September 2, 2026 · Applied Cybernetics Group
Morning Brief — September 2, 2026
Morning Brief — 2026-09-02
3 material breach disclosures, 10 emerging critical cves, 10 supply chain, 21 ransomware activity, 674 ioc volume, 20 active malware families, 2 multi-source iocs, 2 intel feeds, 12 hand-authored sigma, and 18 detection gaps. Sections with no signal are still rendered with an explicit “none in this window” note so absence is visible alongside presence.
Material Breach Disclosures
Park Dental Partners, Inc. (PARK)
- Filed: 2026-09-01 · CIK 0002069604 · Accession
0001104659-26-104300 - Filing: https://www.sec.gov/Archives/edgar/data/2069604/000110465926104300/park-20260828x8k.htm
On August 28, 2026, Park Dental Partners, Inc. (“we” or the “Company”) identified unauthorized access to its computer network. The Company promptly initiated its incident response protocols, and engaged its external cybersecurity and forensic specialists. The Company is continuing to investigate the nature and scope of this incident, including the scope of any compromise of personal or protected h…
NovoCure Ltd (NVCR)
- Filed: 2026-09-01 · CIK 0001645113 · Accession
0001645113-26-000065 - Filing: https://www.sec.gov/Archives/edgar/data/1645113/000164511326000065/nvcr-20260901.htm
Forward-Looking StatementsIn addition to historical facts or statements of current condition, this press release may contain forward-looking statements. Forward-looking statements provide Novocure’s current expectations or forecasts of future events. These may include statements regarding anticipated scientific progress on its research programs, clinical study progress, development of potential pr…
Nutex Health Inc. (NUTX)
- Filed: 2026-08-31 · CIK 0001479681 · Accession
0001628280-26-059602 - Filing: https://www.sec.gov/Archives/edgar/data/1479681/000162828026059602/nutx-20260831.htm
remediation of the incident. Readers are cautioned that these forward-looking statements are not guarantees of future events or outcomes and they should not be unduly relied on, as they are based on information available to the Company and on management’s current beliefs and expectations as of the date of this Current Report on Form 8-K and are therefore inherently uncertain and subject to risks,…
Federal Patching Priority
No new KEV additions in this window.
Exploit Probability Movers
No CVEs with ≥0.20 EPSS movement in this window.
Emerging Critical CVEs
CVE-2026-76658· CRITICAL (10.0) · 2026-09-01 — A vulnerability has been identified in the SSH daemon of HPE Networking Fabric Composer that could allow an unauthenticated remote attacker to gain administrative access to vulnerable AFC hosts. Successful exploitation c…CVE-2026-76657· CRITICAL (10.0) · 2026-09-01 — Vulnerabilities have been identified in the API of HPE Networking Fabric Composer that could potentially allow an unauthenticated remote attacker to circumvent existing authentication controls. Successful exploitation co…CVE-2026-78657· CRITICAL (9.8) · 2026-09-02 — The SigmaForms Pro – AI Generated Forms plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_submission_files function in all versions up to, and including,…CVE-2026-9055· CRITICAL (9.8) · 2026-09-02 — The Booking for Appointments and Events Calendar – Amelia (Premium) plugin for WordPress is vulnerable to Privilege Escalation in versions 8.0 - 9.6.2. This is due to insufficient validation of the attacker-controlled ‘t…CVE-2026-84480· CRITICAL (9.8) · 2026-09-01 — WWBN AVideo fails to validate password recovery token expiration in userRecoverPassSave.json.php, allowing attackers to use expired tokens to reset account passwords indefinitely. Attackers who obtain a recovery token ca…CVE-2026-84372· CRITICAL (9.8) · 2026-09-01 — Predis is a flexible and feature-complete Redis and Valkey client for PHP. From version 3.0.0-RC1 until version 3.3.0, pipeline handling on aggregate cluster and replication connections reparses an already serialized RES…CVE-2023-54391· CRITICAL (9.8) · 2026-09-01 — Proxmox Virtual Environment (VE) 7.0 through 8.0 contains an authentication bypass vulnerability in libpve-access-control before 8.0.4 that allows unauthenticated attackers to authenticate as any existing enabled user wi…CVE-2026-73749· CRITICAL (9.8) · 2026-09-01 — Multiple vulnerabilities exist in a daemon of AOS-CX that may allow for improper processing of malformed input. An unauthenticated remote attacker could exploit these vulnerabilities by sending specially crafted packets…CVE-2026-78012· CRITICAL (9.8) · 2026-09-01 — An issue in the NetStaX EtherNet/IP Stack prior to v5.6.1 could allow a large Class 3 explicit-message request to exceed the application-side receive buffer without generating an error or warning. The result could be mem…CVE-2026-18808· CRITICAL (9.8) · 2026-09-01 — Improper Control of Generation of Code (‘Code Injection’) vulnerability in Klemsan Electrical Electronics Inc. KIO (Klemsan Internet Objects) allows Code Injection.
This issue affects KIO (Klemsan Internet Objects): bef…
Supply Chain
GHSA-vp52-pcj8-j9qc · CVE-2026-84304 (go)
- HIGH · 2026-09-01
- Affected:
google.golang.org/grpc - https://github.com/advisories/GHSA-vp52-pcj8-j9qc
gRPC-Go: Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation
GHSA-68jx-f42c-7599 · CVE-2026-19418 (composer)
- HIGH · 2026-09-01
- Affected:
typo3/cms-backend,typo3/cms-core - https://github.com/advisories/GHSA-68jx-f42c-7599
TYPO3 CMS - Broken Access Control in Backend and Install Tool
GHSA-52xp-w8hr-xv3c · CVE-2026-77567 (composer)
- HIGH · CVSS 8.1 · 2026-09-01
- Affected:
filament/filament,filament/filament - https://github.com/advisories/GHSA-52xp-w8hr-xv3c
Filament: Multi-factor authentication (app) can be bypassed when recovery codes are enabled
GHSA-m4rf-3fr8-xwx3 · CVE-2026-79675 (pip)
- CRITICAL · CVSS 9.8 · 2026-09-01
- Affected:
nltk - https://github.com/advisories/GHSA-m4rf-3fr8-xwx3
NLTK: JVM argument injection bypass via per-call options in the NLTK Stanford wrappers (incomplete fix of CVE-2026-12841)
GHSA-8rr7-cvq3-gmfh (composer)
- HIGH · CVSS 7.5 · 2026-09-01
- Affected:
league/commonmark - https://github.com/advisories/GHSA-8rr7-cvq3-gmfh
league/commonmark: Denial of service via distinctly-named attributes in the Attributes extension
GHSA-6hwm-xvph-95vm · CVE-2026-78680 (pip)
- HIGH · CVSS 7.8 · 2026-09-01
- Affected:
nltk - https://github.com/advisories/GHSA-6hwm-xvph-95vm
NLTK: Uncontrolled search path when invoking the Graphviz ‘dot’ binary
GHSA-jjv6-8j6v-6j52 (composer)
- HIGH · CVSS 7.5 · 2026-09-01
- Affected:
league/commonmark - https://github.com/advisories/GHSA-jjv6-8j6v-6j52
league/commonmark: Denial of service in the SmartPunct and Attributes extensions
GHSA-f8fg-pg57-v4j8 (composer)
- HIGH · CVSS 7.2 · 2026-09-01
- Affected:
league/commonmark - https://github.com/advisories/GHSA-f8fg-pg57-v4j8
league/commonmark XSS: on* event-handler filter in AttributesExtension bypassed with a U+000C form feed
GHSA-j8pm-gj4c-rq4x (composer)
- HIGH · CVSS 7.5 · 2026-09-01
- Affected:
league/commonmark - https://github.com/advisories/GHSA-j8pm-gj4c-rq4x
league/commonmark: Denial of service via crafted code fences, reference links, and emphasis delimiters
GHSA-xwg4-73v4-xw9w · CVE-2026-73086 (npm)
- HIGH · CVSS 7.4 · 2026-09-01
- Affected:
nanoid,nanoid - https://github.com/advisories/GHSA-xwg4-73v4-xw9w
nanoid: Integer Overflow or Wraparound
Ransomware Activity
21 new victim postings across 15 groups.
| Group | Victims | Sample |
|---|---|---|
akira | 3 | Congressional Iron Works, Flex1, BYK Construction |
direwolf | 3 | Oportunidados, Honeycomb Programs Inc, PT Intraco Penta Tbk |
thegentlemen | 3 | CareerSource Palm Beach County, Nutex Health, The Sole |
Black X | 1 | iwin |
Global Secret Group | 1 | Quality Resource Pvt |
SilentRansomGroup | 1 | Holland & Knight |
Wallstreet | 1 | Total Education Solutions |
anubis | 1 | Marlborough Partners |
aurora | 1 | Chip 1 Exchange |
bravox | 1 | SCHMIDT |
fulcrumsec | 1 | Manchester Airports Group |
nightspire | 1 | Transportes Montejo S.A.S. |
qilin | 1 | Grayson Rural Electric Cooperative |
ransomhouse | 1 | REXT Holdings Co., Ltd. |
rhysida | 1 | Szechenyi Programiroda Nonprofit Kf |
IOC Volume
674 new IOCs in this window. By source:
| Source | Count |
|---|---|
urlhaus | 674 |
Recent OSINT Events
No curated MISP events in this window (bulk-IOC contributions tallied in IOC Volume).
Active Malware Families
20 malware families active this week (0 corroborated across ≥2 sources), exercising 22 ATT&CK techniques. Family is the unit, not the indicator: the raw IOCs are drill-down evidence below, not the signal.
| Family | Type | Corrob. | IOCs | Techniques (✗ = coverage gap) |
|---|---|---|---|---|
| Mirai | botnet | — | 1,375 | T1110, T1498, T1499, T1584.005 |
| ConnectWise ScreenConnect (abuse) | rmm-abuse | — | 63 | T1219 |
| ClickFix | delivery → | — | 24 | T1059.001, T1204 |
| AgentTesla | stealer | — | 22 | T1056.001, T1071, T1114, T1555 |
| DDoSAgent | ddos | — | 14 | T1498, T1499 |
| CoinMiner | miner | — | 12 | T1496 |
| PureLogsStealer | stealer | — | 9 | T1005, T1071, T1555 |
| AsyncRAT | rat | — | 6 | T1056.001, T1059.001, T1071, T1219 |
| Formbook | stealer | — | 6 | T1005, T1056.001, T1071, T1555 |
| SilverFox | rat | — | 6 | T1059, T1071, T1219 |
| AMOS (Atomic macOS Stealer) | stealer | — | 5 | T1005, T1056.002, T1071, T1555.001 |
| Stealc | stealer | — | 5 | T1005, T1071, T1555 |
| ClearFake | delivery → | — | 2 | T1059.001, T1189, T1204 |
| GuLoader | loader → | — | 2 | T1027, T1071, T1105 |
| NetSupport Manager (abuse) | rmm-abuse | — | 2 | T1219 |
| Phorpiex | botnet | — | 2 | T1071, T1486, T1566 |
| Lumma | stealer | — | 1 | T1005, T1071, T1555 |
| MassLogger | stealer | — | 1 | T1056.001, T1071, T1555 |
| Remcos | rat | — | 1 | T1056.001, T1071, T1113 |
| Vidar | stealer | — | 1 | T1005, T1071, T1555 |
Families marked ”→” are delivery/social-engineering clusters (ClickFix, ClearFake, GuLoader). Their technique mappings are the delivery chain — downstream behavior is payload-dependent, so they don’t open a hard coverage gap on their own.
Multi-Source IOCs
2 IOCs flagged by 2+ independent sources this window — the highest-confidence signal the cross-feed corpus produces.
| IOC | Type | Sources | Last seen |
|---|---|---|---|
cryptovectorhub1.lol | domain | misp + urlhaus | 2026-09-02 |
hypercorevector4.lol | domain | misp + urlhaus | 2026-09-02 |
MISP × KEV Correlation
No MISP events in this window referenced a CVE.
Cross-Reference
No SEC × KEV vendor token matches in this window. (This is a heuristic surface, absence is expected most days.)
Intel Feeds
2 IOC feeds updated this run (3,006 indicators total) — each available as CSV, MISP JSON, and STIX 2.1. Subscribe at https://thrunt.me/intel/manifest.json.
| Feed | Source | Type | Count | Downloads |
|---|---|---|---|---|
| URLhaus — Malware Distribution URLs | urlhaus | url | 2,903 | CSV · MISP · STIX |
| URLhaus — Malware Distribution Domains | urlhaus | domain | 103 | CSV · MISP · STIX |
Hand-Authored Sigma
10 production-ready TTP rules (+2 scaffolds in the authoring queue) live at https://thrunt.me/sigma/manifest.json. Subscribe via https://thrunt.me/sigma/rules.lock.json (content-hash churn) or pull all with https://thrunt.me/sigma/rules.tar.gz.
| Rule | Status | YAML |
|---|---|---|
| T1037 Boot or Logon Initialization Scripts — Linux Init Script Modification | experimental | https://thrunt.me/sigma/t1037-linux-init-script-modification.yml |
| T1055 Process Injection — Rundll32 Spawning Explorer as an Injection Host | experimental | https://thrunt.me/sigma/t1055-rundll32-spawning-explorer-injection.yml |
| T1071.004 DNS-over-HTTPS Resolution from a Non-Browser Process | experimental | https://thrunt.me/sigma/t1071-004-doh-resolver-non-browser-c2.yml |
| T1098.004 Account Manipulation — SSH Authorized Keys File Modification | experimental | https://thrunt.me/sigma/t1098-004-ssh-authorized-keys-write.yml |
| T1102.001 Dead Drop Resolver — EtherHiding Payload Retrieval from BNB Smart Chain Testnet | experimental | https://thrunt.me/sigma/t1102-001-etherhiding-bsc-testnet-dead-drop.yml |
| T1195.002 Compromise Software Supply Chain — Malicious Google Tag Manager Container | experimental | https://thrunt.me/sigma/t1195-002-unapproved-gtm-container-injection.yml |
| T1204.004 Malicious Copy and Paste — ClickFix macOS Terminal Execution | experimental | https://thrunt.me/sigma/t1204-004-clickfix-macos-terminal-execution.yml |
| T1204.004 Malicious Copy and Paste — ClickFix Run Dialog Execution | experimental | https://thrunt.me/sigma/t1204-004-clickfix-run-dialog-execution.yml |
| T1566.002 Spearphishing Link — Luxembourg Hospitality SMS Phishing Campaign | experimental | https://thrunt.me/sigma/t1566-002-luxembourg-hospitality-sms-phish.yml |
| T1574.002 DLL Side-Loading — Signed javac.exe Loading jli.dll from a User-Writable Path | experimental | https://thrunt.me/sigma/t1574-002-signed-javac-sideload-jli.yml |
| T1003.008 OS Credential Dumping — /etc/shadow and /etc/gshadow Access | draft | https://thrunt.meundefined |
| T1530 Data from Cloud Storage — Detection | draft | https://thrunt.meundefined |
Detection Gaps
18 of 161 techniques with corpus signal have zero detection coverage — no SigmaHQ community rule, no thrunt rule. This is the hand-authoring queue; the live view is at https://thrunt.me/corpus/attck/.
| Technique | Name | Active families | MISP | KEV |
|---|---|---|---|---|
T1011 | Exfiltration Over Other Network Medium | — | 0 | 4 |
T1497 | Virtualization/Sandbox Evasion | — | 0 | 4 |
T1573.001 | Symmetric Cryptography | — | 1 | 3 |
T1562 | — | — | 0 | 3 |
T1001 | Data Obfuscation | — | 0 | 2 |
T1499.002 | Service Exhaustion Flood | — | 0 | 2 |
T1530 | Data from Cloud Storage | — | 0 | 2 |
T1562.001 | — | — | 0 | 2 |
T1003.008 | /etc/passwd and /etc/shadow | — | 0 | 1 |
T1070.001 | — | — | 0 | 1 |
…and 8 more below the cut — full list on the rollup.
Pipeline Health
All feeds healthy.
Sources: SEC EDGAR (public domain), CISA Known Exploited Vulnerabilities (public domain), FIRST.org EPSS (per ToS), NIST NVD (public domain), GitHub Security Advisories (per ToS), abuse.ch URLhaus (CC0, attribution), ransomware.live (per ToS), MITRE ATT&CK (CC BY 4.0).
Published by Applied Cybernetics Group via thrunt.me. Heuristic cross-references are labelled as such; verify before action.