Morning Brief — 2026-08-05

5 material breach disclosures, 3 federal patching priority, 1 exploit probability movers, 10 emerging critical cves, 10 supply chain, 42 ransomware activity, 3328 ioc volume, 15 active malware families, 25 multi-source iocs, 4 intel feeds, 5 hand-authored sigma, and 17 detection gaps. Sections with no signal are still rendered with an explicit “none in this window” note so absence is visible alongside presence.

Material Breach Disclosures

Vivos Therapeutics, Inc. (VVOS)

• Filed: 2026-08-03 · CIK 0001716166 · Accession 0001493152-26-035867
• Filing: https://www.sec.gov/Archives/edgar/data/1716166/000149315226035867/ex10-2.htm

other applicable SEC cybersecurity disclosure rules. Provider shall maintain cyber liability and privacy liability insurance in amounts reasonably sufficient to cover its obligations under this Section 7.8, and shall provide Client with certificates of such insurance upon request.

Intellectual Property

8.1 Client Property. All financial statements, filings, board materials, internal con…

AMGEN INC (AMGN)

• Filed: 2026-07-31 · CIK 0000318154 · Accession 0000318154-26-000119
• Filing: https://www.sec.gov/Archives/edgar/data/318154/000031815426000119/amgn-20260729.htm

The Company has since learned that some of its data, including proprietary data, patient protected health information, and other information, has been exfiltrated from these cloud environments. To date, the Company has not identified any impact to its products, manufacturing operations, or financial reporting systems, or to the Company’s ability to meet patient needs. The investigation remains ong…

River Financial Corp (RVRF)

• Filed: 2026-07-30 · CIK 0001641601 · Accession 0001193125-26-325324
• Filing: https://www.sec.gov/Archives/edgar/data/1641601/000119312526325324/ck0001641601-20260619.htm

Since the date of the original filing, River’s investigation has progressed. River has determined that an unauthorized threat actor accessed portions of its network and removed certain data from its environment. River is working to determine the nature and scope of the information involved, including whether any personally identifiable information was affected. As part of its response, River took…

UPBOUND GROUP, INC. (UPBD)

• Filed: 2026-07-22 · CIK 0000933036 · Accession 0001193125-26-310605
• Filing: https://www.sec.gov/Archives/edgar/data/933036/000119312526310605/upbd-20260721.htm

Caution Concerning Forward-Looking Statements

This Current Report on Form 8-K contains “forward-looking statements” within the meaning of the Private Securities Litigation Reform Act of 1995. Such forward-looking statements involve risks and uncertainties, including statements regarding our understanding of the event and its potential impacts. Factors that could cause or contribute to material…

CID Holdco, Inc. (DAIC)

• Filed: 2026-07-22 · CIK 0002033770 · Accession 0001213900-26-080208
• Filing: https://www.sec.gov/Archives/edgar/data/2033770/000121390026080208/ea029882601ex10-1.htm

any written notice from any governmental authority alleging any material violation of applicable cybersecurity or data privacy laws that remains unresolved. To the Company’s knowledge, there are no pending or threatened claims, investigations or proceedings by any governmental authority relating to any material cybersecurity incident or any material violation of applicable cybersecurity or d…

Federal Patching Priority

CVE-2026-34486 — Apache Tomcat

Apache Tomcat Missing Encryption of Sensitive Data Vulnerability

• Added: 2026-08-04 · Federal due: 2026-08-07 · EPSS 98.6th pct (score 0.426) · CVSS 7.5 (HIGH) · CWE-311, CWE-807
• ransomware use: Unknown

Apache Tomcat contains a missing encryption of sensitive data vulnerability that allows the bypass of the EncryptInterceptor.

Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypass of the EncryptInterceptor. This issue affects Apache Tomcat: 11.0.20, 10.1.53, 9.0.116. Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fix the issue.

CVE-2026-9198 — IBM Langflow

IBM Langflow Code Injection Vulnerability

• Added: 2026-08-04 · Federal due: 2026-08-07 · EPSS 77.5th pct (score 0.019) · CVSS 9.8 (CRITICAL) · CWE-94
• ransomware use: Unknown

Langflow contains a code injection vulnerability that allows unauthenticated attackers to achieve full remote code execution on default Langflow deployments.

IBM Langflow OSS 1.0.0 through 1.10.0 allows unauthenticated attackers to chain /api/v1/auto_login (mints SUPERUSER tokens to any network caller) with /api/v1/validate/code (executes user code via exec()) to achieve full RCE on default Langflow deployments

CVE-2026-18556 — N-able N-central

N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability

• Added: 2026-08-04 · Federal due: 2026-08-07 · EPSS 19.1th pct (score 0.003) · CVSS 7.4 (HIGH) · CWE-288
• ransomware use: Unknown

N-able N-central contains an authentication bypass using an alternate path or channel that allows for authentication bypass.

Authentication bypass using an alternate path or channel vulnerability in N-able N-central allows Authentication Bypass. This issue affects N-central: through 2026.1.

Exploit Probability Movers

Emerging Critical CVEs

• CVE-2026-10090 · CRITICAL (9.9) · 2026-08-05 — A flaw was found in the Application Subscription controller (multicluster-operators-subscription) of Red Hat Advanced Cluster Management for Kubernetes (ACM). A user with namespace-scoped “edit” privileges in an ACM hub…
• CVE-2026-71214 · CRITICAL (9.8) · 2026-08-05 — The Aerie/PlanDev sequencing-server’s authorization middleware (sequencing-server/src/app.ts) derives the caller’s Hasura session role via getHasuraSession(), which prefers a session_variables object taken directly from…
• CVE-2026-71207 · CRITICAL (9.8) · 2026-08-05 — The Stock-Inventory-Management-System application’s login.php assigns raw $_POST username/password values to $_SESSION and builds its authentication query by directly concatenating those session values into a SQL stateme…
• CVE-2026-70554 · CRITICAL (9.8) · 2026-08-04 — MaxSite CMS contains a PHP object injection vulnerability that allows unauthenticated attackers to execute arbitrary code by passing attacker-controlled serialized data in the maxsite_comuser cookie directly to unseriali…
• CVE-2026-45538 · CRITICAL (9.8) · 2026-08-04 — OpenSIPS is a Session Initiation Protocol (SIP) server implementation. In versions 4.0.0 and prior, processing a SIP message with a header name longer than 255 bytes causes a stack buffer overflow when sip_to_json() is c…
• CVE-2026-70553 · CRITICAL (9.8) · 2026-08-04 — MaxSite CMS contains a remote code execution vulnerability that allows unauthenticated attackers to inject arbitrary PHP code into the application configuration file by submitting crafted POST requests to the install end…
• CVE-2026-70552 · CRITICAL (9.8) · 2026-08-04 — MaxSite CMS 109.5 and earlier contains an authentication bypass vulnerability in the AJAX dispatcher that allows unauthenticated attackers to access admin-gated endpoints by supplying any X-Requested-With header and requ…
• CVE-2026-69703 · CRITICAL (9.8) · 2026-08-04 — Atlas-Livre contains an improper access control vulnerability in the admin controllers under Espace_admin/controleur/ that allows unauthenticated attackers to bypass session-based authentication guards by sending raw HTT…
• CVE-2026-49435 · CRITICAL (9.8) · 2026-08-04 — Keysight IxChariot Endpoint and associated products contain a stack-based buffer overflow. An unauthenticated remote attacker can send a specially crafted packet and execute arbitrary code with administrative privileges.
• CVE-2026-0163 · CRITICAL (9.8) · 2026-08-04 — In multiple functions of vpu_ioctl.c, there is a possible use after free due to a use after free. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not…

Supply Chain

GHSA-xpp7-93x6-v29m · CVE-2026-53950 (npm)

• HIGH · CVSS 7.5 · 2026-08-04
• Affected: @tryghost/activitypub
• https://github.com/advisories/GHSA-xpp7-93x6-v29m

XSS in Ghost’s ActivityPub client

GHSA-3cg5-48j3-v4gv · CVE-2026-70494 (pip)

• HIGH · CVSS 8.1 · 2026-08-04
• Affected: open-webui
• https://github.com/advisories/GHSA-3cg5-48j3-v4gv

Open WebUI: A folder write-collaborator can permanently delete the owner’s chats by deleting a shared subfolder

GHSA-pwxh-7358-jq2x · CVE-2026-70492 (pip)

• HIGH · CVSS 8.7 · 2026-08-04
• Affected: open-webui
• https://github.com/advisories/GHSA-pwxh-7358-jq2x

Open WebUI: Stored XSS via unescaped KaTeX render-error fallback in rendered messages

GHSA-3xpf-xq7r-v8c5 · CVE-2026-70486 (pip)

• HIGH · CVSS 8.2 · 2026-08-04
• Affected: open-webui
• https://github.com/advisories/GHSA-3xpf-xq7r-v8c5

Open WebUI: Same-origin XSS to account takeover via terminal file-preview iframe hardcoding allow-same-origin

GHSA-8x5v-cpv7-8jjp · CVE-2026-70485 (pip)

• HIGH · CVSS 7.1 · 2026-08-04
• Affected: open-webui
• https://github.com/advisories/GHSA-8x5v-cpv7-8jjp

Open WebUI: Any authenticated user can reach internal services and cloud metadata via NAT64-encoded URLs

GHSA-rq84-p6rr-vf89 · CVE-2026-70482 (pip)

• HIGH · CVSS 8.1 · 2026-08-04
• Affected: open-webui
• https://github.com/advisories/GHSA-rq84-p6rr-vf89

Open WebUI: Account takeover via OAuth token exchange accepting tokens issued to any client

GHSA-w2rx-84hp-gg95 · CVE-2026-70479 (pip)

• HIGH · CVSS 7.7 · 2026-08-04
• Affected: open-webui
• https://github.com/advisories/GHSA-w2rx-84hp-gg95

Open WebUI: SSRF into internal services via unvalidated sub-resource requests in the Playwright web loader

GHSA-qgvm-j2hm-6m38 · CVE-2026-70478 (npm)

• CRITICAL · 2026-08-04
• Affected: flowise
• https://github.com/advisories/GHSA-qgvm-j2hm-6m38

Flowise: Unauthenticated OAuth2 token refresh endpoint returns access tokens — enables token theft for any connected service

GHSA-5xvg-pmgg-3mxr · CVE-2026-70477 (npm)

• CRITICAL · 2026-08-04
• Affected: flowise, flowise-components
• https://github.com/advisories/GHSA-5xvg-pmgg-3mxr

Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability

GHSA-gmmw-qg98-6j6p · CVE-2026-70476 (npm)

• HIGH · 2026-08-04
• Affected: flowise
• https://github.com/advisories/GHSA-gmmw-qg98-6j6p

Flowise: Broken Access Control in Stripe Subscription Endpoints Allows Cross-Tenant Billing Manipulation

Ransomware Activity

42 new victim postings across 11 groups.

IOC Volume

3328 new IOCs in this window. By source:

Recent OSINT Events

No curated MISP events in this window (bulk-IOC contributions tallied in IOC Volume).

Active Malware Families

15 malware families active this week (2 corroborated across ≥2 sources), exercising 14 ATT&CK techniques. Family is the unit, not the indicator: the raw IOCs are drill-down evidence below, not the signal.

Families marked ”→” are delivery/social-engineering clusters (ClickFix). Their technique mappings are the delivery chain — downstream behavior is payload-dependent, so they don’t open a hard coverage gap on their own.

Multi-Source IOCs

25 IOCs flagged by 2+ independent sources this window — the highest-confidence signal the cross-feed corpus produces.

MISP × KEV Correlation

No MISP events in this window referenced a CVE.

Cross-Reference

No SEC × KEV vendor token matches in this window. (This is a heuristic surface, absence is expected most days.)

Intel Feeds

4 IOC feeds updated this run (9,119 indicators total) — each available as CSV, MISP JSON, and STIX 2.1. Subscribe at https://thrunt.me/intel/manifest.json.

Hand-Authored Sigma

3 production-ready TTP rules (+2 scaffolds in the authoring queue) live at https://thrunt.me/sigma/manifest.json. Subscribe via https://thrunt.me/sigma/rules.lock.json (content-hash churn) or pull all with https://thrunt.me/sigma/rules.tar.gz.

Detection Gaps

17 of 156 techniques with corpus signal have zero detection coverage — no SigmaHQ community rule, no thrunt rule. This is the hand-authoring queue; the live view is at https://thrunt.me/corpus/attck/.

…and 7 more below the cut — full list on the rollup.

Pipeline Health

All feeds healthy.

Sources: SEC EDGAR (public domain), CISA Known Exploited Vulnerabilities (public domain), FIRST.org EPSS (per ToS), NIST NVD (public domain), GitHub Security Advisories (per ToS), abuse.ch URLhaus (CC0, attribution), ransomware.live (per ToS), MITRE ATT&CK (CC BY 4.0).

Published by Applied Cybernetics Group via thrunt.me. Heuristic cross-references are labelled as such; verify before action.