SECURITYINTEL DAILY BRIEF ■ ThreatIntel BriefFriday, October 16, 2026 INTEL CONFIDENCE 100% | THREAT LEVEL CRITICAL |
| THREAT OF THE DAY Widespread Critical RCEs & Linux Kernel Escape | CRITICAL |
| 5 C2 IPs | 47 OTX IOCs | 36 ARTICLES |
| ■ ANALYST TLDR Today's intelligence highlights widespread critical RCE vulnerabilities across popular web applications and infrastructure components, including Nextcloud's Collabora Online, Linux kernel, Next.js, Drupal, Chrome, NGINX, and Adobe. Active exploitation of some flaws is confirmed, alongside sophisticated espionage campaigns targeting government Linux systems and zero-click spyware delivered via online ads. |
| ■ CRITICAL STORIES Hackers exploit Collabora RCE flaw to backdoor Nextcloud servers Active exploitation of a critical RCE (CVE-2026-110447) in a widely used Nextcloud app, leading to server compromise. |
Critical PwnEscape Linux Kernel Vulnerability Lets Guest VMs Read Host Memory A severe vulnerability in the Linux kernel allows guest VMs to escape and read host memory, demonstrated against cloud sandboxes, posing a major threat to cloud environments. |
Next.js Ships Out-of-Band Patch for Two Critical RCE Flaws in Caching and SVG Processing Two critical unauthenticated RCE flaws in Next.js require immediate patching due to their potential for severe impact on web applications. |
Update Chrome: Google fixes 37 security flaws, including seven critical bugs Multiple critical RCE vulnerabilities in Google Chrome could allow attackers to execute arbitrary code via crafted webpages, necessitating urgent browser updates. |
| ■ CVEs IDENTIFIED CVE-2026-110447 Collabora Online - Built-in CODE Server app (richdocumentscode) for Nextcloud — Remote Code Execution (RCE), backdoor Nextcloud servers |
[CVE-TBD] Linux kernel — Guest VMs read host memory (PwnEscape) |
[CVE-TBD] Adobe — Remote Code Execution (RCE) |
[CVE-TBD] WinRAR — Deploy reverse shell |
|
■ THREAT ACTORS Exploiting WinRAR flaw against CIS governments. |
Candiru | Commercial Spyware Vendor |
Zero-click spyware via online ads, targeting Al Jazeera. |
Suspected Kazakhstan-linked hackers | APT/Espionage |
Cyber-espionage campaign against Central Asian governments. |
|
|
| ■ ATT&CK TTPs | T1190 | | Exploit Public-Facing Application | Collabora RCE, NGINX RCE, Next.js RCE, Drupal RCE, Adobe RCE, Chrome RCE. |
| T1210 | | Exploitation of Remote Services | Collabora RCE, NGINX RCE, Next.js RCE, Drupal RCE, Adobe RCE. |
| T1566.001 | | Spearphishing Link | Zero-click spyware via online ads (Candiru), CikaBika Bot RAT delivery, Hirudo RAT delivery, tech support scams. |
| T1189 | | Drive-by Compromise | Zero-click spyware via online ads (Candiru). |
| T1548 | | Abuse Elevation Control Mechanism | Linux kernel PwnEscape, malicious Arch Linux packages gaining root. |
| T1566.001 | | Container Escape | Linux kernel PwnEscape, NVIDIA Container Escape. |
|
■ PATCH PRIORITY Collabora Online - Built-in CODE Server app (richdocumentscode) for Nextcloud — CVE-2026-110447 RCE — BC |
Linux kernel — PwnEscape (Guest VM to Host Memory Read) — THN |
Next.js — Two unauthenticated RCE flaws — THN |
Drupal core (Field UI module) — Unauthenticated RCE flaw — THN |
|
|
| ■ RECOMMENDED ACTIONS TODAY | 1 | [P1] Patch Collabora Online: Immediately apply patches for CVE-2026-110447 in the Collabora Online - Built-in CODE Server app (richdocumentscode) for Nextcloud to prevent RCE and server backdooring. |
| 2 | [P1] Update Linux Kernel: Prioritize applying security updates to Linux kernel, especially on systems hosting virtual machines or containers, to mitigate the critical PwnEscape vulnerability. |
| 3 | [P1] Update Next.js and Drupal: Apply out-of-band security updates for Next.js (caching, SVG processing RCEs) and Drupal core (Field UI module RCE) to address critical unauthenticated remote code execution flaws. |
| 4 | [P1] Update Browsers and Web Servers: Ensure Google Chrome, NGINX, and Adobe products are updated to their latest versions to remediate multiple critical RCE vulnerabilities. |
| 5 | [P2] Monitor Linux Infrastructure: For government and critical infrastructure organizations, enhance monitoring for custom malware, web shells, and credential theft on Linux systems, as targeted by AI-powered espionage. |
|
| | C2 IP BLOCKLIST · AbuseCH Feodo · Showing 5 of 5 IP ADDRESS 162.243.103.246 | PORT 8080 | STATUS OFFLINE | MALWARE Emotet | COUNTRY US |
IP ADDRESS 50.16.16.211 | PORT 443 | STATUS ONLINE | MALWARE QakBot | COUNTRY US |
IP ADDRESS 34.204.119.63 | PORT 443 | STATUS OFFLINE | MALWARE QakBot | COUNTRY US |
IP ADDRESS 178.62.3.223 | PORT 443 | STATUS OFFLINE | MALWARE QakBot | COUNTRY GB |
IP ADDRESS 27.133.154.218 | PORT 443 | STATUS OFFLINE | MALWARE QakBot | COUNTRY JP |
| FULL IOC EXPORT — GOOGLE SHEET All live IOCs with full SHA256 hashes (OTX), IPs, and domains. 2 tabs: C2 IPs · OTX IOCs
Updated daily · Export as CSV to import directly into your tools ■ Open Full IOC Sheet → |
| IOC SOURCES: AbuseCH Feodo · AlienVault OTX
NEWS: THN · KRB · SANS · REC · BC · SW · AWS · GCP · MSFT · U42 · SCH · MWB |
|