Daily Cyber Threat Intel Brief — 2026-10-29
Generated: 2026-10-29 08:02:17 UTC
Executive summary
Priority technology watch items
- An introduction to CISA’s BOD 22-01 Issued nearly four years ago, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) Binding Operational Directive 22-01 (BOD 22-01) has been adopted across both public and private sector organizations as a…
- Talos has identified UAT-11473, a highly sophisticated APT, who exploited CVE-2026-20127, an authentication bypass vulnerability in Cisco SD-WAN Catalyst Controller instances to bypass authentication and gain unauthorized access to affected systems to deploy…
- Building your malware analysis lab is a key point before playing with malware. Today, thanks to virtualization, it&#;x26;#;39;s convenient to play with snapshots in your lab. Start a new investigation from a clean snapshot and take some more when you reached…
Newly exploited vulnerabilities / CVE watch
Ransomware and extortion trend notes
Malware / infrastructure / abuse feed highlights
IOC highlights
| Type | Value | Context | Source |
| cve | `CVE-2026-20127` | Inside KeyDrift: Analyzing historical UAT-11473 activity on Cisco SD-WAN | Cisco Talos Blog |
| cve | `CVE-2026-19175` | CVE-2026-19175 Use after free in Payments | Microsoft Security Response Center RSS |
| cve | `CVE-2026-62740` | CVE-2026-62740 Windows Imaging Component Information Disclosure Vulnerability | Microsoft Security Response Center RSS |
| cve | `CVE-2026-62877` | CVE-2026-62877 Windows Win32k Elevation of Privilege Vulnerability | Microsoft Security Response Center RSS |
| cve | `CVE-2026-78913` | Chromium: CVE-2026-78913 Use after free in Chromoting | Microsoft Security Response Center RSS |
| cve | `CVE-2026-78912` | Chromium: CVE-2026-78912 UI misrepresentation in Browser | Microsoft Security Response Center RSS |
| cve | `CVE-2026-78911` | Chromium: CVE-2026-78911 Incorrect authorization in USB | Microsoft Security Response Center RSS |
| cve | `CVE-2026-78910` | Chromium: CVE-2026-78910 Buffer overflow in V8 | Microsoft Security Response Center RSS |
| cve | `CVE-2026-78909` | Chromium: CVE-2026-78909 Use after free in Views | Microsoft Security Response Center RSS |
| ipv4 | `50.16.16.211` | Feodo Tracker: 1 recommended botnet C2 IPs listed | Feodo Tracker Recommended Blocklist |
| hash | `ed9b39cc52e5ab03735c34039a652f5d` | RansomLook: xspringcapital.com claimed by lockbit5 | RansomLook Recent Listings |
| hash | `98851f019da8167a79f7e392f513b5a4` | RansomLook: susannecerda.com claimed by lockbit5 | RansomLook Recent Listings |