Morning Brief — 2026-07-25

3 material breach disclosures, 20 exploit probability movers, 10 emerging critical cves, 11 supply chain, 18 ransomware activity, 5836 ioc volume, 17 active malware families, 25 multi-source iocs, 4 intel feeds, 5 hand-authored sigma, and 17 detection gaps. Sections with no signal are still rendered with an explicit “none in this window” note so absence is visible alongside presence.

Material Breach Disclosures

UPBOUND GROUP, INC. (UPBD)

• Filed: 2026-07-22 · CIK 0000933036 · Accession 0001193125-26-310605
• Filing: https://www.sec.gov/Archives/edgar/data/933036/000119312526310605/upbd-20260721.htm

Caution Concerning Forward-Looking Statements

This Current Report on Form 8-K contains “forward-looking statements” within the meaning of the Private Securities Litigation Reform Act of 1995. Such forward-looking statements involve risks and uncertainties, including statements regarding our understanding of the event and its potential impacts. Factors that could cause or contribute to material…

CID Holdco, Inc. (DAIC)

• Filed: 2026-07-22 · CIK 0002033770 · Accession 0001213900-26-080208
• Filing: https://www.sec.gov/Archives/edgar/data/2033770/000121390026080208/ea029882601ex10-1.htm

any written notice from any governmental authority alleging any material violation of applicable cybersecurity or data privacy laws that remains unresolved. To the Company’s knowledge, there are no pending or threatened claims, investigations or proceedings by any governmental authority relating to any material cybersecurity incident or any material violation of applicable cybersecurity or d…

River Financial Corp (RVRF)

• Filed: 2026-07-17 · CIK 0001641601 · Accession 0001193125-26-307288
• Filing: https://www.sec.gov/Archives/edgar/data/1641601/000119312526307288/ck0001641601-20260619.htm

As set forth in its Form 8-K filed July 10, 2026, two class action lawsuits were filed relating to the unauthorized threat actor gaining access to the network environment of River Financial Corporation, including River Bank & Trust (together, “River”). A third class action was filed against River on July 10, 2026 and a fourth class action was filed against River on July 16, 2026.

 

The principal…

Federal Patching Priority

No new KEV additions in this window.

Exploit Probability Movers

Emerging Critical CVEs

• CVE-2026-58630 · CRITICAL (10.0) · 2026-07-24 — Improper access control in Azure App Service allows an unauthorized attacker to elevate privileges over a network.
• CVE-2026-57106 · CRITICAL (10.0) · 2026-07-24 — Server-side request forgery (ssrf) in Data Quality allows an unauthorized attacker to elevate privileges over a network.
• CVE-2026-56163 · CRITICAL (10.0) · 2026-07-24 — Missing authentication for critical function in Microsoft Azure Kubernetes Service allows an unauthorized attacker to elevate privileges over a network.
• CVE-2026-61884 · CRITICAL (9.8) · 2026-07-24 — The web management interface of Tycon Systems TPDIN-Monitor-WEB2

 does not perform server-side validation of credentials during the login process. By submitting empty values for both credential fields, an unauthenticate…

• CVE-2026-62835 · CRITICAL (9.3) · 2026-07-24 — Improper authorization in Azure Portal allows an unauthorized attacker to disclose information over a network.
• CVE-2026-48021 · CRITICAL (9.1) · 2026-07-24 — In epa4all, prior to version 2026-05-20, an attacker who can intercept the TLS connection between epa4all and the ePA backend can complete the VAU handshake with attacker-controlled keys and obtain the session encryption…
• CVE-2026-61892 · HIGH (8.8) · 2026-07-24 — Weintek cMT3092X HMI allows a non-privileged user to modify tokens to escalate privileges.
• CVE-2026-60134 · HIGH (8.8) · 2026-07-24 — Weintek cMT3092X HMI allows a non-privileged user to modify cookies to gain elevated privileges.
• CVE-2026-66041 · HIGH (8.8) · 2026-07-24 — FFmpeg 7.0 through 8.1.2, fixed in commit 4da9812, contains a heap out-of-bounds write vulnerability in the vf_quirc filter that allows an attacker to corrupt heap memory by supplying a crafted PGS/SUP subtitle file with…
• CVE-2026-66040 · HIGH (8.8) · 2026-07-24 — FFmpeg through 8.1.2, fixed in commit b506faf, contains a heap out-of-bounds write vulnerability in the native PNG and APNG encoders that allows remote attackers to corrupt heap memory by supplying a crafted PNG image wi…

Supply Chain

GHSA-6vch-q96h-7gc3 (go)

• HIGH · 2026-07-24
• Affected: go.etcd.io/etcd/v3, go.etcd.io/etcd/v3, go.etcd.io/etcd/v3
• https://github.com/advisories/GHSA-6vch-q96h-7gc3

etcd: tlsListener.acceptLoop spawns unbounded handshake goroutines with no deadline

GHSA-j6g5-3hh3-pgw8 · CVE-2026-16796 (pip)

• HIGH · CVSS 7.3 · 2026-07-24
• Affected: bedrock-agentcore
• https://github.com/advisories/GHSA-j6g5-3hh3-pgw8

AWS Bedrock AgentCore: Improper neutralization of argument delimiters in the Python SDK install_packages()

GHSA-xg4h-6gfc-h4m8 (go)

• HIGH · 2026-07-24
• Affected: go.etcd.io/etcd/v3, go.etcd.io/etcd/v3, go.etcd.io/etcd/v3
• https://github.com/advisories/GHSA-xg4h-6gfc-h4m8

etcd: Watch API authorization bypass via open-ended range requests

GHSA-jvxp-qmx7-gjpx · CVE-2026-16756 (rust)

• HIGH · CVSS 7.5 · 2026-07-24
• Affected: aws-smithy-http-server
• https://github.com/advisories/GHSA-jvxp-qmx7-gjpx

Smithy-RS: Allocation of resources without limits in the default aws-smithy-http-server serve() path allows unauthenticated Slowloris denial of service

GHSA-hmj8-5xmh-5573 (pip)

• HIGH · CVSS 7.5 · 2026-07-24
• Affected: libp2p
• https://github.com/advisories/GHSA-hmj8-5xmh-5573

libp2p: yamux connection DoS via oversized data frame

GHSA-6xj8-qv9j-xcjq (go)

• HIGH · CVSS 7.8 · 2026-07-24
• Affected: github.com/jandedobbeleer/oh-my-posh
• https://github.com/advisories/GHSA-6xj8-qv9j-xcjq

Oh My Posh: Arbitrary command execution via template injection in the path segment

GHSA-fp43-vj7g-pg92 (maven)

• HIGH · CVSS 7.5 · 2026-07-24
• Affected: org.omnifaces:omnifaces, org.omnifaces:omnifaces, org.omnifaces:omnifaces
• https://github.com/advisories/GHSA-fp43-vj7g-pg92

OmniFaces: Forged combined-resource IDs and related output/push boundaries

GHSA-gm3r-q2wp-hw87 (npm)

• HIGH · 2026-07-24
• Affected: shescape, shescape
• https://github.com/advisories/GHSA-gm3r-q2wp-hw87

Shescape: Quadratic-time denial of service in the flag-protection

GHSA-w4hw-qcx7-56pr (npm)

• CRITICAL · 2026-07-24
• Affected: shescape, shescape
• https://github.com/advisories/GHSA-w4hw-qcx7-56pr

Shescape: Shell injection via unescaped parentheses on Windows with CMD

GHSA-29w2-fq35-v728 · CVE-2026-16584 (pip)

• HIGH · CVSS 7.0 · 2026-07-24
• Affected: awslabs.aws-api-mcp-server
• https://github.com/advisories/GHSA-29w2-fq35-v728

AWS API MCP Server Security Policy Bypass via Startup Initialization Failure

Exploitation evidence, 7-day window (severity-agnostic — evidence trumps labels):

• GHSA-f75j-4cw6-rmx4 (CVE-2026-20896, go) · 2026-07-21 — EPSS p98.1

Ransomware Activity

18 new victim postings across 13 groups.

IOC Volume

5836 new IOCs in this window. By source:

Recent OSINT Events

No curated MISP events in this window (bulk-IOC contributions tallied in IOC Volume).

Active Malware Families

17 malware families active this week (2 corroborated across ≥2 sources), exercising 20 ATT&CK techniques. Family is the unit, not the indicator: the raw IOCs are drill-down evidence below, not the signal.

Families marked ”→” are delivery/social-engineering clusters (ClearFake, ClickFix, Amadey, GuLoader). Their technique mappings are the delivery chain — downstream behavior is payload-dependent, so they don’t open a hard coverage gap on their own.

Multi-Source IOCs

25 IOCs flagged by 2+ independent sources this window — the highest-confidence signal the cross-feed corpus produces.

MISP × KEV Correlation

No MISP events in this window referenced a CVE.

Cross-Reference

No SEC × KEV vendor token matches in this window. (This is a heuristic surface, absence is expected most days.)

Intel Feeds

4 IOC feeds updated this run (9,136 indicators total) — each available as CSV, MISP JSON, and STIX 2.1. Subscribe at https://thrunt.me/intel/manifest.json.

Hand-Authored Sigma

3 production-ready TTP rules (+2 scaffolds in the authoring queue) live at https://thrunt.me/sigma/manifest.json. Subscribe via https://thrunt.me/sigma/rules.lock.json (content-hash churn) or pull all with https://thrunt.me/sigma/rules.tar.gz.

Detection Gaps

17 of 155 techniques with corpus signal have zero detection coverage — no SigmaHQ community rule, no thrunt rule. This is the hand-authoring queue; the live view is at https://thrunt.me/corpus/attck/.

…and 7 more below the cut — full list on the rollup.

Pipeline Health

All feeds healthy.

Sources: SEC EDGAR (public domain), CISA Known Exploited Vulnerabilities (public domain), FIRST.org EPSS (per ToS), NIST NVD (public domain), GitHub Security Advisories (per ToS), abuse.ch URLhaus (CC0, attribution), ransomware.live (per ToS), MITRE ATT&CK (CC BY 4.0).

Published by Applied Cybernetics Group via thrunt.me. Heuristic cross-references are labelled as such; verify before action.