Morning Brief — 2026-08-14

3 material breach disclosures, 10 emerging critical cves, 5 supply chain, 48 ransomware activity, 18394 ioc volume, 18 active malware families, 25 multi-source iocs, 1 cross-reference, 4 intel feeds, 12 hand-authored sigma, and 17 detection gaps. Sections with no signal are still rendered with an explicit “none in this window” note so absence is visible alongside presence.

Material Breach Disclosures

Alto Ingredients, Inc. (ALTO)

• Filed: 2026-08-07 · CIK 0000778164 · Accession 0001213900-26-086750
• Filing: https://www.sec.gov/Archives/edgar/data/778164/000121390026086750/ea030067001ex10-1.htm

any governmental authority or affected individuals regarding any such incident. There has been no such Breach, and the Company has not been notified of and has no knowledge of any event or condition that would reasonably be expected to result in, any such Breach, except in each case as would not reasonably be expected, individually or in the aggregate, to result in a Material Adverse Effect.

(…

Vivos Therapeutics, Inc. (VVOS)

• Filed: 2026-08-03 · CIK 0001716166 · Accession 0001493152-26-035867
• Filing: https://www.sec.gov/Archives/edgar/data/1716166/000149315226035867/ex10-2.htm

other applicable SEC cybersecurity disclosure rules. Provider shall maintain cyber liability and privacy liability insurance in amounts reasonably sufficient to cover its obligations under this Section 7.8, and shall provide Client with certificates of such insurance upon request.

Intellectual Property

8.1 Client Property. All financial statements, filings, board materials, internal con…

AMGEN INC (AMGN)

• Filed: 2026-07-31 · CIK 0000318154 · Accession 0000318154-26-000119
• Filing: https://www.sec.gov/Archives/edgar/data/318154/000031815426000119/amgn-20260729.htm

The Company has since learned that some of its data, including proprietary data, patient protected health information, and other information, has been exfiltrated from these cloud environments. To date, the Company has not identified any impact to its products, manufacturing operations, or financial reporting systems, or to the Company’s ability to meet patient needs. The investigation remains ong…

Federal Patching Priority

No new KEV additions in this window.

Exploit Probability Movers

No CVEs with ≥0.20 EPSS movement in this window.

Emerging Critical CVEs

• CVE-2026-72851 · CRITICAL (10.0) · 2026-08-13 — Budibase before 3.40.0 contains an unauthenticated SQL injection vulnerability in webhook-triggered automations with EXECUTE_QUERY steps. Attackers can POST attacker-controlled JSON to the webhook trigger endpoint to inj…
• CVE-2026-61962 · CRITICAL (10.0) · 2026-08-13 — Unauthenticated Arbitrary Code Execution in WP BASE Booking <= 6.3.0 versions.
• CVE-2026-27544 · CRITICAL (10.0) · 2026-08-13 — Unauthenticated Remote Code Execution (RCE) in QA Analytics <= 5.2.0.0 versions.
• CVE-2026-59500 · CRITICAL (10.0) · 2026-08-13 — CWE-287: Improper Authentication
• CVE-2026-72842 · CRITICAL (9.9) · 2026-08-13 — luci-app-lxc contains an ACL inconsistency vulnerability that allows low-privileged authenticated LuCI users to access backend container management routes without proper authorization checks. Attackers can exploit path t…
• CVE-2026-72841 · CRITICAL (9.9) · 2026-08-13 — luci-app-openvpn fails to properly validate the instance_name2 parameter during file upload, allowing authenticated users to perform path traversal and write arbitrary files outside the intended directory. Attackers can…
• CVE-2026-73656 · CRITICAL (9.9) · 2026-08-13 — Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. Prior to 4.5.6, POST /api/v1/deployments/:deploymentId/background-workers calls CreateDeploymentBackgroundWorkerServiceV4.call()…
• CVE-2026-12949 · CRITICAL (9.8) · 2026-08-14 — The Wishlist Member plugin for WordPress is vulnerable to Account Takeover via Insufficient Verification of Data Authenticity in versions up to and including 3.34.1. This is due to the wpm_register() function validating…
• CVE-2026-72839 · CRITICAL (9.8) · 2026-08-13 — filebrowser through 2.63.16 fails to properly restrict scope and permissions when self-signup is enabled with default CreateUserDir setting. Unauthenticated attackers can register accounts that inherit the server root sc…
• CVE-2026-72776 · CRITICAL (9.8) · 2026-08-13 — AgenticSeek (commit fc242c7) contains an unauthenticated remote code execution vulnerability that allows any network-adjacent attacker to execute arbitrary commands by submitting crafted queries to the unprotected POST /…

Supply Chain

GHSA-p28v-f755-9qrg · CVE-2026-73654 (npm)

• HIGH · CVSS 8.5 · 2026-08-13
• Affected: @trigger.dev/core
• https://github.com/advisories/GHSA-p28v-f755-9qrg

Trigger.dev: Prototype pollution via run metadata operations → process-wide cross-tenant DoS

GHSA-m42h-3232-vpv3 · CVE-2026-12243 (pip)

• HIGH · CVSS 7.5 · 2026-08-13
• Affected: nltk
• https://github.com/advisories/GHSA-m42h-3232-vpv3

nltk: Arbitrary File Read via Path Traversal in nltk.data.load() through Percent-Encoded Sequences

GHSA-rm43-82j9-r4mj (pip)

• HIGH · 2026-08-13
• Affected: atomic-agents-stack
• https://github.com/advisories/GHSA-rm43-82j9-r4mj

atomic-agents-stack: Dashboard HTTP server path traversal allows arbitrary file read

GHSA-48p8-g2fx-3wwm · CVE-2026-54526 (go)

• HIGH · 2026-08-13
• Affected: github.com/argoproj/argo-workflows/v4, github.com/argoproj/argo-workflows/v3, github.com/argoproj/argo-workflows
• https://github.com/advisories/GHSA-48p8-g2fx-3wwm

Argo Workflows: ArtifactGC.PodSpecPatch bypasses Strict/Secure template reference allow-list (Incomplete fix for CVE-2026-31892)

GHSA-2mhj-fhvg-v428 · CVE-2026-55072 (composer)

• HIGH · CVSS 8.5 · 2026-08-13
• Affected: pimcore/pimcore, pimcore/pimcore
• https://github.com/advisories/GHSA-2mhj-fhvg-v428

Pimcore: ClassDefinition UID regex missing end anchor allows SQL injection via Block.php unquoted table name

Ransomware Activity

48 new victim postings across 15 groups.

IOC Volume

18394 new IOCs in this window. By source:

Recent OSINT Events

No curated MISP events in this window (bulk-IOC contributions tallied in IOC Volume).

Active Malware Families

18 malware families active this week (2 corroborated across ≥2 sources), exercising 20 ATT&CK techniques. Family is the unit, not the indicator: the raw IOCs are drill-down evidence below, not the signal.

Families marked ”→” are delivery/social-engineering clusters (ClickFix, GuLoader). Their technique mappings are the delivery chain — downstream behavior is payload-dependent, so they don’t open a hard coverage gap on their own.

Multi-Source IOCs

25 IOCs flagged by 2+ independent sources this window — the highest-confidence signal the cross-feed corpus produces.

MISP × KEV Correlation

No MISP events in this window referenced a CVE.

Cross-Reference

Alto Ingredients, Inc. (filed 2026-08-07)

Token match on alto against KEV vendor/product strings. This is a heuristic — verify before treating as attribution.

• CVE-2026-0257 — Palo Alto Networks PAN-OS (added 2026-05-29)

Intel Feeds

4 IOC feeds updated this run (10,475 indicators total) — each available as CSV, MISP JSON, and STIX 2.1. Subscribe at https://thrunt.me/intel/manifest.json.

Hand-Authored Sigma

10 production-ready TTP rules (+2 scaffolds in the authoring queue) live at https://thrunt.me/sigma/manifest.json. Subscribe via https://thrunt.me/sigma/rules.lock.json (content-hash churn) or pull all with https://thrunt.me/sigma/rules.tar.gz.

Detection Gaps

17 of 158 techniques with corpus signal have zero detection coverage — no SigmaHQ community rule, no thrunt rule. This is the hand-authoring queue; the live view is at https://thrunt.me/corpus/attck/.

…and 7 more below the cut — full list on the rollup.

Pipeline Health

All feeds healthy.

Sources: SEC EDGAR (public domain), CISA Known Exploited Vulnerabilities (public domain), FIRST.org EPSS (per ToS), NIST NVD (public domain), GitHub Security Advisories (per ToS), abuse.ch URLhaus (CC0, attribution), ransomware.live (per ToS), MITRE ATT&CK (CC BY 4.0).

Published by Applied Cybernetics Group via thrunt.me. Heuristic cross-references are labelled as such; verify before action.