Morning Brief — 2026-08-07

3 material breach disclosures, 1 exploit probability movers, 10 emerging critical cves, 10 supply chain, 96 ransomware activity, 1216 ioc volume, 15 active malware families, 25 multi-source iocs, 4 intel feeds, 5 hand-authored sigma, and 17 detection gaps. Sections with no signal are still rendered with an explicit “none in this window” note so absence is visible alongside presence.

Material Breach Disclosures

Vivos Therapeutics, Inc. (VVOS)

• Filed: 2026-08-03 · CIK 0001716166 · Accession 0001493152-26-035867
• Filing: https://www.sec.gov/Archives/edgar/data/1716166/000149315226035867/ex10-2.htm

other applicable SEC cybersecurity disclosure rules. Provider shall maintain cyber liability and privacy liability insurance in amounts reasonably sufficient to cover its obligations under this Section 7.8, and shall provide Client with certificates of such insurance upon request.

Intellectual Property

8.1 Client Property. All financial statements, filings, board materials, internal con…

AMGEN INC (AMGN)

• Filed: 2026-07-31 · CIK 0000318154 · Accession 0000318154-26-000119
• Filing: https://www.sec.gov/Archives/edgar/data/318154/000031815426000119/amgn-20260729.htm

The Company has since learned that some of its data, including proprietary data, patient protected health information, and other information, has been exfiltrated from these cloud environments. To date, the Company has not identified any impact to its products, manufacturing operations, or financial reporting systems, or to the Company’s ability to meet patient needs. The investigation remains ong…

River Financial Corp (RVRF)

• Filed: 2026-07-30 · CIK 0001641601 · Accession 0001193125-26-325324
• Filing: https://www.sec.gov/Archives/edgar/data/1641601/000119312526325324/ck0001641601-20260619.htm

Since the date of the original filing, River’s investigation has progressed. River has determined that an unauthorized threat actor accessed portions of its network and removed certain data from its environment. River is working to determine the nature and scope of the information involved, including whether any personally identifiable information was affected. As part of its response, River took…

Federal Patching Priority

No new KEV additions in this window.

Exploit Probability Movers

Emerging Critical CVEs

• CVE-2026-65667 · CRITICAL (10.0) · 2026-08-07 — Missing authorization in Microsoft Teams allows an unauthorized attacker to elevate privileges over a network.
• CVE-2026-63508 · CRITICAL (10.0) · 2026-08-07 — Missing authentication for critical function in Microsoft Planetary Computer Pro allows an unauthorized attacker to elevate privileges over a network.
• CVE-2026-56162 · CRITICAL (10.0) · 2026-08-07 — Improper authentication in Azure SQL Database allows an unauthorized attacker to elevate privileges over a network.
• CVE-2026-14812 · CRITICAL (10.0) · 2026-08-06 — The Premium SEO WordPress plugin is malicious: it ships an unauthenticated backdoor that creates a hidden administrator account and, in some builds, also enables remote code execution, server-side request forgery and arb…
• CVE-2026-11976 · CRITICAL (10.0) · 2026-08-06 — The official MonsterInsights Pro update distribution bucket (monster-insights.s3.amazonaws.com) was compromised. Both the current release (10.2.2) and the version MonsterInsights rolled back to (10.2.0) contain a malic…
• CVE-2026-66665 · CRITICAL (10.0) · 2026-08-06 — Unauthenticated Arbitrary File Upload in Type Hub <= 2.0.6 versions.
• CVE-2026-65553 · CRITICAL (10.0) · 2026-08-06 — Unauthenticated Remote Code Execution (RCE) in Spider Analyser – WordPress搜索引擎蜘蛛分析插件 <= 2.1.3 versions.
• CVE-2026-62830 · CRITICAL (9.9) · 2026-08-07 — Missing authorization in Azure SRE Agent allows an authorized attacker to elevate privileges over a network.
• CVE-2026-59115 · CRITICAL (9.9) · 2026-08-07 — ’…/…//’ in Microsoft Entra Provisioning Service (SyncFabric) allows an authorized attacker to elevate privileges over a network.
• CVE-2026-50515 · CRITICAL (9.9) · 2026-08-07 — Deserialization of untrusted data in Azure Service Bus allows an authorized attacker to execute code over a network.

Supply Chain

GHSA-hmqg-cxww-wqhq · CVE-2026-67434 (composer)

• HIGH · 2026-08-06
• Affected: squizlabs/php_codesniffer, squizlabs/php_codesniffer
• https://github.com/advisories/GHSA-hmqg-cxww-wqhq

PHP_CodeSniffer gitblame report command injection via crafted filename

GHSA-w9hm-4m3m-fxmm (npm)

• HIGH · 2026-08-06
• Affected: ngx-extended-pdf-viewer
• https://github.com/advisories/GHSA-w9hm-4m3m-fxmm

ngx-extended-pdf-viewer bundles a version of pdf.js vulnerable to CVE-2026-16633

GHSA-hq66-cqwq-w95j · CVE-2026-16633 (npm)

• HIGH · 2026-08-06
• Affected: pdfjs-dist
• https://github.com/advisories/GHSA-hq66-cqwq-w95j

PDF.js: Arbitrary JavaScript execution upon opening a malicious PDF

GHSA-p8x7-9vfw-p7vc (composer)

• HIGH · 2026-08-06
• Affected: craftcms/cms
• https://github.com/advisories/GHSA-p8x7-9vfw-p7vc

Craft CMS: Arbitrary user password reset leading to administrator account takeover

GHSA-f5wm-88jv-g5hx (composer)

• HIGH · 2026-08-06
• Affected: craftcms/cms, craftcms/cms
• https://github.com/advisories/GHSA-f5wm-88jv-g5hx

Craft CMS: Authenticated RCE through Twig sandbox escape

GHSA-265m-7826-wjqm (composer)

• HIGH · 2026-08-06
• Affected: craftcms/cms, craftcms/cms
• https://github.com/advisories/GHSA-265m-7826-wjqm

Craft CMS: Authenticated RCE via condition.config JSON cleanse bypass

GHSA-mh25-x5hq-wrqp (composer)

• HIGH · CVSS 7.5 · 2026-08-06
• Affected: league/commonmark
• https://github.com/advisories/GHSA-mh25-x5hq-wrqp

league/commonmark: Denial of service via colliding heading slugs

GHSA-jfm3-95jq-q3rf (composer)

• HIGH · CVSS 7.5 · 2026-08-06
• Affected: league/commonmark
• https://github.com/advisories/GHSA-jfm3-95jq-q3rf

league/commonmark: Denial of service via duplicate footnote definitions

GHSA-g2gp-3wwq-f4ph (composer)

• HIGH · CVSS 7.5 · 2026-08-06
• Affected: league/commonmark
• https://github.com/advisories/GHSA-g2gp-3wwq-f4ph

league/commonmark: Denial of service via adjacent inline attribute blocks

GHSA-2q4p-g7hv-5rgv · CVE-2026-71488 (composer)

• HIGH · CVSS 7.5 · 2026-08-06
• Affected: league/commonmark
• https://github.com/advisories/GHSA-2q4p-g7hv-5rgv

league/commonmark: Quadratic-time denial of service when parsing crafted Markdown

Ransomware Activity

96 new victim postings across 17 groups.

IOC Volume

1216 new IOCs in this window. By source:

Recent OSINT Events

No curated MISP events in this window (bulk-IOC contributions tallied in IOC Volume).

Active Malware Families

15 malware families active this week (1 corroborated across ≥2 sources), exercising 14 ATT&CK techniques. Family is the unit, not the indicator: the raw IOCs are drill-down evidence below, not the signal.

Families marked ”→” are delivery/social-engineering clusters (ClickFix). Their technique mappings are the delivery chain — downstream behavior is payload-dependent, so they don’t open a hard coverage gap on their own.

Multi-Source IOCs

25 IOCs flagged by 2+ independent sources this window — the highest-confidence signal the cross-feed corpus produces.

MISP × KEV Correlation

No MISP events in this window referenced a CVE.

Cross-Reference

No SEC × KEV vendor token matches in this window. (This is a heuristic surface, absence is expected most days.)

Intel Feeds

4 IOC feeds updated this run (9,128 indicators total) — each available as CSV, MISP JSON, and STIX 2.1. Subscribe at https://thrunt.me/intel/manifest.json.

Hand-Authored Sigma

3 production-ready TTP rules (+2 scaffolds in the authoring queue) live at https://thrunt.me/sigma/manifest.json. Subscribe via https://thrunt.me/sigma/rules.lock.json (content-hash churn) or pull all with https://thrunt.me/sigma/rules.tar.gz.

Detection Gaps

17 of 156 techniques with corpus signal have zero detection coverage — no SigmaHQ community rule, no thrunt rule. This is the hand-authoring queue; the live view is at https://thrunt.me/corpus/attck/.

…and 7 more below the cut — full list on the rollup.

Pipeline Health

All feeds healthy.

Sources: SEC EDGAR (public domain), CISA Known Exploited Vulnerabilities (public domain), FIRST.org EPSS (per ToS), NIST NVD (public domain), GitHub Security Advisories (per ToS), abuse.ch URLhaus (CC0, attribution), ransomware.live (per ToS), MITRE ATT&CK (CC BY 4.0).

Published by Applied Cybernetics Group via thrunt.me. Heuristic cross-references are labelled as such; verify before action.