Threat Hunt Feed (2026-10-25)
Hacker News: Best
- Node2Shell evolves to HTTP2Shell, blast radius affects many HTTP libs and apps — Sat, 24 Oct 2026 08:06:39 +0000
- Matched TTPs: JavaScript (T1059.007), Malware (T1588.001), Databases (T1213.006), Vulnerabilities (T1588.006), Private Keys (T1552.004), Server (T1584.004), Proxy (T1090), Software (T1592.002), Python (T1059.006), At (T1053.002), Compression (T1027.015)
- eMudhra ignored Mozilla Root investigation deadline; blames social media — Fri, 23 Oct 2026 14:52:08 +0000
- Matched TTPs: Hardware (T1592.001), Code Signing (T1553.002), Private Keys (T1552.004), Firmware (T1592.003), Software (T1592.002), Social Media (T1593.001), At (T1053.002)
BleepingComputer
- BlackX UEFI bootkit exploits Baton Drop flaw to bypass Secure Boot — Sat, 24 Oct 2026 10:17:32 -0400
- Matched TTPs: Bootkit (T1542.003), Malware (T1588.001), Hardware (T1592.001), DLL (T1574.001), Email Accounts (T1585.002), Tool (T1588.002), Phishing (T1566), Firmware (T1592.003), Software (T1592.002), Exploits (T1588.005), Credentials (T1589.001), At (T1053.002)
The Hacker News
- Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software — Sat, 24 Oct 2026 16:39:29 +0530
- Matched TTPs: DNS (T1071.004), Malware (T1588.001), Vulnerabilities (T1588.006), Server (T1584.004), Trap (T1546.005), Proxy (T1090), Software (T1592.002), Social Media (T1593.001), Python (T1059.006), At (T1053.002), Compression (T1027.015)
- Leaked LiteLLM Master Key Let Attackers Steal GitHub Tokens and Hijack Release Pipeline — Sat, 24 Oct 2026 16:33:33 +0530
- Matched TTPs: Artificial Intelligence (T1588.007), DNS (T1071.004), Malware (T1588.001), Vulnerabilities (T1588.006), SSH (T1021.004), Server (T1584.004), Trap (T1546.005), Tool (T1588.002), Multi-Factor Authentication (T1556.006), Social Media (T1593.001), Credentials (T1589.001), Python (T1059.006), At (T1053.002)
- Google Says Gmail and Photos Data Shared With AI Search Could Be Used for Targeted Ads — Sat, 24 Oct 2026 16:06:33 +0530
- Matched TTPs: Artificial Intelligence (T1588.007), DNS (T1071.004), Malware (T1588.001), Vulnerabilities (T1588.006), Server (T1584.004), Trap (T1546.005), Social Media (T1593.001), Python (T1059.006), At (T1053.002)
- Researchers Push Over 2 Million Updates to Remotely Disable Popcorn Time Updater That Could Fuel a Botnet — Sat, 24 Oct 2026 14:34:24 +0530
- Matched TTPs: DNS (T1071.004), Malware (T1588.001), Hardware (T1592.001), Windows Service (T1543.003), Vulnerabilities (T1588.006), Botnet (T1584.005), Domains (T1584.001), Server (T1584.004), Trap (T1546.005), Launchctl (T1569.001), Software (T1592.002), Social Media (T1593.001), Python (T1059.006), At (T1053.002)
- CISA Flags Two Actively Exploited Critical Flaws in Collabora Online and Arista VeloCloud — Sat, 24 Oct 2026 11:55:57 +0530
- Matched TTPs: IP Addresses (T1590.005), DNS (T1071.004), Malware (T1588.001), Vulnerabilities (T1588.006), Web Shell (T1505.003), Server (T1584.004), Trap (T1546.005), Proxy (T1090), Social Media (T1593.001), Python (T1059.006), At (T1053.002)