# Ruleset Update Summary - 2026/10/23 - v11318 **URL:** \ **Category:** Ruleset Updates\ **Created:** [October 23, 2026, 8:07pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2026-10-23-v11318/3489 "2026-10-23T20:07:25Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![rulesbot](https://avatars.discourse-cdn.com/v4/letter/r/13edae/32.png) [@rulesbot](https://community.emergingthreats.net/u/rulesbot)\ **Post date:** [October 23, 2026, 8:07pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2026-10-23-v11318/3489/1 "2026-10-23T20:07:25Z")
## Summary: 8 new OPEN, 11 new PRO (8 + 3) Thanks @trex\_42 * * * ## Added rules: ### Open: - 2072562 - ET EXPLOIT Cisco Identity Services Engine API Gateway Authentication Bypass (CVE-2026-76460) (exploit.rules) - 2072563 - ET WEB\_SPECIFIC\_APPS Fortinet FortiSIEM gRPC phoenixSvc SendQueryResult query-id Header Path Traversal Attempt (CVE-2026-106173) (web\_specific\_apps.rules) - 2072564 - ET MALWARE Backdoored LiteLLM Package CnC Domain in DNS Lookup (litellm .dev) (malware.rules) - 2072565 - ET MALWARE Observed LiteLLM Backdoor Domain (litellm .dev in TLS SNI) (malware.rules) - 2072566 - ET MALWARE Malicious LiteLLM Exfil (litellm .dev) (malware.rules) - 2072567 - ET HUNTING Image Download From Dotted Quad Host via PowerShell (hunting.rules) - 2072568 - ET EXPLOIT\_KIT Coruna EK Domain in DNS Lookup (xie .rpreh .com) (exploit\_kit.rules) - 2072569 - ET EXPLOIT\_KIT Coruna EK Domain in TLS SNI (xie .rpreh .com) (exploit\_kit.rules) ### Pro: - 2868903 - ETPRO WEB\_SPECIFIC\_APPS Apache Superset Default Secret Key Authentication Bypass (CVE-2023-27524) (web\_specific\_apps.rules) - 2868904 - ETPRO EXPLOIT MikroTik RouterOS SMB Buffer Overflow (CVE-2018-7445) (exploit.rules) - 2868905 - ETPRO WEB\_CLIENT Adobe Flash Player Flash Parse Float Stack Buffer Overflow (CVE-2014-9163) (web\_client.rules)