Morning Brief — 2026-07-23

4 material breach disclosures, 2 federal patching priority, 2 exploit probability movers, 10 emerging critical cves, 11 supply chain, 27 ransomware activity, 1612 ioc volume, 17 active malware families, 25 multi-source iocs, 4 intel feeds, 5 hand-authored sigma, and 17 detection gaps. Sections with no signal are still rendered with an explicit “none in this window” note so absence is visible alongside presence.

Material Breach Disclosures

UPBOUND GROUP, INC. (UPBD)

• Filed: 2026-07-22 · CIK 0000933036 · Accession 0001193125-26-310605
• Filing: https://www.sec.gov/Archives/edgar/data/933036/000119312526310605/upbd-20260721.htm

Caution Concerning Forward-Looking Statements

This Current Report on Form 8-K contains “forward-looking statements” within the meaning of the Private Securities Litigation Reform Act of 1995. Such forward-looking statements involve risks and uncertainties, including statements regarding our understanding of the event and its potential impacts. Factors that could cause or contribute to material…

CID Holdco, Inc. (DAIC)

• Filed: 2026-07-22 · CIK 0002033770 · Accession 0001213900-26-080208
• Filing: https://www.sec.gov/Archives/edgar/data/2033770/000121390026080208/ea029882601ex10-1.htm

any written notice from any governmental authority alleging any material violation of applicable cybersecurity or data privacy laws that remains unresolved. To the Company’s knowledge, there are no pending or threatened claims, investigations or proceedings by any governmental authority relating to any material cybersecurity incident or any material violation of applicable cybersecurity or d…

River Financial Corp (RVRF)

• Filed: 2026-07-17 · CIK 0001641601 · Accession 0001193125-26-307288
• Filing: https://www.sec.gov/Archives/edgar/data/1641601/000119312526307288/ck0001641601-20260619.htm

As set forth in its Form 8-K filed July 10, 2026, two class action lawsuits were filed relating to the unauthorized threat actor gaining access to the network environment of River Financial Corporation, including River Bank & Trust (together, “River”). A third class action was filed against River on July 10, 2026 and a fourth class action was filed against River on July 16, 2026.

 

The principal…

River Financial Corp (RVRF)

• Filed: 2026-07-10 · CIK 0001641601 · Accession 0001193125-26-300763
• Filing: https://www.sec.gov/Archives/edgar/data/1641601/000119312526300763/ck0001641601-20260619.htm

Since the date of the original filing, River’s investigation has progressed. River has determined that an unauthorized threat actor accessed portions of its network and removed certain data from its environment. River is working to determine the nature and scope of the information involved, including whether any personally identifiable information was affected. To date, River is not aware of any r…

Federal Patching Priority

CVE-2026-50522 — Microsoft SharePoint

**Microsoft SharePoint Deserialization of Untrusted Data Vulnerability **

• Added: 2026-07-22 · Federal due: 2026-07-25 · EPSS 97.2th pct (score 0.203) · CVSS 9.8 (CRITICAL) · CWE-502
• ransomware use: Unknown

Microsoft SharePoint contains a deserialization of untrusted data vulnerability which could allow an unauthorized attacker to execute code over a network.

Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.

CVE-2026-16232 — Check Point SmartConsole

Check Point SmartConsole Improper Authentication Vulnerability

• Added: 2026-07-22 · Federal due: 2026-07-25 · CVSS 9.1 (CRITICAL) · CWE-287
• ransomware use: Unknown

Check Point SmartConsole contains an improper authentication vulnerability which could allow an unauthenticated remote attacker to obtain an application login token and use it to authenticate with full administrative privileges.

An authentication bypass vulnerability in the Check Point SmartConsole login process allows an unauthenticated remote attacker to obtain an application login token and use it to authenticate with full administrative privileges. Successful exploitation allows the attacker to modify security policies and security configurations. Remote exploitation requires internet access to the Management Server…

Exploit Probability Movers

Emerging Critical CVEs

• CVE-2026-60366 · CRITICAL (10.0) · 2026-07-22 — Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitabl…
• CVE-2026-60369 · CRITICAL (9.9) · 2026-07-22 — Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitabl…
• CVE-2026-60372 · CRITICAL (9.8) · 2026-07-22 — Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitabl…
• CVE-2026-60367 · CRITICAL (9.8) · 2026-07-22 — Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitabl…
• CVE-2026-16606 · CRITICAL (9.8) · 2026-07-22 — A vulnerability in Fujitsu Software Linux openFT and Fujitsu Software Oracle Solaris openFT before version 12.1D00 allows for unauthenticated remote code execution (pre-auth RCE) on GNU/Linux or Oracle Solaris. The Fsas…
• CVE-2026-2395 · CRITICAL (9.8) · 2026-07-22 — Improper neutralization of special elements used in an SQL command (‘SQL injection’) vulnerability in Xpoda Türkiye Informatics Technology Inc. No Code Platform allows SQL Injection.

This issue affects No Code Platform:…

• CVE-2026-46738 · CRITICAL (9.1) · 2026-07-22 — Dell PowerProtect Data Manager, versions prior to 20.2.0.0, contain(s) an Improper Input Validation vulnerability in the REST API. A high privileged attacker with remote access could potentially exploit this vulnerabilit…
• CVE-2026-40712 · CRITICAL (9.1) · 2026-07-22 — Dell PowerProtect Data Manager, versions prior to 20.2.0.0, contain(s) an Improper Input Validation vulnerability in the REST API. A high privileged attacker with remote access could potentially exploit this vulnerabilit…
• CVE-2026-62144 · CRITICAL (9.1) · 2026-07-22 — An authentication bypass vulnerability in Check Point Security Management and Multi-Domain Security Management allows an unauthenticated remote attacker to execute administrative commands on the Management Server. Succes…
• CVE-2026-16723 · CRITICAL (9.0) · 2026-07-23 — A remote code execution (RCE) vulnerability exists in fastjson 1.2.68 through 1.2.83. This vulnerability is exploitable under fastjson’s stock default configuration — no AutoType enablement required, no classpath gadget…

Supply Chain

GHSA-pppj-hq3g-57pj (pip)

• HIGH · 2026-07-22
• Affected: jupyterlab, jupyterlab
• https://github.com/advisories/GHSA-pppj-hq3g-57pj

JupyterLab: Cross-site scripting (XSS) via crafted settings file (overrides.json)

GHSA-gx64-gj6p-pc4c (pip)

• HIGH · 2026-07-22
• Affected: jupyterlab, jupyterlab
• https://github.com/advisories/GHSA-gx64-gj6p-pc4c

JupyterLab: Image viewer allows XSS when opening malicious image in new browser tab

GHSA-89xv-2m56-2m9x · CVE-2026-64649 (npm)

• HIGH · 2026-07-22
• Affected: next, next
• https://github.com/advisories/GHSA-89xv-2m56-2m9x

Next.js: Server-Side Request Forgery in Server Actions on custom servers

GHSA-p9j2-gv94-2wf4 · CVE-2026-64645 (npm)

• HIGH · 2026-07-22
• Affected: next, next
• https://github.com/advisories/GHSA-p9j2-gv94-2wf4

Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname

GHSA-6gpp-xcg3-4w24 · CVE-2026-64642 (npm)

• HIGH · 2026-07-22
• Affected: next
• https://github.com/advisories/GHSA-6gpp-xcg3-4w24

Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale

GHSA-m99w-x7hq-7vfj · CVE-2026-64641 (npm)

• HIGH · 2026-07-22
• Affected: next, next
• https://github.com/advisories/GHSA-m99w-x7hq-7vfj

Next.js: Denial of Service in App Router using Server Actions

GHSA-9299-c6m4-mjhc · CVE-2024-7708 (maven)

• HIGH · CVSS 7.5 · 2026-07-22
• Affected: org.eclipse.jetty:jetty-server, org.eclipse.jetty:jetty-server
• https://github.com/advisories/GHSA-9299-c6m4-mjhc

Eclipse Jetty: DoS attack triggering OutOfMemory with 100-Continue requests

GHSA-2fvj-hgj9-j2gr · CVE-2026-10050 (maven)

• HIGH · 2026-07-22
• Affected: org.eclipse.jetty:jetty-security, org.eclipse.jetty:jetty-security, org.eclipse.jetty:jetty-security
• https://github.com/advisories/GHSA-2fvj-hgj9-j2gr

Eclipse Jetty Digest Authentication: ISO-8859-1 lossy encoding allows authentication bypass via character substitution

GHSA-7488-6r32-c95q · CVE-2026-59822 (pip)

• HIGH · 2026-07-22
• Affected: litellm
• https://github.com/advisories/GHSA-7488-6r32-c95q

LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback

GHSA-xwx6-jjhv-84p8 (npm)

• HIGH · 2026-07-22
• Affected: n8n, n8n, n8n
• https://github.com/advisories/GHSA-xwx6-jjhv-84p8

n8n: Prototype Pollution via Dot-Notation Field Names Leads To Instance-Wide Denial of Service

Exploitation evidence, 7-day window (severity-agnostic — evidence trumps labels):

• GHSA-8qw8-rq86-9pc2 (CVE-2026-27771, go) · 2026-07-17 — EPSS p98.5

Ransomware Activity

27 new victim postings across 12 groups.

IOC Volume

1612 new IOCs in this window. By source:

Recent OSINT Events

No curated MISP events in this window (bulk-IOC contributions tallied in IOC Volume).

Active Malware Families

17 malware families active this week (2 corroborated across ≥2 sources), exercising 20 ATT&CK techniques. Family is the unit, not the indicator: the raw IOCs are drill-down evidence below, not the signal.

Families marked ”→” are delivery/social-engineering clusters (ClearFake, ClickFix, GuLoader, Amadey). Their technique mappings are the delivery chain — downstream behavior is payload-dependent, so they don’t open a hard coverage gap on their own.

Multi-Source IOCs

25 IOCs flagged by 2+ independent sources this window — the highest-confidence signal the cross-feed corpus produces.

MISP × KEV Correlation

No MISP events in this window referenced a CVE.

Cross-Reference

No SEC × KEV vendor token matches in this window. (This is a heuristic surface, absence is expected most days.)

Intel Feeds

4 IOC feeds updated this run (7,677 indicators total) — each available as CSV, MISP JSON, and STIX 2.1. Subscribe at https://thrunt.me/intel/manifest.json.

Hand-Authored Sigma

3 production-ready TTP rules (+2 scaffolds in the authoring queue) live at https://thrunt.me/sigma/manifest.json. Subscribe via https://thrunt.me/sigma/rules.lock.json (content-hash churn) or pull all with https://thrunt.me/sigma/rules.tar.gz.

Detection Gaps

17 of 155 techniques with corpus signal have zero detection coverage — no SigmaHQ community rule, no thrunt rule. This is the hand-authoring queue; the live view is at https://thrunt.me/corpus/attck/.

…and 7 more below the cut — full list on the rollup.

Pipeline Health

All feeds healthy.

Sources: SEC EDGAR (public domain), CISA Known Exploited Vulnerabilities (public domain), FIRST.org EPSS (per ToS), NIST NVD (public domain), GitHub Security Advisories (per ToS), abuse.ch URLhaus (CC0, attribution), ransomware.live (per ToS), MITRE ATT&CK (CC BY 4.0).

Published by Applied Cybernetics Group via thrunt.me. Heuristic cross-references are labelled as such; verify before action.