⚠️ Stale feeds — the following feeds have not refreshed within the staleness window. Treat their sections in this brief as possibly incomplete.

• ctid-attck — 313.2h since last success · HTTP 404 Not Found at https://center-for-threat-informed-defense.github.io/mappings-explorer/data/kev/attack-16.1/kev-07.28.2025/enterprise/kev-07.28.2025_attac

Morning Brief — 2026-10-06

1 exploit probability movers, 10 emerging critical cves, 10 supply chain, 47 ransomware activity, 14803 ioc volume, 19 active malware families, 3 multi-source iocs, 2 intel feeds, 18 hand-authored sigma, 18 detection gaps, and 1 pipeline health. Sections with no signal are still rendered with an explicit “none in this window” note so absence is visible alongside presence.

Material Breach Disclosures

No new Item 1.05 8-K filings in this window.

Federal Patching Priority

No new KEV additions in this window.

Exploit Probability Movers

Emerging Critical CVEs

• CVE-2026-39773 · CRITICAL (10.0) · 2026-10-06 — Unauthenticated Privilege Escalation in Doctreat Core <= 1.7.0 versions.
• CVE-2026-39770 · CRITICAL (10.0) · 2026-10-06 — Unauthenticated Arbitrary File Upload in Doctreat <= 1.7.0 versions.
• CVE-2026-32579 · CRITICAL (10.0) · 2026-10-06 — Unauthenticated Arbitrary File Upload in Kognetiks Chatbot for WordPress <= 2.4.9 versions.
• CVE-2026-105484 · CRITICAL (10.0) · 2026-10-06 — A security vulnerability has been detected in TOTOLINK X6000R 9.4.0cu.652_B20230116. The impacted element is the function firmware_check of the file /cgi-bin/cstecgi.cgi of the component UploadFirmwareFile Handler. Such…
• CVE-2026-105285 · CRITICAL (10.0) · 2026-10-05 — A security vulnerability has been detected in Totolink A3002MU 1.0.0-B20230403.1455. This affects an unknown function of the file /boafrm/formIpQoS of the component QoS Rule Handler. The manipulation of the argument addQ…
• CVE-2026-39759 · CRITICAL (9.9) · 2026-10-06 — Employer / Sales Representative Arbitrary File Upload in Workreap Core <= 3.4.5 versions.
• CVE-2026-39757 · CRITICAL (9.9) · 2026-10-06 — Subscriber Arbitrary File Upload in Taskbot <= 6.6 versions.
• CVE-2026-39755 · CRITICAL (9.9) · 2026-10-06 — Subscriber Arbitrary File Upload in WP Duplicate <= 1.1.11 versions.
• CVE-2026-32568 · CRITICAL (9.9) · 2026-10-06 — Subscriber Remote Code Execution (RCE) in WooCommerce Designer Pro <= 1.9.33 versions.
• CVE-2026-105778 · CRITICAL (9.9) · 2026-10-06 — A vulnerability has been found in Tenda AC5 02.03.01.111_multi. Affected by this issue is some unknown functionality of the file /goform/setWifi of the component Wifi Handler. Such manipulation of the argument wifiPwd le…

Supply Chain

GHSA-v5rq-49vh-5v5c · CVE-2026-102829 (npm)

• CRITICAL · 2026-10-05
• Affected: @simple-git/argv-parser
• https://github.com/advisories/GHSA-v5rq-49vh-5v5c

simple-git: VISUAL editor environment variable is omitted from unsafe editor detection

GHSA-x6jw-m9v5-85vh · CVE-2026-102828 (npm)

• CRITICAL · 2026-10-05
• Affected: simple-git
• https://github.com/advisories/GHSA-x6jw-m9v5-85vh

simple-git unsafe-operation guard does not block trailer command configuration

GHSA-g4wm-2vf7-vfgr · CVE-2026-102826 (npm)

• HIGH · CVSS 8.1 · 2026-10-05
• Affected: simple-git
• https://github.com/advisories/GHSA-g4wm-2vf7-vfgr

simple-git allows command execution through unblocked Git configuration includes

GHSA-858h-whjf-mvg5 · CVE-2026-102827 (npm)

• HIGH · CVSS 8.1 · 2026-10-05
• Affected: simple-git
• https://github.com/advisories/GHSA-858h-whjf-mvg5

simple-git: unsafe-operations plugin bypass via git long-option abbreviation (—receive-p/—exe) -> command execution (residual of CVE-2026-28291)

GHSA-v4x9-3549-crwv · CVE-2026-96749 (pip)

• HIGH · CVSS 8.4 · 2026-10-05
• Affected: pymongo
• https://github.com/advisories/GHSA-v4x9-3549-crwv

PyMongo: PYTHON-5996 Heap out-of-bounds write via signed size overflow in BSON document encoding

GHSA-vp6j-j7w5-5xjj · CVE-2026-96748 (pip)

• HIGH · CVSS 6.5 · 2026-10-05
• Affected: pymongo
• https://github.com/advisories/GHSA-vp6j-j7w5-5xjj

PyMongo: PYTHON-5986 Host injection in PyMongo connection string parsing via percent-encoded delimiters

GHSA-wfpm-5gcm-94cg · CVE-2026-102600 (npm)

• HIGH · CVSS 7.5 · 2026-10-05
• Affected: @socket.io/cluster-engine
• https://github.com/advisories/GHSA-wfpm-5gcm-94cg

Socket.IO: Prototype Pollution via Unsafe Client Session Lookup

GHSA-p6vx-979v-rg4c · CVE-2026-104846 (npm)

• CRITICAL · CVSS 9.8 · 2026-10-05
• Affected: seroval
• https://github.com/advisories/GHSA-p6vx-979v-rg4c

Seroval: fromJSON() Promise thenable assimilation invokes plugin-produced callables (bypass of GHSA-mv8w-475r-vwqw)

GHSA-jp82-f5mq-hwhp · CVE-2026-104845 (npm)

• HIGH · CVSS 7.5 · 2026-10-05
• Affected: seroval
• https://github.com/advisories/GHSA-jp82-f5mq-hwhp

Seroval: Memory exhaustion via unchecked TypedArray length in JSON deserialization

GHSA-jqcg-44mw-7w3h · CVE-2026-90711 (npm)

• CRITICAL · CVSS 9.1 · 2026-10-05
• Affected: proxy-addr
• https://github.com/advisories/GHSA-jqcg-44mw-7w3h

proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet

Ransomware Activity

47 new victim postings across 18 groups.

IOC Volume

14803 new IOCs in this window. By source:

Recent OSINT Events

No curated MISP events in this window (bulk-IOC contributions tallied in IOC Volume).

Active Malware Families

19 malware families active this week (1 corroborated across ≥2 sources), exercising 19 ATT&CK techniques. Family is the unit, not the indicator: the raw IOCs are drill-down evidence below, not the signal.

Families marked ”→” are delivery/social-engineering clusters (ClickFix, SmartLoader, ClearFake, GuLoader). Their technique mappings are the delivery chain — downstream behavior is payload-dependent, so they don’t open a hard coverage gap on their own.

Multi-Source IOCs

3 IOCs flagged by 2+ independent sources this window — the highest-confidence signal the cross-feed corpus produces.

MISP × KEV Correlation

No MISP events in this window referenced a CVE.

Cross-Reference

No recent SEC filings to cross-reference.

Intel Feeds

2 IOC feeds updated this run (5,125 indicators total) — each available as CSV, MISP JSON, and STIX 2.1. Subscribe at https://thrunt.me/intel/manifest.json.

Hand-Authored Sigma

16 production-ready TTP rules (+2 scaffolds in the authoring queue) live at https://thrunt.me/sigma/manifest.json. Subscribe via https://thrunt.me/sigma/rules.lock.json (content-hash churn) or pull all with https://thrunt.me/sigma/rules.tar.gz.

Detection Gaps

18 of 158 techniques with corpus signal have zero detection coverage — no SigmaHQ community rule, no thrunt rule. This is the hand-authoring queue; the live view is at https://thrunt.me/corpus/attck/.

…and 8 more below the cut — full list on the rollup.

Pipeline Health

Sources: SEC EDGAR (public domain), CISA Known Exploited Vulnerabilities (public domain), FIRST.org EPSS (per ToS), NIST NVD (public domain), GitHub Security Advisories (per ToS), abuse.ch URLhaus (CC0, attribution), ransomware.live (per ToS), MITRE ATT&CK (CC BY 4.0).

Published by Applied Cybernetics Group via thrunt.me. Heuristic cross-references are labelled as such; verify before action.