Threat Hunt Feed (2026-10-21)
BleepingComputer
- Mozilla, Google, Apple block compromised eMudhra CA certificates — Tue, 20 Oct 2026 20:46:42 -0400
- Matched TTPs: Malware (T1588.001), Hardware (T1592.001), Vulnerabilities (T1588.006), Domains (T1584.001), Private Keys (T1552.004), Server (T1584.004), Tool (T1588.002), Software (T1592.002), Exploits (T1588.005), Credentials (T1589.001), Python (T1059.006)
- PHP warns admins of two critical flaws, emergency patches coming tomorrow — Tue, 20 Oct 2026 16:56:43 -0400
- Matched TTPs: Malware (T1588.001), Hardware (T1592.001), Vulnerabilities (T1588.006), Server (T1584.004), Web Services (T1584.006), Tool (T1588.002), Software (T1592.002), Exploits (T1588.005), Credentials (T1589.001), At (T1053.002)
- Zeabur shutting down after second security breach in two months — Tue, 20 Oct 2026 15:33:02 -0400
- Matched TTPs: Malware (T1588.001), Hardware (T1592.001), Databases (T1213.006), Vulnerabilities (T1588.006), SSH (T1021.004), Server (T1584.004), Tool (T1588.002), Software (T1592.002), Exploits (T1588.005), Credentials (T1589.001)
- OpenAI says GPT-6.1 Sol is dramatically better at migrating legacy code — Tue, 20 Oct 2026 14:11:03 -0400
- Matched TTPs: Artificial Intelligence (T1588.007), JavaScript (T1059.007), Malware (T1588.001), Hardware (T1592.001), Vulnerabilities (T1588.006), Server (T1584.004), Tool (T1588.002), Software (T1592.002), Exploits (T1588.005), Credentials (T1589.001), Python (T1059.006), Visual Basic (T1059.005), At (T1053.002)
- Windows Server 2025 gets support for quick machine recovery — Tue, 20 Oct 2026 08:16:32 -0400
- Matched TTPs: Malware (T1588.001), Hardware (T1592.001), Vulnerabilities (T1588.006), Server (T1584.004), Tool (T1588.002), Software (T1592.002), Exploits (T1588.005), Credentials (T1589.001), At (T1053.002)
- OVHcloud CLI releases backdoored on GitHub to steal developer secrets — Tue, 20 Oct 2026 07:31:22 -0400
- Matched TTPs: Malware (T1588.001), Hardware (T1592.001), Vulnerabilities (T1588.006), Server (T1584.004), Tool (T1588.002), Software (T1592.002), Exploits (T1588.005), Credentials (T1589.001), At (T1053.002)
- Ahold Delhaize: Cyberattack affects services across US and Europe — Tue, 20 Oct 2026 07:18:35 -0400
- Matched TTPs: Malware (T1588.001), Hardware (T1592.001), Vulnerabilities (T1588.006), Server (T1584.004), Tool (T1588.002), Software (T1592.002), Exploits (T1588.005), Credentials (T1589.001), At (T1053.002)
Darkreading
- Ex-OpenAI Engineer Detained After Planting Secret Recorder at HQ — Tue, 20 Oct 2026 19:16:49 GMT
- Matched TTPs: Malware (T1588.001), Vulnerabilities (T1588.006), Software (T1592.002), At (T1053.002)
- Close Identity Gaps in Software Development Before Unleashing AI — Tue, 20 Oct 2026 15:35:45 GMT
- Matched TTPs: Artificial Intelligence (T1588.007), Vulnerabilities (T1588.006), Software (T1592.002), Exploits (T1588.005), Credentials (T1589.001), At (T1053.002)
- Hackers Abuse AI Pen-Test Tool Cairn to Automate Massive Attack Spree — Tue, 20 Oct 2026 14:36:05 GMT
- Matched TTPs: Vulnerabilities (T1588.006), Vulnerability Scanning (T1595.002), Web Shell (T1505.003), Server (T1584.004), Tool (T1588.002), Phishing (T1566), Software (T1592.002), Credentials (T1589.001), Template Injection (T1221), At (T1053.002)
The Hacker News
- Eight eMudhra CA Keys Compromised, Triggering Emergency Fixes Across Browsers and Software — Tue, 20 Oct 2026 22:39:53 +0530
- Matched TTPs: DNS (T1071.004), Malware (T1588.001), Vulnerabilities (T1588.006), Code Signing (T1553.002), Domains (T1584.001), Private Keys (T1552.004), Server (T1584.004), Trap (T1546.005), Software (T1592.002), Social Media (T1593.001), Python (T1059.006), At (T1053.002)
- Hackers Use Autonomous AI Agents to Breach Company Websites, Target Over 1,200 Sites — Tue, 20 Oct 2026 19:37:17 +0530
- Matched TTPs: Artificial Intelligence (T1588.007), DNS (T1071.004), Malware (T1588.001), Hardware (T1592.001), Vulnerabilities (T1588.006), SSH (T1021.004), Web Shell (T1505.003), Server (T1584.004), Trap (T1546.005), Tool (T1588.002), Social Media (T1593.001), Credentials (T1589.001), Python (T1059.006), At (T1053.002)
- ConnectWise Resets Credentials as Cloud Backup Remains Offline After Security Incident — Tue, 20 Oct 2026 16:26:08 +0530
- Matched TTPs: IP Addresses (T1590.005), DNS (T1071.004), Malware (T1588.001), Vulnerabilities (T1588.006), Server (T1584.004), Trap (T1546.005), Social Media (T1593.001), Credentials (T1589.001), Python (T1059.006), At (T1053.002)
- Hackers Hijack Five OVHcloud CLI Releases to Distribute Secret-Stealing Malware — Tue, 20 Oct 2026 13:51:29 +0530
- Matched TTPs: DNS (T1071.004), Malware (T1588.001), Vulnerabilities (T1588.006), Server (T1584.004), Trap (T1546.005), Tool (T1588.002), Social Media (T1593.001), Credentials (T1589.001), Python (T1059.006), At (T1053.002)
- ClickFix Attackers Exploit Siemens Software Center Flaw to Deploy Remote Access Trojan — Tue, 20 Oct 2026 12:41:45 +0530
- Matched TTPs: Artificial Intelligence (T1588.007), IP Addresses (T1590.005), DNS (T1071.004), Malware (T1588.001), Vulnerabilities (T1588.006), DLL (T1574.001), Msiexec (T1218.007), Domains (T1584.001), Server (T1584.004), Trap (T1546.005), PowerShell (T1059.001), Software (T1592.002), Social Media (T1593.001), Python (T1059.006), At (T1053.002)
- Ex-OpenAI Engineer Detained in Spy Device Case as Saudi Royal Contacts Emerge — Tue, 20 Oct 2026 11:23:16 +0530
- Matched TTPs: Artificial Intelligence (T1588.007), DNS (T1071.004), Malware (T1588.001), Vulnerabilities (T1588.006), Server (T1584.004), Trap (T1546.005), Social Media (T1593.001), Python (T1059.006), At (T1053.002)
- Hackers Use New ROMULUS ClickFix Platform to Deliver LegionLoader and Other Malware — Tue, 20 Oct 2026 09:35:58 +0530
- Matched TTPs: Artificial Intelligence (T1588.007), IP Addresses (T1590.005), DNS (T1071.004), Malware (T1588.001), Vulnerabilities (T1588.006), DLL (T1574.001), Server (T1584.004), Trap (T1546.005), PowerShell (T1059.001), Software (T1592.002), Social Media (T1593.001), Python (T1059.006), At (T1053.002)