Morning Brief — 2026-09-11

4 material breach disclosures, 2 federal patching priority, 3 exploit probability movers, 10 emerging critical cves, 11 supply chain, 25 ransomware activity, 568 ioc volume, 12 active malware families, 1 multi-source iocs, 2 intel feeds, 12 hand-authored sigma, and 18 detection gaps. Sections with no signal are still rendered with an explicit “none in this window” note so absence is visible alongside presence.

Material Breach Disclosures

BOSTON SCIENTIFIC CORP (BSX)

• Filed: 2026-09-08 · CIK 0000885725 · Accession 0000885725-26-000059
• Filing: https://www.sec.gov/Archives/edgar/data/885725/000088572526000059/bsx-20260907.htm

As previously disclosed in a Current Report on Form 8-K filed on August 26, 2026 with the Securities and Exchange Commission, on August 25, 2026, Boston Scientific Corporation (the “Company”) identified a cybersecurity incident that affected certain of its information technology systems and resulted in a global disruption to the Company’s operations. Upon detection, the Company activated its incid…

Park Dental Partners, Inc. (PARK)

• Filed: 2026-09-01 · CIK 0002069604 · Accession 0001104659-26-104300
• Filing: https://www.sec.gov/Archives/edgar/data/2069604/000110465926104300/park-20260828x8k.htm

On August 28, 2026, Park Dental Partners, Inc. (“we” or the “Company”) identified unauthorized access to its computer network. The Company promptly initiated its incident response protocols, and engaged its external cybersecurity and forensic specialists. The Company is continuing to investigate the nature and scope of this incident, including the scope of any compromise of personal or protected h…

NovoCure Ltd (NVCR)

• Filed: 2026-09-01 · CIK 0001645113 · Accession 0001645113-26-000065
• Filing: https://www.sec.gov/Archives/edgar/data/1645113/000164511326000065/nvcr-20260901.htm

Forward-Looking StatementsIn addition to historical facts or statements of current condition, this press release may contain forward-looking statements. Forward-looking statements provide Novocure’s current expectations or forecasts of future events. These may include statements regarding anticipated scientific progress on its research programs, clinical study progress, development of potential pr…

Nutex Health Inc. (NUTX)

• Filed: 2026-08-31 · CIK 0001479681 · Accession 0001628280-26-059602
• Filing: https://www.sec.gov/Archives/edgar/data/1479681/000162828026059602/nutx-20260831.htm

remediation of the incident. Readers are cautioned that these forward-looking statements are not guarantees of future events or outcomes and they should not be unduly relied on, as they are based on information available to the Company and on management’s current beliefs and expectations as of the date of this Current Report on Form 8-K and are therefore inherently uncertain and subject to risks,…

Federal Patching Priority

CVE-2026-67277 — MikroTik RouterOS

MikroTik RouterOS Missing Authentication for Critical Function Vulnerability

• Added: 2026-09-10 · Federal due: 2026-09-13 · EPSS 36.7th pct (score 0.004) · CWE-306
• ransomware use: Unknown

MikroTik RouterOS contains a missing authenticaion for critical function vulnerability which allows kernel memory disclosure and denial of service in the btest service.

RouterOS accepts a “related” btest connection before the corresponding primary session has completed authentication. An unauthenticated client can use this state to start an IPv4 UDP test. With “random-data=false”, the sender transmits an uninitialized tail from a kernel packet buffer. A separate unchecked, inverted packet-size interval causes unsigned integer underflow, anomalously large…

CVE-2026-86060 — MikroTik RouterOS

MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command Vulnerability

• Added: 2026-09-10 · Federal due: 2026-09-13 · EPSS 33.6th pct (score 0.004) · CWE-88
• ransomware use: Unknown

MikroTik RouterOS contains an improper neutralization of argument delimiters in a command vulnerability which allows an attacked to change the trusted RouterOS policy mask, leading to privilege escalation.

RouterOS contains an argument-handling flaw in the SSH login path involving usernames that begin with a prohibited character, allowing for the trusted RouterOS policy mask to be changed, leading to privilege escalation. Exploitation requires an unauthenticated SSH session to reach the RouterOS login helper.This issue was fixed in versions: 6.49.21 (Long-term), 7.23.4 (Long-term) and 7.24.2…

Exploit Probability Movers

Emerging Critical CVEs

• CVE-2026-89094 · CRITICAL (9.9) · 2026-09-10 — Forgejo before 16.0.4 allows remote code execution via a crafted template repository because template expansion on files in .forgejo/template is mishandled.
• CVE-2026-89049 · CRITICAL (9.9) · 2026-09-10 — A server-side request forgery issue due to improper validation of equivalent address representations in the port forwarding to remote hosts functionality in Amazon AWS Systems Manager Agent (SSM Agent) before 3.3.4851.0…
• CVE-2026-68488 · CRITICAL (9.9) · 2026-09-10 — A Time-of-check Time-of-use (TOCTOU) race condition leading to insecure symlink following in Plesk causes local privilege escalation to root via arbitrary file/directory ownership takeover.
• CVE-2026-68487 · CRITICAL (9.9) · 2026-09-10 — Path traversal in Plesk’s Backup Manager causes arbitrary file write as root by an authenticated customer.
• CVE-2026-8778 · CRITICAL (9.8) · 2026-09-11 — The MIPL Grouped Checkout Fields for WooCommerce – Customize & Organize Checkout Fields. plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the mipl_wc_upload_file funct…
• CVE-2026-81204 · CRITICAL (9.8) · 2026-09-10 — IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote attacker to execute arbitrary code due to code injection during graph construction.
• CVE-2026-79724 · CRITICAL (9.8) · 2026-09-10 — IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote attacker to execute arbitrary OS commands due to improper neutralization of special elements used in an OS command.
• CVE-2026-78573 · CRITICAL (9.8) · 2026-09-10 — IBM ContextForge MCP Gateway 1.0.0 through 1.0.7 could allow a remote attacker to gain administrative access due to the use of default credentials.
• CVE-2026-85025 · CRITICAL (9.8) · 2026-09-10 — IBM Langflow OSS 1.0.0 through 1.11.5 Langflow could allow an unauthenticated attacker to execute arbitrary code and access or modify chat sessions through publicly shared MCP project endpoints due to improper enforcemen…
• CVE-2026-52098 · CRITICAL (9.8) · 2026-09-10 — An issue in Flowise 3.1.2 allows a remote attacker to execute arbitrary code via the /api/v1/prediction/ endpoint

Supply Chain

GHSA-w4v4-9rw7-5326 · CVE-2026-88008 (go)

• HIGH · 2026-09-10
• Affected: github.com/traefik/traefik/v3, github.com/traefik/traefik/v2
• https://github.com/advisories/GHSA-w4v4-9rw7-5326

Traefik: Inconsistent Interpretation of HTTP Requests (‘HTTP Request/Response Smuggling’) and Incorrect Authorization

GHSA-v67p-phpq-fc8x · CVE-2026-88004 (go)

• HIGH · 2026-09-10
• Affected: github.com/traefik/traefik/v3
• https://github.com/advisories/GHSA-v67p-phpq-fc8x

Traefik entrypoint header-name sanitization bypassed via request trailers

GHSA-qqjf-53cj-pwvv · CVE-2026-88007 (go)

• CRITICAL · 2026-09-10
• Affected: github.com/traefik/traefik/v3, github.com/traefik/traefik/v2
• https://github.com/advisories/GHSA-qqjf-53cj-pwvv

Traefik HTTP/3 Backend NTLM Connection Reuse

GHSA-f52w-8j3h-j724 · CVE-2026-88009 (go)

• HIGH · 2026-09-10
• Affected: github.com/traefik/traefik/v3, github.com/traefik/traefik/v2
• https://github.com/advisories/GHSA-f52w-8j3h-j724

Traefik: Rootless HTTP/1 request-target routes as ”/” but is forwarded verbatim, bypassing path-scoped routing, middleware guards and access logging

GHSA-xwwr-4h3p-r22c · CVE-2026-88018 (go)

• CRITICAL · CVSS 9.8 · 2026-09-10
• Affected: github.com/rclone/rclone
• https://github.com/advisories/GHSA-xwwr-4h3p-r22c

rclone serve s3: —auth-proxy without —auth-key authenticates nobody - full SigV4 signature bypass

GHSA-p569-5gjg-9cmj · CVE-2026-88044 (go)

• CRITICAL · CVSS 9.1 · 2026-09-10
• Affected: github.com/rclone/rclone
• https://github.com/advisories/GHSA-p569-5gjg-9cmj

rclone: RC per-server auth-proxy bypass

GHSA-c476-6w5q-jw77 · CVE-2026-88017 (go)

• HIGH · CVSS 7.3 · 2026-09-10
• Affected: github.com/rclone/rclone
• https://github.com/advisories/GHSA-c476-6w5q-jw77

rclone: FTP cross-session auth-proxy backend confusion

GHSA-2p48-j3qc-rx9f · CVE-2026-88045 (go)

• HIGH · CVSS 7.5 · 2026-09-10
• Affected: github.com/rclone/rclone
• https://github.com/advisories/GHSA-2p48-j3qc-rx9f

rclone: S3 multipart declared-length memory exhaustion

GHSA-3g9q-v48f-hh9w · CVE-2026-87011 (pip)

• HIGH · CVSS 7.5 · 2026-09-10
• Affected: open-webui
• https://github.com/advisories/GHSA-3g9q-v48f-hh9w

Open WebUI: Unauthenticated requests can stall the server via uncached OIDC fetches in back-channel logout

GHSA-4qpv-39hg-f7fx · CVE-2026-59965 (npm)

• HIGH · CVSS 7.1 · 2026-09-10
• Affected: @jhb.software/payload-alt-text-plugin
• https://github.com/advisories/GHSA-4qpv-39hg-f7fx

@jhb.software/payload-alt-text-plugin: Alt Text Endpoint Authorization Bypass via Payload Local API overrideAccess Omission

Exploitation evidence, 7-day window (severity-agnostic — evidence trumps labels):

• GHSA-rcr6-4jqh-j84m (CVE-2026-60004, go) · 2026-09-08 — in CISA KEV · EPSS p99.7

Ransomware Activity

25 new victim postings across 16 groups.

IOC Volume

568 new IOCs in this window. By source:

Recent OSINT Events

No curated MISP events in this window (bulk-IOC contributions tallied in IOC Volume).

Active Malware Families

12 malware families active this week (0 corroborated across ≥2 sources), exercising 15 ATT&CK techniques. Family is the unit, not the indicator: the raw IOCs are drill-down evidence below, not the signal.

Families marked ”→” are delivery/social-engineering clusters (ClickFix, GuLoader). Their technique mappings are the delivery chain — downstream behavior is payload-dependent, so they don’t open a hard coverage gap on their own.

Multi-Source IOCs

1 IOC flagged by 2+ independent sources this window — the highest-confidence signal the cross-feed corpus produces.

MISP × KEV Correlation

No MISP events in this window referenced a CVE.

Cross-Reference

No SEC × KEV vendor token matches in this window. (This is a heuristic surface, absence is expected most days.)

Intel Feeds

2 IOC feeds updated this run (2,968 indicators total) — each available as CSV, MISP JSON, and STIX 2.1. Subscribe at https://thrunt.me/intel/manifest.json.

Hand-Authored Sigma

10 production-ready TTP rules (+2 scaffolds in the authoring queue) live at https://thrunt.me/sigma/manifest.json. Subscribe via https://thrunt.me/sigma/rules.lock.json (content-hash churn) or pull all with https://thrunt.me/sigma/rules.tar.gz.

Detection Gaps

18 of 158 techniques with corpus signal have zero detection coverage — no SigmaHQ community rule, no thrunt rule. This is the hand-authoring queue; the live view is at https://thrunt.me/corpus/attck/.

…and 8 more below the cut — full list on the rollup.

Pipeline Health

All feeds healthy.

Sources: SEC EDGAR (public domain), CISA Known Exploited Vulnerabilities (public domain), FIRST.org EPSS (per ToS), NIST NVD (public domain), GitHub Security Advisories (per ToS), abuse.ch URLhaus (CC0, attribution), ransomware.live (per ToS), MITRE ATT&CK (CC BY 4.0).

Published by Applied Cybernetics Group via thrunt.me. Heuristic cross-references are labelled as such; verify before action.