Morning Brief — 2026-08-13

4 material breach disclosures, 10 emerging critical cves, 10 supply chain, 77 ransomware activity, 6258 ioc volume, 17 active malware families, 25 multi-source iocs, 1 cross-reference, 4 intel feeds, 9 hand-authored sigma, and 17 detection gaps. Sections with no signal are still rendered with an explicit “none in this window” note so absence is visible alongside presence.

Material Breach Disclosures

Alto Ingredients, Inc. (ALTO)

• Filed: 2026-08-07 · CIK 0000778164 · Accession 0001213900-26-086750
• Filing: https://www.sec.gov/Archives/edgar/data/778164/000121390026086750/ea030067001ex10-1.htm

any governmental authority or affected individuals regarding any such incident. There has been no such Breach, and the Company has not been notified of and has no knowledge of any event or condition that would reasonably be expected to result in, any such Breach, except in each case as would not reasonably be expected, individually or in the aggregate, to result in a Material Adverse Effect.

(…

Vivos Therapeutics, Inc. (VVOS)

• Filed: 2026-08-03 · CIK 0001716166 · Accession 0001493152-26-035867
• Filing: https://www.sec.gov/Archives/edgar/data/1716166/000149315226035867/ex10-2.htm

other applicable SEC cybersecurity disclosure rules. Provider shall maintain cyber liability and privacy liability insurance in amounts reasonably sufficient to cover its obligations under this Section 7.8, and shall provide Client with certificates of such insurance upon request.

Intellectual Property

8.1 Client Property. All financial statements, filings, board materials, internal con…

AMGEN INC (AMGN)

• Filed: 2026-07-31 · CIK 0000318154 · Accession 0000318154-26-000119
• Filing: https://www.sec.gov/Archives/edgar/data/318154/000031815426000119/amgn-20260729.htm

The Company has since learned that some of its data, including proprietary data, patient protected health information, and other information, has been exfiltrated from these cloud environments. To date, the Company has not identified any impact to its products, manufacturing operations, or financial reporting systems, or to the Company’s ability to meet patient needs. The investigation remains ong…

River Financial Corp (RVRF)

• Filed: 2026-07-30 · CIK 0001641601 · Accession 0001193125-26-325324
• Filing: https://www.sec.gov/Archives/edgar/data/1641601/000119312526325324/ck0001641601-20260619.htm

Since the date of the original filing, River’s investigation has progressed. River has determined that an unauthorized threat actor accessed portions of its network and removed certain data from its environment. River is working to determine the nature and scope of the information involved, including whether any personally identifiable information was affected. As part of its response, River took…

Federal Patching Priority

No new KEV additions in this window.

Exploit Probability Movers

No CVEs with ≥0.20 EPSS movement in this window.

Emerging Critical CVEs

• CVE-2026-15413 · CRITICAL (10.0) · 2026-08-13 — The Link Factory WordPress plugin is a backdoor. Distributed as a “homepage sentence publisher”, it exposes an operator-controlled REST API under /wp-json/link-factory/v1/ - authenticated by a detached Ed25519 signature…
• CVE-2024-27253 · CRITICAL (10.0) · 2026-08-12 — IBM DOORS Next 7.0.3 through 7.0.3 Interim Fix 018 could allow an authenticated user to bypass security logic to perform unauthorized activities.
• CVE-2026-73299 · CRITICAL (10.0) · 2026-08-12 — Prompty is a markdown file format (.prompty) for LLM prompts. Prior to 0.1.5 and 2.0.0-beta.5, the TypeScript Nunjucks renderer evaluated untrusted .prompty template bodies with unrestricted JavaScript member access. An…
• CVE-2026-66898 · CRITICAL (9.9) · 2026-08-12 — A path traversal vulnerability in LXD allows an attacker to manipulate file system paths during backup import and restore operations. When importing or restoring a backup archive, LXD fails to validate instance and stora…
• CVE-2026-73269 · CRITICAL (9.9) · 2026-08-12 — A flaw was found in the cluster-curator-controller component. A local user, by creating a ClusterCurator resource with a specific naming convention, can trigger the creation of a cluster-scoped ClusterRoleBinding. This a…
• CVE-2026-73268 · CRITICAL (9.9) · 2026-08-12 — A flaw was found in the cluster-curator-controller component of multicluster engine (MCE). A tenant with create or update permissions on ClusterCurator resources can inject an arbitrary Job specification. This is possibl…
• CVE-2026-72508 · CRITICAL (9.9) · 2026-08-12 — A flaw was found in the multicloud-operators-subscription component of Red Hat Advanced Cluster Management (RHACM). This vulnerability allows a namespace-admin tenant to perform a confused-deputy attack by creating Subsc…
• CVE-2026-63300 · CRITICAL (9.9) · 2026-08-12 — An improper validation vulnerability in the instancePostMigration function in lxd/instance_post.go of LXD allows an authenticated attacker with can_create_instances permissions on a restricted project to bypass project-l…
• CVE-2026-63299 · CRITICAL (9.9) · 2026-08-12 — An authorization bypass vulnerability in LXD allows an authenticated user to bypass project-level disk and volume limits. Two related code paths fail to verify resource limits during volume operations: the storagePoolVol…
• CVE-2026-63298 · CRITICAL (9.9) · 2026-08-12 — An improper neutralization of special elements vulnerability in LXD’s NVIDIA instance configuration handling allows an authenticated attacker to inject arbitrary configuration directives. By supplying newline characters…

Supply Chain

GHSA-cxgv-hp74-jj7r · CVE-2026-55074 (pip)

• HIGH · 2026-08-12
• Affected: ansible-jailexec
• https://github.com/advisories/GHSA-cxgv-hp74-jj7r

Ansible FreeBSD Jail Connection Plugin: Jail escape via symlink following in put_file (host-side root mv)

GHSA-pfvm-w89x-94jw (nuget)

• HIGH · CVSS 7.5 · 2026-08-12
• Affected: SIPSorcery
• https://github.com/advisories/GHSA-pfvm-w89x-94jw

SIPSorcery: Malformed UDP datagram crashes TurnServer receive loop with no restart, disabling TURN UDP relay for all clients (DoS)

GHSA-jwjp-4649-v8jp (nuget)

• HIGH · CVSS 7.5 · 2026-08-12
• Affected: SIPSorcery
• https://github.com/advisories/GHSA-jwjp-4649-v8jp

SIPSorcery vulnerable to Denial of Service via out-of-bounds read in SCTP SACK chunk parsing

GHSA-49m4-vp58-wgc9 · CVE-2026-55071 (pip)

• HIGH · CVSS 8.4 · 2026-08-12
• Affected: stata-mcp
• https://github.com/advisories/GHSA-49m4-vp58-wgc9

MCP-for-Stata: Stata Command Injection via Unsanitized package in ado_package_install

GHSA-w62w-66v9-vvgv · CVE-2026-54917 (go)

• HIGH · 2026-08-12
• Affected: github.com/seaweedfs/seaweedfs
• https://github.com/advisories/GHSA-w62w-66v9-vvgv

SeaweedFS: Path traversal in the S3 and Iceberg REST gateways allows cross-bucket access

GHSA-h47f-gmjp-m7rr · CVE-2026-52776 (pip)

• HIGH · 2026-08-12
• Affected: compliance-trestle
• https://github.com/advisories/GHSA-h47f-gmjp-m7rr

compliance-trestle has an URLSecurityValidator SSRF allowlist bypass via IPv4-mapped IPv6 and 0.0.0.0

GHSA-q939-rpr3-3284 · CVE-2026-48798 (nuget)

• HIGH · CVSS 7.1 · 2026-08-12
• Affected: SSH.NET
• https://github.com/advisories/GHSA-q939-rpr3-3284

SSH.NET: ScpClient Recursive Download Allows Arbitrary File Write via Server-Controlled SCP Filenames

GHSA-3763-qp59-59vf · CVE-2026-46369 (rust)

• HIGH · CVSS 7.5 · 2026-08-12
• Affected: nimiq-blockchain
• https://github.com/advisories/GHSA-3763-qp59-59vf

nimiq-blockchain: Validity store off by one error

GHSA-j5jq-cr68-v2xx · CVE-2026-35445 (composer)

• HIGH · 2026-08-12
• Affected: winter/wn-backend-module
• https://github.com/advisories/GHSA-j5jq-cr68-v2xx

Winter: Authenticated backend users can bypass Users controller permission checks

GHSA-vgp4-2fc4-qff2 · CVE-2026-32258 (composer)

• HIGH · CVSS 8.1 · 2026-08-12
• Affected: winter/wn-backend-module
• https://github.com/advisories/GHSA-vgp4-2fc4-qff2

Winter: Stored XSS through Editor Settings custom styles

Ransomware Activity

77 new victim postings across 11 groups.

IOC Volume

6258 new IOCs in this window. By source:

Recent OSINT Events

No curated MISP events in this window (bulk-IOC contributions tallied in IOC Volume).

Active Malware Families

17 malware families active this week (2 corroborated across ≥2 sources), exercising 20 ATT&CK techniques. Family is the unit, not the indicator: the raw IOCs are drill-down evidence below, not the signal.

Families marked ”→” are delivery/social-engineering clusters (ClickFix, GuLoader). Their technique mappings are the delivery chain — downstream behavior is payload-dependent, so they don’t open a hard coverage gap on their own.

Multi-Source IOCs

25 IOCs flagged by 2+ independent sources this window — the highest-confidence signal the cross-feed corpus produces.

MISP × KEV Correlation

No MISP events in this window referenced a CVE.

Cross-Reference

Alto Ingredients, Inc. (filed 2026-08-07)

Token match on alto against KEV vendor/product strings. This is a heuristic — verify before treating as attribution.

• CVE-2026-0257 — Palo Alto Networks PAN-OS (added 2026-05-29)

Intel Feeds

4 IOC feeds updated this run (10,442 indicators total) — each available as CSV, MISP JSON, and STIX 2.1. Subscribe at https://thrunt.me/intel/manifest.json.

Hand-Authored Sigma

7 production-ready TTP rules (+2 scaffolds in the authoring queue) live at https://thrunt.me/sigma/manifest.json. Subscribe via https://thrunt.me/sigma/rules.lock.json (content-hash churn) or pull all with https://thrunt.me/sigma/rules.tar.gz.

Detection Gaps

17 of 158 techniques with corpus signal have zero detection coverage — no SigmaHQ community rule, no thrunt rule. This is the hand-authoring queue; the live view is at https://thrunt.me/corpus/attck/.

…and 7 more below the cut — full list on the rollup.

Pipeline Health

All feeds healthy.

Sources: SEC EDGAR (public domain), CISA Known Exploited Vulnerabilities (public domain), FIRST.org EPSS (per ToS), NIST NVD (public domain), GitHub Security Advisories (per ToS), abuse.ch URLhaus (CC0, attribution), ransomware.live (per ToS), MITRE ATT&CK (CC BY 4.0).

Published by Applied Cybernetics Group via thrunt.me. Heuristic cross-references are labelled as such; verify before action.