Morning Brief — 2026-09-10

4 material breach disclosures, 4 federal patching priority, 10 emerging critical cves, 11 supply chain, 26 ransomware activity, 602 ioc volume, 12 active malware families, 2 intel feeds, 12 hand-authored sigma, and 18 detection gaps. Sections with no signal are still rendered with an explicit “none in this window” note so absence is visible alongside presence.

Material Breach Disclosures

BOSTON SCIENTIFIC CORP (BSX)

• Filed: 2026-09-08 · CIK 0000885725 · Accession 0000885725-26-000059
• Filing: https://www.sec.gov/Archives/edgar/data/885725/000088572526000059/bsx-20260907.htm

As previously disclosed in a Current Report on Form 8-K filed on August 26, 2026 with the Securities and Exchange Commission, on August 25, 2026, Boston Scientific Corporation (the “Company”) identified a cybersecurity incident that affected certain of its information technology systems and resulted in a global disruption to the Company’s operations. Upon detection, the Company activated its incid…

Park Dental Partners, Inc. (PARK)

• Filed: 2026-09-01 · CIK 0002069604 · Accession 0001104659-26-104300
• Filing: https://www.sec.gov/Archives/edgar/data/2069604/000110465926104300/park-20260828x8k.htm

On August 28, 2026, Park Dental Partners, Inc. (“we” or the “Company”) identified unauthorized access to its computer network. The Company promptly initiated its incident response protocols, and engaged its external cybersecurity and forensic specialists. The Company is continuing to investigate the nature and scope of this incident, including the scope of any compromise of personal or protected h…

NovoCure Ltd (NVCR)

• Filed: 2026-09-01 · CIK 0001645113 · Accession 0001645113-26-000065
• Filing: https://www.sec.gov/Archives/edgar/data/1645113/000164511326000065/nvcr-20260901.htm

Forward-Looking StatementsIn addition to historical facts or statements of current condition, this press release may contain forward-looking statements. Forward-looking statements provide Novocure’s current expectations or forecasts of future events. These may include statements regarding anticipated scientific progress on its research programs, clinical study progress, development of potential pr…

Nutex Health Inc. (NUTX)

• Filed: 2026-08-31 · CIK 0001479681 · Accession 0001628280-26-059602
• Filing: https://www.sec.gov/Archives/edgar/data/1479681/000162828026059602/nutx-20260831.htm

remediation of the incident. Readers are cautioned that these forward-looking statements are not guarantees of future events or outcomes and they should not be unduly relied on, as they are based on information available to the Company and on management’s current beliefs and expectations as of the date of this Current Report on Form 8-K and are therefore inherently uncertain and subject to risks,…

Federal Patching Priority

CVE-2026-20079 — Cisco Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management

Cisco Firewall Management Center Authentication Bypass Using an Alternate Path or Channel Vulnerability

• Added: 2026-09-09 · Federal due: 2026-09-12 · EPSS 98.4th pct (score 0.359) · CVSS 10.0 (CRITICAL) · CWE-288
• ransomware use: Unknown

Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management contain an authentication Bypass using an alternate path or channel vulnerability that could allow an unauthenticated, remote attacker to bypass authentication and execute script files on an affected device to obtain root access to the underlying operating system.

A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to bypass authentication and execute script files on an affected device to obtain root access to the underlying operating system.  This vulnerability is due to an improper system process that is created at boot time. An attacker could exploit this…

CVE-2026-19490 — Citrix NetScaler

Citrix NetScaler Authentication Bypass Using an Alternate Path or Channel Vulnerability

• Added: 2026-09-09 · Federal due: 2026-09-12 · EPSS 88.0th pct (score 0.034) · CWE-288
• ransomware use: Unknown

Citrix NetScaler ADC and NetScaler Gateway contain an authentication-bypass vulnerability involving an alternate path or channel. When the NetScaler appliance is configured as an AAA virtual server or as a Gateway (SSL VPN, ICA Proxy, CVPN, or RDP Proxy), an unauthenticated remote threat actor may be able to bypass authentication.

Vulnerability in NetScaler ADC and NetScaler Gateway. This issue affects ADC: from 14.1 through 73.32 and from 13.1 through 63.21; Gateway: from 14.1 through 73.32 and from 13.1 through 63.21.

CVE-2025-25249 — Fortinet Multiple Products

Fortinet Multiple Products Heap-based Buffer Overflow Vulnerability

• Added: 2026-09-09 · Federal due: 2026-09-12 · EPSS 53.1th pct (score 0.008) · CVSS 8.1 (HIGH) · CWE-122, CWE-787
• ransomware use: Unknown

Fortinet FortiOS, FortiSwitchManager, and FortiSASE contain a heap-based buffer overflow vulnerability that allows an attacker to execute unauthorized code or commands via specially crafted packets.

A heap-based buffer overflow vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through 7.2.11, FortiOS 7.0.0 through 7.0.17, FortiOS 6.4 all versions, FortiSwitchManager 7.2.0 through 7.2.6, FortiSwitchManager 7.0.0 through 7.0.5 allows attacker to execute unauthorized code or commands via specially crafted packets

CVE-2026-87491 — Google Chromium V8

Google Chromium V8 Out of Bounds Write Vulnerability

• Added: 2026-09-09 · Federal due: 2026-09-23 · EPSS 21.4th pct (score 0.003) · CVSS 8.8 (HIGH) · CWE-787
• ransomware use: Unknown

Google Chromium V8 contains an out of bounds write vulnerability that allows a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.

Out of bounds write in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

Exploit Probability Movers

No CVEs with ≥0.20 EPSS movement in this window.

Emerging Critical CVEs

• CVE-2026-19583 · CRITICAL (9.9) · 2026-09-10 — Velociraptor allows some sensitive artifacts to be gated by additional permissions. For example, the Linux.Sys.BashShell artifact allows arbitrary command execution on endpoints, and so it requires the EXECVE permission…
• CVE-2026-67401 · CRITICAL (9.9) · 2026-09-09 — A vulnerability in cPanel allows a mail-enabled account to achieve remote code execution as root through SQLi in EmailTrack component
• CVE-2026-88278 · CRITICAL (9.8) · 2026-09-10 — GeoVision GV-LPC2211 V1.13 fails to enforce WS-Security UsernameToken freshness or nonce reuse protection, allowing a captured PasswordDigest token to be replayed for subsequent ONVIF operations.
• CVE-2026-7188 · CRITICAL (9.8) · 2026-09-10 — Improper neutralization of special elements used in an SQL command (‘SQL injection’) vulnerability in Armiya Information Technologies Ltd. Co. Access Control System allows SQL Injection.

This issue affects Access Contro…

• CVE-2026-18351 · CRITICAL (9.8) · 2026-09-10 — The Drag and Drop File Upload for Elementor Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.6.0 via the elementor_file_upload function. This is due to insufficien…
• CVE-2026-87929 · CRITICAL (9.8) · 2026-09-09 — MaxSite CMS through 109.6 ships with a hardcoded session encryption key in application/config/config.php that is never changed during installation, allowing unauthenticated attackers to forge administrator session cookie…
• CVE-2026-85103 · CRITICAL (9.8) · 2026-09-09 — A heap-based buffer overflow in VPN certificate ASN.1 decoding may allow an unauthenticated remote attacker to execute arbitrary code on Check Point Quantum Security Management and Quantum Security Gateway systems.
• CVE-2026-85102 · CRITICAL (9.8) · 2026-09-09 — Improper certificate trust validation during VPN negotiation in Check Point Quantum Security Gateway may allow an unauthenticated remote attacker to execute arbitrary code on the Gateway.
• CVE-2026-80172 · CRITICAL (9.8) · 2026-09-09 — Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Insufficient Verification of Data Authenticity vulnerability. An unauthenticated attacker with re…
• CVE-2026-85978 · CRITICAL (9.8) · 2026-09-09 — An unauthenticated remote code execution vulnerability exists in the Policy Manager console of Akana API Platform. A path normalization discrepancy between the authentication filter and the servlet dispatcher allows a cr…

Supply Chain

GHSA-cp3j-m783-3ph5 · CVE-2026-59185 (go)

• HIGH · CVSS 8.5 · 2026-09-09
• Affected: github.com/identrail/identrail
• https://github.com/advisories/GHSA-cp3j-m783-3ph5

Identrail Cross-tenant IDOR: Client-supplied GitHub App installation_id is bound to the caller’s workspace without ownership verification

GHSA-g72f-jw3w-mgh7 · CVE-2026-59179 (npm)

• HIGH · CVSS 8.3 · 2026-09-09
• Affected: @openhop/server
• https://github.com/advisories/GHSA-g72f-jw3w-mgh7

@openhop/server: Path Traversal in Flow ID File Operations

GHSA-vv4j-m4vr-f3g6 · CVE-2026-59177 (pip)

• HIGH · CVSS 8.8 · 2026-09-09
• Affected: esphome-device-builder
• https://github.com/advisories/GHSA-vv4j-m4vr-f3g6

ESPHome Device Builder Dashboard: Unauthenticated dashboard access via the HA add-on ingress site bound to all interfaces

GHSA-wcjj-9m6g-2fr2 · CVE-2026-59176 (npm)

• HIGH · CVSS 7.8 · 2026-09-09
• Affected: functype-mcp-server
• https://github.com/advisories/GHSA-wcjj-9m6g-2fr2

functype-mcp-server: MCP set_functype_version Package Alias RCE via Unsanitized pnpm install + Dynamic Import

GHSA-m835-3cm9-rggg · CVE-2026-59172 (go)

• HIGH · CVSS 7.8 · 2026-09-09
• Affected: github.com/candid82/joker
• https://github.com/advisories/GHSA-m835-3cm9-rggg

Joker linter executed project-local .jokerd/linter.* files during linting

GHSA-hxjg-93wc-h8p8 (go)

• HIGH · CVSS 8.8 · 2026-09-09
• Affected: github.com/komari-monitor/komari
• https://github.com/advisories/GHSA-hxjg-93wc-h8p8

Komari: Management Interface CSRF

GHSA-2r5q-h53f-9rp3 · CVE-2026-59160 (npm)

• HIGH · CVSS 8.8 · 2026-09-09
• Affected: @yeger/turbo-graph
• https://github.com/advisories/GHSA-2r5q-h53f-9rp3

@yeger/turbo-graph: Unauthenticated Network-Exposed Task Execution via /api/run

GHSA-fxg7-897c-57mp · CVE-2026-59158 (npm)

• HIGH · CVSS 7.5 · 2026-09-09
• Affected: nuxt-ollama
• https://github.com/advisories/GHSA-fxg7-897c-57mp

Nuxt Ollama: Public Runtime Config Exposes Ollama API Key to Browser Clients

GHSA-5hx7-j24v-rffj · CVE-2026-55864 (maven)

• HIGH · 2026-09-09
• Affected: org.geonetwork-opensource:gn-web-app, org.geonetwork-opensource:gn-web-app
• https://github.com/advisories/GHSA-5hx7-j24v-rffj

GeoNetwork Web Module: Unauthenticaded Server-Side Request Forgery in SLD Tool

GHSA-7w5x-hrqm-74c2 · CVE-2026-85730 (npm)

• HIGH · 2026-09-09
• Affected: smol-toml
• https://github.com/advisories/GHSA-7w5x-hrqm-74c2

smol-toml: Denial of Service via malformed TOML documents

Exploitation evidence, 7-day window (severity-agnostic — evidence trumps labels):

• GHSA-rcr6-4jqh-j84m (CVE-2026-60004, go) · 2026-09-08 — in CISA KEV · EPSS p99.7

Ransomware Activity

26 new victim postings across 15 groups.

IOC Volume

602 new IOCs in this window. By source:

Recent OSINT Events

No curated MISP events in this window (bulk-IOC contributions tallied in IOC Volume).

Active Malware Families

12 malware families active this week (0 corroborated across ≥2 sources), exercising 15 ATT&CK techniques. Family is the unit, not the indicator: the raw IOCs are drill-down evidence below, not the signal.

Families marked ”→” are delivery/social-engineering clusters (ClickFix, GuLoader). Their technique mappings are the delivery chain — downstream behavior is payload-dependent, so they don’t open a hard coverage gap on their own.

Multi-Source IOCs

No IOCs corroborated across multiple sources in this window. Each feed reported uniquely.

MISP × KEV Correlation

No MISP events in this window referenced a CVE.

Cross-Reference

No SEC × KEV vendor token matches in this window. (This is a heuristic surface, absence is expected most days.)

Intel Feeds

2 IOC feeds updated this run (2,941 indicators total) — each available as CSV, MISP JSON, and STIX 2.1. Subscribe at https://thrunt.me/intel/manifest.json.

Hand-Authored Sigma

10 production-ready TTP rules (+2 scaffolds in the authoring queue) live at https://thrunt.me/sigma/manifest.json. Subscribe via https://thrunt.me/sigma/rules.lock.json (content-hash churn) or pull all with https://thrunt.me/sigma/rules.tar.gz.

Detection Gaps

18 of 158 techniques with corpus signal have zero detection coverage — no SigmaHQ community rule, no thrunt rule. This is the hand-authoring queue; the live view is at https://thrunt.me/corpus/attck/.

…and 8 more below the cut — full list on the rollup.

Pipeline Health

All feeds healthy.

Sources: SEC EDGAR (public domain), CISA Known Exploited Vulnerabilities (public domain), FIRST.org EPSS (per ToS), NIST NVD (public domain), GitHub Security Advisories (per ToS), abuse.ch URLhaus (CC0, attribution), ransomware.live (per ToS), MITRE ATT&CK (CC BY 4.0).

Published by Applied Cybernetics Group via thrunt.me. Heuristic cross-references are labelled as such; verify before action.