Morning Brief — 2026-07-29

3 material breach disclosures, 1 exploit probability movers, 10 emerging critical cves, 10 supply chain, 18 ransomware activity, 9006 ioc volume, 13 active malware families, 25 multi-source iocs, 4 intel feeds, 5 hand-authored sigma, and 17 detection gaps. Sections with no signal are still rendered with an explicit “none in this window” note so absence is visible alongside presence.

Material Breach Disclosures

UPBOUND GROUP, INC. (UPBD)

• Filed: 2026-07-22 · CIK 0000933036 · Accession 0001193125-26-310605
• Filing: https://www.sec.gov/Archives/edgar/data/933036/000119312526310605/upbd-20260721.htm

Caution Concerning Forward-Looking Statements

This Current Report on Form 8-K contains “forward-looking statements” within the meaning of the Private Securities Litigation Reform Act of 1995. Such forward-looking statements involve risks and uncertainties, including statements regarding our understanding of the event and its potential impacts. Factors that could cause or contribute to material…

CID Holdco, Inc. (DAIC)

• Filed: 2026-07-22 · CIK 0002033770 · Accession 0001213900-26-080208
• Filing: https://www.sec.gov/Archives/edgar/data/2033770/000121390026080208/ea029882601ex10-1.htm

any written notice from any governmental authority alleging any material violation of applicable cybersecurity or data privacy laws that remains unresolved. To the Company’s knowledge, there are no pending or threatened claims, investigations or proceedings by any governmental authority relating to any material cybersecurity incident or any material violation of applicable cybersecurity or d…

River Financial Corp (RVRF)

• Filed: 2026-07-17 · CIK 0001641601 · Accession 0001193125-26-307288
• Filing: https://www.sec.gov/Archives/edgar/data/1641601/000119312526307288/ck0001641601-20260619.htm

As set forth in its Form 8-K filed July 10, 2026, two class action lawsuits were filed relating to the unauthorized threat actor gaining access to the network environment of River Financial Corporation, including River Bank & Trust (together, “River”). A third class action was filed against River on July 10, 2026 and a fourth class action was filed against River on July 16, 2026.

 

The principal…

Federal Patching Priority

No new KEV additions in this window.

Exploit Probability Movers

Emerging Critical CVEs

• CVE-2026-58150 · CRITICAL (10.0) · 2026-07-29 — Apache Traffic Server does not reject Transfer-Encoding in HTTP/2 requests, allowing downgrade request smuggling.

This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.…

• CVE-2026-57834 · CRITICAL (10.0) · 2026-07-29 — Apache Traffic Server allows request smuggling if chunked messages are malformed.

This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.

Users are rec…

• CVE-2026-33267 · CRITICAL (10.0) · 2026-07-29 — Improper Input Validation vulnerability in Apache Traffic Server.

This issue affects Apache Traffic Server: from 9.2.0 through 9.2.14, from 10.1.0 through 10.1.3.

Users are recommended to upgrade to version 9.2.15 or 1…

• CVE-2026-16498 · CRITICAL (10.0) · 2026-07-28 — The terraform-mcp-server before version 1.1.0 is vulnerable to a cross-tenant credential reuse issue in the streamable-HTTP stateless transport mode that may allow one user’s Terraform token to be used to execute tool ca…
• CVE-2026-63234 · CRITICAL (9.9) · 2026-07-29 — A SQL injection and unsafe deserialisation vulnerability in Koollab LMS allowed an authenticated attacker to inject through the manual mark assessment endpoint, control data passed to unserialize(), write a webshell to a…
• CVE-2026-63233 · CRITICAL (9.9) · 2026-07-29 — A SQL injection and unsafe deserialisation vulnerability in Koollab LMS allowed an authenticated attacker to inject through the assessment overall answer endpoint, control data passed to unserialize(), write a webshell t…
• CVE-2026-63232 · CRITICAL (9.9) · 2026-07-29 — A SQL injection and unsafe deserialisation vulnerability in Koollab LMS allowed an authenticated attacker to inject through the assessment reinforcement endpoint, control data passed to unserialize(), write a webshell to…
• CVE-2026-63227 · CRITICAL (9.9) · 2026-07-29 — An unrestricted SCORM file upload vulnerability in Koollab LMS allowed an authenticated module designer to upload a SCORM package containing a PHP webshell to a publicly accessible directory and execute arbitrary code on…
• CVE-2026-18191 · CRITICAL (9.8) · 2026-07-29 — VIN-DS783E-E6 developed by Vacron has a Hidden Functionality vulnerability, allowing unauthenticated remote attackers to exploit a specific hidden function to obtain the administrator credentials of the device.
• CVE-2026-18072 · CRITICAL (9.8) · 2026-07-29 — The Advanced Responsive Video Embedder for Rumble, Odysee, YouTube, Vimeo, Kick … plugin for WordPress is vulnerable to Authentication Bypass via a Hardcoded Backdoor in version 10.8.7. The vulnerability exists because t…

Supply Chain

GHSA-vj5c-m527-mpff · CVE-2026-54639 (npm)

• HIGH · CVSS 8.8 · 2026-07-28
• Affected: style-dictionary
• https://github.com/advisories/GHSA-vj5c-m527-mpff

Style Dictionary - Prototype Pollution in convertTokenData utility function

GHSA-fh2f-xfxc-q9cc · CVE-2026-54650 (go)

• HIGH · CVSS 8.6 · 2026-07-28
• Affected: github.com/bablilayoub/openhole
• https://github.com/advisories/GHSA-fh2f-xfxc-q9cc

openhole-server vulnerable to path traversal via URL-decoded request path

GHSA-6wcc-39rp-hh9p · CVE-2026-54658 (npm)

• CRITICAL · CVSS 9.8 · 2026-07-28
• Affected: @hypequery/clickhouse
• https://github.com/advisories/GHSA-6wcc-39rp-hh9p

@hypequery/clickhouse has SQL Injection in parameter escaping that allows arbitrary SQL execution

GHSA-whmm-qj9r-wvr2 · CVE-2026-54638 (go)

• HIGH · CVSS 7.5 · 2026-07-28
• Affected: github.com/gotd/td
• https://github.com/advisories/GHSA-whmm-qj9r-wvr2

td has pre-auth denial of service via unbounded memory allocation in proto.UnencryptedMessage.Decode

GHSA-hq33-8jgp-8qq3 · CVE-2026-64863 (go)

• CRITICAL · CVSS 9.1 · 2026-07-28
• Affected: goshs.de/goshs/v2, github.com/patrickhener/goshs/v2, goshs.de/goshs
• https://github.com/advisories/GHSA-hq33-8jgp-8qq3

goshs —no-delete WebDAV MOVE bypass allows file deletion/overwrite

GHSA-rmxw-pq4x-3fvh · CVE-2026-54719 (go)

• HIGH · CVSS 7.5 · 2026-07-28
• Affected: github.com/patrickhener/goshs, github.com/patrickhener/goshs/v2, goshs.de/goshs
• https://github.com/advisories/GHSA-rmxw-pq4x-3fvh

goshs: File-based .goshs ACL authorization bypass via the ?bulk zip-download route (unauthenticated read; residual of GHSA-wvhv-qcqf-f3cx)

GHSA-rjrw-mjq6-hpmm · CVE-2026-62325 (go)

• CRITICAL · CVSS 9.1 · 2026-07-28
• Affected: github.com/patrickhener/goshs/v2, goshs.de/goshs/v2
• https://github.com/advisories/GHSA-rjrw-mjq6-hpmm

goshs SFTP authentication bypass via empty password (incomplete fix of CVE-2026-40884)

GHSA-wjv6-jcfj-mf9r · CVE-2026-54654 (pip)

• HIGH · CVSS 7.8 · 2026-07-28
• Affected: datamodel-code-generator
• https://github.com/advisories/GHSA-wjv6-jcfj-mf9r

datamodel-code-generator vulnerable to code injection via unescaped carriage return in --extra-template-data comment field

GHSA-8359-h9fx-j6v9 · CVE-2026-55389 (pip)

• HIGH · CVSS 7.5 · 2026-07-28
• Affected: datamodel-code-generator
• https://github.com/advisories/GHSA-8359-h9fx-j6v9

datamodel-code-generator vulnerable to arbitrary local file read via JSON-Schema $ref (file:// and ../ traversal), bypassing --no-allow-remote-refs

GHSA-386q-5hp3-95m9 · CVE-2026-54653 (pip)

• HIGH · CVSS 8.8 · 2026-07-28
• Affected: datamodel-code-generator
• https://github.com/advisories/GHSA-386q-5hp3-95m9

datamodel-code-generator vulnerable to code injection in via attacker-controlled default_factory schema field

Ransomware Activity

18 new victim postings across 12 groups.

IOC Volume

9006 new IOCs in this window. By source:

Recent OSINT Events

No curated MISP events in this window (bulk-IOC contributions tallied in IOC Volume).

Active Malware Families

13 malware families active this week (0 corroborated across ≥2 sources), exercising 17 ATT&CK techniques. Family is the unit, not the indicator: the raw IOCs are drill-down evidence below, not the signal.

Families marked ”→” are delivery/social-engineering clusters (ClickFix). Their technique mappings are the delivery chain — downstream behavior is payload-dependent, so they don’t open a hard coverage gap on their own.

Multi-Source IOCs

25 IOCs flagged by 2+ independent sources this window — the highest-confidence signal the cross-feed corpus produces.

MISP × KEV Correlation

No MISP events in this window referenced a CVE.

Cross-Reference

No SEC × KEV vendor token matches in this window. (This is a heuristic surface, absence is expected most days.)

Intel Feeds

4 IOC feeds updated this run (8,859 indicators total) — each available as CSV, MISP JSON, and STIX 2.1. Subscribe at https://thrunt.me/intel/manifest.json.

Hand-Authored Sigma

3 production-ready TTP rules (+2 scaffolds in the authoring queue) live at https://thrunt.me/sigma/manifest.json. Subscribe via https://thrunt.me/sigma/rules.lock.json (content-hash churn) or pull all with https://thrunt.me/sigma/rules.tar.gz.

Detection Gaps

17 of 157 techniques with corpus signal have zero detection coverage — no SigmaHQ community rule, no thrunt rule. This is the hand-authoring queue; the live view is at https://thrunt.me/corpus/attck/.

…and 7 more below the cut — full list on the rollup.

Pipeline Health

All feeds healthy.

Sources: SEC EDGAR (public domain), CISA Known Exploited Vulnerabilities (public domain), FIRST.org EPSS (per ToS), NIST NVD (public domain), GitHub Security Advisories (per ToS), abuse.ch URLhaus (CC0, attribution), ransomware.live (per ToS), MITRE ATT&CK (CC BY 4.0).

Published by Applied Cybernetics Group via thrunt.me. Heuristic cross-references are labelled as such; verify before action.