli decoderRapid7 Blog
    cve`CVE-2026-109618`PHP2Shell security flaws now sucessfully exploited in the wildBleepingComputer Ransomware News
    cve`CVE-2026-109619`PHP2Shell security flaws now sucessfully exploited in the wildBleepingComputer Ransomware News
    cve`CVE-2026-83519`CVE-2026-83519 Windows Error Reporting Remote Code Execution VulnerabilityMicrosoft Security Response Center RSS
    cve`CVE-2026-70054`CVE-2026-70054 Windows NetBIOS Elevation of Privilege VulnerabilityMicrosoft Security Response Center RSS
    cve`CVE-2026-69923`CVE-2026-69923 Windows AI Elevation of Privilege VulnerabilityMicrosoft Security Response Center RSS
    cve`CVE-2026-96311`CVE-2026-96311 Windows Network List Service Tampering VulnerabilityMicrosoft Security Response Center RSS
    cve`CVE-2026-69926`CVE-2026-69926 Desktop Window Manager Elevation of Privilege VulnerabilityMicrosoft Security Response Center RSS
    cve`CVE-2026-96234`CVE-2026-96234 .NET Information Disclosure VulnerabilityMicrosoft Security Response Center RSS
    ipv4`50.16.16.211`Feodo Tracker: 1 recommended botnet C2 IPs listedFeodo Tracker Recommended Blocklist
    hash`17a33551397a7f5b39fd314a495310f7521560e2b3a7e6afcea70456ac546ce7`RansomLook: ST Engineering claimed by metaencryptorRansomLook Recent Listings
    hash`ceef70fcb26a4d59f4bef14e0f10b14ba2423ad07acf65d91487d3ddb5208d4d`RansomLook: ST Engineering claimed by metaencryptorRansomLook Recent Listings

    Defensive takeaways

  • Prioritize patch/exposure review for CISA KEV or actively exploited items touching the technology watchlist.
  • Treat public PoC or Nuclei-template activity as a signal to validate internet-facing exposure and logging, not as standalone proof of exploitation.
  • Use IOC highlights as short-lived hunting pivots; prefer behavior and vulnerable-asset validation over broad permanent blocking.

    • Sources checked

  • BleepingComputer Ransomware News: ok new=0 fetched=15
  • CISA Known Exploited Vulnerabilities: ok new=0 fetched=49
  • Cisco Talos Blog: ok new=0 fetched=15
  • Feodo Tracker Recommended Blocklist: ok new=0 fetched=1
  • Huntress Blog: ok new=0 fetched=25
  • Microsoft Security Response Center RSS: ok new=0 fetched=25
  • NVD Recent CVEs: ok new=21 fetched=80
  • ProjectDiscovery Nuclei Templates Releases: ok new=0 fetched=10
  • RansomLook Recent Listings: ok new=21 fetched=50
  • Rapid7 Blog: ok new=0 fetched=20
  • SANS Internet Storm Center: ok new=0 fetched=10
  • Sophos X-Ops: ok new=0 fetched=15
  • The DFIR Report: ok new=0 fetched=10
  • URLhaus Recent URLs: error: HTTP 410 for https://urlhaus.abuse.ch/downloads/csv_recent/: b'<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">\n<html><head>\n<title>410 Gone</title>\n</head><body>\n<h1>Gone</h1>\n<p>The requested resource is no longer avail'
  • Unit 42 Threat Research: ok new=0 fetched=15

    • Limitations

  • Public/open-source collection only; no paid feeds, customer watchlists, credential dumps, or direct dark-web interaction.
  • Technology-only matching can miss relevant items that do not name a tracked product explicitly.
  • Ransomware victim claims are actor/source claims unless independently corroborated.
  • IOC highlights are publicly sourced and should be validated before enforcement in production controls.
    • public/open-source CTI only // technology-watchlist scope // no customer identifiers // IOC highlights require analyst validation