Daily Hunt Feed - 2026-10-16

Threat Hunt Feed (2026-10-16)

BleepingComputer

• Hackers exploit Collabora RCE flaw to backdoor Nextcloud servers — Thu, 15 Oct 2026 16:25:04 -0400
  • Matched TTPs: Malware (T1588.001), Hardware (T1592.001), Databases (T1213.006), Server (T1584.004), Proxy (T1090), Tool (T1588.002), Software (T1592.002), Exploits (T1588.005), At (T1053.002)
• Hackers hijack D-Link, Ubiquiti devices to resell your stolen bandwidth — Thu, 15 Oct 2026 14:20:59 -0400
  • Matched TTPs: IP Addresses (T1590.005), Malware (T1588.001), Hardware (T1592.001), Vulnerabilities (T1588.006), SSH (T1021.004), Proxy (T1090), Tool (T1588.002), Phishing (T1566), Credential Stuffing (T1110.004), Software (T1592.002), Credentials (T1589.001), At (T1053.002)
• Fake Arch Linux packages push malware with root privileges — Thu, 15 Oct 2026 13:12:31 -0400
  • Matched TTPs: Rootkit (T1014), Malware (T1588.001), Hardware (T1592.001), Tool (T1588.002), Software (T1592.002), Impersonation (T1656), At (T1053.002)
• Is AI pentesting as good as a human pentester? — Thu, 15 Oct 2026 10:01:11 -0400
  • Matched TTPs: Artificial Intelligence (T1588.007), Malware (T1588.001), Hardware (T1592.001), Vulnerabilities (T1588.006), Tool (T1588.002), Software (T1592.002), At (T1053.002)
• Microsoft: Windows Server 2022 reached end of mainstream support — Thu, 15 Oct 2026 09:18:36 -0400
  • Matched TTPs: Malware (T1588.001), Hardware (T1592.001), Server (T1584.004), Tool (T1588.002), Software (T1592.002), At (T1053.002)

Darkreading

• AI Slop Isn’t Just for Social Media; It’s Ruining Cyberattacks, Too — Thu, 15 Oct 2026 20:43:20 GMT
  • Matched TTPs: Artificial Intelligence (T1588.007), Malware (T1588.001), Vulnerabilities (T1588.006), Tool (T1588.002), Phishing (T1566), Social Media (T1593.001), Credentials (T1589.001), At (T1053.002)
• EU Grocers Pay a Steep Price for Unpatched Fridge Firmware — Thu, 15 Oct 2026 07:00:00 GMT
  • Matched TTPs: IP Addresses (T1590.005), Hardware (T1592.001), Vulnerabilities (T1588.006), Firmware (T1592.003), Social Media (T1593.001), At (T1053.002)

The Hacker News

• ThreatsDay: Adobe RCE, DNS Wallet Theft, NVIDIA Container Escape, Self-Healing Backdoor + 23 More — Fri, 16 Oct 2026 00:19:33 +0530
  • Matched TTPs: Scheduled Task (T1053.005), Keylogging (T1056.001), Artificial Intelligence (T1588.007), DNS (T1071.004), DNS Server (T1584.002), Malware (T1588.001), Hardware (T1592.001), Databases (T1213.006), Vulnerabilities (T1588.006), DLL (T1574.001), Domains (T1584.001), Server (T1584.004), Trap (T1546.005), Cloud Services (T1021.007), PowerShell (T1059.001), Tool (T1588.002), Software (T1592.002), Exploits (T1588.005), Social Media (T1593.001), Credentials (T1589.001), Python (T1059.006), At (T1053.002)
• Citizen Lab Traces Zero-Click Candiru Spyware Infections at Al Jazeera to Targeted Online Ads — Thu, 15 Oct 2026 21:31:57 +0530
  • Matched TTPs: Malware (T1588.001), Vulnerabilities (T1588.006), Domains (T1584.001), Server (T1584.004), Trap (T1546.005), Tool (T1588.002), Exploits (T1588.005), Social Media (T1593.001), Credentials (T1589.001), At (T1053.002)
• Silent Lynx Exploits WinRAR Flaw to Deploy Reverse Shell in CIS Government Attacks — Thu, 15 Oct 2026 21:30:26 +0530
  • Matched TTPs: Malware (T1588.001), Vulnerabilities (T1588.006), Domains (T1584.001), Trap (T1546.005), PowerShell (T1059.001), Tool (T1588.002), Phishing (T1566), Exploits (T1588.005), Social Media (T1593.001), Credentials (T1589.001), Python (T1059.006), At (T1053.002)
• Help TDS Linked to Hotejka as 20,000+ Cloudflare Pages Domains Host Tech Support Scams — Thu, 15 Oct 2026 19:41:36 +0530
  • Matched TTPs: DNS (T1071.004), Malware (T1588.001), Browser Extensions (T1176.001), Vulnerabilities (T1588.006), Domains (T1584.001), Trap (T1546.005), Tool (T1588.002), Exploits (T1588.005), Social Media (T1593.001), Credentials (T1589.001), At (T1053.002)
• NGINX Fixes 5 Flaws, Including Possible RCE and a TLS Bug That May Skip Client-Cert Checks — Thu, 15 Oct 2026 18:28:05 +0530
  • Matched TTPs: JavaScript (T1059.007), Vulnerabilities (T1588.006), Domains (T1584.001), Server (T1584.004), Trap (T1546.005), Tool (T1588.002), Exploits (T1588.005), Social Media (T1593.001), Credentials (T1589.001), At (T1053.002)
• Next.js Ships Out-of-Band Patch for Two Critical RCE Flaws in Caching and SVG Processing — Thu, 15 Oct 2026 17:58:13 +0530
  • Matched TTPs: Malicious File (T1204.002), Vulnerabilities (T1588.006), Domains (T1584.001), Server (T1584.004), Trap (T1546.005), Tool (T1588.002), Exploits (T1588.005), Social Media (T1593.001), Credentials (T1589.001), At (T1053.002)
• Drupal Patches Critical Field UI Flaw With Unauthenticated RCE Path via Contributed Modules — Thu, 15 Oct 2026 17:37:20 +0530
  • Matched TTPs: Vulnerabilities (T1588.006), Domains (T1584.001), Server (T1584.004), Trap (T1546.005), Tool (T1588.002), Exploits (T1588.005), Social Media (T1593.001), Credentials (T1589.001), At (T1053.002)
• Fake AI Attacks Spread Across US Companies: How MSSPs Can Stop Incidents Early — Thu, 15 Oct 2026 17:16:59 +0530
  • Matched TTPs: Artificial Intelligence (T1588.007), Malware (T1588.001), Vulnerabilities (T1588.006), Domains (T1584.001), Trap (T1546.005), Mshta (T1218.005), PowerShell (T1059.001), Tool (T1588.002), Phishing (T1566), Software (T1592.002), Exploits (T1588.005), Social Media (T1593.001), Credentials (T1589.001), At (T1053.002)
• Palo Alto Networks Patches PAN-OS Authenticated RCE Flaw Amid Active Exploitation — Thu, 15 Oct 2026 17:16:49 +0530
  • Matched TTPs: IP Addresses (T1590.005), Vulnerabilities (T1588.006), Domains (T1584.001), Trap (T1546.005), Tool (T1588.002), Software (T1592.002), Exploits (T1588.005), Social Media (T1593.001), Credentials (T1589.001), At (T1053.002)
• Langflow’s Critical Authenticated RCE Flaw Targeted in 1,423 Honeypot Exploit Attempts — Thu, 15 Oct 2026 12:37:05 +0530
  • Matched TTPs: Artificial Intelligence (T1588.007), IP Addresses (T1590.005), Vulnerabilities (T1588.006), Domains (T1584.001), Server (T1584.004), Trap (T1546.005), Tool (T1588.002), Exploits (T1588.005), Social Media (T1593.001), Credentials (T1589.001), At (T1053.002)
• AhsayCBS Flaws Exploited to Deploy Web Shells Get New Fixes After Incomplete Patches — Thu, 15 Oct 2026 12:13:08 +0530
  • Matched TTPs: Malware (T1588.001), Vulnerabilities (T1588.006), Domains (T1584.001), Server (T1584.004), Trap (T1546.005), Tool (T1588.002), Software (T1592.002), Exploits (T1588.005), Social Media (T1593.001), Credentials (T1589.001), At (T1053.002)