Morning Brief — 2026-08-06

3 material breach disclosures, 1 federal patching priority, 3 exploit probability movers, 10 emerging critical cves, 10 supply chain, 100 ransomware activity, 3554 ioc volume, 15 active malware families, 25 multi-source iocs, 4 intel feeds, 5 hand-authored sigma, and 17 detection gaps. Sections with no signal are still rendered with an explicit “none in this window” note so absence is visible alongside presence.

Material Breach Disclosures

Vivos Therapeutics, Inc. (VVOS)

• Filed: 2026-08-03 · CIK 0001716166 · Accession 0001493152-26-035867
• Filing: https://www.sec.gov/Archives/edgar/data/1716166/000149315226035867/ex10-2.htm

other applicable SEC cybersecurity disclosure rules. Provider shall maintain cyber liability and privacy liability insurance in amounts reasonably sufficient to cover its obligations under this Section 7.8, and shall provide Client with certificates of such insurance upon request.

Intellectual Property

8.1 Client Property. All financial statements, filings, board materials, internal con…

AMGEN INC (AMGN)

• Filed: 2026-07-31 · CIK 0000318154 · Accession 0000318154-26-000119
• Filing: https://www.sec.gov/Archives/edgar/data/318154/000031815426000119/amgn-20260729.htm

The Company has since learned that some of its data, including proprietary data, patient protected health information, and other information, has been exfiltrated from these cloud environments. To date, the Company has not identified any impact to its products, manufacturing operations, or financial reporting systems, or to the Company’s ability to meet patient needs. The investigation remains ong…

River Financial Corp (RVRF)

• Filed: 2026-07-30 · CIK 0001641601 · Accession 0001193125-26-325324
• Filing: https://www.sec.gov/Archives/edgar/data/1641601/000119312526325324/ck0001641601-20260619.htm

Since the date of the original filing, River’s investigation has progressed. River has determined that an unauthorized threat actor accessed portions of its network and removed certain data from its environment. River is working to determine the nature and scope of the information involved, including whether any personally identifiable information was affected. As part of its response, River took…

Federal Patching Priority

CVE-2026-63077 — JetBrains TeamCity

JetBrains TeamCity Deserialization of Untrusted Data Vulnerability

• Added: 2026-08-05 · Federal due: 2026-08-08 · EPSS 47.6th pct (score 0.006) · CVSS 9.8 (CRITICAL) · CWE-502
• ransomware use: Unknown

JetBrains TeamCity contains a deserialization of untrusted data vulnerability that could allow unauthenticated remote code execution via the agent polling protocol.

In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent polling protocol

Exploit Probability Movers

Emerging Critical CVEs

• CVE-2026-5430 · CRITICAL (10.0) · 2026-08-06 — The JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly configured or supported. This allows an attacker to craft a JWT with an unsupported algorithm, which is then incorrectly…
• CVE-2026-48168 · CRITICAL (10.0) · 2026-08-05 — PraisonAI is a multi-agent teams system. In versions prior to 4.6.40, the bundled Claude GitHub Actions workflow is vulnerable to command injection because it embeds an attacker-controlled pull request branch name into a…
• CVE-2026-70615 · CRITICAL (9.9) · 2026-08-05 — boringproxy through 0.10.0 contains a newline injection vulnerability that allows authenticated low-privileged users with tunnel-creation permission to inject arbitrary lines into the server account’s SSH authorized_keys…
• CVE-2026-20304 · CRITICAL (9.9) · 2026-08-05 — As part of Cisco’s ongoing commitment to proactive security and product quality, the Cisco Catalyst SD-WAN engineering team has conducted a comprehensive internal security review. This review resulted in a software harde…
• CVE-2026-20303 · CRITICAL (9.9) · 2026-08-05 — As part of Cisco’s ongoing commitment to proactive security and product quality, the Cisco Catalyst SD-WAN engineering team has conducted a comprehensive internal security review. This review resulted in software hardeni…
• CVE-2026-9193 · CRITICAL (9.9) · 2026-08-05 — An improper privilege management vulnerability in the Hadoop integration of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an authenticated user with a low-privileged Hadoop role to escalate privileges and exe…
• CVE-2026-8709 · CRITICAL (9.9) · 2026-08-05 — An improper privilege management vulnerability in the REST API document patch operation of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an authenticated user with a low-privileged REST role to escalate privi…
• CVE-2026-7329 · CRITICAL (9.9) · 2026-08-05 — An improper privilege management vulnerability in the SQL, SPARQL, and Optic REST query interfaces of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an authenticated user with a low-privileged REST role to esc…
• CVE-2026-71268 · CRITICAL (9.9) · 2026-08-05 — OpenPLC Runtime v3’s compile_program() function (webserver/openplc.py) parses (*FILE:path content*) directives from uploaded Structured Text (.st) program files and writes the referenced content to `os.path.join(’./cor…
• CVE-2026-1728 · CRITICAL (9.8) · 2026-08-06 — Tokens issued to a low-privileged user are not sufficiently restricted, allowing them to be used to access product-level Admin REST APIs.

Exploitation of this vulnerability allows a low-privileged user to invoke the Adm…

Supply Chain

GHSA-9pgf-384g-p7mv · CVE-2026-71321 (npm)

• HIGH · CVSS 7.5 · 2026-08-05
• Affected: nuxt, nuxt
• https://github.com/advisories/GHSA-9pgf-384g-p7mv

Nuxt: Unauthenticated CPU exhaustion parsing and hashing the Nuxt island endpoint body before hash validation

GHSA-9473-5f9j-94wq · CVE-2026-71320 (npm)

• HIGH · CVSS 8.1 · 2026-08-05
• Affected: nuxt, nuxt
• https://github.com/advisories/GHSA-9473-5f9j-94wq

Nuxt: Server-Side Remote Code Execution via Runtime Template Injection in Nuxt Server Island Props

GHSA-279x-mwfv-vcqv · CVE-2026-71319 (npm)

• CRITICAL · CVSS 9.6 · 2026-08-05
• Affected: @nuxt/devtools
• https://github.com/advisories/GHSA-279x-mwfv-vcqv

Unauthenticated Nuxt DevTools RPC allows arbitrary command execution on the developer’s host

GHSA-wm8w-6qjm-cv43 · CVE-2026-71316 (npm)

• HIGH · CVSS 7.5 · 2026-08-05
• Affected: nuxt
• https://github.com/advisories/GHSA-wm8w-6qjm-cv43

Nuxt runtime payload cache discloses another user’s SSR data across users and to unauthenticated clients

GHSA-hxvh-4h3w-prp9 · CVE-2026-71315 (npm)

• HIGH · CVSS 8.2 · 2026-08-05
• Affected: nuxt, nuxt
• https://github.com/advisories/GHSA-hxvh-4h3w-prp9

Nuxt route rules silently dropped for mixed-case paths, bypassing appMiddleware auth gates (incomplete fix for CVE-2026-53721)

GHSA-hxcr-hm88-mpq6 · CVE-2026-71314 (npm)

• HIGH · CVSS 7.5 · 2026-08-05
• Affected: nuxt, nuxt
• https://github.com/advisories/GHSA-hxcr-hm88-mpq6

Nuxt: Unauthenticated out-of-memory crash via unbounded v-for expansion in island rendering

GHSA-fqj9-69pf-6pjg · CVE-2026-59733 (go)

• HIGH · CVSS 8.8 · 2026-08-05
• Affected: github.com/rclone/rclone
• https://github.com/advisories/GHSA-fqj9-69pf-6pjg

rclone serve restic --private-repos authorization bypass: .. in the URL path lets an authenticated user read, overwrite and delete other users’ repositories

GHSA-2m8m-jhrm-w6j2 · CVE-2026-71312 (go)

• HIGH · CVSS 8.0 · 2026-08-05
• Affected: github.com/rclone/rclone
• https://github.com/advisories/GHSA-2m8m-jhrm-w6j2

rclone: PowerShell Smart-Quote Filename Injection Enables SFTP Server-Side Command Execution

GHSA-cf44-9pgv-m4xc · CVE-2026-54572 (go)

• HIGH · CVSS 7.5 · 2026-08-05
• Affected: github.com/rclone/rclone
• https://github.com/advisories/GHSA-cf44-9pgv-m4xc

rclone: Unvalidated symlink target in local --links — arbitrary file write from an untrusted remote

GHSA-45pq-889g-fcgh · CVE-2026-71309 (go)

• HIGH · 2026-08-05
• Affected: github.com/rclone/rclone
• https://github.com/advisories/GHSA-45pq-889g-fcgh

rclone: Incomplete path validation allows backend root escape in serve restic

Ransomware Activity

100 new victim postings across 16 groups.

IOC Volume

3554 new IOCs in this window. By source:

Recent OSINT Events

No curated MISP events in this window (bulk-IOC contributions tallied in IOC Volume).

Active Malware Families

15 malware families active this week (1 corroborated across ≥2 sources), exercising 14 ATT&CK techniques. Family is the unit, not the indicator: the raw IOCs are drill-down evidence below, not the signal.

Families marked ”→” are delivery/social-engineering clusters (ClickFix). Their technique mappings are the delivery chain — downstream behavior is payload-dependent, so they don’t open a hard coverage gap on their own.

Multi-Source IOCs

25 IOCs flagged by 2+ independent sources this window — the highest-confidence signal the cross-feed corpus produces.

MISP × KEV Correlation

No MISP events in this window referenced a CVE.

Cross-Reference

No SEC × KEV vendor token matches in this window. (This is a heuristic surface, absence is expected most days.)

Intel Feeds

4 IOC feeds updated this run (8,847 indicators total) — each available as CSV, MISP JSON, and STIX 2.1. Subscribe at https://thrunt.me/intel/manifest.json.

Hand-Authored Sigma

3 production-ready TTP rules (+2 scaffolds in the authoring queue) live at https://thrunt.me/sigma/manifest.json. Subscribe via https://thrunt.me/sigma/rules.lock.json (content-hash churn) or pull all with https://thrunt.me/sigma/rules.tar.gz.

Detection Gaps

17 of 156 techniques with corpus signal have zero detection coverage — no SigmaHQ community rule, no thrunt rule. This is the hand-authoring queue; the live view is at https://thrunt.me/corpus/attck/.

…and 7 more below the cut — full list on the rollup.

Pipeline Health

All feeds healthy.

Sources: SEC EDGAR (public domain), CISA Known Exploited Vulnerabilities (public domain), FIRST.org EPSS (per ToS), NIST NVD (public domain), GitHub Security Advisories (per ToS), abuse.ch URLhaus (CC0, attribution), ransomware.live (per ToS), MITRE ATT&CK (CC BY 4.0).

Published by Applied Cybernetics Group via thrunt.me. Heuristic cross-references are labelled as such; verify before action.