⚠️ Stale feeds — the following feeds have not refreshed within the staleness window. Treat their sections in this brief as possibly incomplete.

• ctid-attck — 144h since last success · HTTP 404 Not Found at https://center-for-threat-informed-defense.github.io/mappings-explorer/data/kev/attack-16.1/kev-07.28.2025/enterprise/kev-07.28.2025_attac

Morning Brief — 2026-09-29

1 exploit probability movers, 10 emerging critical cves, 6 supply chain, 30 ransomware activity, 857 ioc volume, 13 active malware families, 3 multi-source iocs, 2 intel feeds, 18 hand-authored sigma, 18 detection gaps, and 1 pipeline health. Sections with no signal are still rendered with an explicit “none in this window” note so absence is visible alongside presence.

Material Breach Disclosures

No new Item 1.05 8-K filings in this window.

Federal Patching Priority

No new KEV additions in this window.

Exploit Probability Movers

Emerging Critical CVEs

• CVE-2026-102240 · CRITICAL (10.0) · 2026-09-29 — A vulnerability was found in Netcore NAP930 0.1.241010.141410. This affects the function eval of the file /www/cgi-bin/network_tools of the component Network Tools CGI. The manipulation of the argument sid results in os…
• CVE-2026-101077 · CRITICAL (10.0) · 2026-09-28 — A flaw has been found in Netcore NR289-GE 1.4.5102. This impacts the function process_request of the component boa_temp Handler. This manipulation causes missing authentication. The attack is possible to be carried out r…
• CVE-2026-101076 · CRITICAL (10.0) · 2026-09-28 — A vulnerability was detected in Netcore NR289-GE 1.4.5102. This affects the function system of the file /set_ntp_server_ip.cgi of the component CGI Handler. The manipulation of the argument ntp_ip results in os command i…
• CVE-2026-101075 · CRITICAL (10.0) · 2026-09-28 — A security vulnerability has been detected in Netcore NR289-GE 1.4.5102. The impacted element is the function system of the file /location_time.cgi of the component Location Time Handler. The manipulation of the argument…
• CVE-2026-101072 · CRITICAL (10.0) · 2026-09-28 — A vulnerability was identified in Netcore NR289-GE 1.4.5102. This issue affects the function system of the file /ap_ip.cgi of the component CGI Handler. Such manipulation of the argument ip leads to os command injection.…
• CVE-2026-101039 · CRITICAL (10.0) · 2026-09-28 — A vulnerability was identified in FAST FAC1900R 20190827_2.0.2. Affected by this issue is the function copy_msg_element of the component devdiscover Service. Such manipulation leads to stack-based buffer overflow. The at…
• CVE-2026-84154 · CRITICAL (9.9) · 2026-09-29 — A Code Injection vulnerability affecting GEOVIA Geospatial Data Manager from Release 3DEXPERIENCE R2024x through Release 3DEXPERIENCE R2026x could allow an attacker to execute arbitrary code on the server.
• CVE-2026-87799 · CRITICAL (9.9) · 2026-09-28 — Improper link resolution in the migration receive path in Canonical LXD versions 4.0 and later (fixed in 4.0.14, 5.0.10, 5.21.8 and 6.10) on Linux allows an authenticated client that can create instances or custom storag…
• CVE-2026-85526 · CRITICAL (9.9) · 2026-09-28 — Path traversal in the Btrfs storage driver (unpackVolume) in Canonical LXD on Linux allows an authenticated user with instance creation privileges to delete or replace arbitrary files and directories on the host filesyst…
• CVE-2026-101038 · CRITICAL (9.9) · 2026-09-28 — A vulnerability was determined in FAST FAC1200R 5.0_20201119_1.0.2. Affected by this vulnerability is the function MmtAtePrase of the component MmtAtePrase Parser. This manipulation causes stack-based buffer overflow. Re…

Supply Chain

GHSA-f67j-2jqw-jpq7 · CVE-2026-101895 (npm)

• HIGH · 2026-09-28
• Affected: @angular/platform-server, @angular/platform-server, @angular/platform-server
• https://github.com/advisories/GHSA-f67j-2jqw-jpq7

Angular SSR: Denial of Service (DoS) via Infinite Loop on Malformed DOCTYPE

GHSA-qw65-cvwx-89v3 · CVE-2026-84292 (npm)

• HIGH · CVSS 7.5 · 2026-09-28
• Affected: fast-uri, fast-uri, fast-uri
• https://github.com/advisories/GHSA-qw65-cvwx-89v3

fast-uri vulnerable to authority injection via an unvalidated port in serialize

GHSA-58mr-gqgx-xq4g · CVE-2026-84394 (npm)

• HIGH · CVSS 7.5 · 2026-09-28
• Affected: fast-uri, fast-uri, fast-uri
• https://github.com/advisories/GHSA-58mr-gqgx-xq4g

fast-uri vulnerable to host confusion via an unclosed bracket in the URI authority

GHSA-j3r3-mxqp-r2p4 · CVE-2026-88058 (npm)

• HIGH · 2026-09-28
• Affected: @angular/platform-server, @angular/platform-server, @angular/platform-server
• https://github.com/advisories/GHSA-j3r3-mxqp-r2p4

Angular SSR: XSS via Unescaped Processing Instruction () Nodes in Fallback Raw-Content Elements

GHSA-q4xh-88c3-wmh7 · CVE-2026-68497 (maven)

• HIGH · CVSS 7.5 · 2026-09-28
• Affected: tools.jackson.core:jackson-databind, tools.jackson.core:jackson-databind, com.fasterxml.jackson.core:jackson-databind
• https://github.com/advisories/GHSA-q4xh-88c3-wmh7

jackson-databind: Duration XMLGregorianCalendar Unbounded Number Parse DoS

GHSA-456v-xq2p-r4cj (npm)

• HIGH · CVSS 7.8 · 2026-09-28
• Affected: code-ollama
• https://github.com/advisories/GHSA-456v-xq2p-r4cj

code-ollama: grep_search Command Injection via Unescaped $() Shell Substitution (CWE-78)

Ransomware Activity

30 new victim postings across 16 groups.

IOC Volume

857 new IOCs in this window. By source:

Recent OSINT Events

No curated MISP events in this window (bulk-IOC contributions tallied in IOC Volume).

Active Malware Families

13 malware families active this week (0 corroborated across ≥2 sources), exercising 18 ATT&CK techniques. Family is the unit, not the indicator: the raw IOCs are drill-down evidence below, not the signal.

Families marked ”→” are delivery/social-engineering clusters (ClickFix, ClearFake). Their technique mappings are the delivery chain — downstream behavior is payload-dependent, so they don’t open a hard coverage gap on their own.

Multi-Source IOCs

3 IOCs flagged by 2+ independent sources this window — the highest-confidence signal the cross-feed corpus produces.

MISP × KEV Correlation

No MISP events in this window referenced a CVE.

Cross-Reference

No recent SEC filings to cross-reference.

Intel Feeds

2 IOC feeds updated this run (4,137 indicators total) — each available as CSV, MISP JSON, and STIX 2.1. Subscribe at https://thrunt.me/intel/manifest.json.

Hand-Authored Sigma

16 production-ready TTP rules (+2 scaffolds in the authoring queue) live at https://thrunt.me/sigma/manifest.json. Subscribe via https://thrunt.me/sigma/rules.lock.json (content-hash churn) or pull all with https://thrunt.me/sigma/rules.tar.gz.

Detection Gaps

18 of 161 techniques with corpus signal have zero detection coverage — no SigmaHQ community rule, no thrunt rule. This is the hand-authoring queue; the live view is at https://thrunt.me/corpus/attck/.

…and 8 more below the cut — full list on the rollup.

Pipeline Health

Sources: SEC EDGAR (public domain), CISA Known Exploited Vulnerabilities (public domain), FIRST.org EPSS (per ToS), NIST NVD (public domain), GitHub Security Advisories (per ToS), abuse.ch URLhaus (CC0, attribution), ransomware.live (per ToS), MITRE ATT&CK (CC BY 4.0).

Published by Applied Cybernetics Group via thrunt.me. Heuristic cross-references are labelled as such; verify before action.