This entry provides indicators of compromise (IOCs) related to ThreatFox for the date 2026-10-07. It is categorized as OSINT related to network activity and payload delivery. No specific malware details, vulnerabilities, or exploits are described.

The data represents a collection of ThreatFox IOCs published on 2026-10-07. It is intended for open-source intelligence purposes and relates to network activity and payload delivery. No technical details, affected software versions, or active exploits are provided.

ThreatFox MISP Feed

Mirai botnet C2 domain (confidence level: 90%)

Remus botnet C2 server (confidence level: 100%)

Remcos botnet C2 server (confidence level: 100%)

Unknown malware payload delivery URL (confidence level: 75%)

Unknown malware payload (confidence level: 100%)

donut_injector payload delivery URL (confidence level: 50%)

Aisuru botnet C2 server (confidence level: 100%)

SmartApeSG payload delivery URL (confidence level: 100%)

SmartApeSG payload delivery domain (confidence level: 100%)

Unknown malware payload delivery domain (confidence level: 80%)

Unknown malware payload delivery URL (confidence level: 80%)

ClearFake payload delivery domain (confidence level: 100%)

php.shin_webshell botnet C2 domain (confidence level: 50%)

Mozi payload delivery URL (confidence level: 75%)

Potassium botnet C2 server (confidence level: 100%)

VShell botnet C2 server (confidence level: 100%)

FAKEUPDATES botnet C2 domain (confidence level: 100%)

Vidar botnet C2 domain (confidence level: 100%)

Bashlite botnet C2 server (confidence level: 75%)

ClearFake payload delivery domain (confidence level: 90%)

DCRat botnet C2 server (confidence level: 100%)

Havoc botnet C2 server (confidence level: 100%)

Cobalt Strike botnet C2 server (confidence level: 75%)

ThreatFox IOCs for 2026-10-07

The Aurora Heatmap WordPress plugin up to version 1.7.2 is vulnerable to stored Cross-Site Scripting (XSS) via the 'url' parameter. This vulnerability allows unauthenticated attackers to inject malicious scripts that execute when an admin user clicks the injected heatmap link. The issue arises from insufficient input sanitization and output escaping.

CVE-2026-94154 describes a stored Cross-Site Scripting vulnerability in the Aurora Heatmap plugin for WordPress, affecting all versions up to and including 1.7.2. The vulnerability is due to improper neutralization of input during web page generation, specifically in the 'url' parameter. An unauthenticated attacker can inject arbitrary scripts that execute in the context of an admin user when interacting with the heatmap link. The CVSS 3.1 base score is 6.1, indicating a medium severity with network attack vector, low attack complexity, no privileges required, but requires user interaction and impacts confidentiality and integrity with no availability impact.

CVE Database V5

The Aurora Heatmap WordPress plugin up to version 1.7.2 is vulnerable to stored Cross-Site Scripting (XSS) via the 'url' parameter. This vulnerability allows unauthenticated attackers to inject malicious scripts that execute when an admin user clicks the injected heatmap link. The issue arises from 

CVE-2026-94154: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in r3098 Aurora Heatmap

The LatePoint Appointment Booking plugin for WordPress up to version 5.6.9 contains an authorization bypass vulnerability. Authenticated users with Subscriber-level access or higher can modify personal information of arbitrary customers due to insufficient ownership checks in the process_step_customer() function. This flaw allows attackers to change details such as first name, last name, email, phone, and notes. When the contact_merge setting is configured to 'phone', attackers can overwrite the victim's email address and potentially take over the account via password reset.

CVE-2026-17538 is an Insecure Direct Object Reference vulnerability (CWE-639) in the LatePoint Appointment Booking & Reservation plugin for WordPress versions up to and including 5.6.9. The vulnerability arises because the process_step_customer() function only verifies if a user is logged in (is_user_logged_in()) before merging POSTed customer data into an existing customer record, without verifying ownership of the customer data. This allows authenticated users with Subscriber-level privileges or higher to modify personal information of any LatePoint customer. If the plugin's contact_merge setting is set to 'phone', attackers can overwrite the victim's email address, enabling account takeover via password reset.

The LatePoint Appointment Booking plugin for WordPress up to version 5.6.9 contains an authorization bypass vulnerability. Authenticated users with Subscriber-level access or higher can modify personal information of arbitrary customers due to insufficient ownership checks in the process_step_custom

CVE-2026-17538: CWE-639 Authorization Bypass Through User-Controlled Key in latepoint Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress

The CEO of MonsterCloud, a ransomware remediation company, has been charged with defrauding ransomware victims by secretly paying attackers for decryptors while falsely claiming to use proprietary technology to recover encrypted data.

The owner of MonsterCloud allegedly deceived ransomware victims by covertly paying ransom demands to attackers to obtain decryptors, while publicly asserting that the company used proprietary methods to recover encrypted files. This conduct constitutes fraud against victims seeking legitimate ransomware recovery services.

Bleeping Computer

Original Source

Ransomware recovery CEO charged over secret ransom payments

Vault

Vault Enterprise

CVE-2026-89322 is a vulnerability in HashiCorp Vault and Vault Enterprise where ACL policies were not consistently evaluated against the canonical form of resource and policy names. This inconsistency could allow an authenticated user with delegated permissions to bypass explicit deny restrictions, potentially accessing protected resources or assigning denied policies, leading to privilege escalation. The issue is fixed in Vault Community Edition 2.1.2 and Vault Enterprise versions 2.1.2, 1.21.12, 1.20.17, and 1.19.23.

HashiCorp Vault and Vault Enterprise versions prior to 2.1.2 (Community Edition) and prior to 1.21.12 (Enterprise) did not consistently normalize resource and policy names when evaluating ACL policies. This improper handling of case sensitivity (CWE-178) allowed authenticated users with delegated permissions to bypass explicit deny rules, potentially granting unauthorized access or privilege escalation. The vulnerability has a CVSS 3.1 score of 7.2, indicating high severity. Official patches are available in the specified fixed versions.

CVE-2026-89322 is a vulnerability in HashiCorp Vault and Vault Enterprise where ACL policies were not consistently evaluated against the canonical form of resource and policy names. This inconsistency could allow an authenticated user with delegated permissions to bypass explicit deny restrictions, 

CVE-2026-89322: CWE-178: Improper Handling of Case Sensitivity in HashiCorp Vault

CVE-2026-11947 was initially assigned as a vulnerability identifier but was subsequently rejected or withdrawn by the responsible CVE Numbering Authority. No technical details, affected versions, or exploit information are available for this entry, indicating it does not correspond to a confirmed security issue.

GCVE Database

Detailed information about Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. (CVE-2026-11947). Get real-time updates, 

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. (CVE-2026-11947) - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2026-11947

AI-Powered Analysis

Technical Analysis

Potential Impact

Mitigation Recommendations

Technical Details

Community Reviews

Actions

External Links

Need more coverage?

Latest Threats

Check if your credentials are on the dark web

Lead Pen Test Professional

CVE-2026-11947

AI-Powered Analysis

Technical Analysis

Potential Impact

Mitigation Recommendations

Technical Details

Community Reviews

Related Threats

The Examples for Developers project aims to provide high-quality, well-documented API examples for a broad range of Drupal core functionality. (CVE-2026-107312)

This module provides a new UI experience for node editing using the Gutenberg Editor library. (CVE-2026-107263)

Freelinking: This module enables you to configure a WIKI-like input filter that allows users to create links to site and external content. (CVE-2026-107310)

Red Hat Security Advisory: perl-DBI security update

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update