Morning Brief — 2026-09-03

3 material breach disclosures, 7 federal patching priority, 10 emerging critical cves, 10 supply chain, 31 ransomware activity, 777 ioc volume, 21 active malware families, 2 multi-source iocs, 2 intel feeds, 12 hand-authored sigma, and 18 detection gaps. Sections with no signal are still rendered with an explicit “none in this window” note so absence is visible alongside presence.

Material Breach Disclosures

Park Dental Partners, Inc. (PARK)

• Filed: 2026-09-01 · CIK 0002069604 · Accession 0001104659-26-104300
• Filing: https://www.sec.gov/Archives/edgar/data/2069604/000110465926104300/park-20260828x8k.htm

On August 28, 2026, Park Dental Partners, Inc. (“we” or the “Company”) identified unauthorized access to its computer network. The Company promptly initiated its incident response protocols, and engaged its external cybersecurity and forensic specialists. The Company is continuing to investigate the nature and scope of this incident, including the scope of any compromise of personal or protected h…

NovoCure Ltd (NVCR)

• Filed: 2026-09-01 · CIK 0001645113 · Accession 0001645113-26-000065
• Filing: https://www.sec.gov/Archives/edgar/data/1645113/000164511326000065/nvcr-20260901.htm

Forward-Looking StatementsIn addition to historical facts or statements of current condition, this press release may contain forward-looking statements. Forward-looking statements provide Novocure’s current expectations or forecasts of future events. These may include statements regarding anticipated scientific progress on its research programs, clinical study progress, development of potential pr…

Nutex Health Inc. (NUTX)

• Filed: 2026-08-31 · CIK 0001479681 · Accession 0001628280-26-059602
• Filing: https://www.sec.gov/Archives/edgar/data/1479681/000162828026059602/nutx-20260831.htm

remediation of the incident. Readers are cautioned that these forward-looking statements are not guarantees of future events or outcomes and they should not be unduly relied on, as they are based on information available to the Company and on management’s current beliefs and expectations as of the date of this Current Report on Form 8-K and are therefore inherently uncertain and subject to risks,…

Federal Patching Priority

CVE-2026-48710 — Kludex Starlette

Kludex Starlette HTTP Request/Response Smuggling Vulnerability

• Added: 2026-09-02 · Federal due: 2026-09-16 · EPSS 80.4th pct (score 0.021) · CVSS 6.5 (MEDIUM) · CWE-444, CWE-1289
• ransomware use: Unknown

Kludex Starlette contains a HTTP request/response smuggling vulnerability that could allow attackers to inject paths into the host part, prepending the actual path leading to issues such as authentication bypass when the authentication depends on the reconstructed URL’s path. This vulnerability could be chaned with CVE-2026-42271.

Starlette is a lightweight ASGI framework/toolkit. Prior to version 1.0.1, the HTTP Host request header was not validated before being used to reconstruct request.url. Because the routing algorithm relies on the raw HTTP path while request.url is rebuilt from the Host header, a malformed header could make request.url.path differ from the path that was actually requested. Middleware and…

CVE-2026-82329 — JFrog Artifactory

JFrog Artifactory Improper Authentication Vulnerability

• Added: 2026-09-02 · Federal due: 2026-09-05 · EPSS 67.2th pct (score 0.012) · CVSS 9.8 (CRITICAL) · CWE-287
• ransomware use: Unknown

JFrog Artifactory contains an improper authentication vulnerability that under default configuration can allow an unauthenticated attacker with network access to obtain administrative privileges.

JFrog Artifactory contains an authentication weakness that, under default configuration, may allow an unauthenticated attacker with network access to obtain administrative privileges.

CVE-2026-9586 — Sangoma Switchvox

Sangoma Switchvox SQL Injection Vulnerability

• Added: 2026-09-02 · Federal due: 2026-09-05 · EPSS 63.0th pct (score 0.011) · CVSS 9.8 (CRITICAL) · CWE-89
• ransomware use: Unknown

Sangoma Switchvox contains a SQL injection vulnerability which allows an unauthenticated remote attacker to execute arbitrary SQL statements against the backend PostgreSQL database using a single crafted request, including database operations and remote code execution.

An unauthenticated SQL injection vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997). The /pa endpoint processes XML content beginning with and directly concatenates the user-controlled PhoneIP value into PostgreSQL queries without sanitization or parameterization. An unauthenticated remote attacker can execute arbitrary SQL statements against the backend…

CVE-2026-49869 — Kestra Kestra OSS

Kestra OSS OS Command Injection Vulnerability

• Added: 2026-09-02 · Federal due: 2026-09-05 · EPSS 60.2th pct (score 0.010) · CVSS 10.0 (CRITICAL) · CWE-78, CWE-184, CWE-287
• ransomware use: Unknown

Kestra OSS contains an OS command injection vulnerability that could allow an unauthenticated remote attacker to create and execute arbitrary workflows without credentials.

Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, AuthenticationFilter in Kestra OSS uses request.getPath().endsWith(“/configs”) to whitelist the public configuration endpoint from Basic Auth. Because the check is a suffix match rather than an exact path match, any API path whose last segment is configs bypasses authentication entirely. An unauthenticated…

CVE-2026-83549 — SonicWall SMA1000 Appliances

SonicWall SMA1000 Appliances OS Command Injection Vulnerability

• Added: 2026-09-02 · Federal due: 2026-09-05 · EPSS 57.8th pct (score 0.009) · CVSS 7.8 (HIGH) · CWE-78
• ransomware use: Unknown

SonicWall SMA1000 Appliances contains an OS command injection vulnerability that could enable a remote authenticated attacker as administrator to execute arbitrary OS commands, resulting in remote code execution.

Post-authentication Improper Neutralization of Special Elements used in an OS Command (‘OS Command Injection’) vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) which in specific conditions could potentially enable a remote authenticated attacker as administrator to execute arbitrary OS commands, resulting in remote code execution.

CVE-2026-59822 — BerriAI LiteLLM

BerriAI LiteLLM Improper Authentication Vulnerability

• Added: 2026-09-02 · Federal due: 2026-09-16 · EPSS 41.9th pct (score 0.005) · CVSS 8.2 (HIGH) · CWE-287, CWE-306
• ransomware use: Unknown

BerriAI LiteLLM contains an improper authentication vulnerability in the MCP Streamable HTTP endpoint that could allow an unauthenticated attacker to establish an authenticated MCP session using an arbitrary Bearer token.

LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.84.0, LiteLLM’s MCP Streamable HTTP endpoint allowed an unauthenticated attacker to use a fabricated Authorization header to trigger an OAuth2 passthrough fallback path that replaced failed LiteLLM key validation with an empty UserAPIKeyAuth() object, allowing requests to reach MCP tooling without a…

CVE-2026-83548 — SonicWall SMA1000 Appliances

SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability

• Added: 2026-09-02 · Federal due: 2026-09-05 · EPSS 18.2th pct (score 0.003) · CVSS 10.0 (CRITICAL) · CWE-441, CWE-918
• ransomware use: Unknown

SonicWall SMA1000 Appliances contains a server-side request forgery vulnerability that could allow a remote unauthenticated attacker to gain unauthorized access to sensitive functionality and perform unauthorized operations.

A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path. A remote unauthenticated attacker could potentially exploit this vulnerability to gain unauthorized access to sensitive functionality and perform unauthorized operations.

Exploit Probability Movers

No CVEs with ≥0.20 EPSS movement in this window.

Emerging Critical CVEs

• CVE-2026-4357 · CRITICAL (10.0) · 2026-09-02 — The Embed HTML5 Game WordPress plugin through 1.3 does not properly restrict who can upload files via the plugin, as well as what can be uploaded, making it possible for unauthenticated attackers to upload PHP backdoors…
• CVE-2026-77009 · CRITICAL (9.9) · 2026-09-02 — The WatchMan-Site7 WordPress plugin through 4.2.0 does not restrict access to its debugging console, which executes user-supplied PHP code, allowing any authenticated user, such as a subscriber, to run arbitrary code on…
• CVE-2026-19117 · CRITICAL (9.8) · 2026-09-02 — Under specific conditions, an attacker can register an attacker-controlled FIDO2 credential against a target account and then authenticate as that user. This issue affects on-premises deployments only.
• CVE-2026-20279 · CRITICAL (9.8) · 2026-09-02 — As part of Cisco’s ongoing commitment to proactive security and product quality, the Cisco IOS XR Software engineering team has conducted a comprehensive internal security review. This review resulted in a software harde…
• CVE-2026-20274 · CRITICAL (9.8) · 2026-09-02 — As part of Cisco’s ongoing commitment to proactive security and product quality, the Cisco IOS XR Software engineering team has conducted a comprehensive internal security review. This review resulted in a software harde…
• CVE-2026-20212 · CRITICAL (9.8) · 2026-09-02 — A vulnerability in the Silicon One integration for Cisco Nexus 9000 Series Switches could allow an unauthenticated, remote attacker to execute code with root privileges.

This vulnerability exists because TCP port…

• CVE-2026-53611 · CRITICAL (9.8) · 2026-09-02 — Looking Glass is a modern, stateless network-diagnostic platform — a single self-contained Go binary that fronts a fleet of routers over SSH and exposes ping / traceroute / BGP lookups through a gRPC (ConnectRPC) API, an…
• CVE-2025-9314 · CRITICAL (9.8) · 2026-09-02 — The Developer Tools WordPress plugin through 1.1.3 contains an unauthenticated arbitrary file upload vulnerability in the bundled SWFUpload component
• CVE-2026-84795 · CRITICAL (9.8) · 2026-09-02 — Craft CMS before 5.10.11 fails to validate the admin flag during user registration, allowing it to persist from deactivated admin accounts. Attackers can register with a deactivated admin’s email address to inherit admin…
• CVE-2026-81294 · CRITICAL (9.8) · 2026-09-02 — Unauthenticated Privilege Escalation in Authorizer <= 3.15.1 versions.

Supply Chain

GHSA-2mw5-23gm-pccq · CVE-2026-73667 (go)

• HIGH · CVSS 8.8 · 2026-09-02
• Affected: github.com/openchoreo/openchoreo, github.com/openchoreo/openchoreo, github.com/openchoreo/openchoreo
• https://github.com/advisories/GHSA-2mw5-23gm-pccq

OpenChoreo: Authenticated OS command injection via OpenChoreo Workflow Plane templates enables code execution in privileged pods

GHSA-52gf-6rpq-fgmx · CVE-2026-73841 (go)

• HIGH · CVSS 8.8 · 2026-09-02
• Affected: github.com/openchoreo/openchoreo, github.com/openchoreo/openchoreo
• https://github.com/advisories/GHSA-52gf-6rpq-fgmx

OpenChoreo: Cross-project command execution and wirelog view access via OpenChoreo openchoreo-api exec and wirelogs endpoints

GHSA-qh9r-j7rp-4x2m · CVE-2026-73843 (go)

• CRITICAL · CVSS 9.6 · 2026-09-02
• Affected: github.com/openchoreo/openchoreo, github.com/openchoreo/openchoreo
• https://github.com/advisories/GHSA-qh9r-j7rp-4x2m

OpenChoreo: Unauthenticated access to data-plane operations via OpenChoreo cluster-gateway management APIs

GHSA-w878-pj84-3j5v · CVE-2026-67445 (go)

• HIGH · CVSS 7.5 · 2026-09-02
• Affected: github.com/axllent/mailpit
• https://github.com/advisories/GHSA-w878-pj84-3j5v

Mailpit: SMTP command parser buffers unbounded command lines before syntax rejection

GHSA-gv5w-hfx8-8cwq · CVE-2026-72921 (go)

• HIGH · CVSS 8.1 · 2026-09-02
• Affected: github.com/seaweedfs/seaweedfs
• https://github.com/advisories/GHSA-gv5w-hfx8-8cwq

SeaweedFS: Filer JWT allowed_prefixes literal prefix match allows cross-tenant access to sibling paths

GHSA-75mr-qw9x-3r39 · CVE-2026-67446 (go)

• HIGH · CVSS 7.5 · 2026-09-02
• Affected: github.com/axllent/mailpit
• https://github.com/advisories/GHSA-75mr-qw9x-3r39

Mailpit: Thumbnail generation decodes unbounded image dimensions before scaling

GHSA-76g3-c3x4-crvx · CVE-2026-84366 (pip)

• HIGH · CVSS 7.4 · 2026-09-02
• Affected: scrapy
• https://github.com/advisories/GHSA-76g3-c3x4-crvx

Scrapy: S3DownloadHandler sends signed S3 requests over plaintext HTTP by default

GHSA-7mqg-cx4g-x2rf · CVE-2026-62676 (pip)

• HIGH · CVSS 7.1 · 2026-09-02
• Affected: omnigent
• https://github.com/advisories/GHSA-7mqg-cx4g-x2rf

Omnigent Guardrail policy bypass: shell-command parser fails open in policies/builtins/_shell.py

GHSA-4q39-2jhr-7qx8 · CVE-2026-65842 (npm)

• HIGH · CVSS 8.2 · 2026-09-02
• Affected: @platejs/docx-io
• https://github.com/advisories/GHSA-4q39-2jhr-7qx8

Plate: SSRF with response disclosure in DOCX image embedding

GHSA-g29j-rwfv-h99w · CVE-2026-63490 (maven)

• HIGH · CVSS 7.5 · 2026-09-02
• Affected: com.github.jknack:handlebars-springmvc
• https://github.com/advisories/GHSA-g29j-rwfv-h99w

Handlebars.java: Arbitrary file read in SpringTemplateLoader via URL-fragment suffix bypass

Ransomware Activity

31 new victim postings across 12 groups.

IOC Volume

777 new IOCs in this window. By source:

Recent OSINT Events

No curated MISP events in this window (bulk-IOC contributions tallied in IOC Volume).

Active Malware Families

21 malware families active this week (0 corroborated across ≥2 sources), exercising 22 ATT&CK techniques. Family is the unit, not the indicator: the raw IOCs are drill-down evidence below, not the signal.

Families marked ”→” are delivery/social-engineering clusters (ClickFix, ClearFake, GuLoader). Their technique mappings are the delivery chain — downstream behavior is payload-dependent, so they don’t open a hard coverage gap on their own.

Multi-Source IOCs

2 IOCs flagged by 2+ independent sources this window — the highest-confidence signal the cross-feed corpus produces.

MISP × KEV Correlation

No MISP events in this window referenced a CVE.

Cross-Reference

No SEC × KEV vendor token matches in this window. (This is a heuristic surface, absence is expected most days.)

Intel Feeds

2 IOC feeds updated this run (3,132 indicators total) — each available as CSV, MISP JSON, and STIX 2.1. Subscribe at https://thrunt.me/intel/manifest.json.

Hand-Authored Sigma

10 production-ready TTP rules (+2 scaffolds in the authoring queue) live at https://thrunt.me/sigma/manifest.json. Subscribe via https://thrunt.me/sigma/rules.lock.json (content-hash churn) or pull all with https://thrunt.me/sigma/rules.tar.gz.

Detection Gaps

18 of 161 techniques with corpus signal have zero detection coverage — no SigmaHQ community rule, no thrunt rule. This is the hand-authoring queue; the live view is at https://thrunt.me/corpus/attck/.

…and 8 more below the cut — full list on the rollup.

Pipeline Health

All feeds healthy.

Sources: SEC EDGAR (public domain), CISA Known Exploited Vulnerabilities (public domain), FIRST.org EPSS (per ToS), NIST NVD (public domain), GitHub Security Advisories (per ToS), abuse.ch URLhaus (CC0, attribution), ransomware.live (per ToS), MITRE ATT&CK (CC BY 4.0).

Published by Applied Cybernetics Group via thrunt.me. Heuristic cross-references are labelled as such; verify before action.