⚠️ Stale feeds — the following feeds have not refreshed within the staleness window. Treat their sections in this brief as possibly incomplete.

• ctid-attck — 216h since last success · HTTP 404 Not Found at https://center-for-threat-informed-defense.github.io/mappings-explorer/data/kev/attack-16.1/kev-07.28.2025/enterprise/kev-07.28.2025_attac

Morning Brief — 2026-10-02

1 federal patching priority, 2 exploit probability movers, 10 emerging critical cves, 10 supply chain, 34 ransomware activity, 960 ioc volume, 14 active malware families, 2 multi-source iocs, 2 intel feeds, 18 hand-authored sigma, 18 detection gaps, and 1 pipeline health. Sections with no signal are still rendered with an explicit “none in this window” note so absence is visible alongside presence.

Material Breach Disclosures

No new Item 1.05 8-K filings in this window.

Federal Patching Priority

CVE-2026-104286 — Fortinet FortiMail

Fortinet FortiMail Path Traversal Vulnerability

• Added: 2026-10-01 · Federal due: 2026-10-04 · CVSS 9.8 (CRITICAL) · CWE-22
• ransomware use: Unknown

Fortinet FortiMail contains a path traversal and an improper neutralization of NULL byte or NULL character vulnerability that may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests.

An improper limitation of a pathname to a restricted directory (‘path traversal’) vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2.0 through 7.2.9 may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests.

Exploit Probability Movers

Emerging Critical CVEs

• CVE-2026-93698 · CRITICAL (9.9) · 2026-10-02 — Insufficient validation allows arbitrary commands to be executed via the Multilang adminbin.
• CVE-2026-96658 · CRITICAL (9.9) · 2026-10-01 — A flaw was found in Foreman. An authenticated attacker with low-level permissions can achieve remote code execution (RCE) by bypassing the safemode sandbox within the templating engine. Due to improper handling of delega…
• CVE-2026-79901 · CRITICAL (9.9) · 2026-10-01 — In deployments using BoKS keytab management, affected versions of boks_keytabmd generate Active Directory service-account passwords from a predictable pseudo-random sequence seeded with the current Unix timestamp. An att…
• CVE-2026-97637 · CRITICAL (9.8) · 2026-10-02 — The JSON API Auth plugin for WordPress is vulnerable to Authentication Bypass via Cached Session Cookie Disclosure in all versions up to, and including, 3.1.2. The vulnerability exists because the required PI-Media/json-…
• CVE-2026-19660 · CRITICAL (9.8) · 2026-10-02 — The Divi Membership plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 2.3.0. The process_paypal_callback function, hooked to the init action, accepts a base64-encoded `…
• CVE-2026-14378 · CRITICAL (9.8) · 2026-10-02 — The DevKit Pro plugin for WordPress is vulnerable to Authentication Bypass Leading to Administrator Account Takeover in all versions up to, and including, 2.3.0 This is due to the revert_switch handler trusting the att…
• CVE-2026-103764 · CRITICAL (9.8) · 2026-10-02 — Mooncake transfer engine before 0.3.13 contains an untrusted pointer dereference in ServerSession::readHeader that allows unauthenticated attackers to read and write arbitrary process memory via the TCP transport data po…
• CVE-2026-59797 · CRITICAL (9.8) · 2026-10-01 — Improper Privilege Management vulnerability in Apache HTTP Server’s mod_ssl via SSLRequire and file-related expressions.

This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.

• CVE-2026-57941 · CRITICAL (9.8) · 2026-10-01 — Use After Free vulnerability in Apache HTTP Server’s mod_http2 via shared session->bbtmp re-entrancy

This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.

• CVE-2026-56154 · CRITICAL (9.8) · 2026-10-01 — Use After Free vulnerability in Apache HTTP Server’s mod_rewrite when using lookahead (%{LA-U:HTTP:…})

This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.

Supply Chain

GHSA-9cqf-hhrq-7v45 (go)

• HIGH · CVSS 8.6 · 2026-10-01
• Affected: github.com/siyuan-note/siyuan/kernel
• https://github.com/advisories/GHSA-9cqf-hhrq-7v45

SiYuan: getAttributeViewSearchTarget returns database row content to anonymous readers with no publish-access check, reopening the class closed one day earlier at the adjacent route

GHSA-qhwx-74w5-xhxq · CVE-2026-92948 (npm)

• CRITICAL · CVSS 9.9 · 2026-10-01
• Affected: vm2
• https://github.com/advisories/GHSA-qhwx-74w5-xhxq

vm2: NodeVM builtin allowlist bypass via node:test.run() execArgv allows sandbox escape

GHSA-jxxv-8r27-vm4p · CVE-2026-92950 (npm)

• HIGH · CVSS 8.6 · 2026-10-01
• Affected: vm2
• https://github.com/advisories/GHSA-jxxv-8r27-vm4p

vm2 CLI provides no sandbox isolation - host-realm require() is reachable from sandboxed scripts

GHSA-h85j-hv3c-qfgq · CVE-2026-92940 (npm)

• CRITICAL · CVSS 10.0 · 2026-10-01
• Affected: vm2
• https://github.com/advisories/GHSA-h85j-hv3c-qfgq

vm2 exposes host HTTPS credentials and TLS traffic through globalAgent

GHSA-c48m-32m9-vx93 · CVE-2026-92951 (npm)

• CRITICAL · CVSS 9.9 · 2026-10-01
• Affected: vm2
• https://github.com/advisories/GHSA-c48m-32m9-vx93

vm2 Custom Module Resolver Can Bypass the External Package Allowlist by Loading a Colliding Host Package

GHSA-6rh5-qq4q-97xh · CVE-2026-92958 (npm)

• HIGH · CVSS 8.5 · 2026-10-01
• Affected: vm2
• https://github.com/advisories/GHSA-6rh5-qq4q-97xh

vm2: NodeVM builtin denylist bypass via fs/promises despite -fs, allowing host filesystem writes

GHSA-8686-vhfx-7r3j · CVE-2026-92957 (npm)

• CRITICAL · CVSS 9.9 · 2026-10-01
• Affected: vm2
• https://github.com/advisories/GHSA-8686-vhfx-7r3j

vm2: NodeVM node:-prefixed negative builtin deny bypass exposes child_process

GHSA-8hr7-r645-pc6w · CVE-2026-92935 (npm)

• CRITICAL · CVSS 9.0 · 2026-10-01
• Affected: vm2
• https://github.com/advisories/GHSA-8hr7-r645-pc6w

vm2: NodeVM nesting guard accepts array-shaped require and permits host RCE

GHSA-647f-g98j-qq25 · CVE-2026-92937 (npm)

• CRITICAL · CVSS 10.0 · 2026-10-01
• Affected: vm2
• https://github.com/advisories/GHSA-647f-g98j-qq25

vm2: GHSA-m283-3h24-438v fix bypass leads to host RCE via call/apply indirection

GHSA-6w8r-xxw2-g3hx · CVE-2026-92938 (npm)

• CRITICAL · CVSS 9.9 · 2026-10-01
• Affected: vm2
• https://github.com/advisories/GHSA-6w8r-xxw2-g3hx

vm2 allows a sandboxed plugin to execute native code through node:sqlite

Ransomware Activity

34 new victim postings across 17 groups.

IOC Volume

960 new IOCs in this window. By source:

Recent OSINT Events

No curated MISP events in this window (bulk-IOC contributions tallied in IOC Volume).

Active Malware Families

14 malware families active this week (1 corroborated across ≥2 sources), exercising 16 ATT&CK techniques. Family is the unit, not the indicator: the raw IOCs are drill-down evidence below, not the signal.

Families marked ”→” are delivery/social-engineering clusters (ClickFix). Their technique mappings are the delivery chain — downstream behavior is payload-dependent, so they don’t open a hard coverage gap on their own.

Multi-Source IOCs

2 IOCs flagged by 2+ independent sources this window — the highest-confidence signal the cross-feed corpus produces.

MISP × KEV Correlation

No MISP events in this window referenced a CVE.

Cross-Reference

No recent SEC filings to cross-reference.

Intel Feeds

2 IOC feeds updated this run (4,402 indicators total) — each available as CSV, MISP JSON, and STIX 2.1. Subscribe at https://thrunt.me/intel/manifest.json.

Hand-Authored Sigma

16 production-ready TTP rules (+2 scaffolds in the authoring queue) live at https://thrunt.me/sigma/manifest.json. Subscribe via https://thrunt.me/sigma/rules.lock.json (content-hash churn) or pull all with https://thrunt.me/sigma/rules.tar.gz.

Detection Gaps

18 of 160 techniques with corpus signal have zero detection coverage — no SigmaHQ community rule, no thrunt rule. This is the hand-authoring queue; the live view is at https://thrunt.me/corpus/attck/.

…and 8 more below the cut — full list on the rollup.

Pipeline Health

Sources: SEC EDGAR (public domain), CISA Known Exploited Vulnerabilities (public domain), FIRST.org EPSS (per ToS), NIST NVD (public domain), GitHub Security Advisories (per ToS), abuse.ch URLhaus (CC0, attribution), ransomware.live (per ToS), MITRE ATT&CK (CC BY 4.0).

Published by Applied Cybernetics Group via thrunt.me. Heuristic cross-references are labelled as such; verify before action.