Morning Brief — 2026-08-16

2 material breach disclosures, 1 exploit probability movers, 10 emerging critical cves, 18 ransomware activity, 481 ioc volume, 15 active malware families, 25 multi-source iocs, 1 cross-reference, 4 intel feeds, 12 hand-authored sigma, and 17 detection gaps. Sections with no signal are still rendered with an explicit “none in this window” note so absence is visible alongside presence.

Material Breach Disclosures

Alto Ingredients, Inc. (ALTO)

• Filed: 2026-08-07 · CIK 0000778164 · Accession 0001213900-26-086750
• Filing: https://www.sec.gov/Archives/edgar/data/778164/000121390026086750/ea030067001ex10-1.htm

any governmental authority or affected individuals regarding any such incident. There has been no such Breach, and the Company has not been notified of and has no knowledge of any event or condition that would reasonably be expected to result in, any such Breach, except in each case as would not reasonably be expected, individually or in the aggregate, to result in a Material Adverse Effect.

(…

Vivos Therapeutics, Inc. (VVOS)

• Filed: 2026-08-03 · CIK 0001716166 · Accession 0001493152-26-035867
• Filing: https://www.sec.gov/Archives/edgar/data/1716166/000149315226035867/ex10-2.htm

other applicable SEC cybersecurity disclosure rules. Provider shall maintain cyber liability and privacy liability insurance in amounts reasonably sufficient to cover its obligations under this Section 7.8, and shall provide Client with certificates of such insurance upon request.

Intellectual Property

8.1 Client Property. All financial statements, filings, board materials, internal con…

Federal Patching Priority

No new KEV additions in this window.

Exploit Probability Movers

Emerging Critical CVEs

• CVE-2024-13784 · CRITICAL (9.8) · 2026-08-16 — The Contact Form, Survey, Quiz & Popup Form Builder – ARForms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.8.5 via deserialization of untrusted input from form submis…
• CVE-2026-18432 · CRITICAL (9.8) · 2026-08-16 — The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.29.9. The vulnerability exists because ActionUser::conditions_logic() gates the `curre…
• CVE-2026-16098 · CRITICAL (9.8) · 2026-08-16 — The ProSolution WP Client plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.0.10 via the proSol_handleFileUpload function. This is due to missing validation of the attack…
• CVE-2026-19924 · CRITICAL (9.8) · 2026-08-16 — A security vulnerability has been detected in Tenda AC10 16.03.10.09_multi_TDE01. This vulnerability affects the function R7WebsSecurityHandler of the component httpd. The manipulation leads to improper authentication. T…
• CVE-2026-73046 · CRITICAL (9.8) · 2026-08-15 — SiYuan before v3.7.4 improperly restricts excessive authentication attempts in the CheckAuth() middleware. The HTTP Basic Authentication branch, which guards nearly the entire /api/* surface, accepts the workspace access…
• CVE-2026-19598 · CRITICAL (9.8) · 2026-08-15 — The Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to Privilege Escalation via Authorization Bypass in all versions up to, and including, 3.3.9. The vulnerability exists because the pods_admin…
• CVE-2026-18316 · CRITICAL (9.1) · 2026-08-16 — The Solace Extra plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check on the import_zip() function in versions up to, and including, 1.6.0. The handler is reg…
• CVE-2026-14524 · CRITICAL (9.1) · 2026-08-16 — The ProSolution WP Client plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the proSol_fileDeleteProcess function in all versions up to, and including, 2.0.8. This…
• CVE-2026-18855 · CRITICAL (9.1) · 2026-08-15 — The Link Library plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the ll_delete_link_fields function in all versions up to, and including, 7.9.4 This makes it poss…
• CVE-2026-73053 · CRITICAL (9.0) · 2026-08-15 — SiYuan versions before v3.7.4 contain a cross-site scripting vulnerability in the unicode2Emoji function that fails to sanitize codepoint branch output. Attackers can craft document icons with hex-encoded markup that exe…

Supply Chain

No high/critical GHSA advisories in this window.

Ransomware Activity

18 new victim postings across 8 groups.

IOC Volume

481 new IOCs in this window. By source:

Recent OSINT Events

No curated MISP events in this window (bulk-IOC contributions tallied in IOC Volume).

Active Malware Families

15 malware families active this week (2 corroborated across ≥2 sources), exercising 19 ATT&CK techniques. Family is the unit, not the indicator: the raw IOCs are drill-down evidence below, not the signal.

Families marked ”→” are delivery/social-engineering clusters (ClickFix, GuLoader). Their technique mappings are the delivery chain — downstream behavior is payload-dependent, so they don’t open a hard coverage gap on their own.

Multi-Source IOCs

25 IOCs flagged by 2+ independent sources this window — the highest-confidence signal the cross-feed corpus produces.

MISP × KEV Correlation

No MISP events in this window referenced a CVE.

Cross-Reference

Alto Ingredients, Inc. (filed 2026-08-07)

Token match on alto against KEV vendor/product strings. This is a heuristic — verify before treating as attribution.

• CVE-2026-0257 — Palo Alto Networks PAN-OS (added 2026-05-29)

Intel Feeds

4 IOC feeds updated this run (9,345 indicators total) — each available as CSV, MISP JSON, and STIX 2.1. Subscribe at https://thrunt.me/intel/manifest.json.

Hand-Authored Sigma

10 production-ready TTP rules (+2 scaffolds in the authoring queue) live at https://thrunt.me/sigma/manifest.json. Subscribe via https://thrunt.me/sigma/rules.lock.json (content-hash churn) or pull all with https://thrunt.me/sigma/rules.tar.gz.

Detection Gaps

17 of 157 techniques with corpus signal have zero detection coverage — no SigmaHQ community rule, no thrunt rule. This is the hand-authoring queue; the live view is at https://thrunt.me/corpus/attck/.

…and 7 more below the cut — full list on the rollup.

Pipeline Health

All feeds healthy.

Sources: SEC EDGAR (public domain), CISA Known Exploited Vulnerabilities (public domain), FIRST.org EPSS (per ToS), NIST NVD (public domain), GitHub Security Advisories (per ToS), abuse.ch URLhaus (CC0, attribution), ransomware.live (per ToS), MITRE ATT&CK (CC BY 4.0).

Published by Applied Cybernetics Group via thrunt.me. Heuristic cross-references are labelled as such; verify before action.