SECURITYINTEL DAILY BRIEF ■ ThreatIntel BriefTuesday, October 13, 2026 INTEL CONFIDENCE 100% | THREAT LEVEL CRITICAL |
|
THREAT OF THE DAY Actively Exploited RCEs & Supply Chain Compromises | CRITICAL |
|
5 C2 IPs | 16 OTX IOCs | 30 ARTICLES |
|
■ ANALYST TLDR Today's intel highlights a surge in actively exploited critical vulnerabilities, including RCE flaws in Bricksforge WordPress plugin and GitLab CI/CD, and a pre-authenticated SSRF in SonicWall SMA 1000 appliances. Additionally, supply chain attacks are a significant concern with hardware implants found in Ledger crypto wallets and AI-augmented campaigns targeting critical infrastructure. |
|
■ CRITICAL STORIES Bricksforge WordPress Plugin Vulnerability Exploited in the Wild (CVE-2026-85097) A maximum-severity RCE flaw in a WordPress plugin is under active exploitation, allowing unauthenticated attackers to take full control of websites. |
GitLab warns of max severity code execution vulnerability GitLab has warned users of a critical RCE vulnerability in its CI/CD Regular Expression Compiler, requiring immediate patching to prevent remote attackers from running arbitrary code. |
Critical SonicWall SMA 1000 Flaw Targeted in 135 Exploitation Attempts After Patch (CVE-2026-102255) A critical pre-authenticated SSRF vulnerability in SonicWall SMA 1000 appliances, with a CVSS score of 10.0, is being actively exploited just days after disclosure. |
Ledger confirms spy chip implant behind wallet crypto thefts Hardware implants found in Ledger devices sold via a reseller, leading to cryptocurrency theft, highlights a critical supply chain compromise risk for hardware wallets. |
|
■ CVEs IDENTIFIED CVE-2026-85097 Bricksforge WordPress Plugin — Unauthenticated Remote Code Execution (RCE) |
CVE-2026-102255 SonicWall Secure Mobile Access (SMA) 1000 appliances — Pre-authenticated Server-Side Request Forgery (SSRF) leading to unauthorized operations |
[CVE-TBD] GitLab CI/CD Regular Expression Compiler — Remote Code Execution (RCE) |
|
■ THREAT ACTORS ShinyHunters | Cybercrime Group |
Alleged member Edward Dubrovsky arrested in FBI hack probe. |
Leader Oleg Korniev pleads guilty to money laundering. |
CyberXero | Initial Access Broker / Data Theft Group |
Used Claude AI in campaign targeting Ukraine, stealing over 628,000 records. |
|
|
|
■ ATT&CK TTPs | T1190 | | Exploit Public-Facing Application | Exploitation of Bricksforge WordPress Plugin (CVE-2026-85097) and SonicWall SMA 1000 (CVE-2026-102255); GitLab RCE vulnerability. |
| T1598.003 | | Supply Chain Compromise: Hardware Supply Chain Compromise | Hardware implant found in Ledger devices sold via CryptoBilis. |
| T1499 | | Endpoint Denial of Service | Cyberattack on Danfoss refrigeration controllers; drone attacks on Yandex data centers. |
| T1529 | | System Shutdown/Restart | Ahold Delhaize taking systems offline; Yandex data centers shut down due to drone attacks. |
| T1498 | | Denial of Service | DDoS attack against Canonical websites. |
| T1566 | | Phishing | AI assistants being baited by phishing emails; CyberXero using AI-augmented phishing. |
|
■ PATCH PRIORITY Bricksforge WordPress Plugin — Actively exploited RCE (CVE-2026-85097) — BC, THN, SW |
GitLab CI/CD Regular Expression Compiler — Max severity RCE ([CVE-TBD]) — BC |
SonicWall Secure Mobile Access (SMA) 1000 appliances — Actively exploited pre-auth SSRF (CVE-2026-102255) — THN, SW |
|
|
|
■ RECOMMENDED ACTIONS TODAY | 1 | [P1] Patch immediately: Update Bricksforge WordPress Plugin to address CVE-2026-85097, as it is actively exploited for RCE. |
| 2 | [P1] Patch immediately: Apply available patches for the maximum-severity RCE vulnerability in GitLab CI/CD Regular Expression Compiler. |
| 3 | [P1] Patch immediately: Update SonicWall Secure Mobile Access (SMA) 1000 appliances to mitigate CVE-2026-102255, which is under active exploitation. |
| 4 | [P2] Supply Chain Review: Users of Ledger devices purchased via CryptoBilis should follow Ledger's guidance and verify device integrity due to confirmed hardware implants. |
| 5 | [P2] Enhance AI Security: Implement strict access controls and content verification for AI assistants, especially concerning email summarization, to prevent phishing and unauthorized actions. |
|
|
|
C2 IP BLOCKLIST · AbuseCH Feodo · Showing 5 of 5 IP ADDRESS 162.243.103.246 | PORT 8080 | STATUS OFFLINE | MALWARE Emotet | COUNTRY US |
IP ADDRESS 50.16.16.211 | PORT 443 | STATUS ONLINE | MALWARE QakBot | COUNTRY US |
IP ADDRESS 34.204.119.63 | PORT 443 | STATUS OFFLINE | MALWARE QakBot | COUNTRY US |
IP ADDRESS 178.62.3.223 | PORT 443 | STATUS OFFLINE | MALWARE QakBot | COUNTRY GB |
IP ADDRESS 27.133.154.218 | PORT 443 | STATUS OFFLINE | MALWARE QakBot | COUNTRY JP |
|
FULL IOC EXPORT — GOOGLE SHEET All live IOCs with full SHA256 hashes (OTX), IPs, and domains. 2 tabs: C2 IPs · OTX IOCs
Updated daily · Export as CSV to import directly into your tools ■ Open Full IOC Sheet → |
|
IOC SOURCES: AbuseCH Feodo · AlienVault OTX
NEWS: THN · KRB · SANS · REC · BC · SW · AWS · GCP · MSFT · U42 · SCH · MWB |