⚠️ Stale feeds — the following feeds have not refreshed within the staleness window. Treat their sections in this brief as possibly incomplete.

• ctid-attck — 191.9h since last success · HTTP 404 Not Found at https://center-for-threat-informed-defense.github.io/mappings-explorer/data/kev/attack-16.1/kev-07.28.2025/enterprise/kev-07.28.2025_attac

Morning Brief — 2026-10-01

1 federal patching priority, 3 exploit probability movers, 10 emerging critical cves, 10 supply chain, 31 ransomware activity, 936 ioc volume, 13 active malware families, 2 multi-source iocs, 2 intel feeds, 18 hand-authored sigma, 18 detection gaps, and 1 pipeline health. Sections with no signal are still rendered with an explicit “none in this window” note so absence is visible alongside presence.

Material Breach Disclosures

No new Item 1.05 8-K filings in this window.

Federal Patching Priority

CVE-2026-76504 — Cisco Catalyst SD-WAN Manager

Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability

• Added: 2026-09-30 · Federal due: 2026-10-03 · CVSS 9.8 (CRITICAL) · CWE-177
• ransomware use: Unknown

Cisco Catalyst SD-WAN Manager contains a hex encoding vulnerability that could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user due to improper handling of URI encoding in an HTTP request.

A vulnerability in the API session-based authentication management of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user. This vulnerability is due to improper handling of URI encoding in an HTTP request, which allows the request to bypass an authentication rule that is intended to restrict access to a…

Exploit Probability Movers

Emerging Critical CVEs

• CVE-2026-55107 · CRITICAL (10.0) · 2026-09-30 — Kobako is a Ruby gem that embeds a Wasm-isolated mruby interpreter inside applications, allowing execution of untrusted Ruby scripts (LLM-generated code, user formulas, student submissions, third-party plugins) in-proces…
• CVE-2026-96349 · CRITICAL (10.0) · 2026-09-30 — Unauthenticated Remote Code Execution (RCE) in SiteSkite <= 2.1.8 versions.
• CVE-2026-75957 · CRITICAL (9.8) · 2026-10-01 — The Ultimate Multisite – WordPress Multisite SaaS & WaaS Platform plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 2.15.0 via the checkout_form parameter of the `login_c…
• CVE-2026-15989 · CRITICAL (9.8) · 2026-10-01 — The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.3.316. This is due to the Register & Login add-on’s before_email_success_msg()…
• CVE-2025-41753 · CRITICAL (9.8) · 2026-10-01 — The object name of a dynamically created BACnet File Object is interpreted as a file path without sufficient validation. Because relative paths are not limited to the intended directory, an unauthenticated remote attacke…
• CVE-2026-82829 · CRITICAL (9.8) · 2026-10-01 — Hitachi Coding Software Suite contains a vulnerability related to Hidden Functionality vulnerability which allows an attacker to gain unauthorized access by exploiting hidden accounts or hard coded credentials.

This is…

• CVE-2026-82827 · CRITICAL (9.8) · 2026-10-01 — Hitachi Coding Software Suite contains a vulnerability related to Use of Hard-coded Cryptographic Key. The Hardcoding of JWT signing secret key allows an attacker to generate unauthorized Bearer tokens and exploit admini…
• CVE-2026-82825 · CRITICAL (9.8) · 2026-10-01 — Hitachi Coding Software Suite contains a vulnerability related to Missing Authentication for Critical Function. This allows an unauthenticated attacker to invoke a critical API, potentially leading to unauthorized retrie…
• CVE-2026-82824 · CRITICAL (9.8) · 2026-10-01 — Hitachi Coding Software Suite contains a vulnerability related to Path Traversal vulnerability that allows an attacker to access, create, modify, or delete files.

This issue affects Hitachi Coding Software Suite: throu…

• CVE-2026-102115 · CRITICAL (9.8) · 2026-09-30 — Kiteworks Core did not correctly validate a parameter submitted to the password reset workflow. An unauthenticated attacker who knew the email address of a user with a locally stored password could potentially reset that…

Supply Chain

GHSA-94p9-xgh2-xp45 · CVE-2026-102930 (pip)

• HIGH · 2026-09-30
• Affected: virtualenv
• https://github.com/advisories/GHSA-94p9-xgh2-xp45

virtualenv: Downloaded seed wheels (pip/setuptools) are not integrity-checked before use

GHSA-chx6-46f5-w4vp (pip)

• HIGH · CVSS 7.5 · 2026-09-30
• Affected: tornado
• https://github.com/advisories/GHSA-chx6-46f5-w4vp

tornado: CurlAsyncHTTPClient enforces no response-size limit — decompression bomb drives unbounded memory accumulation to OOM

GHSA-c2m8-h5v5-343r (pip)

• HIGH · 2026-09-30
• Affected: tornado
• https://github.com/advisories/GHSA-c2m8-h5v5-343r

Tornado: StaticFileHandler follows symlinks outside static root (path traversal)

GHSA-667r-xxjv-c9mm · CVE-2026-84504 (npm)

• HIGH · CVSS 8.1 · 2026-09-30
• Affected: fastify
• https://github.com/advisories/GHSA-667r-xxjv-c9mm

fastify vulnerable to request body replacement via an async validation result collision

GHSA-p68q-wchp-6fh7 · CVE-2026-76169 (npm)

• HIGH · CVSS 7.5 · 2026-09-30
• Affected: fastify
• https://github.com/advisories/GHSA-p68q-wchp-6fh7

fastify vulnerable to authentication bypass via malformed URLs reaching encapsulated not-found handlers

GHSA-hwr6-493r-vm6h · CVE-2026-84469 (npm)

• HIGH · CVSS 7.5 · 2026-09-30
• Affected: fastify
• https://github.com/advisories/GHSA-hwr6-493r-vm6h

fastify vulnerable to request validation bypass via skipped boolean false schemas

GHSA-9q9j-q6p8-xq58 · CVE-2026-84428 (npm)

• HIGH · CVSS 7.5 · 2026-09-30
• Affected: fastify
• https://github.com/advisories/GHSA-9q9j-q6p8-xq58

fastify vulnerable to header validation bypass via incomplete schema case normalization

GHSA-qh8j-hqjv-7m4x · CVE-2026-102984 (npm)

• HIGH · 2026-09-30
• Affected: @astrojs/node
• https://github.com/advisories/GHSA-qh8j-hqjv-7m4x

Astro: Malformed port in the Host header can crash the Node adapter

GHSA-g5vv-9gxw-82hx · CVE-2026-87819 (pip)

• HIGH · CVSS 7.5 · 2026-09-30
• Affected: GitPython
• https://github.com/advisories/GHSA-g5vv-9gxw-82hx

GitPython: Denial of Service via catastrophic backtracking (ReDoS) in Actor.name_email_regex — commit author/committer field parsing

GHSA-239g-whfq-7xj9 · CVE-2026-87817 (pip)

• HIGH · CVSS 8.8 · 2026-09-30
• Affected: gitpython
• https://github.com/advisories/GHSA-239g-whfq-7xj9

GitPython: Repository content can impersonate the git directory, leading to arbitrary code execution

Ransomware Activity

31 new victim postings across 15 groups.

IOC Volume

936 new IOCs in this window. By source:

Recent OSINT Events

No curated MISP events in this window (bulk-IOC contributions tallied in IOC Volume).

Active Malware Families

13 malware families active this week (1 corroborated across ≥2 sources), exercising 16 ATT&CK techniques. Family is the unit, not the indicator: the raw IOCs are drill-down evidence below, not the signal.

Families marked ”→” are delivery/social-engineering clusters (ClickFix). Their technique mappings are the delivery chain — downstream behavior is payload-dependent, so they don’t open a hard coverage gap on their own.

Multi-Source IOCs

2 IOCs flagged by 2+ independent sources this window — the highest-confidence signal the cross-feed corpus produces.

MISP × KEV Correlation

No MISP events in this window referenced a CVE.

Cross-Reference

No recent SEC filings to cross-reference.

Intel Feeds

2 IOC feeds updated this run (4,200 indicators total) — each available as CSV, MISP JSON, and STIX 2.1. Subscribe at https://thrunt.me/intel/manifest.json.

Hand-Authored Sigma

16 production-ready TTP rules (+2 scaffolds in the authoring queue) live at https://thrunt.me/sigma/manifest.json. Subscribe via https://thrunt.me/sigma/rules.lock.json (content-hash churn) or pull all with https://thrunt.me/sigma/rules.tar.gz.

Detection Gaps

18 of 160 techniques with corpus signal have zero detection coverage — no SigmaHQ community rule, no thrunt rule. This is the hand-authoring queue; the live view is at https://thrunt.me/corpus/attck/.

…and 8 more below the cut — full list on the rollup.

Pipeline Health

Sources: SEC EDGAR (public domain), CISA Known Exploited Vulnerabilities (public domain), FIRST.org EPSS (per ToS), NIST NVD (public domain), GitHub Security Advisories (per ToS), abuse.ch URLhaus (CC0, attribution), ransomware.live (per ToS), MITRE ATT&CK (CC BY 4.0).

Published by Applied Cybernetics Group via thrunt.me. Heuristic cross-references are labelled as such; verify before action.