# Ruleset Update Summary - 2026/06/05 - v11208

**URL:** <https://community.emergingthreats.net/t/ruleset-update-summary-2026-06-05-v11208/3348>\
**Category:** Ruleset Updates\
**Created:** [June 5, 2026, 8:13pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2026-06-05-v11208/3348 "2026-06-05T20:13:16Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![rulesbot](https://avatars.discourse-cdn.com/v4/letter/r/13edae/32.png) [@rulesbot](https://community.emergingthreats.net/u/rulesbot)\
**Post date:** [June 5, 2026, 8:13pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2026-06-05-v11208/3348/1 "2026-06-05T20:13:16Z")

</div>

## Summary:

14 new OPEN, 14 new PRO (14 + 0)

* * *

## Added rules:

### Open:

- 2069664 - ET WEB\_SPECIFIC\_APPS XWIKI resource Parameter Directory Traversal Attempt (CVE-2026-23734) (web\_specific\_apps.rules)
- 2069665 - ET MALWARE Fake Updates Victim Click Confirmation (malware.rules)
- 2069666 - ET MALWARE Observed Fake Updates Page Inbound (malware.rules)
- 2069667 - ET MALWARE Fake Updates Victim Click Confirmation Javascript Observed (malware.rules)
- 2069668 - ET MALWARE Observed Fake Updates Page Inbound (malware.rules)
- 2069669 - ET WEB\_SPECIFIC\_APPS OpenCATS Installer Config databaseConnectivity Command Injection Attempt (CVE-2026-27760) (web\_specific\_apps.rules)
- 2069670 - ET MALWARE TA569 Gholoader CnC Domain in DNS Lookup (secure .therunningink .com) (malware.rules)
- 2069671 - ET MALWARE TA569 Gholoader CnC Domain in TLS SNI (secure .therunningink .com) (malware.rules)
- 2069672 - ET EXPLOIT\_KIT ZPHP Domain in DNS Lookup (copperbeacon .top) (exploit\_kit.rules)
- 2069673 - ET EXPLOIT\_KIT ZPHP Domain in DNS Lookup (shadowcompass .top) (exploit\_kit.rules)
- 2069674 - ET EXPLOIT\_KIT ZPHP Domain in TLS SNI (copperbeacon .top) (exploit\_kit.rules)
- 2069675 - ET EXPLOIT\_KIT ZPHP Domain in TLS SNI (shadowcompass .top) (exploit\_kit.rules)
- 2069676 - ET EXPLOIT\_KIT LandUpdate808 Domain in DNS Lookup (diranda .lol) (exploit\_kit.rules)
- 2069677 - ET EXPLOIT\_KIT LandUpdate808 Domain in TLS SNI (diranda .lol) (exploit\_kit.rules)
