Daily Hunt Feed - 2026-10-23

Threat Hunt Feed (2026-10-23)

Hacker News: Best

• Run full iOS 16.5 firmware on Android Devices — Thu, 22 Oct 2026 15:26:22 +0000
  • Matched TTPs: Hardware (T1592.001), Vulnerabilities (T1588.006), SSH (T1021.004), Tool (T1588.002), Firmware (T1592.003), Software (T1592.002), Python (T1059.006), At (T1053.002)
• Quad9 (DNS Resolver) to Exit France — Thu, 22 Oct 2026 14:32:38 +0000
  • Matched TTPs: IP Addresses (T1590.005), DNS (T1071.004), Malware (T1588.001), Domains (T1584.001), Phishing (T1566), Software (T1592.002), At (T1053.002)
• Tell HN: I unknowingly broke the PHP RCE embargo. I am sorry. — Thu, 22 Oct 2026 10:11:44 +0000
  • Matched TTPs: At (T1053.002)

BleepingComputer

• Capcom confirms data breach affecting 11.7 million accounts — Thu, 22 Oct 2026 16:22:45 -0400
  • Matched TTPs: Malware (T1588.001), Hardware (T1592.001), Server (T1584.004), Email Addresses (T1589.002), Web Services (T1584.006), Tool (T1588.002), Software (T1592.002), Credentials (T1589.001), At (T1053.002)
• LiteLLM release pipeline hacked to distribute info-stealer malware — Thu, 22 Oct 2026 15:12:51 -0400
  • Matched TTPs: Malware (T1588.001), Hardware (T1592.001), Databases (T1213.006), SSH (T1021.004), Private Keys (T1552.004), Server (T1584.004), Tool (T1588.002), Software (T1592.002), Credentials (T1589.001), Python (T1059.006), At (T1053.002)
• Microsoft shares how to fix broken Exchange Online EWS apps — Thu, 22 Oct 2026 11:49:32 -0400
  • Matched TTPs: Malware (T1588.001), Hardware (T1592.001), Add-ins (T1137.006), Email Accounts (T1585.002), Server (T1584.004), Web Services (T1584.006), PowerShell (T1059.001), Tool (T1588.002), Software (T1592.002), Credentials (T1589.001)
• Machine speed attacks require machine speed detection and response — Thu, 22 Oct 2026 10:02:12 -0400
  • Matched TTPs: Adversary-in-the-Middle (T1557), Artificial Intelligence (T1588.007), Keychain (T1555.001), Malware (T1588.001), Hardware (T1592.001), Domains (T1584.001), Server (T1584.004), Proxy (T1090), Tool (T1588.002), Phishing (T1566), Software (T1592.002), Credentials (T1589.001), At (T1053.002)
• Amazon says PHP2Shell exploitation began 4 days before patches — Thu, 22 Oct 2026 09:09:12 -0400
  • Matched TTPs: IP Addresses (T1590.005), Malware (T1588.001), Hardware (T1592.001), Vulnerabilities (T1588.006), Server (T1584.004), Tool (T1588.002), Software (T1592.002), Exploits (T1588.005), Credentials (T1589.001), At (T1053.002)

Darkreading

• Microsoft Links Storm-0940 to ConnectWise Supply Chain Attack — Thu, 22 Oct 2026 20:42:17 GMT
  • Matched TTPs: Vulnerabilities (T1588.006), Password Spraying (T1110.003), Tool (T1588.002), Software (T1592.002), Credentials (T1589.001), At (T1053.002)
• Les supermarchés de l’UE paient d’un firmware de réfrigérateur non mis à jour — Thu, 22 Oct 2026 19:30:20 GMT
  • Matched TTPs: Malware (T1588.001), Vulnerabilities (T1588.006), Tool (T1588.002), Firmware (T1592.003), At (T1053.002)

The Hacker News

• The AI Agent Nobody Owns: Watch Expert Webinar On Your Newest Insider Threat — Fri, 23 Oct 2026 00:35:35 +0530
  • Matched TTPs: Artificial Intelligence (T1588.007), DNS (T1071.004), Malware (T1588.001), Browser Extensions (T1176.001), Vulnerabilities (T1588.006), Server (T1584.004), Trap (T1546.005), Tool (T1588.002), Social Media (T1593.001), Credentials (T1589.001), Python (T1059.006), At (T1053.002)
• eMudhra to Exit Global SSL/TLS Business After 8 Intermediate CA Keys Found Easily Guessable — Thu, 22 Oct 2026 23:42:43 +0530
  • Matched TTPs: DNS (T1071.004), Malware (T1588.001), Vulnerabilities (T1588.006), Private Keys (T1552.004), Server (T1584.004), Trap (T1546.005), Software (T1592.002), Social Media (T1593.001), Python (T1059.006), At (T1053.002)
• Two CVSS 9.0 Linux KSMBD RCE Flaws Disclosed on Public Mailing Lists Before Kernel Fixes — Thu, 22 Oct 2026 22:31:53 +0530
  • Matched TTPs: Artificial Intelligence (T1588.007), DNS (T1071.004), Malware (T1588.001), Hardware (T1592.001), Vulnerabilities (T1588.006), Systemctl (T1569.003), Server (T1584.004), Trap (T1546.005), Software (T1592.002), Social Media (T1593.001), Python (T1059.006), At (T1053.002)
• Meta Ordered to Pay $25 Billion After Court Finds 43 Million Privacy Violations — Thu, 22 Oct 2026 21:42:31 +0530
  • Matched TTPs: DNS (T1071.004), Malware (T1588.001), Vulnerabilities (T1588.006), Server (T1584.004), Trap (T1546.005), Social Media (T1593.001), Python (T1059.006), At (T1053.002)
• OpenCode Flaw Lets Malicious MCP Servers Execute Code During Sign-In on Windows and WSL — Thu, 22 Oct 2026 16:14:05 +0530
  • Matched TTPs: Artificial Intelligence (T1588.007), DNS (T1071.004), Malware (T1588.001), Vulnerabilities (T1588.006), Server (T1584.004), Trap (T1546.005), Proxy (T1090), PowerShell (T1059.001), Social Media (T1593.001), Python (T1059.006), At (T1053.002)
• LiteLLM Suspects GitHub Token Leak in AI Gateway Logs Behind Malicious Package Release — Thu, 22 Oct 2026 13:58:48 +0530
  • Matched TTPs: IP Addresses (T1590.005), DNS (T1071.004), Malware (T1588.001), Vulnerabilities (T1588.006), Server (T1584.004), Trap (T1546.005), Tool (T1588.002), Social Media (T1593.001), Credentials (T1589.001), Python (T1059.006), At (T1053.002)
• New QPACK Flaws Can Crash HTTP/3 Servers, Trigger Up to 4,000-Fold Memory Amplification — Thu, 22 Oct 2026 12:08:31 +0530
  • Matched TTPs: DNS (T1071.004), Malware (T1588.001), Vulnerabilities (T1588.006), Server (T1584.004), Trap (T1546.005), Software (T1592.002), Exploits (T1588.005), Social Media (T1593.001), Python (T1059.006), At (T1053.002), Compression (T1027.015)
• Someone Tried to Exploit PHP2Shell 4 Days Before the Vulnerabilities Were Publicly Disclosed — Thu, 22 Oct 2026 12:04:10 +0530
  • Matched TTPs: IP Addresses (T1590.005), DNS (T1071.004), Malware (T1588.001), Vulnerabilities (T1588.006), Server (T1584.004), Trap (T1546.005), Web Services (T1584.006), Software (T1592.002), Exploits (T1588.005), Social Media (T1593.001), Python (T1059.006), At (T1053.002)
• China-Linked Hackers Use ARTEX AI Agents in ConnectWise Supply Chain Attack — Thu, 22 Oct 2026 09:51:26 +0530
  • Matched TTPs: Artificial Intelligence (T1588.007), DNS (T1071.004), Malware (T1588.001), Vulnerabilities (T1588.006), Botnet (T1584.005), Supply Chain Compromise (T1195), Server (T1584.004), Trap (T1546.005), Password Spraying (T1110.003), Cloud Services (T1021.007), Tool (T1588.002), Software (T1592.002), Social Media (T1593.001), Credentials (T1589.001), Python (T1059.006), At (T1053.002)

데일리시큐 - 최근인기기사

• 플렉스 미디어 서버 취약점 4개 연계 공격 확산…CISA, 실제 악용 경고 — 2026-10-22 12:33:30
  • Matched TTPs: Server (T1584.004)