← Back to CVE Catalog/UVI-2026-11-00000094

UVI-2026-11-00000094

CVSS 9.1 (CRITICAL)

Published: 11/3/2026

OpenPhish Zero-Day Phishing Portal Digest (2026-11-04): 300 Active Portals

Affected Packagesbind9, dnsmasq, unbound

Supported Environmentsubuntu, debian, linux-mint, rocky, rhel, almalinux, oracle-linux, suse, alpine, arch, fedora, amazon-linux, kernel, gentoo, freebsd, openbsd, netbsd, macos, wolfi, nixos, void, photon, flatcar, talos, openwrt, openeuler, cloudlinux, kali, azure-linux, centos-stream, opensuse-leap, fedora-coreos, proxmox, truenas-scale, windows

Cryptographic ProvenanceSLSA Level 3 (Cosign OIDC Signed)

⚡ Autonomous Live Mitigation(Zero-Downtime • Sub-50ms Rollback)

Deploy this patch across production Linux or Windows Server fleets with pre-flight sentinels and instant rollback guarantee.

exultia.exe patch --vendor --os windows-server

Tier 1

Zero-Downtime Hot-Mitigation Script

No reboot or service downtime

Sinkhole 83 active phishing domains to 0.0.0.0 in /etc/hosts and local DNS resolver.

mkdir -p /etc/exultia/blocklists
printf "%b\n" "digitalinv.aeronationaviation.com\nmicrosoft09-one.vercel.app\nwww.microsoft09-one.vercel.app\nwww.nextwhatsapp.blogspot.com\nkerijansenlawgroupcom.weupdaa.workers.dev\nventira.life\nfacebook24-facebook.blogspot.com\nwww.roblovx.com.es\nwww.interbank.correctcertificate.com\nroblox.com.ss\napenasate-hoje2026.lat\nwww.facebookprofilelinks.blogspot.com\nmyfamilyprime-espace.com\nfqg.pap.temporary.site\nwww.xf.gdmaoka.com\nyrpkw7grzgo-msvlsi-5z4x8b-yrpks45c.pages.dev\nkxlrq08hwu-wptjn36fyn-3y1x8g-yr200c.pages.dev\nyrpkw866lkw-msvwur-5w4x9b-yrpks19p.pages.dev\nwptjn078mjw-kxlrqrel-9w6t2g-yr166a.pages.dev\n1annj1ab1aaa.pages.dev\nsouroabhdubey.github.io\ncustomer-sp-logandaviau1.pages.dev\nwww.ingresosclientesonline.nosgustan.com\nwww.netflixweb-clone.vercel.app\nwww.webbyhng.com\nwww.fqg.pap.temporary.site\nblopd-ingspeu78.duckdns.org\nindex2100-seven.vercel.app\nmbj651sk-dskrpds-9v6v0e-mbj61c.pages.dev\nkxlrq5iuqtw-wptjnnnx-3w2t9e-wp922a.pages.dev\nsp18ct10-zurlek-biz-vemali.pages.dev\nghscy332nh-pxvbmlpw-0p2k4e-ghs29c.pages.dev\nkxlrq8i37pl-fghzdyhy-3x2u8g-wp256a.pages.dev\nsp3ct10-dorvilo-biz-kemzaro.pages.dev\ns4w.in\nshared.washyoakville.com\nwww.roblox.com.et\ncerroseiep.click\nwww.roblox.com.ml\nwww.blockincgic.top\nbepxt.online\nbinancecheck.com\nbepxt.com\nbinancecheck.online\nwebsite-d8644cc4.svf.kaf.mybluehost.me\nbinanceverify.live\nbepnet.in\nbnbet.online\nbnbvf.org\nbepxt.in" > /etc/exultia/blocklists/openphish-2026-11-04.domains
printf "%b\n" "address=/digitalinv.aeronationaviation.com/0.0.0.0\naddress=/microsoft09-one.vercel.app/0.0.0.0\naddress=/www.microsoft09-one.vercel.app/0.0.0.0\naddress=/www.nextwhatsapp.blogspot.com/0.0.0.0\naddress=/kerijansenlawgroupcom.weupdaa.workers.dev/0.0.0.0\naddress=/ventira.life/0.0.0.0\naddress=/facebook24-facebook.blogspot.com/0.0.0.0\naddress=/www.roblovx.com.es/0.0.0.0\naddress=/www.interbank.correctcertificate.com/0.0.0.0\naddress=/roblox.com.ss/0.0.0.0\naddress=/apenasate-hoje2026.lat/0.0.0.0\naddress=/www.facebookprofilelinks.blogspot.com/0.0.0.0\naddress=/myfamilyprime-espace.com/0.0.0.0\naddress=/fqg.pap.temporary.site/0.0.0.0\naddress=/www.xf.gdmaoka.com/0.0.0.0\naddress=/yrpkw7grzgo-msvlsi-5z4x8b-yrpks45c.pages.dev/0.0.0.0\naddress=/kxlrq08hwu-wptjn36fyn-3y1x8g-yr200c.pages.dev/0.0.0.0\naddress=/yrpkw866lkw-msvwur-5w4x9b-yrpks19p.pages.dev/0.0.0.0\naddress=/wptjn078mjw-kxlrqrel-9w6t2g-yr166a.pages.dev/0.0.0.0\naddress=/1annj1ab1aaa.pages.dev/0.0.0.0\naddress=/souroabhdubey.github.io/0.0.0.0\naddress=/customer-sp-logandaviau1.pages.dev/0.0.0.0\naddress=/www.ingresosclientesonline.nosgustan.com/0.0.0.0\naddress=/www.netflixweb-clone.vercel.app/0.0.0.0\naddress=/www.webbyhng.com/0.0.0.0\naddress=/www.fqg.pap.temporary.site/0.0.0.0\naddress=/blopd-ingspeu78.duckdns.org/0.0.0.0\naddress=/index2100-seven.vercel.app/0.0.0.0\naddress=/mbj651sk-dskrpds-9v6v0e-mbj61c.pages.dev/0.0.0.0\naddress=/kxlrq5iuqtw-wptjnnnx-3w2t9e-wp922a.pages.dev/0.0.0.0\naddress=/sp18ct10-zurlek-biz-vemali.pages.dev/0.0.0.0\naddress=/ghscy332nh-pxvbmlpw-0p2k4e-ghs29c.pages.dev/0.0.0.0\naddress=/kxlrq8i37pl-fghzdyhy-3x2u8g-wp256a.pages.dev/0.0.0.0\naddress=/sp3ct10-dorvilo-biz-kemzaro.pages.dev/0.0.0.0\naddress=/s4w.in/0.0.0.0\naddress=/shared.washyoakville.com/0.0.0.0\naddress=/www.roblox.com.et/0.0.0.0\naddress=/cerroseiep.click/0.0.0.0\naddress=/www.roblox.com.ml/0.0.0.0\naddress=/www.blockincgic.top/0.0.0.0\naddress=/bepxt.online/0.0.0.0\naddress=/binancecheck.com/0.0.0.0\naddress=/bepxt.com/0.0.0.0\naddress=/binancecheck.online/0.0.0.0\naddress=/website-d8644cc4.svf.kaf.mybluehost.me/0.0.0.0\naddress=/binanceverify.live/0.0.0.0\naddress=/bepnet.in/0.0.0.0\naddress=/bnbet.online/0.0.0.0\naddress=/bnbvf.org/0.0.0.0\naddress=/bepxt.in/0.0.0.0" > /etc/exultia/blocklists/dns-sinkhole-2026-11-04.conf
touch /etc/hosts && sed -i '/# BEGIN EXULTIA-OPENPHISH-2026-11-04/,/# END EXULTIA-OPENPHISH-2026-11-04/d' /etc/hosts 2>/dev/null || true
printf "# BEGIN EXULTIA-OPENPHISH-2026-11-04\n0.0.0.0 digitalinv.aeronationaviation.com\n0.0.0.0 microsoft09-one.vercel.app\n0.0.0.0 www.microsoft09-one.vercel.app\n0.0.0.0 www.nextwhatsapp.blogspot.com\n0.0.0.0 kerijansenlawgroupcom.weupdaa.workers.dev\n0.0.0.0 ventira.life\n0.0.0.0 facebook24-facebook.blogspot.com\n0.0.0.0 www.roblovx.com.es\n0.0.0.0 www.interbank.correctcertificate.com\n0.0.0.0 roblox.com.ss\n0.0.0.0 apenasate-hoje2026.lat\n0.0.0.0 www.facebookprofilelinks.blogspot.com\n0.0.0.0 myfamilyprime-espace.com\n0.0.0.0 fqg.pap.temporary.site\n0.0.0.0 www.xf.gdmaoka.com\n0.0.0.0 yrpkw7grzgo-msvlsi-5z4x8b-yrpks45c.pages.dev\n0.0.0.0 kxlrq08hwu-wptjn36fyn-3y1x8g-yr200c.pages.dev\n0.0.0.0 yrpkw866lkw-msvwur-5w4x9b-yrpks19p.pages.dev\n0.0.0.0 wptjn078mjw-kxlrqrel-9w6t2g-yr166a.pages.dev\n0.0.0.0 1annj1ab1aaa.pages.dev\n0.0.0.0 souroabhdubey.github.io\n0.0.0.0 customer-sp-logandaviau1.pages.dev\n0.0.0.0 www.ingresosclientesonline.nosgustan.com\n0.0.0.0 www.netflixweb-clone.vercel.app\n0.0.0.0 www.webbyhng.com\n0.0.0.0 www.fqg.pap.temporary.site\n0.0.0.0 blopd-ingspeu78.duckdns.org\n0.0.0.0 index2100-seven.vercel.app\n0.0.0.0 mbj651sk-dskrpds-9v6v0e-mbj61c.pages.dev\n0.0.0.0 kxlrq5iuqtw-wptjnnnx-3w2t9e-wp922a.pages.dev\n0.0.0.0 sp18ct10-zurlek-biz-vemali.pages.dev\n0.0.0.0 ghscy332nh-pxvbmlpw-0p2k4e-ghs29c.pages.dev\n0.0.0.0 kxlrq8i37pl-fghzdyhy-3x2u8g-wp256a.pages.dev\n0.0.0.0 sp3ct10-dorvilo-biz-kemzaro.pages.dev\n0.0.0.0 s4w.in\n0.0.0.0 shared.washyoakville.com\n0.0.0.0 www.roblox.com.et\n0.0.0.0 cerroseiep.click\n0.0.0.0 www.roblox.com.ml\n0.0.0.0 www.blockincgic.top\n0.0.0.0 bepxt.online\n0.0.0.0 binancecheck.com\n0.0.0.0 bepxt.com\n0.0.0.0 binancecheck.online\n0.0.0.0 website-d8644cc4.svf.kaf.mybluehost.me\n0.0.0.0 binanceverify.live\n0.0.0.0 bepnet.in\n0.0.0.0 bnbet.online\n0.0.0.0 bnbvf.org\n0.0.0.0 bepxt.in\n# END EXULTIA-OPENPHISH-2026-11-04\n" >> /etc/hosts

🔍 Verification Sentinel Probe:

test -s /etc/exultia/blocklists/openphish-2026-11-04.domains && grep -q "BEGIN EXULTIA-OPENPHISH-2026-11-04" /etc/hosts && grep -q "^0.0.0.0 " /etc/hosts

⏪ Sub-50ms Deterministic Rollback:

sed -i '/# BEGIN EXULTIA-OPENPHISH-2026-11-04/,/# END EXULTIA-OPENPHISH-2026-11-04/d' /etc/hosts 2>/dev/null || true; rm -f /etc/exultia/blocklists/openphish-2026-11-04.domains /etc/exultia/blocklists/dns-sinkhole-2026-11-04.conf

Tier 3

Serialized 10% Canary Ansible Playbook

Fleet configuration management

Hardened Ansible playbook with staged canary progression (serial: 10%), configuration validation, and handler reload.

---
- name: Exultia Validated Fix - UVI-2026-11-00000094 (DNS Resolver & Host Sinkhole (/etc/hosts / dnsmasq))
  hosts: all
  become: yes
  serial: "10%"
  tasks:
    - name: Apply Validated Fix (EXPR-PERIMETER-DNS-SINKHOLE)
      ansible.builtin.shell: |
        mkdir -p /etc/exultia/blocklists
        printf "%b\n" "digitalinv.aeronationaviation.com\nmicrosoft09-one.vercel.app\nwww.microsoft09-one.vercel.app\nwww.nextwhatsapp.blogspot.com\nkerijansenlawgroupcom.weupdaa.workers.dev\nventira.life\nfacebook24-facebook.blogspot.com\nwww.roblovx.com.es\nwww.interbank.correctcertificate.com\nroblox.com.ss\napenasate-hoje2026.lat\nwww.facebookprofilelinks.blogspot.com\nmyfamilyprime-espace.com\nfqg.pap.temporary.site\nwww.xf.gdmaoka.com\nyrpkw7grzgo-msvlsi-5z4x8b-yrpks45c.pages.dev\nkxlrq08hwu-wptjn36fyn-3y1x8g-yr200c.pages.dev\nyrpkw866lkw-msvwur-5w4x9b-yrpks19p.pages.dev\nwptjn078mjw-kxlrqrel-9w6t2g-yr166a.pages.dev\n1annj1ab1aaa.pages.dev\nsouroabhdubey.github.io\ncustomer-sp-logandaviau1.pages.dev\nwww.ingresosclientesonline.nosgustan.com\nwww.netflixweb-clone.vercel.app\nwww.webbyhng.com\nwww.fqg.pap.temporary.site\nblopd-ingspeu78.duckdns.org\nindex2100-seven.vercel.app\nmbj651sk-dskrpds-9v6v0e-mbj61c.pages.dev\nkxlrq5iuqtw-wptjnnnx-3w2t9e-wp922a.pages.dev\nsp18ct10-zurlek-biz-vemali.pages.dev\nghscy332nh-pxvbmlpw-0p2k4e-ghs29c.pages.dev\nkxlrq8i37pl-fghzdyhy-3x2u8g-wp256a.pages.dev\nsp3ct10-dorvilo-biz-kemzaro.pages.dev\ns4w.in\nshared.washyoakville.com\nwww.roblox.com.et\ncerroseiep.click\nwww.roblox.com.ml\nwww.blockincgic.top\nbepxt.online\nbinancecheck.com\nbepxt.com\nbinancecheck.online\nwebsite-d8644cc4.svf.kaf.mybluehost.me\nbinanceverify.live\nbepnet.in\nbnbet.online\nbnbvf.org\nbepxt.in" > /etc/exultia/blocklists/openphish-2026-11-04.domains
        printf "%b\n" "address=/digitalinv.aeronationaviation.com/0.0.0.0\naddress=/microsoft09-one.vercel.app/0.0.0.0\naddress=/www.microsoft09-one.vercel.app/0.0.0.0\naddress=/www.nextwhatsapp.blogspot.com/0.0.0.0\naddress=/kerijansenlawgroupcom.weupdaa.workers.dev/0.0.0.0\naddress=/ventira.life/0.0.0.0\naddress=/facebook24-facebook.blogspot.com/0.0.0.0\naddress=/www.roblovx.com.es/0.0.0.0\naddress=/www.interbank.correctcertificate.com/0.0.0.0\naddress=/roblox.com.ss/0.0.0.0\naddress=/apenasate-hoje2026.lat/0.0.0.0\naddress=/www.facebookprofilelinks.blogspot.com/0.0.0.0\naddress=/myfamilyprime-espace.com/0.0.0.0\naddress=/fqg.pap.temporary.site/0.0.0.0\naddress=/www.xf.gdmaoka.com/0.0.0.0\naddress=/yrpkw7grzgo-msvlsi-5z4x8b-yrpks45c.pages.dev/0.0.0.0\naddress=/kxlrq08hwu-wptjn36fyn-3y1x8g-yr200c.pages.dev/0.0.0.0\naddress=/yrpkw866lkw-msvwur-5w4x9b-yrpks19p.pages.dev/0.0.0.0\naddress=/wptjn078mjw-kxlrqrel-9w6t2g-yr166a.pages.dev/0.0.0.0\naddress=/1annj1ab1aaa.pages.dev/0.0.0.0\naddress=/souroabhdubey.github.io/0.0.0.0\naddress=/customer-sp-logandaviau1.pages.dev/0.0.0.0\naddress=/www.ingresosclientesonline.nosgustan.com/0.0.0.0\naddress=/www.netflixweb-clone.vercel.app/0.0.0.0\naddress=/www.webbyhng.com/0.0.0.0\naddress=/www.fqg.pap.temporary.site/0.0.0.0\naddress=/blopd-ingspeu78.duckdns.org/0.0.0.0\naddress=/index2100-seven.vercel.app/0.0.0.0\naddress=/mbj651sk-dskrpds-9v6v0e-mbj61c.pages.dev/0.0.0.0\naddress=/kxlrq5iuqtw-wptjnnnx-3w2t9e-wp922a.pages.dev/0.0.0.0\naddress=/sp18ct10-zurlek-biz-vemali.pages.dev/0.0.0.0\naddress=/ghscy332nh-pxvbmlpw-0p2k4e-ghs29c.pages.dev/0.0.0.0\naddress=/kxlrq8i37pl-fghzdyhy-3x2u8g-wp256a.pages.dev/0.0.0.0\naddress=/sp3ct10-dorvilo-biz-kemzaro.pages.dev/0.0.0.0\naddress=/s4w.in/0.0.0.0\naddress=/shared.washyoakville.com/0.0.0.0\naddress=/www.roblox.com.et/0.0.0.0\naddress=/cerroseiep.click/0.0.0.0\naddress=/www.roblox.com.ml/0.0.0.0\naddress=/www.blockincgic.top/0.0.0.0\naddress=/bepxt.online/0.0.0.0\naddress=/binancecheck.com/0.0.0.0\naddress=/bepxt.com/0.0.0.0\naddress=/binancecheck.online/0.0.0.0\naddress=/website-d8644cc4.svf.kaf.mybluehost.me/0.0.0.0\naddress=/binanceverify.live/0.0.0.0\naddress=/bepnet.in/0.0.0.0\naddress=/bnbet.online/0.0.0.0\naddress=/bnbvf.org/0.0.0.0\naddress=/bepxt.in/0.0.0.0" > /etc/exultia/blocklists/dns-sinkhole-2026-11-04.conf
        touch /etc/hosts && sed -i '/# BEGIN EXULTIA-OPENPHISH-2026-11-04/,/# END EXULTIA-OPENPHISH-2026-11-04/d' /etc/hosts 2>/dev/null || true
        printf "# BEGIN EXULTIA-OPENPHISH-2026-11-04\n0.0.0.0 digitalinv.aeronationaviation.com\n0.0.0.0 microsoft09-one.vercel.app\n0.0.0.0 www.microsoft09-one.vercel.app\n0.0.0.0 www.nextwhatsapp.blogspot.com\n0.0.0.0 kerijansenlawgroupcom.weupdaa.workers.dev\n0.0.0.0 ventira.life\n0.0.0.0 facebook24-facebook.blogspot.com\n0.0.0.0 www.roblovx.com.es\n0.0.0.0 www.interbank.correctcertificate.com\n0.0.0.0 roblox.com.ss\n0.0.0.0 apenasate-hoje2026.lat\n0.0.0.0 www.facebookprofilelinks.blogspot.com\n0.0.0.0 myfamilyprime-espace.com\n0.0.0.0 fqg.pap.temporary.site\n0.0.0.0 www.xf.gdmaoka.com\n0.0.0.0 yrpkw7grzgo-msvlsi-5z4x8b-yrpks45c.pages.dev\n0.0.0.0 kxlrq08hwu-wptjn36fyn-3y1x8g-yr200c.pages.dev\n0.0.0.0 yrpkw866lkw-msvwur-5w4x9b-yrpks19p.pages.dev\n0.0.0.0 wptjn078mjw-kxlrqrel-9w6t2g-yr166a.pages.dev\n0.0.0.0 1annj1ab1aaa.pages.dev\n0.0.0.0 souroabhdubey.github.io\n0.0.0.0 customer-sp-logandaviau1.pages.dev\n0.0.0.0 www.ingresosclientesonline.nosgustan.com\n0.0.0.0 www.netflixweb-clone.vercel.app\n0.0.0.0 www.webbyhng.com\n0.0.0.0 www.fqg.pap.temporary.site\n0.0.0.0 blopd-ingspeu78.duckdns.org\n0.0.0.0 index2100-seven.vercel.app\n0.0.0.0 mbj651sk-dskrpds-9v6v0e-mbj61c.pages.dev\n0.0.0.0 kxlrq5iuqtw-wptjnnnx-3w2t9e-wp922a.pages.dev\n0.0.0.0 sp18ct10-zurlek-biz-vemali.pages.dev\n0.0.0.0 ghscy332nh-pxvbmlpw-0p2k4e-ghs29c.pages.dev\n0.0.0.0 kxlrq8i37pl-fghzdyhy-3x2u8g-wp256a.pages.dev\n0.0.0.0 sp3ct10-dorvilo-biz-kemzaro.pages.dev\n0.0.0.0 s4w.in\n0.0.0.0 shared.washyoakville.com\n0.0.0.0 www.roblox.com.et\n0.0.0.0 cerroseiep.click\n0.0.0.0 www.roblox.com.ml\n0.0.0.0 www.blockincgic.top\n0.0.0.0 bepxt.online\n0.0.0.0 binancecheck.com\n0.0.0.0 bepxt.com\n0.0.0.0 binancecheck.online\n0.0.0.0 website-d8644cc4.svf.kaf.mybluehost.me\n0.0.0.0 binanceverify.live\n0.0.0.0 bepnet.in\n0.0.0.0 bnbet.online\n0.0.0.0 bnbvf.org\n0.0.0.0 bepxt.in\n# END EXULTIA-OPENPHISH-2026-11-04\n" >> /etc/hosts
      args:
        executable: /bin/sh
      register: kinetic_exec
      failed_when: kinetic_exec.rc != 0

    - name: Verify Post-Fix Gate
      ansible.builtin.shell: "test -s /etc/exultia/blocklists/openphish-2026-11-04.domains && grep -q "BEGIN EXULTIA-OPENPHISH-2026-11-04" /etc/hosts && grep -q "^0.0.0.0 " /etc/hosts"
      changed_when: false

Tier 2

Vendor OS Package Upgrade Commands

Native package manager reconciliation

ubuntu

DEBIAN_FRONTEND=noninteractive apt-get update -qq && DEBIAN_FRONTEND=noninteractive apt-get install --only-upgrade -y bind9 dnsmasq unbound

debian

DEBIAN_FRONTEND=noninteractive apt-get update -qq && DEBIAN_FRONTEND=noninteractive apt-get install --only-upgrade -y bind9 dnsmasq unbound

kali

DEBIAN_FRONTEND=noninteractive apt-get update -qq && DEBIAN_FRONTEND=noninteractive apt-get install --only-upgrade -y bind9 dnsmasq unbound

linux-mint

DEBIAN_FRONTEND=noninteractive apt-get update -qq && DEBIAN_FRONTEND=noninteractive apt-get install --only-upgrade -y bind9 dnsmasq unbound

proxmox

DEBIAN_FRONTEND=noninteractive apt-get update -qq && DEBIAN_FRONTEND=noninteractive apt-get install --only-upgrade -y bind9 dnsmasq unbound

truenas-scale

DEBIAN_FRONTEND=noninteractive apt-get update -qq && DEBIAN_FRONTEND=noninteractive apt-get install --only-upgrade -y bind9 dnsmasq unbound

rockydnf upgrade -y bind dnsmasq unbound

rheldnf upgrade -y bind dnsmasq unbound

almalinuxdnf upgrade -y bind dnsmasq unbound

oracle-linuxdnf upgrade -y bind dnsmasq unbound

cloudlinuxdnf upgrade -y bind dnsmasq unbound

amazon-linuxdnf upgrade -y bind dnsmasq unbound

fedoradnf upgrade -y bind dnsmasq unbound

openeulerdnf upgrade -y bind dnsmasq unbound

centos-streamdnf upgrade -y bind dnsmasq unbound

azure-linuxtdnf update -y bind dnsmasq unbound

photontdnf update -y bind dnsmasq unbound

alpineapk update -q && apk upgrade --no-cache bind dnsmasq unbound

wolfiapk update -q && apk upgrade --no-cache bind dnsmasq unbound

susezypper --non-interactive update bind dnsmasq unbound

opensuse-leapzypper --non-interactive update bind dnsmasq unbound

archpacman -S --noconfirm bind9

gentooemerge --update --oneshot bind9

voidxbps-install -Su -y bind9

nixosnix-env -u bind9

openwrtopkg update && opkg upgrade bind9

freebsdpkg upgrade -y bind9

openbsdsyspatch

netbsdpkgin -y upgrade

fedora-coreosrpm-ostree upgrade

flatcarupdate_engine_client -check_for_update

talostalosctl upgrade-k8s

macossoftwareupdate -i -a

Full Standalone Hotfix Script

Complete, self-contained remediation script with privileges check, logging, pre-flight safety, and automatic rollback on verification failure:

#!/bin/sh
# ==============================================================================
# Exultia Surgical Remediation: UVI-2026-11-00000094
# Title: OpenPhish Zero-Day Phishing Portal Digest (2026-11-04): 300 Active Portals
# CVSS Score: 9.1 (CRITICAL) | CISA KEV: NO
# Provenance: [email protected] (Cosign OIDC Keyless) | SLSA Level 3
# Generated by Exultia Autonomous Remediation Engine (https://exultia.tech/cve/UVI-2026-11-00000094)
# ==============================================================================
set -e

log() { echo "[Exultia] $(date +'%Y-%m-%d %H:%M:%S') $1"; }
err() { echo "[Exultia] ERROR: $1" >&2; exit 1; }

if [ "$(id -u)" -ne 0 ]; then
  err "Root privileges required. Run with sudo or as root."
fi

log "Initiating zero-downtime hot-mitigation for UVI-2026-11-00000094..."

# Apply mitigation commands
log "Executing: mkdir -p /etc/exultia/blocklists"
mkdir -p /etc/exultia/blocklists
log "Executing: printf \"%b\n\" \"digitalinv.aeronationaviation.com\nmicrosoft09-one.vercel.app\nwww.microsoft09-one.vercel.app\nwww.nextwhatsapp.blogspot.com\nkerijansenlawgroupcom.weupdaa.workers.dev\nventira.life\nfacebook24-facebook.blogspot.com\nwww.roblovx.com.es\nwww.interbank.correctcertificate.com\nroblox.com.ss\napenasate-hoje2026.lat\nwww.facebookprofilelinks.blogspot.com\nmyfamilyprime-espace.com\nfqg.pap.temporary.site\nwww.xf.gdmaoka.com\nyrpkw7grzgo-msvlsi-5z4x8b-yrpks45c.pages.dev\nkxlrq08hwu-wptjn36fyn-3y1x8g-yr200c.pages.dev\nyrpkw866lkw-msvwur-5w4x9b-yrpks19p.pages.dev\nwptjn078mjw-kxlrqrel-9w6t2g-yr166a.pages.dev\n1annj1ab1aaa.pages.dev\nsouroabhdubey.github.io\ncustomer-sp-logandaviau1.pages.dev\nwww.ingresosclientesonline.nosgustan.com\nwww.netflixweb-clone.vercel.app\nwww.webbyhng.com\nwww.fqg.pap.temporary.site\nblopd-ingspeu78.duckdns.org\nindex2100-seven.vercel.app\nmbj651sk-dskrpds-9v6v0e-mbj61c.pages.dev\nkxlrq5iuqtw-wptjnnnx-3w2t9e-wp922a.pages.dev\nsp18ct10-zurlek-biz-vemali.pages.dev\nghscy332nh-pxvbmlpw-0p2k4e-ghs29c.pages.dev\nkxlrq8i37pl-fghzdyhy-3x2u8g-wp256a.pages.dev\nsp3ct10-dorvilo-biz-kemzaro.pages.dev\ns4w.in\nshared.washyoakville.com\nwww.roblox.com.et\ncerroseiep.click\nwww.roblox.com.ml\nwww.blockincgic.top\nbepxt.online\nbinancecheck.com\nbepxt.com\nbinancecheck.online\nwebsite-d8644cc4.svf.kaf.mybluehost.me\nbinanceverify.live\nbepnet.in\nbnbet.online\nbnbvf.org\nbepxt.in\" > /etc/exultia/blocklists/openphish-2026-11-04.domains"
printf "%b\n" "digitalinv.aeronationaviation.com\nmicrosoft09-one.vercel.app\nwww.microsoft09-one.vercel.app\nwww.nextwhatsapp.blogspot.com\nkerijansenlawgroupcom.weupdaa.workers.dev\nventira.life\nfacebook24-facebook.blogspot.com\nwww.roblovx.com.es\nwww.interbank.correctcertificate.com\nroblox.com.ss\napenasate-hoje2026.lat\nwww.facebookprofilelinks.blogspot.com\nmyfamilyprime-espace.com\nfqg.pap.temporary.site\nwww.xf.gdmaoka.com\nyrpkw7grzgo-msvlsi-5z4x8b-yrpks45c.pages.dev\nkxlrq08hwu-wptjn36fyn-3y1x8g-yr200c.pages.dev\nyrpkw866lkw-msvwur-5w4x9b-yrpks19p.pages.dev\nwptjn078mjw-kxlrqrel-9w6t2g-yr166a.pages.dev\n1annj1ab1aaa.pages.dev\nsouroabhdubey.github.io\ncustomer-sp-logandaviau1.pages.dev\nwww.ingresosclientesonline.nosgustan.com\nwww.netflixweb-clone.vercel.app\nwww.webbyhng.com\nwww.fqg.pap.temporary.site\nblopd-ingspeu78.duckdns.org\nindex2100-seven.vercel.app\nmbj651sk-dskrpds-9v6v0e-mbj61c.pages.dev\nkxlrq5iuqtw-wptjnnnx-3w2t9e-wp922a.pages.dev\nsp18ct10-zurlek-biz-vemali.pages.dev\nghscy332nh-pxvbmlpw-0p2k4e-ghs29c.pages.dev\nkxlrq8i37pl-fghzdyhy-3x2u8g-wp256a.pages.dev\nsp3ct10-dorvilo-biz-kemzaro.pages.dev\ns4w.in\nshared.washyoakville.com\nwww.roblox.com.et\ncerroseiep.click\nwww.roblox.com.ml\nwww.blockincgic.top\nbepxt.online\nbinancecheck.com\nbepxt.com\nbinancecheck.online\nwebsite-d8644cc4.svf.kaf.mybluehost.me\nbinanceverify.live\nbepnet.in\nbnbet.online\nbnbvf.org\nbepxt.in" > /etc/exultia/blocklists/openphish-2026-11-04.domains
log "Executing: printf \"%b\n\" \"address=/digitalinv.aeronationaviation.com/0.0.0.0\naddress=/microsoft09-one.vercel.app/0.0.0.0\naddress=/www.microsoft09-one.vercel.app/0.0.0.0\naddress=/www.nextwhatsapp.blogspot.com/0.0.0.0\naddress=/kerijansenlawgroupcom.weupdaa.workers.dev/0.0.0.0\naddress=/ventira.life/0.0.0.0\naddress=/facebook24-facebook.blogspot.com/0.0.0.0\naddress=/www.roblovx.com.es/0.0.0.0\naddress=/www.interbank.correctcertificate.com/0.0.0.0\naddress=/roblox.com.ss/0.0.0.0\naddress=/apenasate-hoje2026.lat/0.0.0.0\naddress=/www.facebookprofilelinks.blogspot.com/0.0.0.0\naddress=/myfamilyprime-espace.com/0.0.0.0\naddress=/fqg.pap.temporary.site/0.0.0.0\naddress=/www.xf.gdmaoka.com/0.0.0.0\naddress=/yrpkw7grzgo-msvlsi-5z4x8b-yrpks45c.pages.dev/0.0.0.0\naddress=/kxlrq08hwu-wptjn36fyn-3y1x8g-yr200c.pages.dev/0.0.0.0\naddress=/yrpkw866lkw-msvwur-5w4x9b-yrpks19p.pages.dev/0.0.0.0\naddress=/wptjn078mjw-kxlrqrel-9w6t2g-yr166a.pages.dev/0.0.0.0\naddress=/1annj1ab1aaa.pages.dev/0.0.0.0\naddress=/souroabhdubey.github.io/0.0.0.0\naddress=/customer-sp-logandaviau1.pages.dev/0.0.0.0\naddress=/www.ingresosclientesonline.nosgustan.com/0.0.0.0\naddress=/www.netflixweb-clone.vercel.app/0.0.0.0\naddress=/www.webbyhng.com/0.0.0.0\naddress=/www.fqg.pap.temporary.site/0.0.0.0\naddress=/blopd-ingspeu78.duckdns.org/0.0.0.0\naddress=/index2100-seven.vercel.app/0.0.0.0\naddress=/mbj651sk-dskrpds-9v6v0e-mbj61c.pages.dev/0.0.0.0\naddress=/kxlrq5iuqtw-wptjnnnx-3w2t9e-wp922a.pages.dev/0.0.0.0\naddress=/sp18ct10-zurlek-biz-vemali.pages.dev/0.0.0.0\naddress=/ghscy332nh-pxvbmlpw-0p2k4e-ghs29c.pages.dev/0.0.0.0\naddress=/kxlrq8i37pl-fghzdyhy-3x2u8g-wp256a.pages.dev/0.0.0.0\naddress=/sp3ct10-dorvilo-biz-kemzaro.pages.dev/0.0.0.0\naddress=/s4w.in/0.0.0.0\naddress=/shared.washyoakville.com/0.0.0.0\naddress=/www.roblox.com.et/0.0.0.0\naddress=/cerroseiep.click/0.0.0.0\naddress=/www.roblox.com.ml/0.0.0.0\naddress=/www.blockincgic.top/0.0.0.0\naddress=/bepxt.online/0.0.0.0\naddress=/binancecheck.com/0.0.0.0\naddress=/bepxt.com/0.0.0.0\naddress=/binancecheck.online/0.0.0.0\naddress=/website-d8644cc4.svf.kaf.mybluehost.me/0.0.0.0\naddress=/binanceverify.live/0.0.0.0\naddress=/bepnet.in/0.0.0.0\naddress=/bnbet.online/0.0.0.0\naddress=/bnbvf.org/0.0.0.0\naddress=/bepxt.in/0.0.0.0\" > /etc/exultia/blocklists/dns-sinkhole-2026-11-04.conf"
printf "%b\n" "address=/digitalinv.aeronationaviation.com/0.0.0.0\naddress=/microsoft09-one.vercel.app/0.0.0.0\naddress=/www.microsoft09-one.vercel.app/0.0.0.0\naddress=/www.nextwhatsapp.blogspot.com/0.0.0.0\naddress=/kerijansenlawgroupcom.weupdaa.workers.dev/0.0.0.0\naddress=/ventira.life/0.0.0.0\naddress=/facebook24-facebook.blogspot.com/0.0.0.0\naddress=/www.roblovx.com.es/0.0.0.0\naddress=/www.interbank.correctcertificate.com/0.0.0.0\naddress=/roblox.com.ss/0.0.0.0\naddress=/apenasate-hoje2026.lat/0.0.0.0\naddress=/www.facebookprofilelinks.blogspot.com/0.0.0.0\naddress=/myfamilyprime-espace.com/0.0.0.0\naddress=/fqg.pap.temporary.site/0.0.0.0\naddress=/www.xf.gdmaoka.com/0.0.0.0\naddress=/yrpkw7grzgo-msvlsi-5z4x8b-yrpks45c.pages.dev/0.0.0.0\naddress=/kxlrq08hwu-wptjn36fyn-3y1x8g-yr200c.pages.dev/0.0.0.0\naddress=/yrpkw866lkw-msvwur-5w4x9b-yrpks19p.pages.dev/0.0.0.0\naddress=/wptjn078mjw-kxlrqrel-9w6t2g-yr166a.pages.dev/0.0.0.0\naddress=/1annj1ab1aaa.pages.dev/0.0.0.0\naddress=/souroabhdubey.github.io/0.0.0.0\naddress=/customer-sp-logandaviau1.pages.dev/0.0.0.0\naddress=/www.ingresosclientesonline.nosgustan.com/0.0.0.0\naddress=/www.netflixweb-clone.vercel.app/0.0.0.0\naddress=/www.webbyhng.com/0.0.0.0\naddress=/www.fqg.pap.temporary.site/0.0.0.0\naddress=/blopd-ingspeu78.duckdns.org/0.0.0.0\naddress=/index2100-seven.vercel.app/0.0.0.0\naddress=/mbj651sk-dskrpds-9v6v0e-mbj61c.pages.dev/0.0.0.0\naddress=/kxlrq5iuqtw-wptjnnnx-3w2t9e-wp922a.pages.dev/0.0.0.0\naddress=/sp18ct10-zurlek-biz-vemali.pages.dev/0.0.0.0\naddress=/ghscy332nh-pxvbmlpw-0p2k4e-ghs29c.pages.dev/0.0.0.0\naddress=/kxlrq8i37pl-fghzdyhy-3x2u8g-wp256a.pages.dev/0.0.0.0\naddress=/sp3ct10-dorvilo-biz-kemzaro.pages.dev/0.0.0.0\naddress=/s4w.in/0.0.0.0\naddress=/shared.washyoakville.com/0.0.0.0\naddress=/www.roblox.com.et/0.0.0.0\naddress=/cerroseiep.click/0.0.0.0\naddress=/www.roblox.com.ml/0.0.0.0\naddress=/www.blockincgic.top/0.0.0.0\naddress=/bepxt.online/0.0.0.0\naddress=/binancecheck.com/0.0.0.0\naddress=/bepxt.com/0.0.0.0\naddress=/binancecheck.online/0.0.0.0\naddress=/website-d8644cc4.svf.kaf.mybluehost.me/0.0.0.0\naddress=/binanceverify.live/0.0.0.0\naddress=/bepnet.in/0.0.0.0\naddress=/bnbet.online/0.0.0.0\naddress=/bnbvf.org/0.0.0.0\naddress=/bepxt.in/0.0.0.0" > /etc/exultia/blocklists/dns-sinkhole-2026-11-04.conf
log "Executing: touch /etc/hosts && sed -i '/# BEGIN EXULTIA-OPENPHISH-2026-11-04/,/# END EXULTIA-OPENPHISH-2026-11-04/d' /etc/hosts 2>/dev/null || true"
touch /etc/hosts && sed -i '/# BEGIN EXULTIA-OPENPHISH-2026-11-04/,/# END EXULTIA-OPENPHISH-2026-11-04/d' /etc/hosts 2>/dev/null || true
log "Executing: printf \"# BEGIN EXULTIA-OPENPHISH-2026-11-04\n0.0.0.0 digitalinv.aeronationaviation.com\n0.0.0.0 microsoft09-one.vercel.app\n0.0.0.0 www.microsoft09-one.vercel.app\n0.0.0.0 www.nextwhatsapp.blogspot.com\n0.0.0.0 kerijansenlawgroupcom.weupdaa.workers.dev\n0.0.0.0 ventira.life\n0.0.0.0 facebook24-facebook.blogspot.com\n0.0.0.0 www.roblovx.com.es\n0.0.0.0 www.interbank.correctcertificate.com\n0.0.0.0 roblox.com.ss\n0.0.0.0 apenasate-hoje2026.lat\n0.0.0.0 www.facebookprofilelinks.blogspot.com\n0.0.0.0 myfamilyprime-espace.com\n0.0.0.0 fqg.pap.temporary.site\n0.0.0.0 www.xf.gdmaoka.com\n0.0.0.0 yrpkw7grzgo-msvlsi-5z4x8b-yrpks45c.pages.dev\n0.0.0.0 kxlrq08hwu-wptjn36fyn-3y1x8g-yr200c.pages.dev\n0.0.0.0 yrpkw866lkw-msvwur-5w4x9b-yrpks19p.pages.dev\n0.0.0.0 wptjn078mjw-kxlrqrel-9w6t2g-yr166a.pages.dev\n0.0.0.0 1annj1ab1aaa.pages.dev\n0.0.0.0 souroabhdubey.github.io\n0.0.0.0 customer-sp-logandaviau1.pages.dev\n0.0.0.0 www.ingresosclientesonline.nosgustan.com\n0.0.0.0 www.netflixweb-clone.vercel.app\n0.0.0.0 www.webbyhng.com\n0.0.0.0 www.fqg.pap.temporary.site\n0.0.0.0 blopd-ingspeu78.duckdns.org\n0.0.0.0 index2100-seven.vercel.app\n0.0.0.0 mbj651sk-dskrpds-9v6v0e-mbj61c.pages.dev\n0.0.0.0 kxlrq5iuqtw-wptjnnnx-3w2t9e-wp922a.pages.dev\n0.0.0.0 sp18ct10-zurlek-biz-vemali.pages.dev\n0.0.0.0 ghscy332nh-pxvbmlpw-0p2k4e-ghs29c.pages.dev\n0.0.0.0 kxlrq8i37pl-fghzdyhy-3x2u8g-wp256a.pages.dev\n0.0.0.0 sp3ct10-dorvilo-biz-kemzaro.pages.dev\n0.0.0.0 s4w.in\n0.0.0.0 shared.washyoakville.com\n0.0.0.0 www.roblox.com.et\n0.0.0.0 cerroseiep.click\n0.0.0.0 www.roblox.com.ml\n0.0.0.0 www.blockincgic.top\n0.0.0.0 bepxt.online\n0.0.0.0 binancecheck.com\n0.0.0.0 bepxt.com\n0.0.0.0 binancecheck.online\n0.0.0.0 website-d8644cc4.svf.kaf.mybluehost.me\n0.0.0.0 binanceverify.live\n0.0.0.0 bepnet.in\n0.0.0.0 bnbet.online\n0.0.0.0 bnbvf.org\n0.0.0.0 bepxt.in\n# END EXULTIA-OPENPHISH-2026-11-04\n\" >> /etc/hosts"
printf "# BEGIN EXULTIA-OPENPHISH-2026-11-04\n0.0.0.0 digitalinv.aeronationaviation.com\n0.0.0.0 microsoft09-one.vercel.app\n0.0.0.0 www.microsoft09-one.vercel.app\n0.0.0.0 www.nextwhatsapp.blogspot.com\n0.0.0.0 kerijansenlawgroupcom.weupdaa.workers.dev\n0.0.0.0 ventira.life\n0.0.0.0 facebook24-facebook.blogspot.com\n0.0.0.0 www.roblovx.com.es\n0.0.0.0 www.interbank.correctcertificate.com\n0.0.0.0 roblox.com.ss\n0.0.0.0 apenasate-hoje2026.lat\n0.0.0.0 www.facebookprofilelinks.blogspot.com\n0.0.0.0 myfamilyprime-espace.com\n0.0.0.0 fqg.pap.temporary.site\n0.0.0.0 www.xf.gdmaoka.com\n0.0.0.0 yrpkw7grzgo-msvlsi-5z4x8b-yrpks45c.pages.dev\n0.0.0.0 kxlrq08hwu-wptjn36fyn-3y1x8g-yr200c.pages.dev\n0.0.0.0 yrpkw866lkw-msvwur-5w4x9b-yrpks19p.pages.dev\n0.0.0.0 wptjn078mjw-kxlrqrel-9w6t2g-yr166a.pages.dev\n0.0.0.0 1annj1ab1aaa.pages.dev\n0.0.0.0 souroabhdubey.github.io\n0.0.0.0 customer-sp-logandaviau1.pages.dev\n0.0.0.0 www.ingresosclientesonline.nosgustan.com\n0.0.0.0 www.netflixweb-clone.vercel.app\n0.0.0.0 www.webbyhng.com\n0.0.0.0 www.fqg.pap.temporary.site\n0.0.0.0 blopd-ingspeu78.duckdns.org\n0.0.0.0 index2100-seven.vercel.app\n0.0.0.0 mbj651sk-dskrpds-9v6v0e-mbj61c.pages.dev\n0.0.0.0 kxlrq5iuqtw-wptjnnnx-3w2t9e-wp922a.pages.dev\n0.0.0.0 sp18ct10-zurlek-biz-vemali.pages.dev\n0.0.0.0 ghscy332nh-pxvbmlpw-0p2k4e-ghs29c.pages.dev\n0.0.0.0 kxlrq8i37pl-fghzdyhy-3x2u8g-wp256a.pages.dev\n0.0.0.0 sp3ct10-dorvilo-biz-kemzaro.pages.dev\n0.0.0.0 s4w.in\n0.0.0.0 shared.washyoakville.com\n0.0.0.0 www.roblox.com.et\n0.0.0.0 cerroseiep.click\n0.0.0.0 www.roblox.com.ml\n0.0.0.0 www.blockincgic.top\n0.0.0.0 bepxt.online\n0.0.0.0 binancecheck.com\n0.0.0.0 bepxt.com\n0.0.0.0 binancecheck.online\n0.0.0.0 website-d8644cc4.svf.kaf.mybluehost.me\n0.0.0.0 binanceverify.live\n0.0.0.0 bepnet.in\n0.0.0.0 bnbet.online\n0.0.0.0 bnbvf.org\n0.0.0.0 bepxt.in\n# END EXULTIA-OPENPHISH-2026-11-04\n" >> /etc/hosts

# Execute verification sentinel probe
log "Executing verification sentinel probe..."
if test -s /etc/exultia/blocklists/openphish-2026-11-04.domains && grep -q "BEGIN EXULTIA-OPENPHISH-2026-11-04" /etc/hosts && grep -q "^0.0.0.0 " /etc/hosts; then
  log "SUCCESS: Verification passed. UVI-2026-11-00000094 successfully mitigated."
else
  log "CRITICAL: Verification sentinel failed! Initiating emergency rollback..."
  sed -i '/# BEGIN EXULTIA-OPENPHISH-2026-11-04/,/# END EXULTIA-OPENPHISH-2026-11-04/d' /etc/hosts 2>/dev/null || true; rm -f /etc/exultia/blocklists/openphish-2026-11-04.domains /etc/exultia/blocklists/dns-sinkhole-2026-11-04.conf
  err "Rollback complete. System restored to baseline state."
fi