⚠️ Stale feeds — the following feeds have not refreshed within the staleness window. Treat their sections in this brief as possibly incomplete.

• ctid-attck — 72.4h since last success · HTTP 404 Not Found at https://center-for-threat-informed-defense.github.io/mappings-explorer/data/kev/attack-16.1/kev-07.28.2025/enterprise/kev-07.28.2025_attac

Morning Brief — 2026-09-26

3 federal patching priority, 6 exploit probability movers, 10 emerging critical cves, 10 supply chain, 48 ransomware activity, 778 ioc volume, 12 active malware families, 2 multi-source iocs, 2 intel feeds, 18 hand-authored sigma, 18 detection gaps, and 1 pipeline health. Sections with no signal are still rendered with an explicit “none in this window” note so absence is visible alongside presence.

Material Breach Disclosures

No new Item 1.05 8-K filings in this window.

Federal Patching Priority

CVE-2026-87902 — WordPress Core

WordPress Core Remote File Inclusion Vulnerability

• Added: 2026-09-25 · Federal due: 2026-09-28 · EPSS 86.3th pct (score 0.029) · CVSS 8.1 (HIGH) · CWE-98
• ransomware use: Unknown

WordPress Core contains a remote file inclusion vulnerability which could allow an unauthenticated attacker to make page-template resolution include a chosen readable local .php file outside the active theme directories, leading to remote code execution.

An unauthenticated attacker can make get_page_template() page-template resolution include a chosen readable local .php file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to RCE.

CVE-2026-65660 — Microsoft SharePoint

Microsoft SharePoint Code Injection Vulnerability

• Added: 2026-09-25 · Federal due: 2026-09-28 · EPSS 67.4th pct (score 0.012) · CVSS 8.8 (HIGH) · CWE-94
• ransomware use: Unknown

Microsoft SharePoint contains a code injection vulnerability which could allow an authorized attacker to execute code over a network.

Improper control of generation of code (‘code injection’) in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

CVE-2026-67279 — MikroTik RouterOS

Mikrotik RouterOS Improper Enforcement of Behavioral Workflow Vulnerability

• Added: 2026-09-25 · Federal due: 2026-09-28 · EPSS 51.5th pct (score 0.007) · CVSS 6.5 (MEDIUM) · CWE-841
• ransomware use: Unknown

Mikrotik RouterOS contains an improper enforcement of behavioral workflow vulnerability that could allow an unauthenticated client to open a session channel and send an exec request. This vulnerability can be chained to achieve unauthenticated exploitation of CVE-2026-86060.

RouterOS SSH enters the connection protocol after a client-requested rekey even though user authentication was never attempted, allowing an unauthenticated client to open a session channel and send an exec request. On affected builds the server dispatches the command, enabling unauthenticated creation, overwrite, and reconstruction of files in the RouterOS managed file namespace, including…

Exploit Probability Movers

Emerging Critical CVEs

• CVE-2026-18143 · CRITICAL (9.8) · 2026-09-26 — The Request a Quote for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.9.2 via the afrfq_submit_quote_via_popup() function. This is due to missing file e…
• CVE-2026-92161 · CRITICAL (9.8) · 2026-09-25 — FriendsOfFlarum OAuth allows users to log in to Flarum with GitHub, Twitter, Facebook, and other providers. Prior to 1.7.4 and 2.0.0-beta.4, the Discord OAuth provider does not check the verified field returned for an OA…
• CVE-2026-93643 · CRITICAL (9.8) · 2026-09-25 — When OnlyOffice/Document Editing is available, an unauthenticated remote attacker with access to an existing supported public Briefcase document can abuse unsigned save fields to perform path-traversal writes and execute…
• CVE-2026-100075 · CRITICAL (9.8) · 2026-09-25 — In the Linux kernel, the following vulnerability has been resolved:

RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters

When srpt_alloc_rw_ctxs() fails partway through a multi-buffer indirect descriptor, the unwind pat…

• CVE-2026-93647 · CRITICAL (9.3) · 2026-09-25 — An unauthenticated calendar sender can place active markup in a COUNTER message’s RFC From address. Selecting the message in Zimbra Classic triggers stored XSS, allowing the attacker to access mailbox data and act as the…
• CVE-2026-93642 · CRITICAL (9.3) · 2026-09-25 — An unauthenticated sender can forge a share notification that triggers stored XSS when a signed-in Zimbra Modern recipient clicks Accept Share, allowing the attacker to access mailbox data and act as the victim.
• CVE-2026-93641 · CRITICAL (9.3) · 2026-09-25 — An unauthenticated sender can forge a share notification that triggers stored XSS when a signed-in Zimbra Classic recipient clicks Accept Share, allowing the attacker to access mailbox data and act as the victim.
• CVE-2026-97064 · CRITICAL (9.1) · 2026-09-25 — X-SpringBoot through 6.0 ships with a hardcoded static master login verification code 172839 enabled by default in the database seed. Unauthenticated attackers can authenticate as any user by submitting the public master…
• CVE-2026-97063 · CRITICAL (9.1) · 2026-09-25 — X-SpringBoot through 6.0 returns login verification codes in HTTP responses from unauthenticated endpoints GET /sys/mobile/code and GET /sys/email/code without sending them to account owners. Attackers can request codes…
• CVE-2026-62262 · CRITICAL (9.1) · 2026-09-25 — Piwigo is a full featured open source photo gallery application for the web. In 17.0.0beta1 and earlier, when rating is enabled, an unauthenticated guest can call pwg.images.filteredSearch.create with a crafted ratings[]…

Supply Chain

GHSA-q986-4x7x-gx39 · CVE-2026-57443 (pip)

• HIGH · CVSS 7.5 · 2026-09-25
• Affected: scbe-aethermoore
• https://github.com/advisories/GHSA-q986-4x7x-gx39

SCBE-AETHERMOORE Unauthenticated AetherBrowser Ops API Exposes Operator Email Digests

GHSA-vj8p-hp9x-gh47 (erlang)

• HIGH · 2026-09-25
• Affected: mpp
• https://github.com/advisories/GHSA-vj8p-hp9x-gh47

mpp vulnerable to Gas Draining with low gas limit

GHSA-vv77-66rf-pm86 (erlang)

• HIGH · 2026-09-25
• Affected: mpp
• https://github.com/advisories/GHSA-vv77-66rf-pm86

mpp vulnerable to Gas Draining with no limit

GHSA-wrvw-254r-wpmv · CVE-2026-100368 (nuget)

• HIGH · CVSS 8.4 · 2026-09-25
• Affected: CliInvoke.Specializations, CliInvoke.Specializations, CliInvoke.Specializations
• https://github.com/advisories/GHSA-wrvw-254r-wpmv

CliInvoke.Specializations has command injection in PowerShell and Cmd shell wrappers

GHSA-j73w-8hfr-4gc9 · CVE-2026-100369 (nuget)

• HIGH · CVSS 8.4 · 2026-09-25
• Affected: CliInvoke, CliInvoke, CliInvoke
• https://github.com/advisories/GHSA-j73w-8hfr-4gc9

CliInvoke: Argument Injection in Extensibility Runner Factory

GHSA-62mm-xwmv-crhg (pip)

• HIGH · 2026-09-25
• Affected: khoj
• https://github.com/advisories/GHSA-62mm-xwmv-crhg

khoj has an unauthenticated path traversal in /home/ endpoint that allows file read from server filesystem

GHSA-9gfj-28hw-jchp · CVE-2026-86439 (npm)

• HIGH · CVSS 8.8 · 2026-09-25
• Affected: knowns
• https://github.com/advisories/GHSA-9gfj-28hw-jchp

Knowns Unrestricted Path Traversal leading to out-of-bounds arbitrary .md file read, write, and deletion in MCP Docs + Memory Tools

GHSA-29h2-jr22-frmh (npm)

• HIGH · 2026-09-25
• Affected: @openzeppelin/confidential-contracts, @openzeppelin/confidential-contracts, @openzeppelin/confidential-contracts
• https://github.com/advisories/GHSA-29h2-jr22-frmh

OpenZeppelin Confidential Contracts VestingWalletConfidential: a malicious ERC-7984 token is able to extract private data from the vesting wallet

GHSA-g7vj-c29h-3h5m · CVE-2026-92161 (composer)

• CRITICAL · CVSS 9.8 · 2026-09-25
• Affected: fof/oauth, fof/oauth
• https://github.com/advisories/GHSA-g7vj-c29h-3h5m

FriendsOfFlarum OAuth: Unauthenticated account takeover via unverified email trust in Discord OAuth provider

GHSA-v65j-hff3-753c · CVE-2026-57440 (composer)

• HIGH · CVSS 7.5 · 2026-09-25
• Affected: starcitizenwiki/embedvideo
• https://github.com/advisories/GHSA-v65j-hff3-753c

Mediawiki EmbedVideo Extension has stored XSS via malformed src url with $wgEmbedVideoRequireConsent disabled

Ransomware Activity

48 new victim postings across 14 groups.

IOC Volume

778 new IOCs in this window. By source:

Recent OSINT Events

No curated MISP events in this window (bulk-IOC contributions tallied in IOC Volume).

Active Malware Families

12 malware families active this week (0 corroborated across ≥2 sources), exercising 18 ATT&CK techniques. Family is the unit, not the indicator: the raw IOCs are drill-down evidence below, not the signal.

Families marked ”→” are delivery/social-engineering clusters (ClickFix, ClearFake). Their technique mappings are the delivery chain — downstream behavior is payload-dependent, so they don’t open a hard coverage gap on their own.

Multi-Source IOCs

2 IOCs flagged by 2+ independent sources this window — the highest-confidence signal the cross-feed corpus produces.

MISP × KEV Correlation

No MISP events in this window referenced a CVE.

Cross-Reference

No recent SEC filings to cross-reference.

Intel Feeds

2 IOC feeds updated this run (4,256 indicators total) — each available as CSV, MISP JSON, and STIX 2.1. Subscribe at https://thrunt.me/intel/manifest.json.

Hand-Authored Sigma

16 production-ready TTP rules (+2 scaffolds in the authoring queue) live at https://thrunt.me/sigma/manifest.json. Subscribe via https://thrunt.me/sigma/rules.lock.json (content-hash churn) or pull all with https://thrunt.me/sigma/rules.tar.gz.

Detection Gaps

18 of 161 techniques with corpus signal have zero detection coverage — no SigmaHQ community rule, no thrunt rule. This is the hand-authoring queue; the live view is at https://thrunt.me/corpus/attck/.

…and 8 more below the cut — full list on the rollup.

Pipeline Health

Sources: SEC EDGAR (public domain), CISA Known Exploited Vulnerabilities (public domain), FIRST.org EPSS (per ToS), NIST NVD (public domain), GitHub Security Advisories (per ToS), abuse.ch URLhaus (CC0, attribution), ransomware.live (per ToS), MITRE ATT&CK (CC BY 4.0).

Published by Applied Cybernetics Group via thrunt.me. Heuristic cross-references are labelled as such; verify before action.