Morning Brief — 2026-07-24

4 material breach disclosures, 10 emerging critical cves, 11 supply chain, 47 ransomware activity, 5949 ioc volume, 18 active malware families, 25 multi-source iocs, 4 intel feeds, 5 hand-authored sigma, and 17 detection gaps. Sections with no signal are still rendered with an explicit “none in this window” note so absence is visible alongside presence.

Material Breach Disclosures

UPBOUND GROUP, INC. (UPBD)

• Filed: 2026-07-22 · CIK 0000933036 · Accession 0001193125-26-310605
• Filing: https://www.sec.gov/Archives/edgar/data/933036/000119312526310605/upbd-20260721.htm

Caution Concerning Forward-Looking Statements

This Current Report on Form 8-K contains “forward-looking statements” within the meaning of the Private Securities Litigation Reform Act of 1995. Such forward-looking statements involve risks and uncertainties, including statements regarding our understanding of the event and its potential impacts. Factors that could cause or contribute to material…

CID Holdco, Inc. (DAIC)

• Filed: 2026-07-22 · CIK 0002033770 · Accession 0001213900-26-080208
• Filing: https://www.sec.gov/Archives/edgar/data/2033770/000121390026080208/ea029882601ex10-1.htm

any written notice from any governmental authority alleging any material violation of applicable cybersecurity or data privacy laws that remains unresolved. To the Company’s knowledge, there are no pending or threatened claims, investigations or proceedings by any governmental authority relating to any material cybersecurity incident or any material violation of applicable cybersecurity or d…

River Financial Corp (RVRF)

• Filed: 2026-07-17 · CIK 0001641601 · Accession 0001193125-26-307288
• Filing: https://www.sec.gov/Archives/edgar/data/1641601/000119312526307288/ck0001641601-20260619.htm

As set forth in its Form 8-K filed July 10, 2026, two class action lawsuits were filed relating to the unauthorized threat actor gaining access to the network environment of River Financial Corporation, including River Bank & Trust (together, “River”). A third class action was filed against River on July 10, 2026 and a fourth class action was filed against River on July 16, 2026.

 

The principal…

River Financial Corp (RVRF)

• Filed: 2026-07-10 · CIK 0001641601 · Accession 0001193125-26-300763
• Filing: https://www.sec.gov/Archives/edgar/data/1641601/000119312526300763/ck0001641601-20260619.htm

Since the date of the original filing, River’s investigation has progressed. River has determined that an unauthorized threat actor accessed portions of its network and removed certain data from its environment. River is working to determine the nature and scope of the information involved, including whether any personally identifiable information was affected. To date, River is not aware of any r…

Federal Patching Priority

No new KEV additions in this window.

Exploit Probability Movers

No CVEs with ≥0.20 EPSS movement in this window.

Emerging Critical CVEs

• CVE-2026-62825 · CRITICAL (10.0) · 2026-07-24 — Improper authentication in Azure Key Vault allows an unauthorized attacker to elevate privileges over a network.
• CVE-2026-58275 · CRITICAL (10.0) · 2026-07-24 — Missing authorization in Azure DNS allows an unauthorized attacker to elevate privileges over a network.
• CVE-2026-56191 · CRITICAL (10.0) · 2026-07-24 — Improper authentication in Microsoft Exchange Online allows an unauthorized attacker to perform tampering over a network.
• CVE-2026-42933 · CRITICAL (10.0) · 2026-07-23 — Pronetiqs IntraVUE versions 3.2.1a14 and prior have an unintended proxy or intermediary vulnerability which could allow an attacker to use an active proxy, which would bypass OT segmentation.
• CVE-2025-71389 · CRITICAL (10.0) · 2026-07-23 — Cal.com (calcom/cal.diy) before 5.9.9 is vulnerable to unauthenticated remote code execution because it bundles a version of Next.js whose React Server Components (RSC) request handling deserializes attacker-controlled i…
• CVE-2026-6516 · CRITICAL (10.0) · 2026-07-23 — Zohocorp ManageEngine ADAudit Plus versions before 8606 are affected by Unauthenticated Remote code execution due to the vulnerable agent API.
• CVE-2026-47668 · CRITICAL (10.0) · 2026-07-23 — DbGate is cross-platform database manager. In versions 7.1.8 and prior, DbGate’s JSON script runner (POST /runners/start) allows remote code execution via code injection in the functionName parameter of JSON script `…
• CVE-2026-64813 · CRITICAL (10.0) · 2026-07-23 — In JetBrains IntelliJ IDEA before 2026.2 unauthorized settings modification was possible in a Remote Development session
• CVE-2026-64812 · CRITICAL (10.0) · 2026-07-23 — In JetBrains IntelliJ IDEA before 2026.2 unauthorized input injection was possible in a Remote Development session
• CVE-2026-59555 · CRITICAL (10.0) · 2026-07-23 — Unauthenticated Arbitrary File Deletion in Participants Database <= 2.7.8.3 versions.

Supply Chain

GHSA-c96f-x56v-gq3h · CVE-2026-47219 (npm)

• HIGH · CVSS 7.5 · 2026-07-23
• Affected: find-my-way
• https://github.com/advisories/GHSA-c96f-x56v-gq3h

find-my-way: DDoS with HTTP2

GHSA-g867-7843-wf8q · CVE-2026-59935 (pip)

• HIGH · 2026-07-23
• Affected: pypdf
• https://github.com/advisories/GHSA-g867-7843-wf8q

pypdf: Possible infinite loop for not terminated inline images (ASCII85 and ASCIIHex filter)

GHSA-5xf7-4p34-54qr · CVE-2026-59936 (pip)

• HIGH · 2026-07-23
• Affected: pypdf
• https://github.com/advisories/GHSA-5xf7-4p34-54qr

pypdf: Possible infinite loop for not terminated inline images

GHSA-6g55-p6wh-862q · CVE-2026-45623 (npm)

• HIGH · CVSS 7.5 · 2026-07-23
• Affected: postcss
• https://github.com/advisories/GHSA-6g55-p6wh-862q

PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments

GHSA-xh5m-36r6-47m3 · CVE-2026-59933 (composer)

• HIGH · CVSS 7.5 · 2026-07-23
• Affected: phpoffice/phpspreadsheet, phpoffice/phpspreadsheet, phpoffice/phpspreadsheet
• https://github.com/advisories/GHSA-xh5m-36r6-47m3

PHPSpreadsheet: XLS/OLE sector-chain self-loop causes memory exhaustion

GHSA-2mrg-gjxq-2gvr · CVE-2026-59932 (composer)

• HIGH · CVSS 7.5 · 2026-07-23
• Affected: phpoffice/phpspreadsheet, phpoffice/phpspreadsheet, phpoffice/phpspreadsheet
• https://github.com/advisories/GHSA-2mrg-gjxq-2gvr

PHPSpreadsheet: Gnumeric reader unbounded gzip expansion causes memory exhaustion

GHSA-6hq5-7373-42rg · CVE-2026-59931 (composer)

• HIGH · CVSS 7.7 · 2026-07-23
• Affected: phpoffice/phpspreadsheet, phpoffice/phpspreadsheet, phpoffice/phpspreadsheet
• https://github.com/advisories/GHSA-6hq5-7373-42rg

PHPSpreadsheet: SSRF bypass via HTTP redirect in WEBSERVICE() domain whitelist

GHSA-8fpg-xm3f-6cx3 (npm)

• CRITICAL · 2026-07-23
• Affected: next-auth
• https://github.com/advisories/GHSA-8fpg-xm3f-6cx3

Auth.js: Configuration errors can cause existence-based auth checks to fail open (auth object populated with an error)

GHSA-xmf8-cvqr-rfgj (npm)

• HIGH · CVSS 7.5 · 2026-07-23
• Affected: @auth/core, next-auth, next-auth
• https://github.com/advisories/GHSA-xmf8-cvqr-rfgj

Auth.js: getToken() throws an uncaught exception on malformed Bearer authorization headers

GHSA-7rqj-j65f-68wh (npm)

• CRITICAL · 2026-07-23
• Affected: @auth/core, next-auth, next-auth
• https://github.com/advisories/GHSA-7rqj-j65f-68wh

Auth.js: Email normalizer validates the address before Unicode normalization, allowing a homoglyph @ bypass

Exploitation evidence, 7-day window (severity-agnostic — evidence trumps labels):

• GHSA-8qw8-rq86-9pc2 (CVE-2026-27771, go) · 2026-07-17 — EPSS p98.5

Ransomware Activity

47 new victim postings across 10 groups.

IOC Volume

5949 new IOCs in this window. By source:

Recent OSINT Events

No curated MISP events in this window (bulk-IOC contributions tallied in IOC Volume).

Active Malware Families

18 malware families active this week (2 corroborated across ≥2 sources), exercising 20 ATT&CK techniques. Family is the unit, not the indicator: the raw IOCs are drill-down evidence below, not the signal.

Families marked ”→” are delivery/social-engineering clusters (ClearFake, ClickFix, Amadey, GuLoader). Their technique mappings are the delivery chain — downstream behavior is payload-dependent, so they don’t open a hard coverage gap on their own.

Multi-Source IOCs

25 IOCs flagged by 2+ independent sources this window — the highest-confidence signal the cross-feed corpus produces.

MISP × KEV Correlation

No MISP events in this window referenced a CVE.

Cross-Reference

No SEC × KEV vendor token matches in this window. (This is a heuristic surface, absence is expected most days.)

Intel Feeds

4 IOC feeds updated this run (9,402 indicators total) — each available as CSV, MISP JSON, and STIX 2.1. Subscribe at https://thrunt.me/intel/manifest.json.

Hand-Authored Sigma

3 production-ready TTP rules (+2 scaffolds in the authoring queue) live at https://thrunt.me/sigma/manifest.json. Subscribe via https://thrunt.me/sigma/rules.lock.json (content-hash churn) or pull all with https://thrunt.me/sigma/rules.tar.gz.

Detection Gaps

17 of 155 techniques with corpus signal have zero detection coverage — no SigmaHQ community rule, no thrunt rule. This is the hand-authoring queue; the live view is at https://thrunt.me/corpus/attck/.

…and 7 more below the cut — full list on the rollup.

Pipeline Health

All feeds healthy.

Sources: SEC EDGAR (public domain), CISA Known Exploited Vulnerabilities (public domain), FIRST.org EPSS (per ToS), NIST NVD (public domain), GitHub Security Advisories (per ToS), abuse.ch URLhaus (CC0, attribution), ransomware.live (per ToS), MITRE ATT&CK (CC BY 4.0).

Published by Applied Cybernetics Group via thrunt.me. Heuristic cross-references are labelled as such; verify before action.