Morning Brief — 2026-07-21

2 material breach disclosures, 1 exploit probability movers, 10 emerging critical cves, 11 supply chain, 28 ransomware activity, 1134 ioc volume, 17 active malware families, 23 multi-source iocs, 4 intel feeds, 5 hand-authored sigma, and 17 detection gaps. Sections with no signal are still rendered with an explicit “none in this window” note so absence is visible alongside presence.

Material Breach Disclosures

River Financial Corp (RVRF)

• Filed: 2026-07-17 · CIK 0001641601 · Accession 0001193125-26-307288
• Filing: https://www.sec.gov/Archives/edgar/data/1641601/000119312526307288/ck0001641601-20260619.htm

As set forth in its Form 8-K filed July 10, 2026, two class action lawsuits were filed relating to the unauthorized threat actor gaining access to the network environment of River Financial Corporation, including River Bank & Trust (together, “River”). A third class action was filed against River on July 10, 2026 and a fourth class action was filed against River on July 16, 2026.

 

The principal…

River Financial Corp (RVRF)

• Filed: 2026-07-10 · CIK 0001641601 · Accession 0001193125-26-300763
• Filing: https://www.sec.gov/Archives/edgar/data/1641601/000119312526300763/ck0001641601-20260619.htm

Since the date of the original filing, River’s investigation has progressed. River has determined that an unauthorized threat actor accessed portions of its network and removed certain data from its environment. River is working to determine the nature and scope of the information involved, including whether any personally identifiable information was affected. To date, River is not aware of any r…

Federal Patching Priority

No new KEV additions in this window.

Exploit Probability Movers

Emerging Critical CVEs

• CVE-2026-46412 · CRITICAL (10.0) · 2026-07-20 — @beproduct/nestjs-auth is a NestJS authentication module for BeProduct IDS (Identity Server) with OpenID Connect support. Between 2026-05-11 20:19 UTC and 22:56 UTC, an attacker used a compromised npm publish token to pu…
• CVE-2026-54051 · CRITICAL (9.9) · 2026-07-20 — Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.9.1, the agent sandbox gates shell commands behind an allowlist (SandboxPolicy.isCommandAllowed), which THREAT_MODEL.md calls the main con…
• CVE-2026-51027 · CRITICAL (9.9) · 2026-07-20 — An issue in FileThingie v.2.5.7 allows a remote attacker to obtain sensitive information via the ft2.php component.
• CVE-2026-13439 · CRITICAL (9.8) · 2026-07-21 — The Easy Form Builder by WhiteStudio plugin for WordPress is vulnerable to Unauthenticated Privilege Escalation to Administrator in versions up to, and including, 4.0.11 This is due to the password recovery flow using th…
• CVE-2026-64625 · CRITICAL (9.8) · 2026-07-20 — AVideo before 29.0 contains an incomplete fix for CVE-2026-45578 where execAsync() re-wraps escaped commands in double-quoted sh -c, allowing command substitution via $() and backticks. Attackers can inject arbitrary OS…
• CVE-2026-63767 · CRITICAL (9.8) · 2026-07-20 — ktransformers through 0.6.3, fixed in commit def0f93, contains an unauthenticated pickle deserialization vulnerability that allows remote attackers to execute arbitrary commands by sending crafted pickle payloads to the…
• CVE-2026-63766 · CRITICAL (9.8) · 2026-07-20 — GPT-SoVITS through 20250606v2pro contains an OS command injection vulnerability in webui.py where ASR, slice, denoise, and uvr5 functions interpolate unsanitized Gradio textbox values directly into shell commands execute…
• CVE-2026-41252 · CRITICAL (9.8) · 2026-07-20 — xrdp is an open source RDP server. Versions 0.10.6 and prior contain a missing bounds check in xrdp, which allows a heap-based buffer overflow when operating in vnc-any mode. The issue occurs during the handling of RFB p…
• CVE-2026-35048 · CRITICAL (9.8) · 2026-07-20 — The Piwigo installer in versions 16.3.0 and earlier accepts POST parameters for database configuration and writes them directly into a PHP configuration file without proper sanitization. On PHP 8+, the addslashes() pro…
• CVE-2026-64620 · CRITICAL (9.8) · 2026-07-20 — FreeRDP before 3.28.0 (affected <=3.27.1) contains a heap-based buffer overflow in crypto_rsa_common() (libfreerdp/crypto/crypto.c). The function writes the modular-exponentiation result into the caller’s output buffer v…

Supply Chain

GHSA-9hw9-ch79-4vh6 · CVE-2026-59205 (pip)

• HIGH · CVSS 7.5 · 2026-07-20
• Affected: pillow
• https://github.com/advisories/GHSA-9hw9-ch79-4vh6

Pillow: Controlled heap out-of-bounds write in Pillow ImageCmsTransform.apply() via output mode mismatch

GHSA-vjc4-5qp5-m44j · CVE-2026-59204 (pip)

• HIGH · 2026-07-20
• Affected: pillow
• https://github.com/advisories/GHSA-vjc4-5qp5-m44j

Pillow JPEG2000 tiled decode retains a growing scratch buffer and can be used for denial of service

GHSA-jjj6-mw9f-p565 · CVE-2026-59200 (pip)

• HIGH · CVSS 7.5 · 2026-07-20
• Affected: Pillow
• https://github.com/advisories/GHSA-jjj6-mw9f-p565

Pillow: Decompression Bomb DoS via PdfParser.PdfStream.decode()

GHSA-6r8x-57c9-28j4 · CVE-2026-59199 (pip)

• HIGH · CVSS 7.5 · 2026-07-20
• Affected: Pillow
• https://github.com/advisories/GHSA-6r8x-57c9-28j4

Pillow: Heap out-of-bounds write Image.paste() / Image.crop() via signed coordinate overflow

GHSA-xj96-63gp-2gmr · CVE-2026-59197 (pip)

• HIGH · CVSS 8.2 · 2026-07-20
• Affected: Pillow
• https://github.com/advisories/GHSA-xj96-63gp-2gmr

Pillow: Heap out-of-bounds write in ImageFilter.RankFilter via integer overflow in ImagingExpand

GHSA-wp74-jgxh-gv4q · CVE-2026-50651 (nuget)

• HIGH · CVSS 7.5 · 2026-07-20
• Affected: Microsoft.NetCore.App.Runtime.linux-arm, Microsoft.NetCore.App.Runtime.linux-arm64, Microsoft.NetCore.App.Runtime.linux-musl-arm
• https://github.com/advisories/GHSA-wp74-jgxh-gv4q

Microsoft Security Advisory CVE-2026-50651 – .NET Denial of Service Vulnerability

GHSA-8q5v-6pqq-x66h · CVE-2026-50525 (nuget)

• HIGH · CVSS 7.5 · 2026-07-20
• Affected: System.Security.Cryptography.Xml, System.Security.Cryptography.Xml, System.Security.Cryptography.Xml
• https://github.com/advisories/GHSA-8q5v-6pqq-x66h

Microsoft Security Advisory CVE-2026-50525 – .NET Denial of Service Vulnerability

GHSA-qvw7-jm5c-6hqw · CVE-2026-50528 (nuget)

• HIGH · CVSS 8.2 · 2026-07-20
• Affected: Microsoft.NetCore.App.Runtime.linux-arm, Microsoft.NetCore.App.Runtime.linux-arm64, Microsoft.NetCore.App.Runtime.linux-musl-arm
• https://github.com/advisories/GHSA-qvw7-jm5c-6hqw

Microsoft Security Advisory CVE-2026-50528 – .NET Security Feature Bypass Vulnerability

GHSA-23rf-6693-g89p · CVE-2026-50648 (nuget)

• HIGH · CVSS 7.5 · 2026-07-20
• Affected: System.Security.Cryptography.Xml, System.Security.Cryptography.Xml, System.Security.Cryptography.Xml
• https://github.com/advisories/GHSA-23rf-6693-g89p

Microsoft Security Advisory CVE-2026-50648 – .NET Denial of Service Vulnerability

GHSA-w7cw-xp7h-6j5j · CVE-2026-50524 (nuget)

• HIGH · CVSS 7.5 · 2026-07-20
• Affected: Microsoft.NetCore.App.Runtime.linux-arm, Microsoft.NetCore.App.Runtime.linux-arm64, Microsoft.NetCore.App.Runtime.linux-musl-arm
• https://github.com/advisories/GHSA-w7cw-xp7h-6j5j

Microsoft Security Advisory CVE-2026-50524 – .NET Denial of Service Vulnerability

Exploitation evidence, 7-day window (severity-agnostic — evidence trumps labels):

• GHSA-8qw8-rq86-9pc2 (CVE-2026-27771, go) · 2026-07-17 — EPSS p98.5

Ransomware Activity

28 new victim postings across 10 groups.

IOC Volume

1134 new IOCs in this window. By source:

Recent OSINT Events

No curated MISP events in this window (bulk-IOC contributions tallied in IOC Volume).

Active Malware Families

17 malware families active this week (4 corroborated across ≥2 sources), exercising 22 ATT&CK techniques. Family is the unit, not the indicator: the raw IOCs are drill-down evidence below, not the signal.

Families marked ”→” are delivery/social-engineering clusters (ClearFake, ClickFix, GuLoader, Amadey). Their technique mappings are the delivery chain — downstream behavior is payload-dependent, so they don’t open a hard coverage gap on their own.

Multi-Source IOCs

23 IOCs flagged by 2+ independent sources this window — the highest-confidence signal the cross-feed corpus produces.

MISP × KEV Correlation

No MISP events in this window referenced a CVE.

Cross-Reference

No SEC × KEV vendor token matches in this window. (This is a heuristic surface, absence is expected most days.)

Intel Feeds

4 IOC feeds updated this run (6,246 indicators total) — each available as CSV, MISP JSON, and STIX 2.1. Subscribe at https://thrunt.me/intel/manifest.json.

Hand-Authored Sigma

3 production-ready TTP rules (+2 scaffolds in the authoring queue) live at https://thrunt.me/sigma/manifest.json. Subscribe via https://thrunt.me/sigma/rules.lock.json (content-hash churn) or pull all with https://thrunt.me/sigma/rules.tar.gz.

Detection Gaps

17 of 157 techniques with corpus signal have zero detection coverage — no SigmaHQ community rule, no thrunt rule. This is the hand-authoring queue; the live view is at https://thrunt.me/corpus/attck/.

…and 7 more below the cut — full list on the rollup.

Pipeline Health

All feeds healthy.

Sources: SEC EDGAR (public domain), CISA Known Exploited Vulnerabilities (public domain), FIRST.org EPSS (per ToS), NIST NVD (public domain), GitHub Security Advisories (per ToS), abuse.ch URLhaus (CC0, attribution), ransomware.live (per ToS), MITRE ATT&CK (CC BY 4.0).

Published by Applied Cybernetics Group via thrunt.me. Heuristic cross-references are labelled as such; verify before action.