⚠️ Stale feeds — the following feeds have not refreshed within the staleness window. Treat their sections in this brief as possibly incomplete.

• ctid-attck — 240h since last success · HTTP 404 Not Found at https://center-for-threat-informed-defense.github.io/mappings-explorer/data/kev/attack-16.1/kev-07.28.2025/enterprise/kev-07.28.2025_attac

Morning Brief — 2026-10-03

2 federal patching priority, 5 exploit probability movers, 10 emerging critical cves, 10 supply chain, 33 ransomware activity, 896 ioc volume, 15 active malware families, 2 multi-source iocs, 2 intel feeds, 18 hand-authored sigma, 18 detection gaps, and 1 pipeline health. Sections with no signal are still rendered with an explicit “none in this window” note so absence is visible alongside presence.

Material Breach Disclosures

No new Item 1.05 8-K filings in this window.

Federal Patching Priority

CVE-2026-102489 — Zammad GmbH Zammad

Zammad GmbH Zammad Session Fixation Vulnerability

• Added: 2026-10-02 · Federal due: 2026-10-05 · EPSS 45.8th pct (score 0.006) · CVSS 9.8 (CRITICAL) · CWE-384
• ransomware use: Unknown

Zammad GmbH Zammad contains a session fixation vulnerability that can lead to remote code execution as the zammad user. This vulnerability can be chained with CVE-2026-102490.

Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user. The vulnerability is also present in version 7.0.0 to version 7.1.3, but not exploitable due to environment conditions.

CVE-2026-102490 — Zammad GmbH Zammad

Zammad GmbH Zammad Improper Privilege Management Vulnerability

• Added: 2026-10-02 · Federal due: 2026-10-05 · EPSS 16.3th pct (score 0.003) · CVSS 9.8 (CRITICAL) · CWE-269
• ransomware use: Unknown

Zammad GmbH Zammad contains an improper privilege management vulnerability that can allow the local zammad user to escalate privileges to root. This vulnerability can be chained with CVE-2026-102489.

All versions of Zammad including the latest alpha enable the local zammad user to escalate privileges to root.

Exploit Probability Movers

Emerging Critical CVEs

• CVE-2026-103956 · CRITICAL (10.0) · 2026-10-02 — Missing authentication for critical function in the authentication dependency in Loom for AWS before 1.6.1 allowed remote actors to obtain super-admin authority over the agent control plane, including registering tool se…
• CVE-2026-104610 · CRITICAL (10.0) · 2026-10-02 — A security vulnerability has been detected in Tenda HG7, HG9 and HG10 300001138_en_xpon. This impacts the function boaGetVar of the file /boaform/formLoopBack of the component Boa Web Server. Such manipulation of the arg…
• CVE-2026-105080 · CRITICAL (9.9) · 2026-10-03 — In ConvertX before 0.19.0, converters/calibre.ts does not block recipe files, and instead passes them to the ebook-convert program from Calibre. This affects executable code in a .recipe or .downloaded_recipe file.
• CVE-2026-82041 · CRITICAL (9.9) · 2026-10-02 — UTMStack before 11.2.16 contains a missing authorization vulnerability in UTMIncidentCommandWebsocket.processCommand(), the handler mapped to the /command/{hostname} STOMP destination, where no role check or command allo…
• CVE-2026-90970 · CRITICAL (9.9) · 2026-10-02 — GitLab has remediated a vulnerability in the GitLab AI Gateway component affecting all versions of the AI Gateway from 18.1.6 before 19.2.4, 19.3 before 19.3.2, and 19.4 before 19.4.1 that, under certain conditions, coul…
• CVE-2026-84411 · CRITICAL (9.8) · 2026-10-02 — The web management service in affected RouterOS versions contains an integer underflow in its HTTP request body handling that is reachable before authentication. This can be leveraged by an unauthenticated network attack…
• CVE-2026-82042 · CRITICAL (9.8) · 2026-10-02 — UTMStack before 11.2.16 contains an authentication bypass vulnerability that allows remote attackers to gain full administrative API access by presenting a valid Utm-Internal-Key header matching the INTERNAL_KEY environm…
• CVE-2023-54405 · CRITICAL (9.8) · 2026-10-02 — H3C CVM, the Cloud Virtualization Management component of the H3C CAS cloud platform, contains an unauthenticated arbitrary file upload vulnerability in the /cas/fileUpload/upload endpoint that allows remote attackers to…
• CVE-2026-104846 · CRITICAL (9.8) · 2026-10-02 — Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. From 0.12.0 until 1.6.2, fromJSON deserialization of a fulfilled Promise control node can pass a plugin-produ…
• CVE-2026-19652 · CRITICAL (9.8) · 2026-10-02 — The Divi Membership plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 2.2.0. This is due to the dmem_form_submit_handler() function determining the new user’s role by iteratin…

Supply Chain

GHSA-x4q3-gcj3-m6cf · CVE-2026-73802 (go)

• CRITICAL · CVSS 9.9 · 2026-10-02
• Affected: gitea.com/gitea/runner
• https://github.com/advisories/GHSA-x4q3-gcj3-m6cf

gitea-runner: workflow container.options passes host namespaces and capability flags to job container when privileged mode is disabled

GHSA-gjj5-9665-rwrc · CVE-2026-104861 (npm)

• HIGH · CVSS 7.5 · 2026-10-02
• Affected: probe-image-size
• https://github.com/advisories/GHSA-gjj5-9665-rwrc

probe-image-size: Quadratic-time Denial of Service in the SVG Parser

GHSA-x8gv-g2g3-65fj (go)

• HIGH · CVSS 8.2 · 2026-10-02
• Affected: github.com/siyuan-note/siyuan/kernel
• https://github.com/advisories/GHSA-x8gv-g2g3-65fj

SiYuan Agent Tools SSRF via DNS-Rebinding TOCTOU (Bypass of CheckHostSSRF)

GHSA-x8mw-p69m-v3mx · CVE-2026-19481 (npm)

• HIGH · CVSS 7.5 · 2026-10-02
• Affected: @fastify/busboy
• https://github.com/advisories/GHSA-x8mw-p69m-v3mx

@fastify/busboy vulnerable to Denial of Service via prototype-named multipart part header

GHSA-xjh9-v7x6-24jw · CVE-2026-19484 (npm)

• HIGH · CVSS 7.5 · 2026-10-02
• Affected: @fastify/busboy
• https://github.com/advisories/GHSA-xjh9-v7x6-24jw

@fastify/busboy vulnerable to Denial of Service via oversized multipart boundary

GHSA-cjcg-cxmh-9wcr (rust)

• HIGH · CVSS 7.5 · 2026-10-02
• Affected: praxis-proxy
• https://github.com/advisories/GHSA-cjcg-cxmh-9wcr

Praxis affected by HTTP/2 Bomb

GHSA-h46j-26q3-rggf · CVE-2026-71416 (pip)

• HIGH · CVSS 8.8 · 2026-10-02
• Affected: headroom-ai
• https://github.com/advisories/GHSA-h46j-26q3-rggf

Headroom vulnerable to Cross-Site WebSocket Hijacking (CSWSH)

GHSA-4vpg-gwqq-w44c · CVE-2026-74904 (go)

• HIGH · CVSS 7.5 · 2026-10-02
• Affected: github.com/siyuan-note/siyuan/kernel
• https://github.com/advisories/GHSA-4vpg-gwqq-w44c

SiYuan: 17 block metadata/content endpoints in kernel/api/block.go have zero publish-access filtering, reachable by anonymous publish-mode readers

GHSA-72qq-p3r5-f7wq · CVE-2026-10032 (npm)

• CRITICAL · CVSS 9.3 · 2026-10-02
• Affected: @a2ui/web_core
• https://github.com/advisories/GHSA-72qq-p3r5-f7wq

@a2ui/web_core: openUrl permits javascript: URI execution via agent-supplied button actions

GHSA-8ffr-xgwf-xj56 · CVE-2026-18140 (rust)

• HIGH · CVSS 7.5 · 2026-10-02
• Affected: aws-smithy-json
• https://github.com/advisories/GHSA-8ffr-xgwf-xj56

aws-smithy-json: Uncontrolled recursion in the aws-smithy-json unknown-key skip path allows unauthenticated remote denial of service in smithy-rs generated servers

Ransomware Activity

33 new victim postings across 13 groups.

IOC Volume

896 new IOCs in this window. By source:

Recent OSINT Events

No curated MISP events in this window (bulk-IOC contributions tallied in IOC Volume).

Active Malware Families

15 malware families active this week (1 corroborated across ≥2 sources), exercising 18 ATT&CK techniques. Family is the unit, not the indicator: the raw IOCs are drill-down evidence below, not the signal.

Families marked ”→” are delivery/social-engineering clusters (ClickFix). Their technique mappings are the delivery chain — downstream behavior is payload-dependent, so they don’t open a hard coverage gap on their own.

Multi-Source IOCs

2 IOCs flagged by 2+ independent sources this window — the highest-confidence signal the cross-feed corpus produces.

MISP × KEV Correlation

No MISP events in this window referenced a CVE.

Cross-Reference

No recent SEC filings to cross-reference.

Intel Feeds

2 IOC feeds updated this run (4,494 indicators total) — each available as CSV, MISP JSON, and STIX 2.1. Subscribe at https://thrunt.me/intel/manifest.json.

Hand-Authored Sigma

16 production-ready TTP rules (+2 scaffolds in the authoring queue) live at https://thrunt.me/sigma/manifest.json. Subscribe via https://thrunt.me/sigma/rules.lock.json (content-hash churn) or pull all with https://thrunt.me/sigma/rules.tar.gz.

Detection Gaps

18 of 160 techniques with corpus signal have zero detection coverage — no SigmaHQ community rule, no thrunt rule. This is the hand-authoring queue; the live view is at https://thrunt.me/corpus/attck/.

…and 8 more below the cut — full list on the rollup.

Pipeline Health

Sources: SEC EDGAR (public domain), CISA Known Exploited Vulnerabilities (public domain), FIRST.org EPSS (per ToS), NIST NVD (public domain), GitHub Security Advisories (per ToS), abuse.ch URLhaus (CC0, attribution), ransomware.live (per ToS), MITRE ATT&CK (CC BY 4.0).

Published by Applied Cybernetics Group via thrunt.me. Heuristic cross-references are labelled as such; verify before action.