Daily Hunt Feed - 2026-10-22

Threat Hunt Feed (2026-10-22)

Hacker News: Best

• Today’s PHP security release, and how we’re strengthening security — Wed, 21 Oct 2026 15:48:56 +0000
  • Matched TTPs: Vulnerabilities (T1588.006), Software (T1592.002), Exploits (T1588.005), Social Media (T1593.001), At (T1053.002)
• Security advisory: Critical remote code execution vulnerabilities, update now — Tue, 20 Oct 2026 20:15:50 +0000
  • Matched TTPs: JavaScript (T1059.007), Vulnerabilities (T1588.006), Server (T1584.004), Proxy (T1090), Web Services (T1584.006), Social Media (T1593.001), At (T1053.002), Compression (T1027.015)

Krebs on Security

• Widespread PHP Flaw May Cause Many Site Outages Today — Wed, 21 Oct 2026 15:26:07 +0000
  • Matched TTPs: Vulnerabilities (T1588.006), Server (T1584.004), Software (T1592.002), Exploits (T1588.005), At (T1053.002)

BleepingComputer

• Japan’s Onamae Desktop Cloud hacked, up to 27,000 servers affected — Wed, 21 Oct 2026 17:43:27 -0400
  • Matched TTPs: DNS (T1071.004), Malware (T1588.001), Hardware (T1592.001), Server (T1584.004), Tool (T1588.002), Phishing (T1566), Software (T1592.002), Credentials (T1589.001), At (T1053.002)
• Lazarus hackers use post-quantum cryptography for malware delivery — Wed, 21 Oct 2026 16:31:48 -0400
  • Matched TTPs: JavaScript (T1059.007), Malware (T1588.001), Hardware (T1592.001), Domains (T1584.001), Server (T1584.004), Tool (T1588.002), Phishing (T1566), Software (T1592.002), Credentials (T1589.001), At (T1053.002)
• CISA: Hackers chain Plex flaws in Plex2Shell attacks to breach servers — Wed, 21 Oct 2026 14:34:42 -0400
  • Matched TTPs: Sharepoint (T1213.002), Malware (T1588.001), Hardware (T1592.001), Vulnerabilities (T1588.006), Server (T1584.004), Tool (T1588.002), Software (T1592.002), Credentials (T1589.001), At (T1053.002)
• PHP ships emergency patches for critical PHP2Shell flaws — Wed, 21 Oct 2026 10:07:05 -0400
  • Matched TTPs: Malware (T1588.001), Hardware (T1592.001), Vulnerabilities (T1588.006), Server (T1584.004), Tool (T1588.002), Software (T1592.002), Exploits (T1588.005), Credentials (T1589.001), At (T1053.002)
• ClickFix has never been bigger, and AI tools are its most convincing lure yet — Wed, 21 Oct 2026 10:00:10 -0400
  • Matched TTPs: Malvertising (T1583.008), Malware (T1588.001), Hardware (T1592.001), Browser Extensions (T1176.001), Server (T1584.004), Search Engines (T1593.002), Tool (T1588.002), Phishing (T1566), Software (T1592.002), Social Media (T1593.001), SEO Poisoning (T1608.006), Malicious Link (T1204.001), At (T1053.002)

Darkreading

• Marvell, Microsoft & Oracle Work to Standardize Data Center Hardware Security — Wed, 21 Oct 2026 20:14:42 GMT
  • Matched TTPs: Hardware (T1592.001), Vulnerabilities (T1588.006), Server (T1584.004), Software (T1592.002), Credentials (T1589.001), At (T1053.002)
• ‘PHP2Shell’ Bugs Signal Red Alert for Security Industry — Wed, 21 Oct 2026 19:19:17 GMT
  • Matched TTPs: Vulnerabilities (T1588.006), Server (T1584.004), Tool (T1588.002), Software (T1592.002), Exploits (T1588.005), At (T1053.002)
• Decades-Old Windows Utility Powers Modern ClickFix Attack — Wed, 21 Oct 2026 13:00:00 GMT
  • Matched TTPs: Malware (T1588.001), Vulnerabilities (T1588.006), Proxy (T1090), PowerShell (T1059.001), Tool (T1588.002), Phishing (T1566), Software (T1592.002), At (T1053.002)

The Hacker News

• Critical GitLab Flaw (CVSS 10.0) Could Allow Unauthenticated RCE Across 12 Years of Releases — Thu, 22 Oct 2026 00:27:34 +0530
  • Matched TTPs: DNS (T1071.004), Malware (T1588.001), Vulnerabilities (T1588.006), Server (T1584.004), Trap (T1546.005), Software (T1592.002), Social Media (T1593.001), Python (T1059.006), At (T1053.002)
• LiteLLM Compromised in Supply Chain Attack Delivering Credential Stealer and Backdoor — Wed, 21 Oct 2026 23:31:57 +0530
  • Matched TTPs: Artificial Intelligence (T1588.007), DNS (T1071.004), Malware (T1588.001), Vulnerabilities (T1588.006), Private Keys (T1552.004), Server (T1584.004), Trap (T1546.005), Proxy (T1090), Software (T1592.002), Social Media (T1593.001), Credentials (T1589.001), Python (T1059.006), At (T1053.002)
• OpenAI’s GPT-6 Agent Removed Safety Monitoring, Then Falsely Denied Doing So — Wed, 21 Oct 2026 22:03:47 +0530
  • Matched TTPs: Artificial Intelligence (T1588.007), DNS (T1071.004), Malware (T1588.001), Vulnerabilities (T1588.006), Server (T1584.004), Trap (T1546.005), Software (T1592.002), Social Media (T1593.001), Python (T1059.006), At (T1053.002)
• PHP Issues Emergency Patches for Two Critical PHP2Shell RCE Flaws as Exploit Attempts Emerge — Wed, 21 Oct 2026 19:30:00 +0530
  • Matched TTPs: DNS (T1071.004), Malware (T1588.001), Vulnerabilities (T1588.006), Server (T1584.004), Trap (T1546.005), Proxy (T1090), Exploits (T1588.005), Social Media (T1593.001), Python (T1059.006), At (T1053.002)
• China-Aligned Bronze Sandcastle Abuses Sandboxie DLL Sideloading to Deploy Backdoors — Wed, 21 Oct 2026 17:35:00 +0530
  • Matched TTPs: DNS (T1071.004), Malware (T1588.001), Vulnerabilities (T1588.006), DLL (T1574.001), Server (T1584.004), Trap (T1546.005), Software (T1592.002), Exploits (T1588.005), Social Media (T1593.001), Python (T1059.006), At (T1053.002)
• Generative AI Is Erasing Behavioral Tells, Weakening Behavior-Only Detection, Proofpoint Reports — Wed, 21 Oct 2026 17:23:34 +0530
  • Matched TTPs: Artificial Intelligence (T1588.007), DNS (T1071.004), Malware (T1588.001), Vulnerabilities (T1588.006), Domains (T1584.001), Server (T1584.004), Trap (T1546.005), Phishing (T1566), Social Media (T1593.001), Credentials (T1589.001), Python (T1059.006), At (T1053.002)
• PHP2Shell: What Actually Protects You Before the 14:00 UTC PHP RCE Patch, and What Doesn’t — Wed, 21 Oct 2026 16:06:53 +0530
  • Matched TTPs: DNS (T1071.004), Malware (T1588.001), Vulnerabilities (T1588.006), Server (T1584.004), Trap (T1546.005), Social Media (T1593.001), Credentials (T1589.001), Python (T1059.006), At (T1053.002)
• The Harness Is the Hard Part of Agentic Pentesting — Wed, 21 Oct 2026 16:02:40 +0530
  • Matched TTPs: Artificial Intelligence (T1588.007), DNS (T1071.004), Malware (T1588.001), Vulnerabilities (T1588.006), Server (T1584.004), Trap (T1546.005), Social Media (T1593.001), Credentials (T1589.001), Python (T1059.006), At (T1053.002)
• Attackers Hijacked Over 300 Tor Exit Relays to Intercept SSH Connections — Wed, 21 Oct 2026 16:00:27 +0530
  • Matched TTPs: Rootkit (T1014), DNS (T1071.004), Malware (T1588.001), Cron (T1053.003), Vulnerabilities (T1588.006), SSH (T1021.004), Server (T1584.004), Trap (T1546.005), Tool (T1588.002), Social Media (T1593.001), Python (T1059.006), At (T1053.002)
• PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security Alert — Wed, 21 Oct 2026 14:35:17 +0530
  • Matched TTPs: DNS (T1071.004), Malware (T1588.001), Cron (T1053.003), Vulnerabilities (T1588.006), Server (T1584.004), Trap (T1546.005), Software (T1592.002), Social Media (T1593.001), Python (T1059.006), At (T1053.002)
• CISA Orders Federal Agencies to Patch Exploited Plex2Shell, Siemens, and SiteGuard Flaws — Wed, 21 Oct 2026 12:56:49 +0530
  • Matched TTPs: DNS (T1071.004), Malware (T1588.001), Vulnerabilities (T1588.006), DLL (T1574.001), Server (T1584.004), Trap (T1546.005), Proxy (T1090), Software (T1592.002), Social Media (T1593.001), Python (T1059.006), At (T1053.002)
• Hackers Hid Vasilek Backdoor in VMware Tools During 2-Year Russian Healthcare Intrusion — Wed, 21 Oct 2026 11:35:15 +0530
  • Matched TTPs: VNC (T1021.005), JavaScript (T1059.007), DNS (T1071.004), Malware (T1588.001), Windows Service (T1543.003), Vulnerabilities (T1588.006), DLL (T1574.001), Botnet (T1584.005), Server (T1584.004), Trap (T1546.005), Clear Windows Event Logs (T1070.001), Proxy (T1090), Trusted Relationship (T1199), Phishing (T1566), Software (T1592.002), Social Media (T1593.001), Python (T1059.006), At (T1053.002)