Morning Brief — 2026-08-21

1 material breach disclosures, 2 federal patching priority, 1 exploit probability movers, 10 emerging critical cves, 11 supply chain, 72 ransomware activity, 450 ioc volume, 18 active malware families, 2 multi-source iocs, 1 cross-reference, 4 intel feeds, 12 hand-authored sigma, and 17 detection gaps. Sections with no signal are still rendered with an explicit “none in this window” note so absence is visible alongside presence.

Material Breach Disclosures

Alto Ingredients, Inc. (ALTO)

• Filed: 2026-08-07 · CIK 0000778164 · Accession 0001213900-26-086750
• Filing: https://www.sec.gov/Archives/edgar/data/778164/000121390026086750/ea030067001ex10-1.htm

any governmental authority or affected individuals regarding any such incident. There has been no such Breach, and the Company has not been notified of and has no knowledge of any event or condition that would reasonably be expected to result in, any such Breach, except in each case as would not reasonably be expected, individually or in the aggregate, to result in a Material Adverse Effect.

(…

Federal Patching Priority

CVE-2026-72530 — TrueConf Server

TrueConf Server Code Injection Vulnerability

• Added: 2026-08-20 · Federal due: 2026-09-03 · EPSS 27.2th pct (score 0.003) · CVSS 9.0 (CRITICAL) · CWE-94
• ransomware use: Unknown

TrueConf Server contains a code injection vulnerability that could allow an unauthorized remote attacker with network access via port 4307/TCP to use a specially crafted script to break out of the isolated environment and execute arbitrary code on the host system.

A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X to 5.5.5, and earlier could use a specially crafted script to break out of the isolated environment and execute arbitrary code on the host system.

CVE-2026-72529 — TrueConf Server

TrueConf Server Missing Authentication for Critical Function Vulnerability

• Added: 2026-08-20 · Federal due: 2026-08-23 · EPSS 21.1th pct (score 0.003) · CVSS 9.8 (CRITICAL) · CWE-306
• ransomware use: Unknown

TrueConf Server contains a missing authentication for critical function vulnerability which could allow a remote unauthorized attacker with network access via port 4307/TCP to execute an arbitrary script.

A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X to 5.5.5, and earlier could execute an arbitrary script by calling an undocumented function.

Exploit Probability Movers

Emerging Critical CVEs

• CVE-2026-69836 · CRITICAL (10.0) · 2026-08-20 — Deserialization of untrusted data in Microsoft Entra ID allows an unauthorized attacker to execute code over a network.
• CVE-2026-69555 · CRITICAL (10.0) · 2026-08-20 — Incorrect authorization in Azure Arc allows an unauthorized attacker to elevate privileges over a network.
• CVE-2026-65816 · CRITICAL (10.0) · 2026-08-20 — Use of incorrectly-resolved name or reference in Azure Arc allows an unauthorized attacker to elevate privileges over a network.
• CVE-2026-65801 · CRITICAL (10.0) · 2026-08-20 — Server-side request forgery (ssrf) in Microsoft Exchange Online allows an unauthorized attacker to elevate privileges over a network.
• CVE-2026-65770 · CRITICAL (10.0) · 2026-08-20 — Improper neutralization of argument delimiters in a command (‘argument injection’) in Azure Managed Instance for Apache Cassandra allows an unauthorized attacker to execute code over a network.
• CVE-2026-69851 · CRITICAL (9.9) · 2026-08-20 — Server-side request forgery (ssrf) in Azure Active Directory allows an authorized attacker to elevate privileges over a network.
• CVE-2026-68789 · CRITICAL (9.9) · 2026-08-20 — Improper neutralization of special elements used in an sql command (‘sql injection’) in Azure SQL Database allows an authorized attacker to elevate privileges over a network.
• CVE-2026-68782 · CRITICAL (9.9) · 2026-08-20 — Improper neutralization of special elements used in an sql command (‘sql injection’) in Azure SQL Database allows an authorized attacker to elevate privileges over a network.
• CVE-2026-63509 · CRITICAL (9.9) · 2026-08-20 — Relative path traversal in Microsoft Fabric allows an authorized attacker to elevate privileges over a network.
• CVE-2026-18835 · CRITICAL (9.9) · 2026-08-20 — IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.

Supply Chain

GHSA-8cfw-pcwh-v63w (composer)

• HIGH · CVSS 8.4 · 2026-08-20
• Affected: winter/wn-system-module
• https://github.com/advisories/GHSA-8cfw-pcwh-v63w

Winter: Authenticated Twig sandbox escape in CMS SecurityPolicy (bypass of CVE-2024-54149)

GHSA-4899-mpch-38p3 · CVE-2026-63202 (maven)

• HIGH · CVSS 7.5 · 2026-08-20
• Affected: io.netty.incubator:netty-incubator-codec-bhttp
• https://github.com/advisories/GHSA-4899-mpch-38p3

netty-incubator-codec-ohttp BinaryHttpParser: Unauthenticated CPU-exhaustion DoS via infinite loop in field-section decoding

GHSA-hmq9-67w8-j5pw · CVE-2026-61827 (maven)

• HIGH · 2026-08-20
• Affected: io.netty.incubator:netty-incubator-codec-bhttp
• https://github.com/advisories/GHSA-hmq9-67w8-j5pw

netty-incubator-codec-ohttp: BinaryHttpParser should enforce limits for variable lengths fields

GHSA-8cfx-wx3q-mh5q · CVE-2026-63124 (maven)

• HIGH · CVSS 7.5 · 2026-08-20
• Affected: io.netty.incubator:netty-incubator-codec-bhttp
• https://github.com/advisories/GHSA-8cfx-wx3q-mh5q

netty-incubator-codec-ohttp: Binary HTTP parser infinite loop on known-length field section boundary

GHSA-2mc4-j865-9q4r · CVE-2026-61798 (maven)

• HIGH · CVSS 8.1 · 2026-08-20
• Affected: io.netty.incubator:netty-incubator-codec-ohttp-hpke-classes-boringssl
• https://github.com/advisories/GHSA-2mc4-j865-9q4r

netty-incubator-codec-ohttp: BoringSSL HPKE private key bytes exposed through toString() and exception messages

GHSA-ghvf-qf6h-g8x5 (npm)

• HIGH · 2026-08-20
• Affected: @nocobase/server
• https://github.com/advisories/GHSA-ghvf-qf6h-g8x5

NocoBase: Arbitrary File Write chained with Local file Inclusion leads to Remote code execution

GHSA-23m2-mghx-vqmf · CVE-2026-54263 (pip)

• HIGH · CVSS 7.3 · 2026-08-20
• Affected: wagtail, wagtail
• https://github.com/advisories/GHSA-23m2-mghx-vqmf

Wagtail: Reflected XSS in dynamic image URL generator view

GHSA-vmr9-j6wf-pmh2 · CVE-2026-54251 (maven)

• HIGH · 2026-08-20
• Affected: io.netty.incubator:netty-incubator-codec-ohttp
• https://github.com/advisories/GHSA-vmr9-j6wf-pmh2

netty-incubator-codec-ohttp: [OHttpServerCodec] Native Direct-Memory Leak on AEAD Decryption Failure Leads to Gateway Denial of Service

GHSA-7q96-f8xw-jv5j · CVE-2026-54245 (go)

• HIGH · 2026-08-20
• Affected: github.com/fleetdm/fleet
• https://github.com/advisories/GHSA-7q96-f8xw-jv5j

Fleet: SQL injection in Okta conditional access endpoint allows host-controlled compromise of the Fleet database

GHSA-mrc5-3mm3-45c5 · CVE-2026-54182 (composer)

• HIGH · CVSS 8.1 · 2026-08-20
• Affected: backpack/crud, backpack/crud, backpack/crud
• https://github.com/advisories/GHSA-mrc5-3mm3-45c5

Laravel Backpack CRUD: OS command injection in Stats::makeCurlRequest via attacker-controlled Host header (pre-auth)

Exploitation evidence, 7-day window (severity-agnostic — evidence trumps labels):

• GHSA-7gwp-5pfp-969j (CVE-2026-64849, pip) · 2026-08-17 — in CISA KEV · EPSS p94.4

Ransomware Activity

72 new victim postings across 21 groups.

IOC Volume

450 new IOCs in this window. By source:

Recent OSINT Events

No curated MISP events in this window (bulk-IOC contributions tallied in IOC Volume).

Active Malware Families

18 malware families active this week (0 corroborated across ≥2 sources), exercising 21 ATT&CK techniques. Family is the unit, not the indicator: the raw IOCs are drill-down evidence below, not the signal.

Families marked ”→” are delivery/social-engineering clusters (ClickFix, GuLoader). Their technique mappings are the delivery chain — downstream behavior is payload-dependent, so they don’t open a hard coverage gap on their own.

Multi-Source IOCs

2 IOCs flagged by 2+ independent sources this window — the highest-confidence signal the cross-feed corpus produces.

MISP × KEV Correlation

No MISP events in this window referenced a CVE.

Cross-Reference

Alto Ingredients, Inc. (filed 2026-08-07)

Token match on alto against KEV vendor/product strings. This is a heuristic — verify before treating as attribution.

• CVE-2026-0257 — Palo Alto Networks PAN-OS (added 2026-05-29)

Intel Feeds

4 IOC feeds updated this run (2,982 indicators total) — each available as CSV, MISP JSON, and STIX 2.1. Subscribe at https://thrunt.me/intel/manifest.json.

Hand-Authored Sigma

10 production-ready TTP rules (+2 scaffolds in the authoring queue) live at https://thrunt.me/sigma/manifest.json. Subscribe via https://thrunt.me/sigma/rules.lock.json (content-hash churn) or pull all with https://thrunt.me/sigma/rules.tar.gz.

Detection Gaps

17 of 158 techniques with corpus signal have zero detection coverage — no SigmaHQ community rule, no thrunt rule. This is the hand-authoring queue; the live view is at https://thrunt.me/corpus/attck/.

…and 7 more below the cut — full list on the rollup.

Pipeline Health

All feeds healthy.

Sources: SEC EDGAR (public domain), CISA Known Exploited Vulnerabilities (public domain), FIRST.org EPSS (per ToS), NIST NVD (public domain), GitHub Security Advisories (per ToS), abuse.ch URLhaus (CC0, attribution), ransomware.live (per ToS), MITRE ATT&CK (CC BY 4.0).

Published by Applied Cybernetics Group via thrunt.me. Heuristic cross-references are labelled as such; verify before action.