October 10, 2026 · Applied Cybernetics Group
Morning Brief — October 10, 2026
⚠️ Stale feeds — the following feeds have not refreshed within the staleness window. Treat their sections in this brief as possibly incomplete.
ctid-attck— 409h since last success · HTTP 404 Not Found at https://center-for-threat-informed-defense.github.io/mappings-explorer/data/kev/attack-16.1/kev-07.28.2025/enterprise/kev-07.28.2025_attac
Morning Brief — 2026-10-10
10 emerging critical cves, 10 supply chain, 69 ransomware activity, 771 ioc volume, 15 active malware families, 2 multi-source iocs, 2 intel feeds, 18 hand-authored sigma, 18 detection gaps, and 1 pipeline health. Sections with no signal are still rendered with an explicit “none in this window” note so absence is visible alongside presence.
Material Breach Disclosures
No new Item 1.05 8-K filings in this window.
Federal Patching Priority
No new KEV additions in this window.
Exploit Probability Movers
No CVEs with ≥0.20 EPSS movement in this window.
Emerging Critical CVEs
CVE-2026-94503· CRITICAL (10.0) · 2026-10-09 — Unrestricted Upload of File with Dangerous Type vulnerability in PX-lab Zombify zombify allows Upload a Web Shell to a Web Server.This issue affects Zombify: from n/a through 1.7.7.CVE-2026-108263· CRITICAL (9.9) · 2026-10-09 — Astron Agent is an agentic workflow platform for building and running AI agents. Prior to 1.1.2, the default workflow code-node path through /console-api/workflow/code/run and /workflow/v1/run selects LocalExecutor in co…CVE-2026-93945· CRITICAL (9.8) · 2026-10-10 — Deserialization of Untrusted Data vulnerability in Axiomthemes Balance balance allows Object Injection.This issue affects Balance: from n/a through 1.12.0.CVE-2026-93944· CRITICAL (9.8) · 2026-10-10 — Deserialization of Untrusted Data vulnerability in ThemeREX Group Camelia camelia allows Object Injection.This issue affects Camelia: from n/a through 1.2.15.CVE-2026-93943· CRITICAL (9.8) · 2026-10-10 — Deserialization of Untrusted Data vulnerability in ThemeREX Group Convex convex allows Object Injection.This issue affects Convex: from n/a through 1.16.0.CVE-2026-93942· CRITICAL (9.8) · 2026-10-10 — Deserialization of Untrusted Data vulnerability in ThemeREX Group Dwell dwell allows Object Injection.This issue affects Dwell: from n/a through 1.16.0.CVE-2026-93941· CRITICAL (9.8) · 2026-10-10 — Deserialization of Untrusted Data vulnerability in ThemeREX Group Edema edema allows Object Injection.This issue affects Edema: from n/a through 1.2.2.2.CVE-2026-93940· CRITICAL (9.8) · 2026-10-10 — Deserialization of Untrusted Data vulnerability in ThemeREX Group Greeny greeny allows Object Injection.This issue affects Greeny: from n/a through 2.10.0.CVE-2026-93938· CRITICAL (9.8) · 2026-10-10 — Deserialization of Untrusted Data vulnerability in ThemeREX Group Hogwords hogwords allows Object Injection.This issue affects Hogwords: from n/a through 1.2.7.CVE-2026-93937· CRITICAL (9.8) · 2026-10-10 — Deserialization of Untrusted Data vulnerability in ThemeREX Group Hygia hygia allows Object Injection.This issue affects Hygia: from n/a through 1.21.0.
Supply Chain
GHSA-m687-p538-r5hp (go)
- HIGH · 2026-10-09
- Affected:
code.vikunja.io/api - https://github.com/advisories/GHSA-m687-p538-r5hp
Vikunja: Permissive Cross-domain Security Policy trusts every localhost origin which should not be trusted
GHSA-j3hg-9rp3-5hw9 · CVE-2026-107805 (go)
- HIGH · CVSS 7.5 · 2026-10-09
- Affected:
github.com/0xJacky/Nginx-UI - https://github.com/advisories/GHSA-j3hg-9rp3-5hw9
Nginx UI: Unauthenticated signed-request body staging can exhaust temporary storage
GHSA-pwhx-cvv3-qj5c · CVE-2026-108259 (npm)
- HIGH · CVSS 8.2 · 2026-10-09
- Affected:
@tinacms/cli - https://github.com/advisories/GHSA-pwhx-cvv3-qj5c
Tina: Code injection via unescaped Git branch name in generated client source
GHSA-x34j-47hf-4xg7 · CVE-2026-108261 (npm)
- CRITICAL · CVSS 9.3 · 2026-10-09
- Affected:
tinacms,@tinacms/app - https://github.com/advisories/GHSA-x34j-47hf-4xg7
TinaCMS admin preview iframe loads an attacker-controlled origin from the URL fragment
GHSA-c42q-qvc3-j6vg · CVE-2026-108260 (npm)
- HIGH · CVSS 7.6 · 2026-10-09
- Affected:
@tinacms/web-components - https://github.com/advisories/GHSA-c42q-qvc3-j6vg
@tinacms/web-components: tina-markdown writes rich-text link URLs into href without scheme validation, allowing stored XSS
GHSA-628f-v4f6-p37r · CVE-2026-107845 (composer)
- CRITICAL · CVSS 9.3 · 2026-10-09
- Affected:
contao/comments-bundle,contao/comments-bundle - https://github.com/advisories/GHSA-628f-v4f6-p37r
Contao: Cross-site scripting in the comments bundle
GHSA-wq92-8x3r-fm38 · CVE-2026-91970 (go)
- HIGH · 2026-10-09
- Affected:
code.vikunja.io/api - https://github.com/advisories/GHSA-wq92-8x3r-fm38
Vikunja: Planka migration retains an unbounded aggregate of attacker-served attachments and can OOM the API
GHSA-pqf9-h8g4-8gmh · CVE-2026-91969 (go)
- HIGH · 2026-10-09
- Affected:
code.vikunja.io/api - https://github.com/advisories/GHSA-pqf9-h8g4-8gmh
Vikunja: Unbounded CSV row cardinality permits API process termination
GHSA-xxc3-xpmc-vmvr · CVE-2026-91968 (go)
- HIGH · 2026-10-09
- Affected:
code.vikunja.io/api - https://github.com/advisories/GHSA-xxc3-xpmc-vmvr
Vikunja: Unbounded nested task-filter recursion permits API process termination
GHSA-w7jp-mf2v-8342 · CVE-2026-91979 (go)
- HIGH · 2026-10-09
- Affected:
code.vikunja.io/api - https://github.com/advisories/GHSA-w7jp-mf2v-8342
Vikunja: Denial of service via decompression bomb in the data import
Ransomware Activity
69 new victim postings across 19 groups.
| Group | Victims | Sample |
|---|---|---|
thegentlemen | 37 | DW McMillan Memorial Hospital, Saskatoon Tribal Council, Aquatech, AnyTech365, G… |
qilin | 4 | Vadeto Group, Tepcomp, Melchioni Spa, Hagiva Yh |
Black X | 3 | bayer, enTouch, lopay |
akira | 3 | Yarema, Design Electric, TigerPress (DCC) |
arcusmedia | 3 | AETHOS, mblllp, Ladrillera Mecanizada |
Deadlock | 2 | Saber1, idi pharma |
Panzer | 2 | Supreme Energy, solutend |
payoutsking | 2 | Merrill Iron & Steel, Watermark Retirement Communities |
rhysida | 2 | Anne Arundel County, RealManage |
safepay | 2 | hoteldelfinolugano.ch, dwi-bau.de |
anubis | 1 | Mynd |
bravox | 1 | Dudley Land Company |
chaos | 1 | astranahealth.com |
cry0 | 1 | Anaergia |
emperador | 1 | Imperial Diamond Jewellery |
interlock | 1 | Shalom Christian Academy |
settra | 1 | northshoresun.timesreview.com |
termite | 1 | iDentalSoft |
threeam | 1 | fleetworksinc.com |
IOC Volume
771 new IOCs in this window. By source:
| Source | Count |
|---|---|
urlhaus | 771 |
Recent OSINT Events
No curated MISP events in this window (bulk-IOC contributions tallied in IOC Volume).
Active Malware Families
15 malware families active this week (0 corroborated across ≥2 sources), exercising 18 ATT&CK techniques. Family is the unit, not the indicator: the raw IOCs are drill-down evidence below, not the signal.
| Family | Type | Corrob. | IOCs | Techniques (✗ = coverage gap) |
|---|---|---|---|---|
| Mirai | botnet | — | 2,201 | T1110, T1498, T1499, T1584.005 |
| ClickFix | delivery → | — | 28 | T1059.001, T1204 |
| ConnectWise ScreenConnect (abuse) | rmm-abuse | — | 24 | T1219 |
| SmartLoader | loader → | — | 24 | T1027, T1059.001, T1105 |
| AsyncRAT | rat | — | 18 | T1056.001, T1059.001, T1071, T1219 |
| CoinMiner | miner | — | 18 | T1496 |
| DDoSAgent | ddos | — | 14 | T1498, T1499 |
| AgentTesla | stealer | — | 12 | T1056.001, T1071, T1114, T1555 |
| Formbook | stealer | — | 7 | T1005, T1056.001, T1071, T1555 |
| GuLoader | loader → | — | 7 | T1027, T1071, T1105 |
| ClearFake | delivery → | — | 6 | T1059.001, T1189, T1204 |
| Remcos | rat | — | 6 | T1056.001, T1071, T1113 |
| SilverFox | rat | — | 6 | T1059, T1071, T1219 |
| XWorm | rat | — | 4 | T1056.001, T1071 |
| NetSupport Manager (abuse) | rmm-abuse | — | 2 | T1219 |
Families marked ”→” are delivery/social-engineering clusters (ClickFix, SmartLoader, GuLoader, ClearFake). Their technique mappings are the delivery chain — downstream behavior is payload-dependent, so they don’t open a hard coverage gap on their own.
Multi-Source IOCs
2 IOCs flagged by 2+ independent sources this window — the highest-confidence signal the cross-feed corpus produces.
| IOC | Type | Sources | Last seen |
|---|---|---|---|
193.161.193.99 | ip-src | misp + urlhaus | 2026-10-10 |
exo-api.tf | domain | misp + urlhaus | 2026-10-10 |
MISP × KEV Correlation
No MISP events in this window referenced a CVE.
Cross-Reference
No recent SEC filings to cross-reference.
Intel Feeds
2 IOC feeds updated this run (5,127 indicators total) — each available as CSV, MISP JSON, and STIX 2.1. Subscribe at https://thrunt.me/intel/manifest.json.
| Feed | Source | Type | Count | Downloads |
|---|---|---|---|---|
| URLhaus — Malware Distribution URLs | urlhaus | url | 5,000 | CSV · MISP · STIX |
| URLhaus — Malware Distribution Domains | urlhaus | domain | 127 | CSV · MISP · STIX |
Hand-Authored Sigma
16 production-ready TTP rules (+2 scaffolds in the authoring queue) live at https://thrunt.me/sigma/manifest.json. Subscribe via https://thrunt.me/sigma/rules.lock.json (content-hash churn) or pull all with https://thrunt.me/sigma/rules.tar.gz.
| Rule | Status | YAML |
|---|---|---|
| T1037 Boot or Logon Initialization Scripts — Linux Init Script Modification | experimental | https://thrunt.me/sigma/t1037-linux-init-script-modification.yml |
| T1055 Process Injection — Rundll32 Spawning Explorer as an Injection Host | experimental | https://thrunt.me/sigma/t1055-rundll32-spawning-explorer-injection.yml |
| T1071.004 DNS-over-HTTPS Resolution from a Non-Browser Process | experimental | https://thrunt.me/sigma/t1071-004-doh-resolver-non-browser-c2.yml |
| T1098.004 Account Manipulation — SSH Authorized Keys File Modification | experimental | https://thrunt.me/sigma/t1098-004-ssh-authorized-keys-write.yml |
| T1098.005 Okta Verify Enrollment from a Hypervisor Guest | experimental | https://thrunt.me/sigma/t1098-005-hypervisor-mfa-device-enrollment.yml |
| T1102.001 Dead Drop Resolver — EtherHiding Payload Retrieval from BNB Smart Chain Testnet | experimental | https://thrunt.me/sigma/t1102-001-etherhiding-bsc-testnet-dead-drop.yml |
| T1195.002 Compromise Software Supply Chain — Malicious Google Tag Manager Container | experimental | https://thrunt.me/sigma/t1195-002-unapproved-gtm-container-injection.yml |
| T1204.004 Malicious Copy and Paste — ClickFix macOS Terminal Execution | experimental | https://thrunt.me/sigma/t1204-004-clickfix-macos-terminal-execution.yml |
| T1204.004 Malicious Copy and Paste — ClickFix Run Dialog Execution | experimental | https://thrunt.me/sigma/t1204-004-clickfix-run-dialog-execution.yml |
| T1557 Okta Authentication or MFA via a Remote-Desktop / Proxy / Tor Tunnel | experimental | https://thrunt.me/sigma/t1557-aitm-cross-asn-session-mfa.yml |
| T1557 Claims Kit First-Party Exfil — X-Enc Single-Letter C2 | experimental | https://thrunt.me/sigma/t1557-claims-kit-single-letter-c2-xenc.yml |
| T1557 Okta Verify SVG Asset Served by a Non-Okta Host | experimental | https://thrunt.me/sigma/t1557-non-okta-host-oktaverify-svg.yml |
| T1557 reCAPTCHA-Skinned Cloudflare Turnstile Gate | experimental | https://thrunt.me/sigma/t1557-recaptcha-skinned-turnstile-gate.yml |
| T1566.002 Spearphishing Link — Luxembourg Hospitality SMS Phishing Campaign | experimental | https://thrunt.me/sigma/t1566-002-luxembourg-hospitality-sms-phish.yml |
| T1574.002 DLL Side-Loading — Signed javac.exe Loading jli.dll from a User-Writable Path | experimental | https://thrunt.me/sigma/t1574-002-signed-javac-sideload-jli.yml |
| T1583.001 Resolution of a ShinyHunters .claims Impersonation Domain | experimental | https://thrunt.me/sigma/t1583-001-claims-registration-conjunction.yml |
| T1003.008 OS Credential Dumping — /etc/shadow and /etc/gshadow Access | draft | https://thrunt.meundefined |
| T1530 Data from Cloud Storage — Detection | draft | https://thrunt.meundefined |
Detection Gaps
18 of 159 techniques with corpus signal have zero detection coverage — no SigmaHQ community rule, no thrunt rule. This is the hand-authoring queue; the live view is at https://thrunt.me/corpus/attck/.
| Technique | Name | Active families | MISP | KEV |
|---|---|---|---|---|
T1011 | Exfiltration Over Other Network Medium | — | 0 | 4 |
T1497 | Virtualization/Sandbox Evasion | — | 0 | 4 |
T1573.001 | Symmetric Cryptography | — | 1 | 3 |
T1562 | — | — | 0 | 3 |
T1001 | Data Obfuscation | — | 0 | 2 |
T1499.002 | Service Exhaustion Flood | — | 0 | 2 |
T1530 | Data from Cloud Storage | — | 0 | 2 |
T1562.001 | — | — | 0 | 2 |
T1003.008 | /etc/passwd and /etc/shadow | — | 0 | 1 |
T1070.001 | — | — | 0 | 1 |
…and 8 more below the cut — full list on the rollup.
Pipeline Health
| Feed | Last success | Status |
|---|---|---|
ctid-attck | 2026-09-23 09:41:01 UTC | failing |
Sources: SEC EDGAR (public domain), CISA Known Exploited Vulnerabilities (public domain), FIRST.org EPSS (per ToS), NIST NVD (public domain), GitHub Security Advisories (per ToS), abuse.ch URLhaus (CC0, attribution), ransomware.live (per ToS), MITRE ATT&CK (CC BY 4.0).
Published by Applied Cybernetics Group via thrunt.me. Heuristic cross-references are labelled as such; verify before action.