Morning Brief — 2026-08-28

3 federal patching priority, 3 exploit probability movers, 10 emerging critical cves, 3 supply chain, 37 ransomware activity, 483 ioc volume, 13 active malware families, 3 multi-source iocs, 2 intel feeds, 12 hand-authored sigma, and 17 detection gaps. Sections with no signal are still rendered with an explicit “none in this window” note so absence is visible alongside presence.

Material Breach Disclosures

No new Item 1.05 8-K filings in this window.

Federal Patching Priority

CVE-2023-49105 — ownCloud ownCloud

ownCloud Improper Authentication Vulnerability

• Added: 2026-08-27 · Federal due: 2026-08-30 · EPSS 95.6th pct (score 0.111) · CVSS 9.8 (CRITICAL) · CWE-287
• ransomware use: Unknown

ownCloud contains an improper authentication vulnerability that allows an attacker to access, modify, or delete any file without authentication if the username of a victim is known, and the victim has no signing-key configured.

An issue was discovered in ownCloud owncloud/core before 10.13.1. An attacker can access, modify, or delete any file without authentication if the username of a victim is known, and the victim has no signing-key configured. This occurs because pre-signed URLs can be accepted even when no signing-key is configured for the owner of the files. The earliest affected version is 10.6.0.

CVE-2026-53362 — Linux Kernel

Linux Kernel Unspecified Vulnerability

• Added: 2026-08-27 · Federal due: 2026-08-30 · EPSS 18.0th pct (score 0.003) · CVSS 7.8 (HIGH) · CWE-787, CWE-122
• ransomware use: Unknown

Linux Kernel contains an unspecified vulnerability that can allow for privilege escalation via IPv6 networking subsystem. This vulnerability can impact multiple products, including but not limited to Suse, Red Hat, and other products using Linux.

In the Linux kernel, the following vulnerability has been resolved: ipv6: account for fraggap on the paged allocation path In __ip6_append_data(), when the paged-allocation branch is taken (MSG_MORE / NETIF_F_SG / large fraglen), alloclen and pagedlen are computed as alloclen = fragheaderlen + transhdrlen; pagedlen = datalen - transhdrlen; datalen already includes fraggap (datalen = length +…

CVE-2026-66384 — JFrog Artifactory

JFrog Artifactory Improper Limitation of a Pathname to a Restricted Directory Vulnerability

• Added: 2026-08-27 · Federal due: 2026-09-10 · EPSS 17.9th pct (score 0.003) · CVSS 5.3 (MEDIUM) · CWE-22
• ransomware use: Unknown

JFrog Artifactory contains an improper limitation of a pathname to a restricted directory vulnerability. This can allow an authenticated user to write data outside the intended Docker cache path under specific remote-repository conditions.

An authenticated user may write data outside the intended Docker cache path under specific remote-repository conditions.

Exploit Probability Movers

Emerging Critical CVEs

• CVE-2026-81735 · CRITICAL (10.0) · 2026-08-27 — startServer.ts in the mcp-http-server package of UI-TARS-desktop defaulted its listen address to ’::’ when no host was given, so startSseAndStreamableHttpMcpServer bound the Streamable HTTP and SSE MCP transports to ever…
• CVE-2026-81096 · CRITICAL (10.0) · 2026-08-27 — ToolUniverse ran caller-supplied Python inside a sandbox that could be escaped, on a server that required no authentication. The executor behind the python_code_executor tool, in python_executor_tool.py, inspected the su…
• CVE-2026-78032 · CRITICAL (9.8) · 2026-08-28 — SOY CMS contains an issue with deserialization of untrusted data. An arbitrary code may be executed by an attacker with the web server privilege.
• CVE-2026-76581 · CRITICAL (9.8) · 2026-08-28 — The WPMU DEV Dashboard plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.0.1. This is due to inconsistent and ambiguous HMAC message construction between the unauthentica…
• CVE-2026-82082 · CRITICAL (9.8) · 2026-08-28 — NUMail developed by Green-Computing has an OS Command Injection vulnerability. Unauthenticated remote attackers can inject arbitrary OS commands and execute them on the server.
• CVE-2026-78239 · CRITICAL (9.8) · 2026-08-28 — Xiiaozet LK100W exposes a critical management function that can be invoked without authentication, allowing a remote attacker to enable administrative services that should be restricted. Successful exploitation may pe…
• CVE-2026-76943 · CRITICAL (9.8) · 2026-08-28 — Xiiaozet LK100Wt contains an authentication weakness within an administrative service that may allow an attacker to bypass intended access controls and obtain command execution capabilities. Successful exploitation co…
• CVE-2026-76179 · CRITICAL (9.8) · 2026-08-28 — An improper protection of authentication tokens vulnerability exists in certain Ebyte gateway products. Authentication tokens used by the web management interface are insufficiently protected during client-side sessio…
• CVE-2026-73125 · CRITICAL (9.8) · 2026-08-28 — Ebyte device web management interface does not consistently enforce authentication before granting access to administrative functionality. An unauthenticated remote attacker could access sensitive configuration inform…
• CVE-2026-71187 · CRITICAL (9.8) · 2026-08-28 — The Ebyte device relies on client side authentication logic that can be reproduced by unauthenticated users. An attacker may generate valid authentication requests and bypass authentication to obtain administrative ac…

Supply Chain

GHSA-mf7q-r4rv-jv94 (go)

• HIGH · 2026-08-27
• Affected: github.com/crossplane/crossplane-runtime/v2, github.com/crossplane/crossplane-runtime/v2
• https://github.com/advisories/GHSA-mf7q-r4rv-jv94

Crossplane’s TOCTOU between cosign verification and image fetch in xpkg.CachedClient allows tag-based package install to bypass signature check

GHSA-39mm-rwm3-29jp · CVE-2026-54718 (composer)

• HIGH · CVSS 7.2 · 2026-08-27
• Affected: symbiote/silverstripe-advancedworkflow, symbiote/silverstripe-advancedworkflow, symbiote/silverstripe-advancedworkflow
• https://github.com/advisories/GHSA-39mm-rwm3-29jp

silverstripe-advancedworkflow vulnerable to remote code execution via advanced workflow email template

GHSA-g8wr-r2v2-vqc6 · CVE-2026-54721 (composer)

• HIGH · CVSS 8.8 · 2026-08-27
• Affected: silverstripe/userforms, silverstripe/userforms, silverstripe/userforms
• https://github.com/advisories/GHSA-g8wr-r2v2-vqc6

silverstripe/userforms vulnerable to remote code execution via userforms email subject

Ransomware Activity

37 new victim postings across 15 groups.

IOC Volume

483 new IOCs in this window. By source:

Recent OSINT Events

No curated MISP events in this window (bulk-IOC contributions tallied in IOC Volume).

Active Malware Families

13 malware families active this week (0 corroborated across ≥2 sources), exercising 15 ATT&CK techniques. Family is the unit, not the indicator: the raw IOCs are drill-down evidence below, not the signal.

Families marked ”→” are delivery/social-engineering clusters (ClickFix, ClearFake). Their technique mappings are the delivery chain — downstream behavior is payload-dependent, so they don’t open a hard coverage gap on their own.

Multi-Source IOCs

3 IOCs flagged by 2+ independent sources this window — the highest-confidence signal the cross-feed corpus produces.

MISP × KEV Correlation

No MISP events in this window referenced a CVE.

Cross-Reference

No recent SEC filings to cross-reference.

Intel Feeds

2 IOC feeds updated this run (2,734 indicators total) — each available as CSV, MISP JSON, and STIX 2.1. Subscribe at https://thrunt.me/intel/manifest.json.

Hand-Authored Sigma

10 production-ready TTP rules (+2 scaffolds in the authoring queue) live at https://thrunt.me/sigma/manifest.json. Subscribe via https://thrunt.me/sigma/rules.lock.json (content-hash churn) or pull all with https://thrunt.me/sigma/rules.tar.gz.

Detection Gaps

17 of 155 techniques with corpus signal have zero detection coverage — no SigmaHQ community rule, no thrunt rule. This is the hand-authoring queue; the live view is at https://thrunt.me/corpus/attck/.

…and 7 more below the cut — full list on the rollup.

Pipeline Health

All feeds healthy.

Sources: SEC EDGAR (public domain), CISA Known Exploited Vulnerabilities (public domain), FIRST.org EPSS (per ToS), NIST NVD (public domain), GitHub Security Advisories (per ToS), abuse.ch URLhaus (CC0, attribution), ransomware.live (per ToS), MITRE ATT&CK (CC BY 4.0).

Published by Applied Cybernetics Group via thrunt.me. Heuristic cross-references are labelled as such; verify before action.