Morning Brief — 2026-07-31

4 material breach disclosures, 2 exploit probability movers, 10 emerging critical cves, 10 supply chain, 15 ransomware activity, 1138 ioc volume, 12 active malware families, 25 multi-source iocs, 4 intel feeds, 5 hand-authored sigma, and 17 detection gaps. Sections with no signal are still rendered with an explicit “none in this window” note so absence is visible alongside presence.

Material Breach Disclosures

River Financial Corp (RVRF)

• Filed: 2026-07-30 · CIK 0001641601 · Accession 0001193125-26-325324
• Filing: https://www.sec.gov/Archives/edgar/data/1641601/000119312526325324/ck0001641601-20260619.htm

Since the date of the original filing, River’s investigation has progressed. River has determined that an unauthorized threat actor accessed portions of its network and removed certain data from its environment. River is working to determine the nature and scope of the information involved, including whether any personally identifiable information was affected. As part of its response, River took…

UPBOUND GROUP, INC. (UPBD)

• Filed: 2026-07-22 · CIK 0000933036 · Accession 0001193125-26-310605
• Filing: https://www.sec.gov/Archives/edgar/data/933036/000119312526310605/upbd-20260721.htm

Caution Concerning Forward-Looking Statements

This Current Report on Form 8-K contains “forward-looking statements” within the meaning of the Private Securities Litigation Reform Act of 1995. Such forward-looking statements involve risks and uncertainties, including statements regarding our understanding of the event and its potential impacts. Factors that could cause or contribute to material…

CID Holdco, Inc. (DAIC)

• Filed: 2026-07-22 · CIK 0002033770 · Accession 0001213900-26-080208
• Filing: https://www.sec.gov/Archives/edgar/data/2033770/000121390026080208/ea029882601ex10-1.htm

any written notice from any governmental authority alleging any material violation of applicable cybersecurity or data privacy laws that remains unresolved. To the Company’s knowledge, there are no pending or threatened claims, investigations or proceedings by any governmental authority relating to any material cybersecurity incident or any material violation of applicable cybersecurity or d…

River Financial Corp (RVRF)

• Filed: 2026-07-17 · CIK 0001641601 · Accession 0001193125-26-307288
• Filing: https://www.sec.gov/Archives/edgar/data/1641601/000119312526307288/ck0001641601-20260619.htm

As set forth in its Form 8-K filed July 10, 2026, two class action lawsuits were filed relating to the unauthorized threat actor gaining access to the network environment of River Financial Corporation, including River Bank & Trust (together, “River”). A third class action was filed against River on July 10, 2026 and a fourth class action was filed against River on July 16, 2026.

 

The principal…

Federal Patching Priority

No new KEV additions in this window.

Exploit Probability Movers

Emerging Critical CVEs

• CVE-2026-18452 · CRITICAL (10.0) · 2026-07-31 — DMS+ (Non-Mobile) developed by Rich Source has a Use of Hard-coded Credentials vulnerability. Unauthenticated remote attackers can exploit a fixed API key to gain control over all installed DMS+ devices.
• CVE-2026-66803 · CRITICAL (10.0) · 2026-07-30 — Improper access control in Azure Cosmos DB allows an unauthorized attacker to execute code over a network.
• CVE-2026-12946 · CRITICAL (9.9) · 2026-07-30 — IBM Langflow OSS 1.0.0 through 1.10.0 could allow a remote attacker to inject arbitrary code on the system, due to the improper control of user input code.
• CVE-2026-13435 · CRITICAL (9.9) · 2026-07-30 — IBM Langflow OSS 1.0.0 through 1.10.1 contains an improper input validation vulnerability in the PythonREPL sandbox implementation.
• CVE-2026-14483 · CRITICAL (9.8) · 2026-07-31 — The Realtyna Organic IDX plugin + WPL Real Estate plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 5.2.0 via the upload function. This is due to missing file type validati…
• CVE-2026-63223 · CRITICAL (9.8) · 2026-07-31 — CodeIgniter is a PHP full-stack web framework. Prior to 4.7.4, the is_image and mime_in upload validation rules do not independently enforce a safe client filename extension, allowing a remote attacker to upload executab…
• CVE-2026-68503 · CRITICAL (9.8) · 2026-07-30 — LazyOwn RedTeam/APT Framework is an AI-powered C2 and red-team operations framework. Prior to 0.2.154, LazyOwn ships default C2 credentials LazyOwn and LazyOwn in payload.json and core/payload_schema.py and passes them u…
• CVE-2026-68502 · CRITICAL (9.8) · 2026-07-30 — LazyOwn RedTeam/APT Framework is an AI-powered C2 and red-team operations framework. Prior to 0.2.154, LazyOwn’s lazyc2.py registers an unauthenticated Socket.IO input event handler that dispatches data.get(‘value’) to L…
• CVE-2026-67594 · CRITICAL (9.8) · 2026-07-30 — Spikster through commit e1cdf8c contains a missing authentication vulnerability that allows unauthenticated remote attackers to access all API routes by exploiting the unattached CipiAuth middleware, which is registered…
• CVE-2026-67208 · CRITICAL (9.8) · 2026-07-30 — Juggle through 1.6.0 contains a remote code execution vulnerability that allows unauthenticated remote attackers to execute arbitrary OS commands by connecting to the exposed H2 database web console using default shipped…

Supply Chain

GHSA-hf3j-86p7-mfw8 · CVE-2025-4318 (npm)

• CRITICAL · 2026-07-30
• Affected: @aws-amplify/codegen-ui-react
• https://github.com/advisories/GHSA-hf3j-86p7-mfw8

AWS Amplify Studio UI Component Properties Has an Input Validation Issue

GHSA-xr9x-r78c-5hrm · CVE-2026-66066 (rubygems)

• CRITICAL · 2026-07-30
• Affected: activestorage, activestorage, activestorage
• https://github.com/advisories/GHSA-xr9x-r78c-5hrm

Active Storage has possible arbitrary file read and remote code execution in Active Storage variant processing

GHSA-cg4g-m8jx-vjv2 · CVE-2026-54722 (npm)

• HIGH · 2026-07-30
• Affected: dssrf
• https://github.com/advisories/GHSA-cg4g-m8jx-vjv2

dssrf has an SSRF bypass with remove_at_symbol_in_string

GHSA-c9hr-64h3-gxpc · CVE-2026-67424 (pip)

• HIGH · CVSS 8.5 · 2026-07-30
• Affected: flyto-core
• https://github.com/advisories/GHSA-c9hr-64h3-gxpc

Flyto2 Core: Guarded HTTP modules follow redirects into internal space without per-hop SSRF revalidation

GHSA-pgwh-4jj4-qm8v · CVE-2026-67428 (pip)

• HIGH · CVSS 8.5 · 2026-07-30
• Affected: flyto-core
• https://github.com/advisories/GHSA-pgwh-4jj4-qm8v

Flyto2 Core: Multiple HTTP-family modules fetch client-controlled URLs without the SSRF guard their siblings apply (SSRF to internal/metadata)

GHSA-jx74-cqjv-2c67 · CVE-2026-67426 (pip)

• CRITICAL · CVSS 9.3 · 2026-07-30
• Affected: flyto-core
• https://github.com/advisories/GHSA-jx74-cqjv-2c67

Flyto2 Core: Unauthenticated flyto-verification /run: callback_url SSRF and internal runner-secret exfiltration

GHSA-qq9q-xgm3-xv9g · CVE-2026-67425 (pip)

• HIGH · CVSS 8.6 · 2026-07-30
• Affected: flyto-core
• https://github.com/advisories/GHSA-qq9q-xgm3-xv9g

Flyto2 Core: LLM/API keys leak to an attacker-controlled base_url

GHSA-hr7p-wg7r-hg9m · CVE-2026-67427 (pip)

• HIGH · CVSS 8.6 · 2026-07-30
• Affected: flyto-core
• https://github.com/advisories/GHSA-hr7p-wg7r-hg9m

Flyto2 Core: ${env.VAR} interpolation reads any env secret despite env.get being denylisted

GHSA-2956-977x-2w3r · CVE-2026-67429 (pip)

• CRITICAL · CVSS 10.0 · 2026-07-30
• Affected: flyto-core
• https://github.com/advisories/GHSA-2956-977x-2w3r

Flyto2 Core: Arbitrary file write via image.download (and other file-writing modules)

GHSA-5p9g-j988-pcwv · CVE-2026-67431 (rubygems)

• HIGH · 2026-07-30
• Affected: mcp
• https://github.com/advisories/GHSA-5p9g-j988-pcwv

MCP Ruby SDK: Ruby SSE Session Poisoning

Ransomware Activity

15 new victim postings across 8 groups.

IOC Volume

1138 new IOCs in this window. By source:

Recent OSINT Events

No curated MISP events in this window (bulk-IOC contributions tallied in IOC Volume).

Active Malware Families

12 malware families active this week (1 corroborated across ≥2 sources), exercising 17 ATT&CK techniques. Family is the unit, not the indicator: the raw IOCs are drill-down evidence below, not the signal.

Families marked ”→” are delivery/social-engineering clusters (ClickFix). Their technique mappings are the delivery chain — downstream behavior is payload-dependent, so they don’t open a hard coverage gap on their own.

Multi-Source IOCs

25 IOCs flagged by 2+ independent sources this window — the highest-confidence signal the cross-feed corpus produces.

MISP × KEV Correlation

No MISP events in this window referenced a CVE.

Cross-Reference

No SEC × KEV vendor token matches in this window. (This is a heuristic surface, absence is expected most days.)

Intel Feeds

4 IOC feeds updated this run (8,626 indicators total) — each available as CSV, MISP JSON, and STIX 2.1. Subscribe at https://thrunt.me/intel/manifest.json.

Hand-Authored Sigma

3 production-ready TTP rules (+2 scaffolds in the authoring queue) live at https://thrunt.me/sigma/manifest.json. Subscribe via https://thrunt.me/sigma/rules.lock.json (content-hash churn) or pull all with https://thrunt.me/sigma/rules.tar.gz.

Detection Gaps

17 of 157 techniques with corpus signal have zero detection coverage — no SigmaHQ community rule, no thrunt rule. This is the hand-authoring queue; the live view is at https://thrunt.me/corpus/attck/.

…and 7 more below the cut — full list on the rollup.

Pipeline Health

All feeds healthy.

Sources: SEC EDGAR (public domain), CISA Known Exploited Vulnerabilities (public domain), FIRST.org EPSS (per ToS), NIST NVD (public domain), GitHub Security Advisories (per ToS), abuse.ch URLhaus (CC0, attribution), ransomware.live (per ToS), MITRE ATT&CK (CC BY 4.0).

Published by Applied Cybernetics Group via thrunt.me. Heuristic cross-references are labelled as such; verify before action.