Morning Brief — 2026-08-15

2 material breach disclosures, 10 emerging critical cves, 7 supply chain, 17 ransomware activity, 13044 ioc volume, 17 active malware families, 25 multi-source iocs, 1 cross-reference, 4 intel feeds, 12 hand-authored sigma, and 17 detection gaps. Sections with no signal are still rendered with an explicit “none in this window” note so absence is visible alongside presence.

Material Breach Disclosures

Alto Ingredients, Inc. (ALTO)

• Filed: 2026-08-07 · CIK 0000778164 · Accession 0001213900-26-086750
• Filing: https://www.sec.gov/Archives/edgar/data/778164/000121390026086750/ea030067001ex10-1.htm

any governmental authority or affected individuals regarding any such incident. There has been no such Breach, and the Company has not been notified of and has no knowledge of any event or condition that would reasonably be expected to result in, any such Breach, except in each case as would not reasonably be expected, individually or in the aggregate, to result in a Material Adverse Effect.

(…

Vivos Therapeutics, Inc. (VVOS)

• Filed: 2026-08-03 · CIK 0001716166 · Accession 0001493152-26-035867
• Filing: https://www.sec.gov/Archives/edgar/data/1716166/000149315226035867/ex10-2.htm

other applicable SEC cybersecurity disclosure rules. Provider shall maintain cyber liability and privacy liability insurance in amounts reasonably sufficient to cover its obligations under this Section 7.8, and shall provide Client with certificates of such insurance upon request.

Intellectual Property

8.1 Client Property. All financial statements, filings, board materials, internal con…

Federal Patching Priority

No new KEV additions in this window.

Exploit Probability Movers

No CVEs with ≥0.20 EPSS movement in this window.

Emerging Critical CVEs

• CVE-2026-73678 · CRITICAL (10.0) · 2026-08-14 — MindsDB Minds Platform version 26.1.0 and earlier contains an unauthenticated remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary OS commands by submitting crafted prompts to th…
• CVE-2026-19188 · CRITICAL (10.0) · 2026-08-14 — A critical OS command injection vulnerability has been identified in the Haiwell IoT Cloud HMI Gateway product. The vulnerability exists in the Net Check feature accessible via the /setting endpoint. The cmdPing Socke…
• CVE-2026-72811 · CRITICAL (10.0) · 2026-08-14 — SiYuan versions <= v3.7.2 contain a SQL injection vulnerability in the backlink/mention search query (kernel/model/backlink.go), which concatenates stored block metadata (title, name, alias, anchor text) and the client-s…
• CVE-2026-17186 · CRITICAL (9.9) · 2026-08-14 — IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to execute arbitrary CL commands due to improper neutralization of special elements in a command.
• CVE-2026-19682 · CRITICAL (9.9) · 2026-08-14 — A command injection vulnerability exists in Security Center where a remote, unauthenticated attacker could exploit this issue to execute arbitrary commands on the underlying operating system with the privileges of the se…
• CVE-2026-19681 · CRITICAL (9.9) · 2026-08-14 — An authenticated command injection vulnerability exists in Security Center related to file upload processing. An attacker could exploit this issue by uploading a specially crafted file, potentially resulting in arbitrary…
• CVE-2026-19626 · CRITICAL (9.9) · 2026-08-14 — A remote code execution vulnerability exists in Tenable Security Center’s report generation functionality. An authenticated, non-administrative user could exploit this issue by supplying specially crafted input that is l…
• CVE-2026-16142 · CRITICAL (9.8) · 2026-08-15 — The TrueBooker plugin for WordPress is vulnerable to Account Takeover in all versions up to, and including, 1.2.6. This is due to the add_front_user_update() AJAX handler being registered for unauthenticated users and ac…
• CVE-2026-15826 · CRITICAL (9.8) · 2026-08-15 — The User Profile Builder plugin for WordPress is vulnerable to Authentication Bypass via Type Confusion in versions up to, and including, 3.16.4. This is due to the wppb_log_in_user() function calling absint() on the ret…
• CVE-2026-15341 · CRITICAL (9.8) · 2026-08-15 — The User Session Synchronizer plugin for WordPress is vulnerable to Authentication Bypass leading to Account Takeover in all versions up to, and including, 1.4.0. The synchronize_session() function, hooked on init an…

Supply Chain

GHSA-49mq-fc6q-3h46 · CVE-2026-55157 (npm)

• HIGH · CVSS 8.4 · 2026-08-14
• Affected: @ooples/token-optimizer-mcp
• https://github.com/advisories/GHSA-49mq-fc6q-3h46

Token Optimizer MCP: OS command injection in smart_user via username in get-user-info

GHSA-h84g-69h7-mw6v · CVE-2026-55153 (maven)

• HIGH · CVSS 7.1 · 2026-08-14
• Affected: com.mchange:mchange-commons-java
• https://github.com/advisories/GHSA-h84g-69h7-mw6v

mchange-commons-java contains elements susceptible to abuse via JNDI injection and “deserialization gadgets”

GHSA-fpmh-vx4h-xc33 · CVE-2026-53660 (maven)

• HIGH · 2026-08-14
• Affected: org.openidentityplatform.openam:openam-core
• https://github.com/advisories/GHSA-fpmh-vx4h-xc33

OpenAM Insecure SSO Cookie Initialization

GHSA-2j9v-p4xj-cjw2 · CVE-2026-53657 (go)

• HIGH · CVSS 8.2 · 2026-08-14
• Affected: github.com/lima-vm/lima/v2
• https://github.com/advisories/GHSA-2j9v-p4xj-cjw2

Lima: An arbitrary user in a QEMU VM could gain the root privilege in the VM via the guest agent socket

GHSA-4x9g-vw65-vvf9 · CVE-2026-53653 (composer)

• HIGH · 2026-08-14
• Affected: getgrav/grav, getgrav/grav
• https://github.com/advisories/GHSA-4x9g-vw65-vvf9

Grav: Unauthenticated denial of service via unbounded image derivative dimensions

GHSA-5fpj-28rv-84r7 · CVE-2026-35219 (npm)

• HIGH · 2026-08-14
• Affected: @budibase/server
• https://github.com/advisories/GHSA-5fpj-28rv-84r7

Budibase: SSRF in Automation Steps - Webhook, Zapier, N8N, Slack, Discord Bypass IP Blacklist

GHSA-29rf-f4vv-pvq6 · CVE-2026-35511 (go)

• HIGH · 2026-08-14
• Affected: github.com/authorizerdev/authorizer
• https://github.com/advisories/GHSA-29rf-f4vv-pvq6

Authorizer: Zero-click account takeover via OAuth identity linking to unverified email accounts

Ransomware Activity

17 new victim postings across 10 groups.

IOC Volume

13044 new IOCs in this window. By source:

Recent OSINT Events

No curated MISP events in this window (bulk-IOC contributions tallied in IOC Volume).

Active Malware Families

17 malware families active this week (2 corroborated across ≥2 sources), exercising 20 ATT&CK techniques. Family is the unit, not the indicator: the raw IOCs are drill-down evidence below, not the signal.

Families marked ”→” are delivery/social-engineering clusters (ClickFix, GuLoader). Their technique mappings are the delivery chain — downstream behavior is payload-dependent, so they don’t open a hard coverage gap on their own.

Multi-Source IOCs

25 IOCs flagged by 2+ independent sources this window — the highest-confidence signal the cross-feed corpus produces.

MISP × KEV Correlation

No MISP events in this window referenced a CVE.

Cross-Reference

Alto Ingredients, Inc. (filed 2026-08-07)

Token match on alto against KEV vendor/product strings. This is a heuristic — verify before treating as attribution.

• CVE-2026-0257 — Palo Alto Networks PAN-OS (added 2026-05-29)

Intel Feeds

4 IOC feeds updated this run (10,472 indicators total) — each available as CSV, MISP JSON, and STIX 2.1. Subscribe at https://thrunt.me/intel/manifest.json.

Hand-Authored Sigma

10 production-ready TTP rules (+2 scaffolds in the authoring queue) live at https://thrunt.me/sigma/manifest.json. Subscribe via https://thrunt.me/sigma/rules.lock.json (content-hash churn) or pull all with https://thrunt.me/sigma/rules.tar.gz.

Detection Gaps

17 of 158 techniques with corpus signal have zero detection coverage — no SigmaHQ community rule, no thrunt rule. This is the hand-authoring queue; the live view is at https://thrunt.me/corpus/attck/.

…and 7 more below the cut — full list on the rollup.

Pipeline Health

All feeds healthy.

Sources: SEC EDGAR (public domain), CISA Known Exploited Vulnerabilities (public domain), FIRST.org EPSS (per ToS), NIST NVD (public domain), GitHub Security Advisories (per ToS), abuse.ch URLhaus (CC0, attribution), ransomware.live (per ToS), MITRE ATT&CK (CC BY 4.0).

Published by Applied Cybernetics Group via thrunt.me. Heuristic cross-references are labelled as such; verify before action.