# Ruleset Update Summary - 2026/10/16 - v11313 **URL:** \ **Category:** Ruleset Updates\ **Created:** [October 16, 2026, 8:38pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2026-10-16-v11313/3483 "2026-10-16T20:38:40Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![rulesbot](https://avatars.discourse-cdn.com/v4/letter/r/13edae/32.png) [@rulesbot](https://community.emergingthreats.net/u/rulesbot)\ **Post date:** [October 16, 2026, 8:38pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2026-10-16-v11313/3483/1 "2026-10-16T20:38:40Z")
## Summary: 6 new OPEN, 31 new PRO (6 + 25) * * * ## Added rules: ### Open: - 2072501 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (gloob .top) (malware.rules) - 2072502 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (gloob .top) in TLS SNI (malware.rules) - 2072503 - ET MALWARE TA569 Gholoader CnC Domain in DNS Lookup (mini-kit .nashstuder .com) (malware.rules) - 2072504 - ET MALWARE TA569 Gholoader CnC Domain in DNS Lookup (embed-api .joelbaueronline .com) (malware.rules) - 2072505 - ET MALWARE TA569 Gholoader CnC Domain in TLS SNI (mini-kit .nashstuder .com) (malware.rules) - 2072506 - ET MALWARE TA569 Gholoader CnC Domain in TLS SNI (embed-api .joelbaueronline .com) (malware.rules) ### Pro: - 2868832 - ETPRO WEB\_SPECIFIC\_APPS Advantech R-SeeNet Authenticated Arbitrary File Read (CVE-2023-3256) (web\_specific\_apps.rules) - 2868833 - ETPRO WEB\_SPECIFIC\_APPS Advantech iView NetworkServlet backupDatabase backup\_filename Command Injection Parameter (CVE-2022-2143) (web\_specific\_apps.rules) - 2868834 - ETPRO WEB\_SPECIFIC\_APPS Advantech iView runProViewUpgrade fwfilename Command Injection (CVE-2022-2143) (web\_specific\_apps.rules) - 2868835 - ETPRO WEB\_SPECIFIC\_APPS AnythingLLM Unauthenticated API System Configuration Access (CVE-2026-24477, CVE-2024-6842) (web\_specific\_apps.rules) - 2868836 - ETPRO WEB\_SPECIFIC\_APPS AnythingLLM API Key Exposure Information Disclosure (CVE-2026-24477, CVE-2024-6842) (web\_specific\_apps.rules) - 2868837 - ETPRO WEB\_SPECIFIC\_APPS Apache OFBiz Authenticated Groovy RCE via traverseContent Service (CVE-2026-46586) (web\_specific\_apps.rules) - 2868838 - ETPRO WEB\_SPECIFIC\_APPS XWiki Platform Remote Code Execution (CVE-2025-24893) (web\_specific\_apps.rules) - 2868839 - ETPRO WEB\_SPECIFIC\_APPS Zoho ManageEngine Applications Manager SQL Injection (CVE-2024-5678) (web\_specific\_apps.rules) - 2868840 - ETPRO WEB\_SPECIFIC\_APPS Apache Kylin Arbitrary File Read (CVE-2025-61734) M1 (web\_specific\_apps.rules) - 2868841 - ETPRO WEB\_SPECIFIC\_APPS Apache Kylin Arbitrary File Read (CVE-2025-61734) M2 (web\_specific\_apps.rules) - 2868842 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - PING Outbound (malware.rules) - 2868843 - ETPRO WEB\_SPECIFIC\_APPS Apache Kylin Server-Side Request Forgery (CVE-2025-61735) M1 (web\_specific\_apps.rules) - 2868844 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PING Outbound (malware.rules) - 2868845 - ETPRO MALWARE TA584 Win32/XWorm CnC Command - Ping Inbound (malware.rules) - 2868846 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - RD- Inbound (malware.rules) - 2868847 - ETPRO WEB\_SPECIFIC\_APPS Apache Kylin Server-Side Request Forgery (CVE-2025-61735) M2 (web\_specific\_apps.rules) - 2868848 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - sendPlugin Outbound (malware.rules) - 2868849 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - Informations Outbound (malware.rules) - 2868850 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - GetInformations Inbound (malware.rules) - 2868851 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PCShutdown Inbound (malware.rules) - 2868852 - ETPRO WEB\_SPECIFIC\_APPS Apache Kylin User Update Authentication Bypass (web\_specific\_apps.rules) - 2868853 - ETPRO WEB\_SPECIFIC\_APPS Apache Ofbiz Scrum Plugin RCE via SVN Argument Injection (CVE-2025-54466) (web\_specific\_apps.rules) - 2868854 - ETPRO WEB\_SPECIFIC\_APPS Apache OFBiz statsDecoratorLocation Server-Side Request Forgery (CVE-2024-45507) (web\_specific\_apps.rules) - 2868855 - ETPRO WEB\_SPECIFIC\_APPS Apache Traffic Control SQL Injection in deliveryservice\_request\_comments Endpoint (CVE-2024-45387) (web\_specific\_apps.rules) - 2868856 - ETPRO HUNTING ClickFix Related POST Activity (hunting.rules)