AETERNAE AI RESEARCH LLC INDEPENDENT RESEARCH
ÆAETERNAERESEARCH
Sign inRequest access
Æ / PUBLIC MALWARE INTELLIGENCE

Follow the evidence.

Published file metadata, source observations, indicators, and research history in one bounded catalog.

2,400+Reachable catalog records
73 / 100Current catalog page
24Maximum records per page
0Samples downloaded by this page

Feed collection status

Sources represented on this page. Publication and observation dates describe the content; successful batch dates describe local collection. A recent batch does not certify complete coverage or current provider availability.

2 sources: 0 stale, 0 needing attention, 0 paused, 0 unverified.

Review source update dates and status
  • intelligence_src_3be955b51398bb2da5Recent successful batchLast successful batch: Last attempt:
  • intelligence_src_3d2122a1e906762671Recent successful batchLast successful batch: Last attempt:

Stale means older than twice the recorded collection interval, with a minimum of one hour; without an interval, the threshold is 24 hours. Cached content remains available while a feed is stale, paused, or unverified.

Clear filters
2,400+ MATCHING RECORDSMETADATA ONLY / SOURCE ATTRIBUTION PRESERVED
REPORT1 SOURCE

MISP v2.5.45 released - Overmind Everywhere, LDAP Reworked, Security Hardened and Many Fixes

MISP v2.5.45 has been released with Overmind Everywhere, LDAP Reworked, Security Hardened. A large six-week cycle (herding kids, pets, bots is tiring in the heat, especially without an HVAC). Three themes dominate: the continued Overmind (Bootstrap 5) UI migration, a full revamp of LDAP authentication, and a concentrated security and correctness hardening pass. Highlights Overmind UI migration (83 commits) The single largest workstream in this release. Server settings, the Workflow indexes (ad-hoc, triggers, modules) and the workflow editor, the Decaying Model index, misp-module enrichment, and the complete registration / user settings / forgot-password / change-password flows have all been migrated. Feed migration is now complete, including a freetext feed preview index and import modals. New BS5 views landed for Jobs, Tasks, AnalystData, Feeds, TaxiiServers, CryptographicKeys and GalaxyClusterRelations. Alongside the migrations, the add/edit modals were overhauled across roughly a dozen entity types — Cerebrates, TaxiiServers, SightingDB, Collections, SharingGroups and Blueprints, Correlation Rules, blocklists, Regexp, Allowedlist, warninglists, tags and tag collections, servers. Also new: an organisation merge feature, an import action on the event index, server preview views, and a reworked header/action display. LDAP authentication revamp (PR #10956) Role and organisation mapping now supported via either a directory field or group membership ldapNestedGroups resolves nested group membership Users flagged ACCOUNTDISABLE in userAccountControl are disabled in MISP (behind a setting) MISP accounts can be synced from LDAP via the User check_validity task, schedulable as an admin task Authentication against a header asserted by a trusted proxy ldapOrgGroupMapping / ldapRoleGroupMapping precedence now follows settings order Security: passwordless binds to LDAP are now prevented, and a DN-linking bug causing incorrect matching is fixed A full pytest suite (tests/ldapauth/) with an OpenLDAP service running in CI Security hardening Eight XSS escaping fixes: correlation data in event-view JS rendering, event date in the index table time element, parent object name in sub-attribute rows, object name in attribute row data attributes, highlighted and missing taxonomy namespaces in ajaxTags, JS-safe encoding of warninglist match values in onclick, and contributor org names in the event view Per-org module restrictions are now honoured on all getEnabledModule() paths Event modify ACL is now enforced on attribute enrichment REST search honours the distribution=0 filter in fetchEvent Other new features Serve the instance GPG key via /gpg.asc, with caching Manage Supervisor-backed workers directly from the CLI Bug fixes Collections, analyst data and objects Compare distribution numerically in Collection::mayView; align buildConditions org visibility with mayView Check event visibility before collection attachment NOT-rule-only orgc_name filter no longer drops all rows (collections and analyst data) Log CollectionElement save failures instead of swallowing them; reset skipCollectionModifiedBump via finally Drop the stale-modified conflict guard from user edit Report the real id/uuid for intra-batch duplicate objects Propagate object-level first_seen/last_seen to new attributes Log when an attribute delete cascade does not fully save; only unpublish the event when the cascade succeeded Core and API Repair an invalid character class in _harvestParameters wildcard matching Serialise validation errors before throwing in AuditLog::insert Add a missing org_id guard to object/attribute correlation ACL Fix inverted null checks in the changeInTagOrCluster flag Avoid a recursive read in the generateCount bulk update Stop re-including theme files when building theme labels Check the populated stderr property rather than an unset variable in background jobs Scheduler now recovers from lost database connections (#10624) TAXII getObject queri

First reported Aug 25, 2026 15:27 UTCCatalog metadata updated Oct 16, 2026 10:48 UTCOpen evidence record
REPORT1 SOURCE

MISP 2.5.46 released - security hardening, major performance gains, knowledge-base updates and Overmind moving forward

MISP 2.5.46 is out, and the project continues to move at a very active development pace. This release brings together a large security review, significant performance improvements, major updates to the MISP knowledge bases and submodules, many fixes contributed by the community, and another substantial round of work on Overmind, the evolving MISP user interface. The volume and diversity of changes in this release also reflect the current activity around MISP: development, security reviews, performance work, knowledge-base maintenance, UI improvements and external contributions are all happening continuously across the project. Major security hardening A large part of this release is dedicated to improving MISP's security posture. A new shared UrlEgressValidator introduces a common policy for outbound URL requests, validating schemes and resolved addresses and blocking loopback, link-local and private destinations where appropriate. CurlClient has also been extended with: host pinning; controlled and validated redirects; response size limits; TLS peer verification enabled by default. These changes provide the foundation for securing the different places where MISP retrieves remote resources. Several concrete SSRF-related issues have consequently been addressed, including: event report URL imports; feed redirects; TAXII discovery; credential forwarding during redirects; access to internal or private network destinations. The security review also resulted in a broad range of additional fixes: rejection of empty and non-string LDAP and LinOTP credentials; session ID rotation after CustomAuth authentication; brute-force protection for email OTP verification; improved CSRF protection across user settings and dashboard actions; conversion of numerous state-changing GET requests to POST; stricter sharing-group authorisation; enforcement of perm_modify when deleting attributes; access-control enforcement in the OnDemand correlation engine; ACL checks for collection objects, graph references, feeds and cryptographic keys; SVG sandboxing for inline-served organisation logos and report pictures; prevention of stored and reflected XSS through URL and event filtering parameters; protection against path manipulation in server-side file deletion; redaction of information that should not be exposed to insufficiently privileged users; improved authentication-failure logging and throttling. Many of these issues were identified during the extensive review performed with the Scottish Government – National Cyber Team, by elhoim (David André), and through additional internal review. A big thank you to everyone involved in this work. Significant performance improvements This release also contains some important performance work. Event report counts Event report counts on event indexes previously resulted in one count query per event. The new implementation performs grouped queries instead. For a default page containing 60 events, this reduces roughly 60 database round trips to one or two queries depending on the user context. Benchmarks with a real MariaDB instance showed improvements in the range of roughly 19× to 35× for this operation. Sightings retrieval Sightings attached during MispAttribute::fetchAttributes() are now fetched in batches rather than individually for every attribute. Previously, a 50,000-attribute batch could potentially trigger a huge number of database queries. The new implementation groups the work into chunked queries while preserving the existing sightings policies and ACL behaviour. In the benchmark used during development, the sighting attachment step went from: 8.109 seconds / 10,661 queries to: 0.149 seconds / 6 queries for a 5,000-attribute test case — more than a 50× reduction for that part of the processing path. This should particularly benefit large instances and high-volume export or REST API workloads. Major updates to MISP galaxies, warning lists and knowledge bases MISP 2.5.46 is also accompanied

First reported Sep 11, 2026 07:28 UTCCatalog metadata updated Oct 16, 2026 10:48 UTCOpen evidence record
REPORT1 SOURCE

MISP 2.5.50 Released - Security hardening, Overmind improvements, and streamlined workflows

MISP 2.5.50 — Security hardening, Overmind improvements, and streamlined workflows Release date: 9 October 2026 MISP 2.5.50 brings a substantial set of security fixes, continued development of the Overmind user interface, and the consolidation of several legacy features into their modern replacements. The release also improves TAXII connectivity, object handling, event graphs, statistics, and day-to-day administration. Highlights Security hardening: Important access-control fixes, restrictions on sensitive server settings, and safer attachment download headers. Overmind improvements: A redesigned Server Settings interface, new workflow views, improved object and attribute handling, and numerous usability enhancements. Simplified data model: Legacy event discussions, templates, and signature allowedlists are migrated to analyst notes, event templates, and warninglists, respectively. Better integrations and data quality: A new phishing feed, fixes for TAXII connection management, and improved duplicate-attribute handling. New statistics: Object-relation usage reporting to help understand how MISP object templates are used in practice. Security improvements This release includes several security and privacy fixes. Upgrading is strongly recommended. Sensitive configuration settings are now CLI-only. The Redis host settings (MISP.redis_host, Plugin.ZeroMQ_redis_host, and SimpleBackgroundJobs.redis_host) can no longer be changed through the web interface or API. The download_attachments_on_load setting is also restricted. These changes reduce the risks associated with a compromised administrative session. Thanks to Logan Homolka and CERT.pl for reporting the relevant issues. Safer attachment downloads. Updates to the CakePHP dependency correctly escape quotes and backslashes and strip control characters from filenames in Content-Disposition headers. This prevents crafted filenames from manipulating download headers or causing unintended inline rendering. Thanks to Logan Homolka for the reports. Object search respects attribute visibility. Searches in the event view now consider only attributes that the user is authorised to see, avoiding information disclosure through organisation-only, sharing-group-restricted, or soft-deleted attributes. Event index access-control correction. An ACL-related information leak in the event index has been fixed. Thanks to Jeroen Pinoy for the report. Visibility-aware galaxy counts. Galaxy cluster views now count only tagged attributes visible to the current user. Modernisation and migration of legacy features Event discussions are replaced by analyst notes The legacy Thread and Post functionality has been removed in favour of analyst data notes. Existing discussions are migrated as follows: Posts attached to events become notes on those events. General discussions become notes attached to the originating organisation. Replies become notes attached to the note they answer. Author organisation, timestamps, and appropriate visibility information are preserved. The old discussion interfaces, related settings, notifications, workflow trigger, and ZMQ conversation topic have been removed. Records that cannot be migrated, and workflows using the removed trigger, are logged during migration. Legacy templates are replaced by event templates The older template system has been retired in favour of event templates. Organisation-authored legacy templates are converted to active event templates; the bundled legacy seed templates are superseded by the event template library. The migration logs definitions that cannot be saved or conflict with existing names. The perm_template permission remains in use for event templates. Behaviour change: Event templates create new events; the legacy ability to populate an existing event from a template is removed. Signature allowedlists are replaced by warninglists The legacy signature allowedlist is removed and its entries are migrated into an enabled custom regular-expre

First reported Oct 10, 2026 15:32 UTCCatalog metadata updated Oct 16, 2026 10:48 UTCOpen evidence record
REPORT1 SOURCE

MISP 2.5.48 - AImageddon security roundup release

This is a security release. It closes a large batch of findings from the autumn 2026 review round, and every instance should be updated. Alongside the security work it brings a new XLSX export, tag removal from misp-module results, and a set of sync, ACL and correlation bug fixes. Security 2.5.48 fixes 20 vulnerabilities, plus 6 further hardening changes made during the same review. They cover stored and reflected cross-site scripting, mass-assignment and record-targeting flaws, event and object access-control gaps, multi-factor authentication token reuse, and the handling of data received from linked servers. Individual findings are not detailed here. They are published on the MISP security page as the advisories go out, and (G)CVE identifiers and severity scores are being processed by the GCVE team. Thanks to the reporters Our thanks go to everyone who reported to us in this round, for the quality of the reports and for their patience through a long coordinated-disclosure cycle: Jeroen Pinoy David André - elhoim (https://github.com/elhoim) Wenhao Wu Bastien Bossiroy of NCIA Célien Desteucq of NCIA Tanguy Snoeck of NCIA Jan Verschueren of NCIA Several of the findings in this release were reported independently by more than one of them; joint credit is recorded in the individual advisories. New features XLSX export Events, attributes and sightings can now be exported directly as an Excel workbook, available wherever the CSV export is offered (the per-event download list, the mass export picker and restSearch). Values that Excel would interpret as a formula keep their exact content and are marked with the quotePrefix cell style, so nothing is evaluated on open and no characters are added to the data. For workflows that re-export the workbook back to CSV, escape_formulas_literal:1 switches to the literal apostrophe form instead. The XLSX entry is now listed above CSV in the export pickers, and the CSV entry is labelled as not being intended for Excel. Please for the love of Cthulhu, stop sending us reports about the CSV export being vulnerable to Excel formula inclusion. CSV != Excel, MISP shares IoCs which we don't want to mangle for the SIEM, detection tool, etc consumers for whom the CSV format is meant. We hope that with all the warnings in the UI now users will use the native xlsx format now for all ingestions into excel and similar tools. Tag removal from misp-module results Enrichment and import modules can now return a remove_tags list on a result row, and MISP will strip those tags from the attribute the row points at. When the attribute already exists in the event, the row changes its tags instead of creating a duplicate. Removed tags are reported in the resolution screen and in the EventShell enrichment output alongside the ones that were added. Bug fixes Sync: objects created without a description were rejected by every instance receiving them, silently dropping the object and all of its attributes. Sync: the local and non-exportable tag filter ran only once per event instead of once per event report, so all but one report lost their tags on the remote — and a withheld final report made the remote reject the whole event. Proposals: the proposal ACL accepted any attribute or object carrying one of the user's sharing groups regardless of its distribution, and gave the owner organisation no access to proposals on its own organisation-only attributes. Attributes: the permission check on attribute restore was inverted for perm_modify users. Correlations: the correlation distribution snapshot was not refreshed when an event edit changed its distribution or sharing group, so declassified or broadened events failed to re-surface their correlations. Events: deleting an event left event report tags, event graphs, proposal correlations, fuzzy ssdeep chunks and attachment scan results behind as orphans. Enrichment: a missing-argument error when enriching an object. CRUD: correlation_exclusions/add answered 403 with an

First reported Sep 29, 2026 08:17 UTCCatalog metadata updated Oct 16, 2026 10:48 UTCOpen evidence record
REPORT1 SOURCE

LotR Episode 9: The SOC Data Breakdown

In this conversation, we discuss the evolving landscape of security operations, focusing on the challenges and innovations in data management, particularly in relation to Security Information and Event Management (SIEM) systems, data lakes, and the role of data pipelines.

First reported Sep 09, 2025 13:45 UTCCatalog metadata updated Oct 16, 2026 10:46 UTCOpen evidence record

The public shared-host view reaches the newest 2,400 matching records. Narrow the filters or search an exact MD5, SHA-1, or SHA-256 value to reach a specific record.

A filename, label, or report mention alone does not establish maliciousness. Observation dates describe cited sources; collection dates describe this local metadata catalog. No malware samples are stored, fetched, or executed by these pages.