Morning Brief — 2026-09-12

5 material breach disclosures, 4 federal patching priority, 1 exploit probability movers, 10 emerging critical cves, 11 supply chain, 16 ransomware activity, 502 ioc volume, 15 active malware families, 1 multi-source iocs, 2 intel feeds, 12 hand-authored sigma, and 18 detection gaps. Sections with no signal are still rendered with an explicit “none in this window” note so absence is visible alongside presence.

Material Breach Disclosures

Nutex Health Inc. (NUTX)

• Filed: 2026-09-11 · CIK 0001479681 · Accession 0001628280-26-061432
• Filing: https://www.sec.gov/Archives/edgar/data/1479681/000162828026061432/materiality_assessmentxupd.htm

Forward-Looking StatementsCertain statements and information included in this press release constitute “forward-looking statements” within the meaning of the Private Securities Litigation Reform Act of 1995. When used in this press release, the words or phrases “will,” “will likely result,” “expected to,” “will continue,” “anticipated,” “estimate,” “projected,” “intend,” “goal,” or similar express…

BOSTON SCIENTIFIC CORP (BSX)

• Filed: 2026-09-08 · CIK 0000885725 · Accession 0000885725-26-000059
• Filing: https://www.sec.gov/Archives/edgar/data/885725/000088572526000059/bsx-20260907.htm

As previously disclosed in a Current Report on Form 8-K filed on August 26, 2026 with the Securities and Exchange Commission, on August 25, 2026, Boston Scientific Corporation (the “Company”) identified a cybersecurity incident that affected certain of its information technology systems and resulted in a global disruption to the Company’s operations. Upon detection, the Company activated its incid…

Park Dental Partners, Inc. (PARK)

• Filed: 2026-09-01 · CIK 0002069604 · Accession 0001104659-26-104300
• Filing: https://www.sec.gov/Archives/edgar/data/2069604/000110465926104300/park-20260828x8k.htm

On August 28, 2026, Park Dental Partners, Inc. (“we” or the “Company”) identified unauthorized access to its computer network. The Company promptly initiated its incident response protocols, and engaged its external cybersecurity and forensic specialists. The Company is continuing to investigate the nature and scope of this incident, including the scope of any compromise of personal or protected h…

NovoCure Ltd (NVCR)

• Filed: 2026-09-01 · CIK 0001645113 · Accession 0001645113-26-000065
• Filing: https://www.sec.gov/Archives/edgar/data/1645113/000164511326000065/nvcr-20260901.htm

Forward-Looking StatementsIn addition to historical facts or statements of current condition, this press release may contain forward-looking statements. Forward-looking statements provide Novocure’s current expectations or forecasts of future events. These may include statements regarding anticipated scientific progress on its research programs, clinical study progress, development of potential pr…

Nutex Health Inc. (NUTX)

• Filed: 2026-08-31 · CIK 0001479681 · Accession 0001628280-26-059602
• Filing: https://www.sec.gov/Archives/edgar/data/1479681/000162828026059602/nutx-20260831.htm

remediation of the incident. Readers are cautioned that these forward-looking statements are not guarantees of future events or outcomes and they should not be unduly relied on, as they are based on information available to the Company and on management’s current beliefs and expectations as of the date of this Current Report on Form 8-K and are therefore inherently uncertain and subject to risks,…

Federal Patching Priority

CVE-2026-84869 — ConnectWise ScreenConnect

ConnectWise ScreenConnect Improper Privilege Management and Missing Authorization Vulnerability

• Added: 2026-09-11 · Federal due: 2026-09-14 · EPSS 31.6th pct (score 0.004) · CVSS 9.9 (CRITICAL) · CWE-269, CWE-862
• ransomware use: Unknown

ConnectWise ScreenConnect contains both an improper privilege management and missing authorization vulnerability that may allow an attacker to file transfer and execution through an active remote sessions without authorization or host confirmation.

A condition in the ScreenConnect client may allow files to be transferred and executed through an active remote session without authorization or Host confirmation in certain circumstances. ScreenConnect servers are not impacted.

CVE-2026-42018 — JFrog Artifactory

JFrog Artifactory Improper Authentication Vulnerability

• Added: 2026-09-11 · Federal due: 2026-09-25 · EPSS 28.0th pct (score 0.003) · CVSS 7.5 (HIGH) · CWE-287
• ransomware use: Unknown

JFrog Artifactory contains an improper authentication vulnerability that could return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled, potentially exposing sensitive resources.

JFrog Artifactory could return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled, potentially exposing sensitive resources.

CVE-2026-42016 — JFrog Artifactory

JFrog Artifactory Incorrect Authorization Vulnerability

• Added: 2026-09-11 · Federal due: 2026-09-25 · EPSS 18.4th pct (score 0.003) · CVSS 8.1 (HIGH) · CWE-863
• ransomware use: Unknown

JFrog Artifactory contains an incorrect authorization vulnerability that allows leads to privilege escalation attack due to a validation check of the token signature/issuer and not the token’s scope.

JFrog Artifactory (Self Hosted) versions before 7.133.11 are vulnerable to a privilege escalation attack due to a validation check of the token signature/issuer and not the token’s scope.

CVE-2026-85706 — GitLab Community Edition and Enterprise Edition

GitLab Community Edition and Enterprise Edition Path Traversal Vulnerability

• Added: 2026-09-11 · Federal due: 2026-09-14 · CVSS 10.0 (CRITICAL) · CWE-22
• ransomware use: Unknown

GitLab Community Edition and Enterprise Edition contains a path traversal vulnerability that allows an unauthenticated user to read arbitrary files due to an improper path confinement and missing authentication enforcement in the repository commits API.

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions, an unauthenticated user could have read arbitrary files from the GitLab server due to improper path confinement and missing authentication enforcement in the repository commits API.

Exploit Probability Movers

Emerging Critical CVEs

• CVE-2026-80462 · CRITICAL (10.0) · 2026-09-11 — A vulnerability in the Chef Automate API gateway and identity validation path may allow an unauthenticated actor to gain elevated access to protected Chef Automate functionality under specific conditions.
• CVE-2026-87719 · CRITICAL (9.9) · 2026-09-12 — GitLab has remediated an issue in GitLab EE affecting all versions from 18.3 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could allow an authenticated user with Duo Chat access…
• CVE-2026-78159 · CRITICAL (9.8) · 2026-09-12 — The The Events Calendar plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 6.17.3 via the parse_array function. This is due to insufficient validation of the widget ‘classes…
• CVE-2026-78006 · CRITICAL (9.8) · 2026-09-12 — The The Events Calendar plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 6.17.4 via the is_safe_widget_instance function. This is due to insufficient protection in is_safe…
• CVE-2026-53952 · CRITICAL (9.8) · 2026-09-11 — GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS. A logic flaw in GetSimple CMS (v3.4.0a and below) and GetSimpleCMS-CE (v3.3.22 and below) allows unauthentica…
• CVE-2026-79395 · CRITICAL (9.8) · 2026-09-11 — An improper authentication vulnerability in the WS-Security (wsse:UsernameToken) verification routine within the Sofia IPC daemon in Xiongmai IP Camera XM530 firmware HMT.CM2005-v220608.1837 and earlier allows remote att…
• CVE-2026-62105 · CRITICAL (9.8) · 2026-09-11 — Unauthenticated PHP Object Injection in ThemeREX Addons < 2.45.0 versions.
• CVE-2026-62103 · CRITICAL (9.8) · 2026-09-11 — Unauthenticated PHP Object Injection in Everest Forms <= 3.6.0 versions.
• CVE-2026-72710 · CRITICAL (9.8) · 2026-09-11 — SPIP before 4.4.18 contains a remote code execution vulnerability in the editer_objet action where the arg parameter resolves SQL table names without enforcing an editable columns allowlist, allowing attackers with a val…
• CVE-2026-72709 · CRITICAL (9.8) · 2026-09-11 — SPIP before 4.4.18 contains a missing authorization vulnerability in the administrative action endpoints under ecrire/action/ that allows unauthenticated attackers to perform privileged actions by supplying a valid HMAC-…

Supply Chain

GHSA-325j-mg25-8q58 · CVE-2026-61534 (npm)

• CRITICAL · CVSS 9.1 · 2026-09-11
• Affected: yayson
• https://github.com/advisories/GHSA-325j-mg25-8q58

yayson: Prototype pollution in Store/LegacyStore deserialization

GHSA-rqx4-3f6q-3x2v · CVE-2026-59148 (npm)

• HIGH · CVSS 8.8 · 2026-09-11
• Affected: @mockoon/commons-server, @mockoon/cli
• https://github.com/advisories/GHSA-rqx4-3f6q-3x2v

@Mockoon/commons-server: Unauthenticated admin API + wildcard CORS allows mock-state hijack and secret theft

GHSA-65h7-9wrw-629c · CVE-2026-59973 (npm)

• HIGH · CVSS 8.5 · 2026-09-11
• Affected: mcp-from-openapi, @frontmcp/adapters, frontmcp
• https://github.com/advisories/GHSA-65h7-9wrw-629c

FrontMCP and mcp-from-openapi have bypass of OpenAPI external $ref SSRF fix

GHSA-h8m9-jgf8-vwvp · CVE-2026-59151 (pip)

• CRITICAL · CVSS 9.6 · 2026-09-11
• Affected: prowler-cloud
• https://github.com/advisories/GHSA-h8m9-jgf8-vwvp

Prowler: SAML Domain Claiming Enables Cross-Tenant Account Takeover

GHSA-2cg9-97gq-9mqp · CVE-2026-56825 (composer)

• HIGH · CVSS 8.1 · 2026-09-11
• Affected: shopper/framework
• https://github.com/advisories/GHSA-2cg9-97gq-9mqp

Shopper: Missing authorization on product removal actions in CollectionProducts component

GHSA-g3f9-g5vj-p62f · CVE-2026-56829 (composer)

• HIGH · CVSS 8.1 · 2026-09-11
• Affected: shopper/framework
• https://github.com/advisories/GHSA-g3f9-g5vj-p62f

Shopper: Unauthorized inventory stock manipulation via unlocked variant property in VariantStock component

GHSA-j328-xmgp-j4q3 · CVE-2026-56828 (composer)

• HIGH · CVSS 8.8 · 2026-09-11
• Affected: shopper/framework
• https://github.com/advisories/GHSA-j328-xmgp-j4q3

Shopper: privilege escalation via improper Livewire admin component authorization

GHSA-243p-f3cv-c5wh · CVE-2026-56827 (composer)

• HIGH · CVSS 8.1 · 2026-09-11
• Affected: shopper/framework
• https://github.com/advisories/GHSA-243p-f3cv-c5wh

Shopper: Authorization bypass in Filament bulk actions allows browse-only staff to mass-delete attributes/tags and mass-toggle visibility of brands/categories/suppliers

GHSA-vjfw-cpmh-xwv3 · CVE-2026-11745 (maven)

• HIGH · 2026-09-11
• Affected: com.linecorp.centraldogma:centraldogma-server-mirror-git
• https://github.com/advisories/GHSA-vjfw-cpmh-xwv3

Central Dogma: SSH host-key verification permanently disabled in Git mirror (SshGitMirror)

GHSA-2j95-gqxf-v3vg · CVE-2026-11746 (maven)

• CRITICAL · 2026-09-11
• Affected: com.linecorp.centraldogma:centraldogma-server
• https://github.com/advisories/GHSA-2j95-gqxf-v3vg

Central Dogma: Hard-coded ZooKeeper replication secret ‘ch4n63m3’ with silent fallback enables cluster takeover

Exploitation evidence, 7-day window (severity-agnostic — evidence trumps labels):

• GHSA-rcr6-4jqh-j84m (CVE-2026-60004, go) · 2026-09-08 — in CISA KEV · EPSS p99.7

Ransomware Activity

16 new victim postings across 10 groups.

IOC Volume

502 new IOCs in this window. By source:

Recent OSINT Events

No curated MISP events in this window (bulk-IOC contributions tallied in IOC Volume).

Active Malware Families

15 malware families active this week (0 corroborated across ≥2 sources), exercising 17 ATT&CK techniques. Family is the unit, not the indicator: the raw IOCs are drill-down evidence below, not the signal.

Families marked ”→” are delivery/social-engineering clusters (ClickFix, GuLoader, Amadey). Their technique mappings are the delivery chain — downstream behavior is payload-dependent, so they don’t open a hard coverage gap on their own.

Multi-Source IOCs

1 IOC flagged by 2+ independent sources this window — the highest-confidence signal the cross-feed corpus produces.

MISP × KEV Correlation

No MISP events in this window referenced a CVE.

Cross-Reference

No SEC × KEV vendor token matches in this window. (This is a heuristic surface, absence is expected most days.)

Intel Feeds

2 IOC feeds updated this run (2,980 indicators total) — each available as CSV, MISP JSON, and STIX 2.1. Subscribe at https://thrunt.me/intel/manifest.json.

Hand-Authored Sigma

10 production-ready TTP rules (+2 scaffolds in the authoring queue) live at https://thrunt.me/sigma/manifest.json. Subscribe via https://thrunt.me/sigma/rules.lock.json (content-hash churn) or pull all with https://thrunt.me/sigma/rules.tar.gz.

Detection Gaps

18 of 158 techniques with corpus signal have zero detection coverage — no SigmaHQ community rule, no thrunt rule. This is the hand-authoring queue; the live view is at https://thrunt.me/corpus/attck/.

…and 8 more below the cut — full list on the rollup.

Pipeline Health

All feeds healthy.

Sources: SEC EDGAR (public domain), CISA Known Exploited Vulnerabilities (public domain), FIRST.org EPSS (per ToS), NIST NVD (public domain), GitHub Security Advisories (per ToS), abuse.ch URLhaus (CC0, attribution), ransomware.live (per ToS), MITRE ATT&CK (CC BY 4.0).

Published by Applied Cybernetics Group via thrunt.me. Heuristic cross-references are labelled as such; verify before action.