⚠️ Stale feeds — the following feeds have not refreshed within the staleness window. Treat their sections in this brief as possibly incomplete.

• ctid-attck — 384.4h since last success · HTTP 404 Not Found at https://center-for-threat-informed-defense.github.io/mappings-explorer/data/kev/attack-16.1/kev-07.28.2025/enterprise/kev-07.28.2025_attac

Morning Brief — 2026-10-09

5 federal patching priority, 2 exploit probability movers, 10 emerging critical cves, 10 supply chain, 30 ransomware activity, 946 ioc volume, 16 active malware families, 2 multi-source iocs, 2 intel feeds, 18 hand-authored sigma, 18 detection gaps, and 1 pipeline health. Sections with no signal are still rendered with an explicit “none in this window” note so absence is visible alongside presence.

Material Breach Disclosures

No new Item 1.05 8-K filings in this window.

Federal Patching Priority

CVE-2015-3306 — ProFTPD ProFTPD

ProFTPD Improper Access Control Vulnerability

• Added: 2026-10-08 · Federal due: 2026-10-11 · EPSS 99.9th pct (score 0.968) · CVSS 10.0 (CRITICAL) · CWE-284
• ransomware use: Unknown

ProFTPD contains an improper access control vulnerability that could allow remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.

The mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.

CVE-2016-3081 — Apache Struts

Apache Struts Command Injection Vulnerability

• Added: 2026-10-08 · Federal due: 2026-10-11 · EPSS 99.8th pct (score 0.934) · CVSS 8.1 (HIGH) · CWE-77
• ransomware use: Unknown

Apache Struts contains a command injection vulnerability that could allow remote attackers to execute arbitrary code via method:prefix when Dynamic Method Invocation is enabled.

Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method: prefix, related to chained expressions.

CVE-2015-5477 — ISC BIND

** ISC BIND Data Processing Errors Vulnerability**

• Added: 2026-10-08 · Federal due: 2026-10-11 · EPSS 99.8th pct (score 0.913) · CVSS 7.5 (HIGH) · CWE-19, CWE-617
• ransomware use: Unknown

ISC BIND contains a data processing errors vulnerability that could allow remote attackers to cause a denial of service via TKEY queries.

named in ISC BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3 allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) via TKEY queries.

CVE-2021-3199 — ONLYOFFICE Docs

ONLYOFFICE Docs Server Path Traversal Vulnerability

• Added: 2026-10-08 · Federal due: 2026-10-11 · EPSS 94.8th pct (score 0.082) · CVSS 9.8 (CRITICAL) · CWE-22
• ransomware use: Unknown

ONLYOFFICE Docs contains a path traversal vulnerability that can occur when JWT is used, via a /.. sequence in an image upload parameter and could allow for remote code execution.

Directory traversal with remote code execution can occur in /upload in ONLYOFFICE Document Server before 5.6.3, when JWT is used, via a /.. sequence in an image upload parameter.

CVE-2023-22894 — Strapi Strapi

Strapi Cleartext Storage of Sensitive Information Vulnerability

• Added: 2026-10-08 · Federal due: 2026-10-11 · EPSS 75.9th pct (score 0.017) · CVSS 4.9 (MEDIUM) · CWE-312
• ransomware use: Unknown

Strapi contains a cleartext storage of sensitive information vulnerability that could allow attackers with access to the admin panel to discover sensitive user details via the query filter. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version. This vulnerability can be chained with CVE-2023-22621 to achieve remote code execution.

Strapi through 4.5.5 allows attackers (with access to the admin panel) to discover sensitive user details by exploiting the query filter. The attacker can filter users by columns that contain sensitive information and infer a value from API responses. If the attacker has super admin access, then this can be exploited to discover the password hash and password reset token of all users. If the…

Exploit Probability Movers

Emerging Critical CVEs

• CVE-2026-96207 · CRITICAL (10.0) · 2026-10-08 — Improper certificate validation in Microsoft Partner Center allows an unauthorized attacker to elevate privileges over a network.
• CVE-2026-94510 · CRITICAL (9.9) · 2026-10-08 — Authorization bypass through user-controlled key in Microsoft Bookings allows an unauthorized attacker to elevate privileges over a network.
• CVE-2026-106126 · CRITICAL (9.9) · 2026-10-08 — A command injection vulnerability in the Active Directory Events Listener of Tenable Identity Exposure (SaaS) allows an authenticated, low-privileged attacker to execute arbitrary commands as SYSTEM on the PDCe.
• CVE-2026-107908 · CRITICAL (9.8) · 2026-10-09 — A heap-based out-of-bounds write in the BoltReadHandler function (src/bolt/bolt_api.c) in FalkorDB before 4.20.0 allows a remote unauthenticated attacker to cause a denial of service and possibly execute arbitrary code b…
• CVE-2026-5759 · CRITICAL (9.8) · 2026-10-09 — A double free and use-after-free vulnerability in the RdbLoadDeletedNodes function of the RDB graph decoders (src/serializers/decoders/*/decode_graph_entities.c) in FalkorDB before 4.18.1 allows a remote attacker who can…
• CVE-2026-88131 · CRITICAL (9.8) · 2026-10-08 — Deserialization of untrusted data in Microsoft Dataverse allows an unauthorized attacker to execute code over a network.
• CVE-2026-77900 · CRITICAL (9.8) · 2026-10-08 — Missing authentication for critical function in Azure App Service allows an unauthorized attacker to execute code over a network.
• CVE-2026-84249 · CRITICAL (9.8) · 2026-10-08 — IBM Guardium Data Protection 12.2, and 12.2.2 could allow a remote attacker to execute arbitrary management operations due to missing authentication for critical function.
• CVE-2026-80381 · CRITICAL (9.8) · 2026-10-08 — IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute unauthorized SQL statements due to SQL injection.
• CVE-2026-75875 · CRITICAL (9.8) · 2026-10-08 — IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute arbitrary code due to path traversal.

Supply Chain

GHSA-6v25-8wq6-xq4j · CVE-2026-107726 (maven)

• CRITICAL · 2026-10-08
• Affected: com.hazelcast:hazelcast, com.hazelcast:hazelcast, com.hazelcast:hazelcast
• https://github.com/advisories/GHSA-6v25-8wq6-xq4j

Hazelcast allows arbitrary member memory access by low-privileged client

GHSA-w294-6q5q-53p8 · CVE-2026-107725 (maven)

• HIGH · 2026-10-08
• Affected: com.hazelcast:hazelcast, com.hazelcast:hazelcast, com.hazelcast:hazelcast
• https://github.com/advisories/GHSA-w294-6q5q-53p8

Hazelcast has an authorization bypass in IMap Predicates API

GHSA-8wpc-h4q6-8fxv · CVE-2026-107720 (npm)

• HIGH · CVSS 7.4 · 2026-10-08
• Affected: fast-jwt
• https://github.com/advisories/GHSA-8wpc-h4q6-8fxv

fast-jwt: createVerifier accepts unsigned JWTs when key is ” or null and algorithms is explicitly set

GHSA-ww5h-9m49-7xx4 · CVE-2026-107722 (npm)

• CRITICAL · CVSS 9.8 · 2026-10-08
• Affected: fast-jwt
• https://github.com/advisories/GHSA-ww5h-9m49-7xx4

fast-jwt: Incomplete patch of CVE-2026-34950: Non-whitespace key-prefix re-enables RSA→HS256 algorithm confusion

GHSA-5hjw-83fp-phq9 · CVE-2026-107723 (npm)

• HIGH · CVSS 8.1 · 2026-10-08
• Affected: fast-jwt
• https://github.com/advisories/GHSA-5hjw-83fp-phq9

fast-jwt : Silent claim-validator bypass when JWT payload is a JSON array

GHSA-g3jj-5cmm-3hxx · CVE-2026-107724 (npm)

• HIGH · CVSS 7.4 · 2026-10-08
• Affected: fast-jwt
• https://github.com/advisories/GHSA-g3jj-5cmm-3hxx

fast-jwt treats raw public JWK JSON as an HMAC secret, enabling HS256 token forgery

GHSA-6wjp-v33h-5cvq · CVE-2026-61426 (npm)

• HIGH · CVSS 8.6 · 2026-10-08
• Affected: praisonai
• https://github.com/advisories/GHSA-6wjp-v33h-5cvq

PraisonAI: AgentOS defaults to network-exposed no-auth mode, allowing unauthenticated agent invocation and instruction disclosure

GHSA-c78w-2q4r-68r7 · CVE-2026-61442 (pip)

• HIGH · CVSS 7.1 · 2026-10-08
• Affected: praisonai-platform
• https://github.com/advisories/GHSA-c78w-2q4r-68r7

PraisonAI: Platform member PATCH routes allow owner resource rewrites and project lead reassignment delete bypass

GHSA-cv3g-hj65-pcfh · CVE-2026-61434 (pip)

• HIGH · CVSS 8.8 · 2026-10-08
• Affected: praisonai
• https://github.com/advisories/GHSA-cv3g-hj65-pcfh

PraisonAI: Shell command allowlist bypass via find -exec built-in action

GHSA-9mp3-24cc-77mg · CVE-2026-61445 (pip)

• CRITICAL · CVSS 9.9 · 2026-10-08
• Affected: praisonai
• https://github.com/advisories/GHSA-9mp3-24cc-77mg

PraisonAI: AICoder Arbitrary File Write and Command Execution via LLM Tool Calls

Ransomware Activity

30 new victim postings across 10 groups.

IOC Volume

946 new IOCs in this window. By source:

Recent OSINT Events

No curated MISP events in this window (bulk-IOC contributions tallied in IOC Volume).

Active Malware Families

16 malware families active this week (0 corroborated across ≥2 sources), exercising 20 ATT&CK techniques. Family is the unit, not the indicator: the raw IOCs are drill-down evidence below, not the signal.

Families marked ”→” are delivery/social-engineering clusters (ClickFix, SmartLoader, ClearFake, GuLoader). Their technique mappings are the delivery chain — downstream behavior is payload-dependent, so they don’t open a hard coverage gap on their own.

Multi-Source IOCs

2 IOCs flagged by 2+ independent sources this window — the highest-confidence signal the cross-feed corpus produces.

MISP × KEV Correlation

No MISP events in this window referenced a CVE.

Cross-Reference

No recent SEC filings to cross-reference.

Intel Feeds

2 IOC feeds updated this run (5,113 indicators total) — each available as CSV, MISP JSON, and STIX 2.1. Subscribe at https://thrunt.me/intel/manifest.json.

Hand-Authored Sigma

16 production-ready TTP rules (+2 scaffolds in the authoring queue) live at https://thrunt.me/sigma/manifest.json. Subscribe via https://thrunt.me/sigma/rules.lock.json (content-hash churn) or pull all with https://thrunt.me/sigma/rules.tar.gz.

Detection Gaps

18 of 159 techniques with corpus signal have zero detection coverage — no SigmaHQ community rule, no thrunt rule. This is the hand-authoring queue; the live view is at https://thrunt.me/corpus/attck/.

…and 8 more below the cut — full list on the rollup.

Pipeline Health

Sources: SEC EDGAR (public domain), CISA Known Exploited Vulnerabilities (public domain), FIRST.org EPSS (per ToS), NIST NVD (public domain), GitHub Security Advisories (per ToS), abuse.ch URLhaus (CC0, attribution), ransomware.live (per ToS), MITRE ATT&CK (CC BY 4.0).

Published by Applied Cybernetics Group via thrunt.me. Heuristic cross-references are labelled as such; verify before action.