Threat Intelligence Report October 2026

30 days of threat data. 17 critical CVEs. 88,000+ threat events from 75 countries. This is what our sensors picked up across enterprise infrastructure worldwide.

What we observed

Exploitation of Fortinet FortiGate, Ivanti Connect Secure, Citrix NetScaler, React/Next.js, and PHP 8.4 / Apache platforms
Targeted CVEs: CVE-2025-64446, CVE-2024-55591, CVE-2024-21762, CVE-2026-24858, CVE-2025-24472, CVE-2025-22457, CVE-2025-0282, CVE-2026-0778, CVE-2026-0779, CVE-2023-3519, CVE-2025-5777, CVE-2025-7775, CVE-2026-3055, CVE-2026-4368, CVE-2025-55182, CVE-2026-109618, CVE-2024-4577
High-confidence TTPs: Iranian Go Bot login brute force and credential stuffing, path traversal and sensitive file reads, PHP2Shell memory disclosure chain (CVE-2026-109618), php-cgi argument injection (CVE-2024-4577)
PHP2Shell sensor recorded 255 chain stage requests from 24 sources, with no execution payloads reaching the sensor
3 botnets identified including two Iranian State-Sponsored campaigns (suspected APT35/Charming Kitten)
Significant geographic concentration: Japan accounts for 43% of all attack traffic, with M247 Europe SRL as top threat source
441 Tor exit nodes observed conducting reconnaissance or exploitation attempts
100 ransomware victims across 29 groups, with qilin leading (13 victims)
TLS fingerprint intelligence: Monitoring 97 known malware signatures including Tofsee (45 variants)
React2Shell honeypot detected active worm propagation (apache) with C2 infrastructure