# Ruleset Update Summary - 2026/07/21 - v11238 **URL:** \ **Category:** Ruleset Updates\ **Created:** [July 21, 2026, 8:40pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2026-07-21-v11238/3392 "2026-07-21T20:40:46Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![rulesbot](https://avatars.discourse-cdn.com/v4/letter/r/13edae/32.png) [@rulesbot](https://community.emergingthreats.net/u/rulesbot)\ **Post date:** [July 21, 2026, 8:40pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2026-07-21-v11238/3392/1 "2026-07-21T20:40:46Z")
## Summary: 9 new OPEN, 12 new PRO (9 + 3) * * * ## Added rules: ### Open: - 2071235 - ET WEB\_SPECIFIC\_APPS SonicWall SMA Websocket Tunnel Bypass (CVE-2026-15409) (web\_specific\_apps.rules) - 2071236 - ET EXPLOIT\_KIT LandUpdate808 Domain in DNS Lookup (meduurst .space) (exploit\_kit.rules) - 2071237 - ET EXPLOIT\_KIT LandUpdate808 Domain in TLS SNI (meduurst .space) (exploit\_kit.rules) - 2071238 - ET MALWARE TA569 Gholoader CnC Domain in DNS Lookup (img2 .mekebibsolomonlaw .com) (malware.rules) - 2071239 - ET MALWARE TA569 Gholoader CnC Domain in TLS SNI (img2 .mekebibsolomonlaw .com) (malware.rules) - 2071240 - ET WEB\_SPECIFIC\_APPS Esri ArcGIS Server Unauthenticated Path Traversal in UploadsManager (CVE-2026-9181) (web\_specific\_apps.rules) - 2071241 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (choppyi .cyou) (malware.rules) - 2071242 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (choppyi .cyou) in TLS SNI (malware.rules) - 2071249 - ET SCAN Zimbra Collaboration Global Address List Bulk Enumeration (scan.rules) ### Pro: - 2868019 - ETPRO WEB\_SPECIFIC\_APPS PTC Windchill/FlexPLM Unauthenticated Remote Code Execution (CVE-2026-12569) (web\_specific\_apps.rules) - 2868020 - ETPRO PHISHING Generic Device Code Phish Landing Page M1 2026-07-21 (phishing.rules) - 2868021 - ETPRO PHISHING Generic Device Code Phish Landing Page M2 2026-07-21 (phishing.rules)