⚠️ Stale feeds — the following feeds have not refreshed within the staleness window. Treat their sections in this brief as possibly incomplete.

• ctid-attck — 48.3h since last success · HTTP 404 Not Found at https://center-for-threat-informed-defense.github.io/mappings-explorer/data/kev/attack-16.1/kev-07.28.2025/enterprise/kev-07.28.2025_attac

Morning Brief — 2026-09-25

1 material breach disclosures, 2 federal patching priority, 20 exploit probability movers, 10 emerging critical cves, 10 supply chain, 33 ransomware activity, 713 ioc volume, 14 active malware families, 3 multi-source iocs, 2 intel feeds, 18 hand-authored sigma, 18 detection gaps, and 1 pipeline health. Sections with no signal are still rendered with an explicit “none in this window” note so absence is visible alongside presence.

Material Breach Disclosures

Nutex Health Inc. (NUTX)

• Filed: 2026-09-11 · CIK 0001479681 · Accession 0001628280-26-061432
• Filing: https://www.sec.gov/Archives/edgar/data/1479681/000162828026061432/materiality_assessmentxupd.htm

Forward-Looking StatementsCertain statements and information included in this press release constitute “forward-looking statements” within the meaning of the Private Securities Litigation Reform Act of 1995. When used in this press release, the words or phrases “will,” “will likely result,” “expected to,” “will continue,” “anticipated,” “estimate,” “projected,” “intend,” “goal,” or similar express…

Federal Patching Priority

CVE-2026-71362 — Adobe Commerce and Magento

**Adobe Commerce and Magento Incorrect Authorization Vulnerability **

• Added: 2026-09-24 · Federal due: 2026-09-27 · EPSS 82.8th pct (score 0.023) · CVSS 9.1 (CRITICAL) · CWE-863
• ransomware use: Unknown

Adobe Commerce and Magento contains an incorrect authorization vulnerability that could allow an attacker to leverage this vulnerability to gain elevated access to sensitive resources without any user interaction.

Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could leverage this vulnerability to gain elevated access to sensitive resources. Exploitation of this issue does not require user interaction.

CVE-2026-5430 — WSO2 Multiple Products

**WSO2 Multiple Products Path Traversal Vulnerability **

• Added: 2026-09-24 · Federal due: 2026-09-27 · EPSS 28.6th pct (score 0.004) · CVSS 10.0 (CRITICAL) · CWE-347
• ransomware use: Unknown

WSO2 API Control Plane, API Manager, Traffic Manager & Universal Gateway contain a path traversal vulnerability that could allow for unrestricted file upload and lead to remote code execution.

The JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly configured or supported. This allows an attacker to craft a JWT with an unsupported algorithm, which is then incorrectly validated, leading to unauthorized access. Successful exploitation of this vulnerability may result in unauthorized access to the system, including the potential compromise of…

Exploit Probability Movers

Emerging Critical CVEs

• CVE-2026-61732 · CRITICAL (10.0) · 2026-09-24 — Decepticon is an autonomous hacking agent for red teams. Versions prior to 1.1.17 wrap web crawl results — the output of agent reconnaissance against target services — into LLM messages without neutralizing ChatML specia…
• CVE-2026-97360 · CRITICAL (10.0) · 2026-09-24 — HFS2 version 2.4.0 and earlier contains an unauthenticated arbitrary file access vulnerability that allows unauthenticated attackers to read, write, append, and delete files anywhere the HFS service account has filesyste…
• CVE-2026-97359 · CRITICAL (10.0) · 2026-09-24 — HFS2 version 2.4.0 and earlier contains a template injection vulnerability in the multipart upload handler that allows unauthenticated attackers to achieve remote code execution by embedding malicious template syntax in…
• CVE-2026-93425 · CRITICAL (9.9) · 2026-09-24 — Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the patch.readRepoDirectories tRPC procedure passes the user-controlled repoPath value from apps/dokploy/server/api/routers/patch.ts into a…
• CVE-2026-19072 · CRITICAL (9.9) · 2026-09-24 — Velociraptor stores the compiled VQL in the hunt object internally to avoid having to recompile the artifacts for each endpoint in the hunt. Although the field “compiled_collector_args” is an internal field, Velociraptor…
• CVE-2026-14281 · CRITICAL (9.8) · 2026-09-25 — The Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.8.6. This is due to missing pe…
• CVE-2026-13249 · CRITICAL (9.8) · 2026-09-24 — An unauthenticated Remote Code Execution via Arbitrary File Upload vulnerability in the web management interface in Honeywell PD45 Industrial Printer version F10.19.010040, allows upload of attacker controlled files with…
• CVE-2026-97413 · CRITICAL (9.8) · 2026-09-24 — In the Linux kernel, the following vulnerability has been resolved:

RDMA/rtrs-srv: Fix integer underflow in process_read and process_write

usr_len is read from a network-supplied message field (le16_to_cpu) and used to…

• CVE-2026-93207 · CRITICAL (9.8) · 2026-09-24 — In the Linux kernel, the following vulnerability has been resolved:

SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry

svcauth_gss_decode_credbody() writes the caller’s rpc_gss_wire_cred field by fie…

• CVE-2026-12227 · CRITICAL (9.8) · 2026-09-24 — The Visual Composer Website Builder plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 45.16.0 via the vcv-template parameter. This makes it possible for unauthenticated at…

Supply Chain

GHSA-3c93-f73f-qc9h · CVE-2026-57178 (pip)

• HIGH · CVSS 7.4 · 2026-09-24
• Affected: social-auth-core
• https://github.com/advisories/GHSA-3c93-f73f-qc9h

social-auth-core: VK App backend accepts unsigned callback data when auth_key is missing

GHSA-r4vp-3vw6-r2x5 · CVE-2026-57171 (pip)

• HIGH · CVSS 8.4 · 2026-09-24
• Affected: compliance-trestle, compliance-trestle
• https://github.com/advisories/GHSA-r4vp-3vw6-r2x5

Trestle is vulnerable to arbitrary file write via path traversal in author generate commands (Incomplete fix of CVE-2026-46345)

GHSA-mr95-65j8-9mxp · CVE-2026-57170 (pip)

• HIGH · CVSS 7.8 · 2026-09-24
• Affected: compliance-trestle, compliance-trestle
• https://github.com/advisories/GHSA-mr95-65j8-9mxp

Trestle SSTI in Jinja2 include tags allows arbitrary code execution (Incomplete fix of CVE-2026-46439)

GHSA-3cj3-hqcr-g934 · CVE-2026-59723 (npm)

• HIGH · CVSS 8.8 · 2026-09-24
• Affected: cline
• https://github.com/advisories/GHSA-3cj3-hqcr-g934

Cline: Cross-Origin WebSocket Hijacking in Cline Hub Dashboard (/browser endpoint)

GHSA-36h5-qg4p-q2qf · CVE-2026-61815 (composer)

• HIGH · CVSS 7.2 · 2026-09-24
• Affected: zbateson/mail-mime-parser, zbateson/mail-mime-parser
• https://github.com/advisories/GHSA-36h5-qg4p-q2qf

zbateson/mail-mime-parser has CRLF header injection via attachment filename

GHSA-f6v3-2qmr-vfjx · CVE-2026-61816 (composer)

• HIGH · CVSS 7.5 · 2026-09-24
• Affected: zbateson/mail-mime-parser, zbateson/mail-mime-parser
• https://github.com/advisories/GHSA-f6v3-2qmr-vfjx

zbateson/mail-mime-parser has uncontrolled resource consumption (CPU/memory DoS) parsing untrusted MIME

GHSA-jmg2-rcxh-w8q3 · CVE-2026-61782 (npm)

• HIGH · CVSS 7.5 · 2026-09-24
• Affected: @rsdoctor/rspack-plugin
• https://github.com/advisories/GHSA-jmg2-rcxh-w8q3

@rsdoctor/rspack-plugin has Unauthenticated HTTP API that Exposes Project Source Code and Build Metadata

GHSA-4hq8-gpf5-8p68 · CVE-2026-57231 (go)

• HIGH · CVSS 7.5 · 2026-09-24
• Affected: github.com/containers/podman/v5, go.podman.io/podman/v6, github.com/containers/podman/v4
• https://github.com/advisories/GHSA-4hq8-gpf5-8p68

Podman: Malformed Image can trick podman run into leaking host environment variables into the container

GHSA-mwwr-p57h-56pf · CVE-2026-61788 (npm)

• HIGH · CVSS 7.4 · 2026-09-24
• Affected: @bytebase/dbhub
• https://github.com/advisories/GHSA-mwwr-p57h-56pf

@bytebase/dbhub’s read-only mode does not prevent database writes

GHSA-fm8p-53ww-hf6w · CVE-2026-61742 (npm)

• CRITICAL · 2026-09-24
• Affected: @bytebase/dbhub
• https://github.com/advisories/GHSA-fm8p-53ww-hf6w

DBHub HTTP transport DNS rebinding allows unauthenticated browser-origin SQL execution

Ransomware Activity

33 new victim postings across 12 groups.

IOC Volume

713 new IOCs in this window. By source:

Recent OSINT Events

No curated MISP events in this window (bulk-IOC contributions tallied in IOC Volume).

Active Malware Families

14 malware families active this week (1 corroborated across ≥2 sources), exercising 18 ATT&CK techniques. Family is the unit, not the indicator: the raw IOCs are drill-down evidence below, not the signal.

Families marked ”→” are delivery/social-engineering clusters (ClickFix, ClearFake). Their technique mappings are the delivery chain — downstream behavior is payload-dependent, so they don’t open a hard coverage gap on their own.

Multi-Source IOCs

3 IOCs flagged by 2+ independent sources this window — the highest-confidence signal the cross-feed corpus produces.

MISP × KEV Correlation

No MISP events in this window referenced a CVE.

Cross-Reference

No SEC × KEV vendor token matches in this window. (This is a heuristic surface, absence is expected most days.)

Intel Feeds

2 IOC feeds updated this run (4,168 indicators total) — each available as CSV, MISP JSON, and STIX 2.1. Subscribe at https://thrunt.me/intel/manifest.json.

Hand-Authored Sigma

16 production-ready TTP rules (+2 scaffolds in the authoring queue) live at https://thrunt.me/sigma/manifest.json. Subscribe via https://thrunt.me/sigma/rules.lock.json (content-hash churn) or pull all with https://thrunt.me/sigma/rules.tar.gz.

Detection Gaps

18 of 161 techniques with corpus signal have zero detection coverage — no SigmaHQ community rule, no thrunt rule. This is the hand-authoring queue; the live view is at https://thrunt.me/corpus/attck/.

…and 8 more below the cut — full list on the rollup.

Pipeline Health

Sources: SEC EDGAR (public domain), CISA Known Exploited Vulnerabilities (public domain), FIRST.org EPSS (per ToS), NIST NVD (public domain), GitHub Security Advisories (per ToS), abuse.ch URLhaus (CC0, attribution), ransomware.live (per ToS), MITRE ATT&CK (CC BY 4.0).

Published by Applied Cybernetics Group via thrunt.me. Heuristic cross-references are labelled as such; verify before action.