Morning Brief — 2026-08-04

5 material breach disclosures, 1 federal patching priority, 1 exploit probability movers, 10 emerging critical cves, 10 supply chain, 25 ransomware activity, 7621 ioc volume, 13 active malware families, 25 multi-source iocs, 4 intel feeds, 5 hand-authored sigma, and 17 detection gaps. Sections with no signal are still rendered with an explicit “none in this window” note so absence is visible alongside presence.

Material Breach Disclosures

Vivos Therapeutics, Inc. (VVOS)

• Filed: 2026-08-03 · CIK 0001716166 · Accession 0001493152-26-035867
• Filing: https://www.sec.gov/Archives/edgar/data/1716166/000149315226035867/ex10-2.htm

other applicable SEC cybersecurity disclosure rules. Provider shall maintain cyber liability and privacy liability insurance in amounts reasonably sufficient to cover its obligations under this Section 7.8, and shall provide Client with certificates of such insurance upon request.

Intellectual Property

8.1 Client Property. All financial statements, filings, board materials, internal con…

AMGEN INC (AMGN)

• Filed: 2026-07-31 · CIK 0000318154 · Accession 0000318154-26-000119
• Filing: https://www.sec.gov/Archives/edgar/data/318154/000031815426000119/amgn-20260729.htm

The Company has since learned that some of its data, including proprietary data, patient protected health information, and other information, has been exfiltrated from these cloud environments. To date, the Company has not identified any impact to its products, manufacturing operations, or financial reporting systems, or to the Company’s ability to meet patient needs. The investigation remains ong…

River Financial Corp (RVRF)

• Filed: 2026-07-30 · CIK 0001641601 · Accession 0001193125-26-325324
• Filing: https://www.sec.gov/Archives/edgar/data/1641601/000119312526325324/ck0001641601-20260619.htm

Since the date of the original filing, River’s investigation has progressed. River has determined that an unauthorized threat actor accessed portions of its network and removed certain data from its environment. River is working to determine the nature and scope of the information involved, including whether any personally identifiable information was affected. As part of its response, River took…

UPBOUND GROUP, INC. (UPBD)

• Filed: 2026-07-22 · CIK 0000933036 · Accession 0001193125-26-310605
• Filing: https://www.sec.gov/Archives/edgar/data/933036/000119312526310605/upbd-20260721.htm

Caution Concerning Forward-Looking Statements

This Current Report on Form 8-K contains “forward-looking statements” within the meaning of the Private Securities Litigation Reform Act of 1995. Such forward-looking statements involve risks and uncertainties, including statements regarding our understanding of the event and its potential impacts. Factors that could cause or contribute to material…

CID Holdco, Inc. (DAIC)

• Filed: 2026-07-22 · CIK 0002033770 · Accession 0001213900-26-080208
• Filing: https://www.sec.gov/Archives/edgar/data/2033770/000121390026080208/ea029882601ex10-1.htm

any written notice from any governmental authority alleging any material violation of applicable cybersecurity or data privacy laws that remains unresolved. To the Company’s knowledge, there are no pending or threatened claims, investigations or proceedings by any governmental authority relating to any material cybersecurity incident or any material violation of applicable cybersecurity or d…

Federal Patching Priority

CVE-2026-18577 — N-able N-central

N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability

• Added: 2026-08-03 · Federal due: 2026-08-06 · EPSS 71.3th pct (score 0.015) · CWE-288
• ransomware use: Unknown

N-able N-central contains an authentication bypass using an alternate path or channel allows for authentication bypass and account takeover in N-central. This vulnerability is the result of an incomplete patch for CVE-2026-18556.

An incomplete patch for CVE-2026-18556 allows for authentication bypass and account takeover in N-central Versions through 2026.3.1

Exploit Probability Movers

Emerging Critical CVEs

• CVE-2026-48331 · CRITICAL (10.0) · 2026-08-03 — Adobe Campaign Classic (ACC) is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. Exploitation of this issue does not require user interaction. Scope is changed.
• CVE-2026-48330 · CRITICAL (10.0) · 2026-08-03 — Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability that could result in arbitrary code execution in the context of the curren…
• CVE-2026-48323 · CRITICAL (10.0) · 2026-08-03 — Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in arbitrary code execution in the context of the current user. An atta…
• CVE-2026-69085 · CRITICAL (10.0) · 2026-08-03 — SiYuan before v3.7.3 contains a SQL injection vulnerability in the /api/filetree/searchDocs endpoint, where the caller-supplied keyword parameter is concatenated directly into SQL statements with no escaping or parameter…
• CVE-2026-69084 · CRITICAL (10.0) · 2026-08-03 — SiYuan versions <= v3.7.2 expose the /api/search/searchEmbedBlock endpoint, which passes a client-supplied SQL statement verbatim to the main read-write siyuan.db handle with no single-statement, read-only, or admin rest…
• CVE-2026-69083 · CRITICAL (10.0) · 2026-08-03 — SiYuan versions before v3.7.3 contain SQL injection vulnerabilities in the fullTextSearchAssetContent endpoint reachable by unauthenticated users and publish RoleReader tokens. Attackers can execute arbitrary SQL on the…
• CVE-2026-48326 · CRITICAL (9.9) · 2026-08-03 — Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability that could result in arbitrary code execution in the context of the curren…
• CVE-2026-18686 · CRITICAL (9.8) · 2026-08-04 — A vulnerability was detected in GL.iNet GL-MT3000 up to 4.4.5. The affected element is the function nas-web.add_user of the file /cgi-bin/glc of the component nas-web RPC Wrapper. Performing a manipulation results in com…
• CVE-2026-18685 · CRITICAL (9.8) · 2026-08-04 — A security vulnerability has been detected in GL.iNet GL-MT3000 up to 4.4.5. Impacted is the function set_upgrade of the file /cgi-bin/glc of the component modem.so. Such manipulation leads to command injection. It is po…
• CVE-2026-48333 · CRITICAL (9.8) · 2026-08-03 — Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could exploit this vulnerability to gain elevated privileges. Exploitation of th…

Supply Chain

GHSA-jwv3-5hgf-82ww · CVE-2026-69249 (pip)

• HIGH · 2026-08-03
• Affected: cryptography
• https://github.com/advisories/GHSA-jwv3-5hgf-82ww

python-cryptography: Duplicate self-signed intermediates can cause exponential path-building

GHSA-g6cj-pr64-35w5 · CVE-2026-69247 (pip)

• HIGH · 2026-08-03
• Affected: cryptography
• https://github.com/advisories/GHSA-g6cj-pr64-35w5

cryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle through distinguishable errors and timing

GHSA-v5mv-p594-2x33 · CVE-2026-69246 (composer)

• HIGH · CVSS 7.2 · 2026-08-03
• Affected: guzzlehttp/guzzle, guzzlehttp/guzzle
• https://github.com/advisories/GHSA-v5mv-p594-2x33

Guzzle: Noncanonical host can bypass host-based checks

GHSA-cq5v-8q36-5273 · CVE-2026-69244 (pip)

• HIGH · 2026-08-03
• Affected: aiohttp
• https://github.com/advisories/GHSA-cq5v-8q36-5273

AIOHTTP: Out-of-bounds heap read in C HTTP response parser error path (malformed chunked response)

GHSA-v8fg-2rw7-q452 · CVE-2026-69240 (npm)

• CRITICAL · CVSS 9.8 · 2026-08-03
• Affected: sequelize
• https://github.com/advisories/GHSA-v8fg-2rw7-q452

Sequelize: SQL Injection (Oracle DB)

GHSA-3f7w-8rr8-f37f (pip)

• HIGH · CVSS 8.1 · 2026-08-03
• Affected: GitPython
• https://github.com/advisories/GHSA-3f7w-8rr8-f37f

GitPython: Unguarded git option forwarding in IndexFile.checkout() and TagReference.create() enables arbitrary file overwrite and arbitrary file read

GHSA-mwp4-54f8-5fhr · CVE-2026-69192 (npm)

• HIGH · 2026-08-03
• Affected: ip-address
• https://github.com/advisories/GHSA-mwp4-54f8-5fhr

ip-address: Address4 decodes leading-zero octets as decimal while resolvers decode them as octal, allowing SSRF and trust-boundary bypass

GHSA-4cwx-7wf7-3272 · CVE-2026-13697 (npm)

• HIGH · CVSS 7.4 · 2026-08-03
• Affected: undici, undici
• https://github.com/advisories/GHSA-4cwx-7wf7-3272

undici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directives

GHSA-7p8r-x3mc-p8w7 · CVE-2026-18446 (npm)

• HIGH · CVSS 7.5 · 2026-08-03
• Affected: fast-uri, fast-uri, fast-uri
• https://github.com/advisories/GHSA-7p8r-x3mc-p8w7

fast-uri vulnerable to host confusion via backslash authority introducer

GHSA-2m8v-j782-fhvr · CVE-2026-69185 (npm)

• HIGH · CVSS 7.5 · 2026-08-03
• Affected: socket.io-parser, socket.io-parser, socket.io-parser
• https://github.com/advisories/GHSA-2m8v-j782-fhvr

Socket.IO: Zero-attachment Memory Exhaustion

Ransomware Activity

25 new victim postings across 8 groups.

IOC Volume

7621 new IOCs in this window. By source:

Recent OSINT Events

No curated MISP events in this window (bulk-IOC contributions tallied in IOC Volume).

Active Malware Families

13 malware families active this week (1 corroborated across ≥2 sources), exercising 16 ATT&CK techniques. Family is the unit, not the indicator: the raw IOCs are drill-down evidence below, not the signal.

Families marked ”→” are delivery/social-engineering clusters (ClickFix). Their technique mappings are the delivery chain — downstream behavior is payload-dependent, so they don’t open a hard coverage gap on their own.

Multi-Source IOCs

25 IOCs flagged by 2+ independent sources this window — the highest-confidence signal the cross-feed corpus produces.

MISP × KEV Correlation

No MISP events in this window referenced a CVE.

Cross-Reference

No SEC × KEV vendor token matches in this window. (This is a heuristic surface, absence is expected most days.)

Intel Feeds

4 IOC feeds updated this run (9,011 indicators total) — each available as CSV, MISP JSON, and STIX 2.1. Subscribe at https://thrunt.me/intel/manifest.json.

Hand-Authored Sigma

3 production-ready TTP rules (+2 scaffolds in the authoring queue) live at https://thrunt.me/sigma/manifest.json. Subscribe via https://thrunt.me/sigma/rules.lock.json (content-hash churn) or pull all with https://thrunt.me/sigma/rules.tar.gz.

Detection Gaps

17 of 156 techniques with corpus signal have zero detection coverage — no SigmaHQ community rule, no thrunt rule. This is the hand-authoring queue; the live view is at https://thrunt.me/corpus/attck/.

…and 7 more below the cut — full list on the rollup.

Pipeline Health

All feeds healthy.

Sources: SEC EDGAR (public domain), CISA Known Exploited Vulnerabilities (public domain), FIRST.org EPSS (per ToS), NIST NVD (public domain), GitHub Security Advisories (per ToS), abuse.ch URLhaus (CC0, attribution), ransomware.live (per ToS), MITRE ATT&CK (CC BY 4.0).

Published by Applied Cybernetics Group via thrunt.me. Heuristic cross-references are labelled as such; verify before action.