Morning Brief — 2026-08-01

4 material breach disclosures, 10 emerging critical cves, 10 supply chain, 58 ransomware activity, 1191 ioc volume, 12 active malware families, 11 multi-source iocs, 4 intel feeds, 5 hand-authored sigma, and 17 detection gaps. Sections with no signal are still rendered with an explicit “none in this window” note so absence is visible alongside presence.

Material Breach Disclosures

AMGEN INC (AMGN)

• Filed: 2026-07-31 · CIK 0000318154 · Accession 0000318154-26-000119
• Filing: https://www.sec.gov/Archives/edgar/data/318154/000031815426000119/amgn-20260729.htm

The Company has since learned that some of its data, including proprietary data, patient protected health information, and other information, has been exfiltrated from these cloud environments. To date, the Company has not identified any impact to its products, manufacturing operations, or financial reporting systems, or to the Company’s ability to meet patient needs. The investigation remains ong…

River Financial Corp (RVRF)

• Filed: 2026-07-30 · CIK 0001641601 · Accession 0001193125-26-325324
• Filing: https://www.sec.gov/Archives/edgar/data/1641601/000119312526325324/ck0001641601-20260619.htm

Since the date of the original filing, River’s investigation has progressed. River has determined that an unauthorized threat actor accessed portions of its network and removed certain data from its environment. River is working to determine the nature and scope of the information involved, including whether any personally identifiable information was affected. As part of its response, River took…

UPBOUND GROUP, INC. (UPBD)

• Filed: 2026-07-22 · CIK 0000933036 · Accession 0001193125-26-310605
• Filing: https://www.sec.gov/Archives/edgar/data/933036/000119312526310605/upbd-20260721.htm

Caution Concerning Forward-Looking Statements

This Current Report on Form 8-K contains “forward-looking statements” within the meaning of the Private Securities Litigation Reform Act of 1995. Such forward-looking statements involve risks and uncertainties, including statements regarding our understanding of the event and its potential impacts. Factors that could cause or contribute to material…

CID Holdco, Inc. (DAIC)

• Filed: 2026-07-22 · CIK 0002033770 · Accession 0001213900-26-080208
• Filing: https://www.sec.gov/Archives/edgar/data/2033770/000121390026080208/ea029882601ex10-1.htm

any written notice from any governmental authority alleging any material violation of applicable cybersecurity or data privacy laws that remains unresolved. To the Company’s knowledge, there are no pending or threatened claims, investigations or proceedings by any governmental authority relating to any material cybersecurity incident or any material violation of applicable cybersecurity or d…

Federal Patching Priority

No new KEV additions in this window.

Exploit Probability Movers

No CVEs with ≥0.20 EPSS movement in this window.

Emerging Critical CVEs

• CVE-2026-52855 · CRITICAL (9.9) · 2026-07-31 — Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.12.3, {{config.}} placeholders in egg configuration-file templates allow a low-privileged user to read {{con…
• CVE-2026-17566 · CRITICAL (9.9) · 2026-07-31 — pgAdmin 4’s Import/Export Data tool builds a psql \copy (…) command line by interpolating a user-supplied SQL query into a Jinja template and passing the rendered line to psql via —command. To stop an attacker from br…
• CVE-2026-15964 · CRITICAL (9.8) · 2026-08-01 — The Single Sign On For TNG plugin for WordPress is vulnerable to Authentication Bypass via unauthenticated password reset in all versions up to, and including, 2.0.0. This is due to the ssoprocess_ajax() function — reg…
• CVE-2026-68771 · CRITICAL (9.8) · 2026-07-31 — ComfyUI v0.23.0 contains an unsafe deserialization vulnerability in the LoadTrainingDataset node that allows unauthenticated remote attackers to execute arbitrary Python code by uploading a crafted pickle file and trigge…
• CVE-2026-68770 · CRITICAL (9.8) · 2026-07-31 — sentence-transformers contains a security control bypass vulnerability that allows attackers to achieve arbitrary code execution by exploiting a logic flaw in the import_module_class helper within sentence_transformers/u…
• CVE-2026-67822 · CRITICAL (9.8) · 2026-07-31 — Tenda W6-S 1.0.0.4(510) contains a stack-based buffer overflow vulnerability in the /goform/wifiSSIDset endpoint. The function formwrlSSIDset uses sprintf to copy user-controlled ‘GO’ and ‘index’ parameters into a 64-byt…
• CVE-2026-17561 · CRITICAL (9.8) · 2026-07-31 — Improper Control of Generation of Code (‘Code Injection’) vulnerability in Innotim Software, Telecommunications and Consulting Trade Ltd. Co. Logsign SIEM allows Code Injection.

This issue affects Logsign SIEM: before 6…

• CVE-2026-54725 · CRITICAL (9.6) · 2026-07-31 — vault-secrets-webhook is a Kubernetes mutating webhook that makes direct secret injection into Pods possible. Prior to 1.23.1, parseVaultConfig() in pkg/webhook/config.go accepts the vault.security.banzaicloud.io/vault-a…
• CVE-2026-17349 · CRITICAL (9.6) · 2026-07-31 — /misc/workspace/adhoc_connect_server, part of the Workspaces feature introduced in pgAdmin 4 9.0, when passed the id of an existing server, clones that server via Server.clone(), which copies every column from the source…
• CVE-2026-3141 · CRITICAL (9.1) · 2026-08-01 — The FormGent plugin for WordPress is vulnerable to unauthorized arbitrary file deletion due to a missing capability check on the /wp-json/formgent/responses/attachments REST API endpoint in all versions up to, and includ…

Supply Chain

GHSA-vvp7-h4fj-m28w · CVE-2026-54910 (go)

• HIGH · CVSS 7.7 · 2026-07-31
• Affected: github.com/gtsteffaniak/filebrowser/backend
• https://github.com/advisories/GHSA-vvp7-h4fj-m28w

FileBrowser Quantum’s path traversal issue in subtitle handler allows any authenticated user to read arbitrary files

GHSA-wf43-fpp3-cf65 · CVE-2026-53608 (npm)

• HIGH · CVSS 8.7 · 2026-07-31
• Affected: @apostrophecms/seo
• https://github.com/advisories/GHSA-wf43-fpp3-cf65

@apostrophecms/seo Vulnerable to Stored XSS via Unsanitized Google Analytics / GTM ID Injected into Script Tag

GHSA-6h5j-32cf-4253 · CVE-2026-53609 (npm)

• CRITICAL · CVSS 9.1 · 2026-07-31
• Affected: apostrophe
• https://github.com/advisories/GHSA-6h5j-32cf-4253

Apostrophe has Server-Side Prototype Pollution in apos.util.set via patch operators that leads to process-wide authorization bypass

GHSA-p849-8hwh-84j9 · CVE-2026-52887 (npm)

• CRITICAL · CVSS 10.0 · 2026-07-31
• Affected: @nocobase/plugin-notification-in-app-message
• https://github.com/advisories/GHSA-p849-8hwh-84j9

NocoBase: SQL injection in /api/myInAppChannels:list filter to PG-superuser RCE

GHSA-98pp-vccm-qm25 · CVE-2026-53599 (composer)

• HIGH · CVSS 7.5 · 2026-07-31
• Affected: redaxo/source
• https://github.com/advisories/GHSA-98pp-vccm-qm25

Redaxo has a Mediapool isAllowedExtension bypass via multi-segment filename that leads to authenticated RCE on Apache mod_php multi-extension handlers

GHSA-mx5j-mp4f-g8jg · CVE-2026-53510 (rubygems)

• HIGH · CVSS 8.1 · 2026-07-31
• Affected: savon
• https://github.com/advisories/GHSA-mx5j-mp4f-g8jg

Savon::Model evaluates WSDL operation names as Ruby source

GHSA-rxcw-mc6f-6hr3 · CVE-2026-58263 (npm)

• HIGH · CVSS 7.2 · 2026-07-31
• Affected: jodit
• https://github.com/advisories/GHSA-rxcw-mc6f-6hr3

Jodit Editor: Mutation XSS in jodit clean-html via a MathML/style rawtext carrier

GHSA-cj54-hpcc-gj6h · CVE-2026-53502 (pip)

• HIGH · 2026-07-31
• Affected: thumbor
• https://github.com/advisories/GHSA-cj54-hpcc-gj6h

Thumbor has path traversal via post-validation URL decoding bypass in file_loader

GHSA-phj3-59pf-cp83 · CVE-2026-53505 (pip)

• HIGH · CVSS 7.5 · 2026-07-31
• Affected: thumbor
• https://github.com/advisories/GHSA-phj3-59pf-cp83

Thumbor proportion filter allows unbounded post-transform resize leading to remote DoS

GHSA-5vjc-7cxw-4w6j · CVE-2026-53504 (pip)

• HIGH · CVSS 7.5 · 2026-07-31
• Affected: thumbor
• https://github.com/advisories/GHSA-5vjc-7cxw-4w6j

Thumbor has Regex Denial of Service (ReDoS) in convolution filter

Ransomware Activity

58 new victim postings across 11 groups.

IOC Volume

1191 new IOCs in this window. By source:

Recent OSINT Events

No curated MISP events in this window (bulk-IOC contributions tallied in IOC Volume).

Active Malware Families

12 malware families active this week (1 corroborated across ≥2 sources), exercising 17 ATT&CK techniques. Family is the unit, not the indicator: the raw IOCs are drill-down evidence below, not the signal.

Families marked ”→” are delivery/social-engineering clusters (ClickFix). Their technique mappings are the delivery chain — downstream behavior is payload-dependent, so they don’t open a hard coverage gap on their own.

Multi-Source IOCs

11 IOCs flagged by 2+ independent sources this window — the highest-confidence signal the cross-feed corpus produces.

MISP × KEV Correlation

No MISP events in this window referenced a CVE.

Cross-Reference

No SEC × KEV vendor token matches in this window. (This is a heuristic surface, absence is expected most days.)

Intel Feeds

4 IOC feeds updated this run (8,864 indicators total) — each available as CSV, MISP JSON, and STIX 2.1. Subscribe at https://thrunt.me/intel/manifest.json.

Hand-Authored Sigma

3 production-ready TTP rules (+2 scaffolds in the authoring queue) live at https://thrunt.me/sigma/manifest.json. Subscribe via https://thrunt.me/sigma/rules.lock.json (content-hash churn) or pull all with https://thrunt.me/sigma/rules.tar.gz.

Detection Gaps

17 of 157 techniques with corpus signal have zero detection coverage — no SigmaHQ community rule, no thrunt rule. This is the hand-authoring queue; the live view is at https://thrunt.me/corpus/attck/.

…and 7 more below the cut — full list on the rollup.

Pipeline Health

All feeds healthy.

Sources: SEC EDGAR (public domain), CISA Known Exploited Vulnerabilities (public domain), FIRST.org EPSS (per ToS), NIST NVD (public domain), GitHub Security Advisories (per ToS), abuse.ch URLhaus (CC0, attribution), ransomware.live (per ToS), MITRE ATT&CK (CC BY 4.0).

Published by Applied Cybernetics Group via thrunt.me. Heuristic cross-references are labelled as such; verify before action.