August 22, 2026 · Applied Cybernetics Group
Morning Brief — August 22, 2026
Morning Brief — 2026-08-22
1 federal patching priority, 10 emerging critical cves, 11 supply chain, 22 ransomware activity, 400 ioc volume, 21 active malware families, 2 multi-source iocs, 2 intel feeds, 12 hand-authored sigma, and 17 detection gaps. Sections with no signal are still rendered with an explicit “none in this window” note so absence is visible alongside presence.
Material Breach Disclosures
No new Item 1.05 8-K filings in this window.
Federal Patching Priority
CVE-2026-73570 — Synacor Zimbra Collaboration Suite (ZCS)
Zimbra Collaboration Suite (ZCS) OS Command Injection Vulnerability
- Added: 2026-08-21 · Federal due: 2026-08-24 · EPSS 43.2th pct (score 0.005) · CVSS 8.9 (HIGH) · CWE-78
- ransomware use: Unknown
Zimbra Collaboration Suite (ZCS) contains an OS command injection vulnerability which could allow an unauthenticated attacker to send specially crafted SMTP requests that may result in execution of arbitrary operating system commands as the Zimbra user.
A remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zimbra-snmp package is installed and SNMP notifications are enabled. Due to improper sanitization of untrusted input during SNMP notification processing, an unauthenticated attacker can send specially crafted SMTP requests that may result in execution of arbitrary operating system commands…
Exploit Probability Movers
No CVEs with ≥0.20 EPSS movement in this window.
Emerging Critical CVEs
CVE-2026-61539· CRITICAL (10.0) · 2026-08-21 — Xinference is an inference API for running open-source, speech, and multimodal models. In 2.5.0 and earlier, Xinference passes attacker-influenced Llama3 tool-call output to eval() in xinference/model/llm/tool_parsers/ll…CVE-2026-69502· CRITICAL (10.0) · 2026-08-21 — Server-side request forgery (ssrf) in Azure SQL Database allows an unauthorized attacker to elevate privileges over a network.CVE-2026-62283· CRITICAL (9.9) · 2026-08-21 — Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. Nezha versions 1.14.13 through 1.14.14 and 2.0.0 through 2.0.9 do not bind stream identifiers created by CreateStream in ser…CVE-2026-77810· CRITICAL (9.9) · 2026-08-21 — In the Neptune connector, a user with access to Neptune through Athena Federated Query could gain access to properties in the Lambda supplying the compute for the connector. To remediate this issue, users should upgrade…CVE-2026-63343· CRITICAL (9.9) · 2026-08-21 — Incus is a system container and virtual machine manager. Prior to version 7.3.0, a malicious image containing ametadata.yamlsymlink pointing to an arbitrary host path allows an authenticated Incus user to read or ove…CVE-2026-63125· CRITICAL (9.9) · 2026-08-21 — Incus is a system container and virtual machine manager. Prior to version 7.3.0, an unprivileged, project-confined Incus user (a non-admin TLS/RBAC identity withcan_create_imagesandcan_create_instances) can execut…CVE-2026-62941· CRITICAL (9.9) · 2026-08-21 — Incus is a system container and virtual machine manager. Prior to version 7.3.0, when copying an instance across projects, the project restriction check (AllowInstanceCreation) runs BEFORE the source instance’s configu…CVE-2026-62940· CRITICAL (9.9) · 2026-08-21 — Incus is a system container and virtual machine manager. Prior to version 7.3.0, when migrating an instance to another cluster member, user-supplied configuration overrides (including security-critical keys like `securit…CVE-2026-62867· CRITICAL (9.9) · 2026-08-21 — Incus is a system container and virtual machine manager. Prior to version 7.3.0, improper validation of user-providedblock.create_optionsin storage volume configuration leads to argument injection in the constructed…CVE-2026-48769· CRITICAL (9.9) · 2026-08-21 — Incus is a system container and virtual machine manager. Prior to version 7.2.0, an arbitrary file write exists in the Incus client when a malicious image server returns a craftedIncus-Image-Hashheader. This can lead…
Supply Chain
GHSA-66mm-25pp-rfff · CVE-2026-77415 (npm)
- CRITICAL · 2026-08-21
- Affected:
jsonata,jsonata - https://github.com/advisories/GHSA-66mm-25pp-rfff
JSONata vulnerable to Arbitrary Code Execution via crafted JSONata expressions
GHSA-2943-5xfg-gq5f · CVE-2026-77414 (npm)
- CRITICAL · 2026-08-21
- Affected:
jsonata,jsonata - https://github.com/advisories/GHSA-2943-5xfg-gq5f
JSONata vulnerable to Arbitrary Code Execution via crafted JSONata expressions
GHSA-2cp2-2r3c-7p7r · CVE-2026-68508 (pip)
- HIGH · CVSS 7.8 · 2026-08-21
- Affected:
hydra-core - https://github.com/advisories/GHSA-2cp2-2r3c-7p7r
Hydra: hydra.utils.instantiate with untrusted config can lead to code execution
GHSA-5h77-88j3-r659 · CVE-2026-63135 (composer)
- HIGH · CVSS 8.2 · 2026-08-21
- Affected:
yourls/yourls - https://github.com/advisories/GHSA-5h77-88j3-r659
YOURLS has stored XSS in referrer statistics chart via crafted Referer header
GHSA-8gq3-vp5j-2grp · CVE-2026-77413 (npm)
- CRITICAL · 2026-08-21
- Affected:
jsonata,jsonata - https://github.com/advisories/GHSA-8gq3-vp5j-2grp
JSONata: Arbitrary Code Execution via crafted JSONata expressions
GHSA-xhj3-7xw9-vr34 · CVE-2026-77354 (go)
- HIGH · 2026-08-21
- Affected:
github.com/getkin/kin-openapi - https://github.com/advisories/GHSA-xhj3-7xw9-vr34
kin-openapi has uncontrolled resource consumption in openapi3filter deepObject query parameter decoding
GHSA-x2rj-828p-hx9m · CVE-2026-61539 (pip)
- CRITICAL · CVSS 10.0 · 2026-08-21
- Affected:
xinference - https://github.com/advisories/GHSA-x2rj-828p-hx9m
Xinference vulnerable to remote code execution via unsafe eval() in Llama3 tool-call parsing
GHSA-hrwp-4hh9-c8r8 · CVE-2026-59989 (composer)
- CRITICAL · 2026-08-21
- Affected:
phalcon/cphalcon - https://github.com/advisories/GHSA-hrwp-4hh9-c8r8
Phalcon Volt compiler join filter compile-time PHP code injection (SSTI leads to RCE)
GHSA-mmfr-pmjx-hw9w · CVE-2026-76905 (go)
- HIGH · CVSS 7.5 · 2026-08-21
- Affected:
github.com/getkin/kin-openapi - https://github.com/advisories/GHSA-mmfr-pmjx-hw9w
kin-openapi openai3filter: nil-pointer panic in ConvertErrors on malformed multipart/form-data body enables unauthenticated DoS
GHSA-26w5-6g95-gj28 · CVE-2026-64679 (go)
- HIGH · CVSS 8.1 · 2026-08-21
- Affected:
github.com/runatlantis/atlantis - https://github.com/advisories/GHSA-26w5-6g95-gj28
Atlantis Workspace Handling has Path Traversal that Allows Out-of-Bounds Directory Deletion/Creation
Exploitation evidence, 7-day window (severity-agnostic — evidence trumps labels):
GHSA-7gwp-5pfp-969j(CVE-2026-64849, pip) · 2026-08-17 — in CISA KEV · EPSS p94.4
Ransomware Activity
22 new victim postings across 10 groups.
| Group | Victims | Sample |
|---|---|---|
qilin | 7 | Quaker State Mexico, iPic, Cinépolis, Gindre India, The Pendas Law Firm, Blake S… |
pear | 4 | Island Networks, Mogren, Glessner & Ahrens, P.S., Clifton Architectural Glass & … |
rhysida | 3 | CRI Electric, Fairview Dental Group, Battle Creek Public Schools |
spacebears | 2 | holzmarkt chemnitz, Freelom |
L Group | 1 | cedarridge.org |
Panzer | 1 | Nteitalia |
akira | 1 | JC Sales |
nightspire | 1 | Victory Personal Care, Inc |
termite | 1 | Everglades Boats |
thegentlemen | 1 | Meridian Logistics Group |
IOC Volume
400 new IOCs in this window. By source:
| Source | Count |
|---|---|
urlhaus | 400 |
Recent OSINT Events
No curated MISP events in this window (bulk-IOC contributions tallied in IOC Volume).
Active Malware Families
21 malware families active this week (0 corroborated across ≥2 sources), exercising 22 ATT&CK techniques. Family is the unit, not the indicator: the raw IOCs are drill-down evidence below, not the signal.
| Family | Type | Corrob. | IOCs | Techniques (✗ = coverage gap) |
|---|---|---|---|---|
| Mirai | botnet | — | 925 | T1110, T1498, T1499, T1584.005 |
| ConnectWise ScreenConnect (abuse) | rmm-abuse | — | 100 | T1219 |
| ClickFix | delivery → | — | 23 | T1059.001, T1204 |
| AgentTesla | stealer | — | 10 | T1056.001, T1071, T1114, T1555 |
| AsyncRAT | rat | — | 9 | T1056.001, T1059.001, T1071, T1219 |
| Remcos | rat | — | 9 | T1056.001, T1071, T1113 |
| CoinMiner | miner | — | 8 | T1496 |
| Formbook | stealer | — | 7 | T1005, T1056.001, T1071, T1555 |
| PureLogsStealer | stealer | — | 6 | T1005, T1071, T1555 |
| DDoSAgent | ddos | — | 4 | T1498, T1499 |
| Phorpiex | botnet | — | 4 | T1071, T1486, T1566 |
| XWorm | rat | — | 4 | T1056.001, T1071 |
| GuLoader | loader → | — | 3 | T1027, T1071, T1105 |
| Vidar | stealer | — | 3 | T1005, T1071, T1555 |
| ACRStealer | stealer | — | 2 | T1005, T1071, T1555 |
| ClearFake | delivery → | — | 2 | T1059.001, T1189, T1204 |
| MassLogger | stealer | — | 2 | T1056.001, T1071, T1555 |
| AMOS (Atomic macOS Stealer) | stealer | — | 1 | T1005, T1056.002, T1071, T1555.001 |
| njRAT | rat | — | 1 | T1056.001, T1059.003, T1071, T1219 |
| PhantomStealer | stealer | — | 1 | T1005, T1555 |
| PureHVNC | rat | — | 1 | T1071, T1113 |
Families marked ”→” are delivery/social-engineering clusters (ClickFix, GuLoader, ClearFake). Their technique mappings are the delivery chain — downstream behavior is payload-dependent, so they don’t open a hard coverage gap on their own.
Multi-Source IOCs
2 IOCs flagged by 2+ independent sources this window — the highest-confidence signal the cross-feed corpus produces.
| IOC | Type | Sources | Last seen |
|---|---|---|---|
cryptomeshforge10.lol | domain | misp + urlhaus | 2026-08-22 |
hypercorevector5.lol | domain | misp + urlhaus | 2026-08-22 |
MISP × KEV Correlation
No MISP events in this window referenced a CVE.
Cross-Reference
No recent SEC filings to cross-reference.
Intel Feeds
2 IOC feeds updated this run (2,959 indicators total) — each available as CSV, MISP JSON, and STIX 2.1. Subscribe at https://thrunt.me/intel/manifest.json.
| Feed | Source | Type | Count | Downloads |
|---|---|---|---|---|
| URLhaus — Malware Distribution URLs | urlhaus | url | 2,851 | CSV · MISP · STIX |
| URLhaus — Malware Distribution Domains | urlhaus | domain | 108 | CSV · MISP · STIX |
Hand-Authored Sigma
10 production-ready TTP rules (+2 scaffolds in the authoring queue) live at https://thrunt.me/sigma/manifest.json. Subscribe via https://thrunt.me/sigma/rules.lock.json (content-hash churn) or pull all with https://thrunt.me/sigma/rules.tar.gz.
| Rule | Status | YAML |
|---|---|---|
| T1037 Boot or Logon Initialization Scripts — Linux Init Script Modification | experimental | https://thrunt.me/sigma/t1037-linux-init-script-modification.yml |
| T1055 Process Injection — Rundll32 Spawning Explorer as an Injection Host | experimental | https://thrunt.me/sigma/t1055-rundll32-spawning-explorer-injection.yml |
| T1071.004 DNS-over-HTTPS Resolution from a Non-Browser Process | experimental | https://thrunt.me/sigma/t1071-004-doh-resolver-non-browser-c2.yml |
| T1098.004 Account Manipulation — SSH Authorized Keys File Modification | experimental | https://thrunt.me/sigma/t1098-004-ssh-authorized-keys-write.yml |
| T1102.001 Dead Drop Resolver — EtherHiding Payload Retrieval from BNB Smart Chain Testnet | experimental | https://thrunt.me/sigma/t1102-001-etherhiding-bsc-testnet-dead-drop.yml |
| T1195.002 Compromise Software Supply Chain — Malicious Google Tag Manager Container | experimental | https://thrunt.me/sigma/t1195-002-unapproved-gtm-container-injection.yml |
| T1204.004 Malicious Copy and Paste — ClickFix macOS Terminal Execution | experimental | https://thrunt.me/sigma/t1204-004-clickfix-macos-terminal-execution.yml |
| T1204.004 Malicious Copy and Paste — ClickFix Run Dialog Execution | experimental | https://thrunt.me/sigma/t1204-004-clickfix-run-dialog-execution.yml |
| T1566.002 Spearphishing Link — Luxembourg Hospitality SMS Phishing Campaign | experimental | https://thrunt.me/sigma/t1566-002-luxembourg-hospitality-sms-phish.yml |
| T1574.002 DLL Side-Loading — Signed javac.exe Loading jli.dll from a User-Writable Path | experimental | https://thrunt.me/sigma/t1574-002-signed-javac-sideload-jli.yml |
| T1003.008 OS Credential Dumping — /etc/shadow and /etc/gshadow Access | draft | https://thrunt.meundefined |
| T1530 Data from Cloud Storage — Detection | draft | https://thrunt.meundefined |
Detection Gaps
17 of 158 techniques with corpus signal have zero detection coverage — no SigmaHQ community rule, no thrunt rule. This is the hand-authoring queue; the live view is at https://thrunt.me/corpus/attck/.
| Technique | Name | Active families | MISP | KEV |
|---|---|---|---|---|
T1011 | Exfiltration Over Other Network Medium | — | 0 | 4 |
T1497 | Virtualization/Sandbox Evasion | — | 0 | 4 |
T1562 | — | — | 0 | 3 |
T1573.001 | Symmetric Cryptography | — | 0 | 3 |
T1001 | Data Obfuscation | — | 0 | 2 |
T1499.002 | Service Exhaustion Flood | — | 0 | 2 |
T1530 | Data from Cloud Storage | — | 0 | 2 |
T1562.001 | — | — | 0 | 2 |
T1003.008 | /etc/passwd and /etc/shadow | — | 0 | 1 |
T1070.001 | — | — | 0 | 1 |
…and 7 more below the cut — full list on the rollup.
Pipeline Health
All feeds healthy.
Sources: SEC EDGAR (public domain), CISA Known Exploited Vulnerabilities (public domain), FIRST.org EPSS (per ToS), NIST NVD (public domain), GitHub Security Advisories (per ToS), abuse.ch URLhaus (CC0, attribution), ransomware.live (per ToS), MITRE ATT&CK (CC BY 4.0).
Published by Applied Cybernetics Group via thrunt.me. Heuristic cross-references are labelled as such; verify before action.