// THREAT INTELLIGENCE CENTER

Turn threat signals into defensive action.

Live cyber update intelligence, KEV-style prioritization, mitigation guidance, and SOC-ready action cards.

Export JSON Export CSV

Tracked items

Critical CVEs

High risks

Live

Feed status

Intel feed

low

ISC Stormcast For Monday, October 5th, 2026 https://isc.sans.edu/podcastdetail/10122, (Mon, Oct 5th)

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

Mitigation: Triage affected assets, validate exposure, apply available mitigations, increase logging, and document evidence for incident review.

high

TTY Logs and the Data it Captures, (Sun, Oct 4th)

For an experiment, I created a script [1] that parses and send the TTY logs collected from actors or bots activity that run various commands after they successfully login the DShield sensor. Those TTY logs are sent daily at the end of each day to the DShield SIEM [2] to be correlated with all the data. 

Mitigation: Triage affected assets, validate exposure, apply available mitigations, increase logging, and document evidence for incident review.

critical

Citrix patches NetScaler SAML zero-day exploited in attacks

Citrix has released emergency updates for a new NetScaler denial-of-service vulnerability tracked as CVE-2026-88779 that has been exploited in zero-day attacks, with researchers investigating whether it can also be exploited for remote code execution. [...]

Mitigation: Triage affected assets, validate exposure, apply available mitigations, increase logging, and document evidence for incident review.

critical

CISA Adds One Known Exploited Vulnerability to Catalog

CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2026-88779 Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise. Binding Operational Directi

Mitigation: Confirm exposure, apply vendor patches, add temporary WAF/IPS rules, and run post-patch vulnerability validation.

low

Anthropic asks Claude users to share voice data for AI model training

Anthropic has started asking Claude users to voluntarily share their voice conversations to help train and improve its AI models. [...]

Mitigation: Triage affected assets, validate exposure, apply available mitigations, increase logging, and document evidence for incident review.

low

User Agent Strings Curiosities, (Sun, Oct 4th)

Sometimes I have to smile, or my interest is triggered, when I review new User Agent Strings in the honeypot logs.

Mitigation: Triage affected assets, validate exposure, apply available mitigations, increase logging, and document evidence for incident review.

low

ShinyHunters Suspect Rey Reportedly Detained in Jordan, Helping FBI Identify Group Members

A suspected member of the ShinyHunters digital extortion group, who goes by the online alias "Rey," has been allegedly detained by authorities in Jordan, Reuters reported, citing three people familiar with the matter. Rey, whose real name is Saif ‌al-Din Khader, is said to have been brought into custody on September 29, 2026, cooperating with the U.S. Federal Bureau of Investigation (FBI) and

Mitigation: Triage affected assets, validate exposure, apply available mitigations, increase logging, and document evidence for incident review.

high

China-Aligned TA419 Targets U.S. AI Policy Experts With Microsoft AitM Phishing

A new China-nexus cyber espionage group known as TA419 has been attributed to multiple credential phishing campaigns targeting artificial intelligence (AI) experts working for U.S. think tanks, universities, and legal sector organizations. The campaigns have impersonated prominent economists and AI policymakers, as well as a prominent Anthropic employee, to single out an AI policy expert at a

Mitigation: Harden SPF/DKIM/DMARC, block sender infrastructure, inspect mailbox rules, and require MFA re-authentication.

Open full cyber update stream →

How to use Threat Intelligence マニュアルと実例 — inputs, output, limits, what it does not do, and a worked example. Open the reference →