⚠️ Stale feeds — the following feeds have not refreshed within the staleness window. Treat their sections in this brief as possibly incomplete.

• ctid-attck — 168h since last success · HTTP 404 Not Found at https://center-for-threat-informed-defense.github.io/mappings-explorer/data/kev/attack-16.1/kev-07.28.2025/enterprise/kev-07.28.2025_attac

Morning Brief — 2026-09-30

1 federal patching priority, 3 exploit probability movers, 10 emerging critical cves, 10 supply chain, 63 ransomware activity, 745 ioc volume, 14 active malware families, 1 multi-source iocs, 2 intel feeds, 18 hand-authored sigma, 18 detection gaps, and 1 pipeline health. Sections with no signal are still rendered with an explicit “none in this window” note so absence is visible alongside presence.

Material Breach Disclosures

No new Item 1.05 8-K filings in this window.

Federal Patching Priority

CVE-2026-86950 — Apple Multiple Products

Apple Multiple Products Out-of-Bounds Write Vulnerability

• Added: 2026-09-29 · Federal due: 2026-10-02 · EPSS 55.3th pct (score 0.008) · CVSS 8.8 (HIGH) · CWE-787
• ransomware use: Unknown

Apple iOS, macOS, and iPadOS contain an out-of-bounds write vulnerability in CoreGraphics that may lead to arbitrary code execution.

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7.1 and iPadOS 26.7.1, macOS Sequoia 15.8.1, macOS Tahoe 26.7.1. Processing a maliciously crafted file may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions…

Exploit Probability Movers

Emerging Critical CVEs

• CVE-2026-71379 · CRITICAL (10.0) · 2026-09-29 — The file export endpoint allows any unauthenticated attacker to export arbitrary database tables by sending a crafted POST request.
• CVE-2026-96587 · CRITICAL (10.0) · 2026-09-29 — The Viidure Android application embeds permanent, plaintext cloud storage credentials within its compiled code. These credentials provide full access to critical platform storage, including the ability to read, modify, o…
• CVE-2026-53988 · CRITICAL (10.0) · 2026-09-29 — Dockhand before 1.0.40 contains an authentication bypass vulnerability in its git webhook endpoints that allows unauthenticated remote attackers to trigger arbitrary stack redeployments by exploiting a null webhook secre…
• CVE-2026-102911 · CRITICAL (9.9) · 2026-09-30 — A flaw has been found in zosmaai pi-llm-wiki up to 0.11.7. Affected is an unknown function of the file mcp/index.ts of the component wiki_capture_source MCP tool. Executing a manipulation of the argument url can lead to…
• CVE-2026-102458 · CRITICAL (9.8) · 2026-09-30 — EasyFlow .NET developed by Digiwin has a Missing Authentication vulnerability. Unauthenticated remote attackers can obtain other users’ plaintext passwords through a specific API.
• CVE-2026-102455 · CRITICAL (9.8) · 2026-09-30 — EasyFlow .NET developed by Digiwin has a Insecure Deserialization vulnerability. Unauthenticated remote attackers can execute arbitrary code on the server by sending maliciously crafted serialized content.
• CVE-2026-103110 · CRITICAL (9.8) · 2026-09-30 — Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper input validation that allows a remote attacker to execute code remotely as an unprivileged user on a Pexip Infinity Conferencing Node.
• CVE-2026-103041 · CRITICAL (9.8) · 2026-09-29 — LightLLM through 1.2.0 multimodal deployments expose an unauthenticated RPyC cache service with pickle deserialization enabled on all interfaces. Attackers can send crafted serialized objects to exposed cache methods to…
• CVE-2026-103040 · CRITICAL (9.8) · 2026-09-29 — LightLLM through 1.2.0 contains a remote code execution vulnerability in the router profiler service when started with —enable_profiling flag. The service exposes an unauthenticated RPyC server with pickle deserializati…
• CVE-2026-79538 · CRITICAL (9.8) · 2026-09-29 — metatool-ai MetaMCP up to and including 2.4.22 is vulnerable to Code Execution in the internal MCP inspector proxy endpoint GET /mcp-proxy/server/stdio (createTransport, STDIO branch, routers/mcp-proxy/server.ts).

Supply Chain

GHSA-m8vh-jmq9-5rjg · CVE-2026-102281 (npm)

• HIGH · CVSS 7.5 · 2026-09-29
• Affected: @nestjs/microservices, @nestjs/microservices
• https://github.com/advisories/GHSA-m8vh-jmq9-5rjg

Nest: Remote process termination via a deeply nested microservice message pattern

GHSA-hrh2-vp3x-79xf · CVE-2026-101894 (npm)

• CRITICAL · CVSS 9.1 · 2026-09-29
• Affected: @xhmikosr/decompress, @xhmikosr/decompress, decompress
• https://github.com/advisories/GHSA-hrh2-vp3x-79xf

@xhmikosr/decompress: Path traversal via symlink chain

GHSA-qhr7-859c-m2p7 · CVE-2026-102278 (npm)

• HIGH · CVSS 7.5 · 2026-09-29
• Affected: brace-expansion, brace-expansion, brace-expansion
• https://github.com/advisories/GHSA-qhr7-859c-m2p7

brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion

GHSA-6j4f-fj2g-mc7p · CVE-2026-102276 (npm)

• HIGH · CVSS 7.5 · 2026-09-29
• Affected: brace-expansion, brace-expansion, brace-expansion
• https://github.com/advisories/GHSA-6j4f-fj2g-mc7p

brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion

GHSA-2gc4-cqfq-p2gv · CVE-2026-102599 (npm)

• HIGH · CVSS 7.5 · 2026-09-29
• Affected: engine.io
• https://github.com/advisories/GHSA-2gc4-cqfq-p2gv

Socket.IO: Engine.IO Protocol Revision Mismatch DoS

GHSA-v53p-9fqp-m79j (npm)

• HIGH · CVSS 7.5 · 2026-09-29
• Affected: nodemailer
• https://github.com/advisories/GHSA-v53p-9fqp-m79j

Nodemailer: Quadratic backtracking in the addressparser free-text fallback allows remote denial of service

GHSA-9j54-fg26-wv3r · CVE-2026-102266 (pip)

• HIGH · CVSS 7.4 · 2026-09-29
• Affected: PyJWT
• https://github.com/advisories/GHSA-9j54-fg26-wv3r

PyJWT: PyJWK accepts empty HMAC keys, bypassing PyJWT’s empty-key validation

GHSA-ffc3-869f-jxw9 · CVE-2026-102268 (pip)

• CRITICAL · CVSS 9.1 · 2026-09-29
• Affected: PyJWT
• https://github.com/advisories/GHSA-ffc3-869f-jxw9

PyJWT: Asymmetric-PEM detection bypass: whitespace/line-ending-mutated public keys skip the HS/asymmetric confusion guard

GHSA-w2cx-738m-mc7w · CVE-2026-102273 (pip)

• HIGH · CVSS 7.4 · 2026-09-29
• Affected: PyJWT
• https://github.com/advisories/GHSA-w2cx-738m-mc7w

PyJWT accepts public JWK containers as HMAC secrets

GHSA-9v7f-9g4p-ffgj · CVE-2026-102267 (pip)

• HIGH · CVSS 7.4 · 2026-09-29
• Affected: PyJWT
• https://github.com/advisories/GHSA-9v7f-9g4p-ffgj

PyJWT: PyJWKClient follows redirects when fetching JWKS

Ransomware Activity

63 new victim postings across 15 groups.

IOC Volume

745 new IOCs in this window. By source:

Recent OSINT Events

No curated MISP events in this window (bulk-IOC contributions tallied in IOC Volume).

Active Malware Families

14 malware families active this week (0 corroborated across ≥2 sources), exercising 17 ATT&CK techniques. Family is the unit, not the indicator: the raw IOCs are drill-down evidence below, not the signal.

Families marked ”→” are delivery/social-engineering clusters (ClickFix). Their technique mappings are the delivery chain — downstream behavior is payload-dependent, so they don’t open a hard coverage gap on their own.

Multi-Source IOCs

1 IOC flagged by 2+ independent sources this window — the highest-confidence signal the cross-feed corpus produces.

MISP × KEV Correlation

No MISP events in this window referenced a CVE.

Cross-Reference

No recent SEC filings to cross-reference.

Intel Feeds

2 IOC feeds updated this run (4,029 indicators total) — each available as CSV, MISP JSON, and STIX 2.1. Subscribe at https://thrunt.me/intel/manifest.json.

Hand-Authored Sigma

16 production-ready TTP rules (+2 scaffolds in the authoring queue) live at https://thrunt.me/sigma/manifest.json. Subscribe via https://thrunt.me/sigma/rules.lock.json (content-hash churn) or pull all with https://thrunt.me/sigma/rules.tar.gz.

Detection Gaps

18 of 161 techniques with corpus signal have zero detection coverage — no SigmaHQ community rule, no thrunt rule. This is the hand-authoring queue; the live view is at https://thrunt.me/corpus/attck/.

…and 8 more below the cut — full list on the rollup.

Pipeline Health

Sources: SEC EDGAR (public domain), CISA Known Exploited Vulnerabilities (public domain), FIRST.org EPSS (per ToS), NIST NVD (public domain), GitHub Security Advisories (per ToS), abuse.ch URLhaus (CC0, attribution), ransomware.live (per ToS), MITRE ATT&CK (CC BY 4.0).

Published by Applied Cybernetics Group via thrunt.me. Heuristic cross-references are labelled as such; verify before action.