Morning Brief — 2026-08-08

4 material breach disclosures, 1 federal patching priority, 2 exploit probability movers, 10 emerging critical cves, 10 supply chain, 18 ransomware activity, 2530 ioc volume, 15 active malware families, 25 multi-source iocs, 1 cross-reference, 4 intel feeds, 5 hand-authored sigma, and 17 detection gaps. Sections with no signal are still rendered with an explicit “none in this window” note so absence is visible alongside presence.

Material Breach Disclosures

Alto Ingredients, Inc. (ALTO)

• Filed: 2026-08-07 · CIK 0000778164 · Accession 0001213900-26-086750
• Filing: https://www.sec.gov/Archives/edgar/data/778164/000121390026086750/ea030067001ex10-1.htm

any governmental authority or affected individuals regarding any such incident. There has been no such Breach, and the Company has not been notified of and has no knowledge of any event or condition that would reasonably be expected to result in, any such Breach, except in each case as would not reasonably be expected, individually or in the aggregate, to result in a Material Adverse Effect.

(…

Vivos Therapeutics, Inc. (VVOS)

• Filed: 2026-08-03 · CIK 0001716166 · Accession 0001493152-26-035867
• Filing: https://www.sec.gov/Archives/edgar/data/1716166/000149315226035867/ex10-2.htm

other applicable SEC cybersecurity disclosure rules. Provider shall maintain cyber liability and privacy liability insurance in amounts reasonably sufficient to cover its obligations under this Section 7.8, and shall provide Client with certificates of such insurance upon request.

Intellectual Property

8.1 Client Property. All financial statements, filings, board materials, internal con…

AMGEN INC (AMGN)

• Filed: 2026-07-31 · CIK 0000318154 · Accession 0000318154-26-000119
• Filing: https://www.sec.gov/Archives/edgar/data/318154/000031815426000119/amgn-20260729.htm

The Company has since learned that some of its data, including proprietary data, patient protected health information, and other information, has been exfiltrated from these cloud environments. To date, the Company has not identified any impact to its products, manufacturing operations, or financial reporting systems, or to the Company’s ability to meet patient needs. The investigation remains ong…

River Financial Corp (RVRF)

• Filed: 2026-07-30 · CIK 0001641601 · Accession 0001193125-26-325324
• Filing: https://www.sec.gov/Archives/edgar/data/1641601/000119312526325324/ck0001641601-20260619.htm

Since the date of the original filing, River’s investigation has progressed. River has determined that an unauthorized threat actor accessed portions of its network and removed certain data from its environment. River is working to determine the nature and scope of the information involved, including whether any personally identifiable information was affected. As part of its response, River took…

Federal Patching Priority

CVE-2026-8037 — Progress LoadMaster

Progress LoadMaster Command Injection Vulnerability

• Added: 2026-08-07 · Federal due: 2026-08-10 · EPSS 99.7th pct (score 0.848) · CVSS 9.6 (CRITICAL) · CWE-77
• ransomware use: Unknown

Progress LoadMaster contains a command injection vulnerability that allows an un-authenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in multiple command endpoints.

OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an un-authenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in multiple command endpoints

Exploit Probability Movers

Emerging Critical CVEs

• CVE-2026-64637 · CRITICAL (9.9) · 2026-08-07 — Improper privilege management in the XML-RPC API of Plesk before 18.0.80, allows an authenticated reseller to obtain an administrative session for the root user account.
• CVE-2026-14526 · CRITICAL (9.8) · 2026-08-08 — The AI Copilot – Content Generator plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.5.6. This is due to the plugin not properly verifying that a user is authorized to per…
• CVE-2026-61808 · CRITICAL (9.8) · 2026-08-07 — LightRAG provides simple and fast retrieval-augmented generation. Through version 1.5.4, the LightRAG API server binds to all network interfaces with authentication disabled by default, allowing an unauthenticated networ…
• CVE-2026-19264 · CRITICAL (9.8) · 2026-08-07 — Postiz is an open-source social media scheduling tool. The route that serves locally stored media joins URL-supplied path segments onto the upload directory and streams the file without normalising the path or confining…
• CVE-2022-4995 · CRITICAL (9.8) · 2026-08-07 — Weaver (Fanwei) E-cology 9.0 versions prior to 10.52 contain a file upload vulnerability that allows a remote, unauthenticated attacker to upload arbitrary files, including JSP webshells, by submitting a multipart/form-d…
• CVE-2026-71558 · CRITICAL (9.8) · 2026-08-07 — Heap type confusion vulnerability in Apache Fory C++ deserialization.

This issue affects Apache Fory C++ versions from 0.14.0 before 1.5.0. A crafted input payload can bypass type compatibility checks during polymorphic…

• CVE-2026-46409 · CRITICAL (9.6) · 2026-08-07 — OpenYak is a local-first agent runtime for reliable tool-using models, with a desktop workspace built on top. Prior to version 1.1.3, the OpenYak desktop backend binds an HTTP API to 127.0.0.1:<random port> (commonly 1…
• CVE-2026-50540 · CRITICAL (9.6) · 2026-08-07 — Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines (VMs) that perform like containers. Prior to version 4.0.0, kata-runtime is vulnerable to host code executio…
• CVE-2026-48170 · CRITICAL (9.1) · 2026-08-07 — scim-patch, a library to perform SCIM patch, prior to version 0.9.1 performs prototype pollution when applying a SCIM PATCH operation whose value object contains a key like "__proto__.someProp". After one such patc…
• CVE-2026-48039 · CRITICAL (9.1) · 2026-08-07 — Meta Ads MCP is a Model Context Protocol (MCP) server that lets AI assistants run Meta Ads. Prior to version 1.0.109, AuthInjectionMiddleware.dispatch() at http_auth_integration.py:272 unconditionally forwards unauth…

Supply Chain

GHSA-rg76-677x-56q9 · CVE-2026-71851 (npm)

• CRITICAL · CVSS 9.0 · 2026-08-07
• Affected: crypto-js
• https://github.com/advisories/GHSA-rg76-677x-56q9

crypto-js: Insufficient Entropy in Cryptographic Secret Generation via Vulnerable CryptoJS Dependency Chain

GHSA-gm37-52c6-37mw · CVE-2026-67422 (pip)

• HIGH · CVSS 7.5 · 2026-08-07
• Affected: pymdown-extensions
• https://github.com/advisories/GHSA-gm37-52c6-37mw

pymdown-extensions: exponential-backtracking ReDoS in caret, tilde, betterem, and magiclink inline processors

GHSA-mmj4-63m4-r6h5 · CVE-2026-63223 (composer)

• CRITICAL · CVSS 9.8 · 2026-08-07
• Affected: codeigniter4/framework
• https://github.com/advisories/GHSA-mmj4-63m4-r6h5

CodeIgniter: Uploaded file extension validation bypass in is_image and mime_in rules

GHSA-hhmc-q9hp-r662 · CVE-2026-63222 (composer)

• HIGH · CVSS 7.5 · 2026-08-07
• Affected: codeigniter4/framework
• https://github.com/advisories/GHSA-hhmc-q9hp-r662

CodeIgniter: Path traversal in UploadedFile::move() when using client-provided filenames

GHSA-c9w5-rwh3-7pm9 · CVE-2026-63221 (composer)

• CRITICAL · CVSS 9.4 · 2026-08-07
• Affected: codeigniter4/framework
• https://github.com/advisories/GHSA-c9w5-rwh3-7pm9

CodeIgniter: SQL injection in Query Builder deleteBatch() when used with where() conditions

GHSA-wcx4-wpfv-mc5c · CVE-2026-15895 (npm)

• HIGH · CVSS 7.8 · 2026-08-07
• Affected: jsii-diff
• https://github.com/advisories/GHSA-wcx4-wpfv-mc5c

jsii-diff: Command Injection via npm: package argument

GHSA-hc8v-wwc9-vgxm · CVE-2026-71556 (go)

• HIGH · CVSS 7.1 · 2026-08-07
• Affected: github.com/go-git/go-git/v5, github.com/go-git/go-git/v6
• https://github.com/advisories/GHSA-hc8v-wwc9-vgxm

go-git: Worktree operations may follow symlinks

GHSA-wvpp-8hx9-p66j (pip)

• HIGH · CVSS 8.8 · 2026-08-07
• Affected: GitPython
• https://github.com/advisories/GHSA-wvpp-8hx9-p66j

GitPython: Unsafe git option guard bypass via split_single_char_options=False short-option token smuggling enables command execution

GHSA-jm78-9fvv-mhgr (pip)

• HIGH · CVSS 8.8 · 2026-08-07
• Affected: GitPython
• https://github.com/advisories/GHSA-jm78-9fvv-mhgr

GitPython: git-config OPTION-name injection via =/#/whitespace bypasses name validator, enabling forged core.sshCommand/hooksPath (RCE)

GHSA-hmq2-w58f-27jc (pip)

• HIGH · CVSS 8.2 · 2026-08-07
• Affected: GitPython
• https://github.com/advisories/GHSA-hmq2-w58f-27jc

GitPython: Arbitrary Git Repository Creation Outside the Working Tree via Unvalidated .gitmodules Submodule Name in GitPython

Ransomware Activity

18 new victim postings across 10 groups.

IOC Volume

2530 new IOCs in this window. By source:

Recent OSINT Events

No curated MISP events in this window (bulk-IOC contributions tallied in IOC Volume).

Active Malware Families

15 malware families active this week (1 corroborated across ≥2 sources), exercising 14 ATT&CK techniques. Family is the unit, not the indicator: the raw IOCs are drill-down evidence below, not the signal.

Families marked ”→” are delivery/social-engineering clusters (ClickFix). Their technique mappings are the delivery chain — downstream behavior is payload-dependent, so they don’t open a hard coverage gap on their own.

Multi-Source IOCs

25 IOCs flagged by 2+ independent sources this window — the highest-confidence signal the cross-feed corpus produces.

MISP × KEV Correlation

No MISP events in this window referenced a CVE.

Cross-Reference

Alto Ingredients, Inc. (filed 2026-08-07)

Token match on alto against KEV vendor/product strings. This is a heuristic — verify before treating as attribution.

• CVE-2026-0257 — Palo Alto Networks PAN-OS (added 2026-05-29)

Intel Feeds

4 IOC feeds updated this run (9,345 indicators total) — each available as CSV, MISP JSON, and STIX 2.1. Subscribe at https://thrunt.me/intel/manifest.json.

Hand-Authored Sigma

3 production-ready TTP rules (+2 scaffolds in the authoring queue) live at https://thrunt.me/sigma/manifest.json. Subscribe via https://thrunt.me/sigma/rules.lock.json (content-hash churn) or pull all with https://thrunt.me/sigma/rules.tar.gz.

Detection Gaps

17 of 156 techniques with corpus signal have zero detection coverage — no SigmaHQ community rule, no thrunt rule. This is the hand-authoring queue; the live view is at https://thrunt.me/corpus/attck/.

…and 7 more below the cut — full list on the rollup.

Pipeline Health

All feeds healthy.

Sources: SEC EDGAR (public domain), CISA Known Exploited Vulnerabilities (public domain), FIRST.org EPSS (per ToS), NIST NVD (public domain), GitHub Security Advisories (per ToS), abuse.ch URLhaus (CC0, attribution), ransomware.live (per ToS), MITRE ATT&CK (CC BY 4.0).

Published by Applied Cybernetics Group via thrunt.me. Heuristic cross-references are labelled as such; verify before action.