Morning Brief — 2026-09-24

1 material breach disclosures, 10 emerging critical cves, 10 supply chain, 21 ransomware activity, 745 ioc volume, 14 active malware families, 3 multi-source iocs, 2 intel feeds, 18 hand-authored sigma, 18 detection gaps, and 1 pipeline health. Sections with no signal are still rendered with an explicit “none in this window” note so absence is visible alongside presence.

Material Breach Disclosures

Nutex Health Inc. (NUTX)

• Filed: 2026-09-11 · CIK 0001479681 · Accession 0001628280-26-061432
• Filing: https://www.sec.gov/Archives/edgar/data/1479681/000162828026061432/materiality_assessmentxupd.htm

Forward-Looking StatementsCertain statements and information included in this press release constitute “forward-looking statements” within the meaning of the Private Securities Litigation Reform Act of 1995. When used in this press release, the words or phrases “will,” “will likely result,” “expected to,” “will continue,” “anticipated,” “estimate,” “projected,” “intend,” “goal,” or similar express…

Federal Patching Priority

No new KEV additions in this window.

Exploit Probability Movers

No CVEs with ≥0.20 EPSS movement in this window.

Emerging Critical CVEs

• CVE-2026-86708 · CRITICAL (10.0) · 2026-09-23 — ZohoCorp ManageEngine Applications Manager versions 182200 and below were vulnerable to exposure of a Google Cloud service-account private key in the Applications Manager installer, which could allow an unauthenticated a…
• CVE-2026-59167 · CRITICAL (10.0) · 2026-09-23 — SunEditor is a lightweight and powerful WYSIWYG editor in vanilla JavaScript with no dependencies. Prior to 2.47.11, the sanitizer in src/lib/core.js does not consistently reject namespaced or custom HTML elements, allow…
• CVE-2026-93577 · CRITICAL (9.9) · 2026-09-24 — GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to execute…
• CVE-2026-89078 · CRITICAL (9.9) · 2026-09-24 — GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to execute…
• CVE-2026-84719 · CRITICAL (9.9) · 2026-09-23 — A flaw was found in the Ansible Automation Platform automation-controller. When a WorkflowJobTemplate is copied, the deep-copy permission sanitizer validates only the inventory, unified_job_template, and credentials of e…
• CVE-2026-84502 · CRITICAL (9.9) · 2026-09-23 — A flaw was found in Red Hat Ansible Automation Platform’s automation- controller. The Project scm_url field is not validated against values that begin with a dash and is stored and passed verbatim to the git SCM module.…
• CVE-2026-84474 · CRITICAL (9.9) · 2026-09-23 — A flaw was found in Red Hat Ansible Automation Platform’s automation- controller. The provisioning-callback secret (host_config_key) is exposed to users holding only the read-level view_jobtemplate permission — both in…
• CVE-2026-77602 · CRITICAL (9.9) · 2026-09-23 — OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From 5.1.0 until 7.3.0, authenticated non-administrator users can write content under targets_modifi…
• CVE-2026-19599 · CRITICAL (9.9) · 2026-09-23 — ZohoCorp ManageEngine OpManager MSP versions 12.8.709 and below were vulnerable to a Remote Code Execution vulnerability in the Notification Profile module.
• CVE-2026-78308 · CRITICAL (9.8) · 2026-09-24 — Improper Authentication vulnerability in DIAEnergie allows Authentication Bypass.

This issue affects DIAEnergie: before 1.11.00.022.

Supply Chain

GHSA-9643-4qgh-g8mx · CVE-2026-56669 (npm)

• HIGH · CVSS 7.5 · 2026-09-23
• Affected: elysia
• https://github.com/advisories/GHSA-9643-4qgh-g8mx

elysia has Inefficient Algorithmic Complexity and Interpretation Conflict

GHSA-wmw4-mw6x-6vfm · CVE-2026-61685 (npm)

• HIGH · CVSS 7.5 · 2026-09-23
• Affected: @fecommunity/reactpress
• https://github.com/advisories/GHSA-wmw4-mw6x-6vfm

ReactPress has SQL injection via dynamic column names in TypeORM query builders

GHSA-gvf2-2rh5-mpgf · CVE-2026-77394 (npm)

• HIGH · CVSS 7.6 · 2026-09-23
• Affected: @openc3/vue-common
• https://github.com/advisories/GHSA-gvf2-2rh5-mpgf

OpenC3 COSMOS: Stored, cross-user XSS via Telemetry screen BUTTON widget

GHSA-9wh6-9hq7-9688 · CVE-2026-82407 (go)

• HIGH · 2026-09-23
• Affected: github.com/klever-io/klever-go
• https://github.com/advisories/GHSA-9wh6-9hq7-9688

Klever-Go: Validator registration accepts an unvalidated BLS public key → consensus liveness DoS

GHSA-7c7c-373r-gfjj · CVE-2026-82409 (go)

• HIGH · 2026-09-23
• Affected: github.com/klever-io/klever-go
• https://github.com/advisories/GHSA-7c7c-373r-gfjj

Klever-Go: Elasticsearch bulk / painless injection via on-chain account name -> explorer/indexer data forgery

GHSA-26r5-4mm2-px5c · CVE-2026-82406 (go)

• HIGH · 2026-09-23
• Affected: github.com/klever-io/klever-go
• https://github.com/advisories/GHSA-26r5-4mm2-px5c

Klever-Go: Zombie-order theft: Buy missing IsClaimed guard in native marketplace

GHSA-9rg8-2wvr-fgjh · CVE-2026-76089 (composer)

• HIGH · CVSS 7.7 · 2026-09-23
• Affected: verbb/formie, verbb/formie
• https://github.com/advisories/GHSA-9rg8-2wvr-fgjh

Formie: Missing authorization on sent notification resend modal exposes submission PII

GHSA-w4cm-gvhj-cgw6 · CVE-2026-61814 (maven)

• HIGH · CVSS 7.5 · 2026-09-23
• Affected: org.typelevel:jawn-parser_2.12, org.typelevel:jawn-parser_2.13, org.typelevel:jawn-parser_3
• https://github.com/advisories/GHSA-w4cm-gvhj-cgw6

Jawn: Quadratic parsing effort in AsyncParser

GHSA-cc4v-rvgp-2pf3 · CVE-2026-59990 (maven)

• HIGH · CVSS 7.5 · 2026-09-23
• Affected: org.typelevel:jawn-parser_2.12, org.typelevel:jawn-parser_2.13, org.typelevel:jawn-parser_3
• https://github.com/advisories/GHSA-cc4v-rvgp-2pf3

Jawn: Uncontrolled nesting depth in JSON parser

GHSA-97cv-x867-6xhm · CVE-2026-82405 (go)

• HIGH · 2026-09-23
• Affected: github.com/klever-io/klever-go
• https://github.com/advisories/GHSA-97cv-x867-6xhm

Klever-Go Account takeover: kleverUpdateAccountPermission authorizes on attacker-controlled RecipientAddr instead of the authenticated caller

Ransomware Activity

21 new victim postings across 14 groups.

IOC Volume

745 new IOCs in this window. By source:

Recent OSINT Events

No curated MISP events in this window (bulk-IOC contributions tallied in IOC Volume).

Active Malware Families

14 malware families active this week (1 corroborated across ≥2 sources), exercising 18 ATT&CK techniques. Family is the unit, not the indicator: the raw IOCs are drill-down evidence below, not the signal.

Families marked ”→” are delivery/social-engineering clusters (ClickFix, ClearFake). Their technique mappings are the delivery chain — downstream behavior is payload-dependent, so they don’t open a hard coverage gap on their own.

Multi-Source IOCs

3 IOCs flagged by 2+ independent sources this window — the highest-confidence signal the cross-feed corpus produces.

MISP × KEV Correlation

No MISP events in this window referenced a CVE.

Cross-Reference

No SEC × KEV vendor token matches in this window. (This is a heuristic surface, absence is expected most days.)

Intel Feeds

2 IOC feeds updated this run (4,116 indicators total) — each available as CSV, MISP JSON, and STIX 2.1. Subscribe at https://thrunt.me/intel/manifest.json.

Hand-Authored Sigma

16 production-ready TTP rules (+2 scaffolds in the authoring queue) live at https://thrunt.me/sigma/manifest.json. Subscribe via https://thrunt.me/sigma/rules.lock.json (content-hash churn) or pull all with https://thrunt.me/sigma/rules.tar.gz.

Detection Gaps

18 of 161 techniques with corpus signal have zero detection coverage — no SigmaHQ community rule, no thrunt rule. This is the hand-authoring queue; the live view is at https://thrunt.me/corpus/attck/.

…and 8 more below the cut — full list on the rollup.

Pipeline Health

Sources: SEC EDGAR (public domain), CISA Known Exploited Vulnerabilities (public domain), FIRST.org EPSS (per ToS), NIST NVD (public domain), GitHub Security Advisories (per ToS), abuse.ch URLhaus (CC0, attribution), ransomware.live (per ToS), MITRE ATT&CK (CC BY 4.0).

Published by Applied Cybernetics Group via thrunt.me. Heuristic cross-references are labelled as such; verify before action.