⚠️ Stale feeds — the following feeds have not refreshed within the staleness window. Treat their sections in this brief as possibly incomplete.

• ctid-attck — 480.3h since last success · HTTP 404 Not Found at https://center-for-threat-informed-defense.github.io/mappings-explorer/data/kev/attack-16.1/kev-07.28.2025/enterprise/kev-07.28.2025_attac

Morning Brief — 2026-10-13

1 exploit probability movers, 10 emerging critical cves, 73 ransomware activity, 625 ioc volume, 14 active malware families, 1 multi-source iocs, 2 intel feeds, 18 hand-authored sigma, 18 detection gaps, and 1 pipeline health. Sections with no signal are still rendered with an explicit “none in this window” note so absence is visible alongside presence.

Material Breach Disclosures

No new Item 1.05 8-K filings in this window.

Federal Patching Priority

No new KEV additions in this window.

Exploit Probability Movers

Emerging Critical CVEs

• CVE-2026-109110 · CRITICAL (10.0) · 2026-10-13 — A flaw has been found in Wavlink WL-WN592AX6 250422. This issue affects the function system of the component wmapd Daemon. Executing a manipulation can lead to os command injection. It is possible to launch the attack re…
• CVE-2026-109109 · CRITICAL (10.0) · 2026-10-13 — A vulnerability was detected in Wavlink WL-WN530BE1-A 251117. This vulnerability affects the function strcpy of the file /cgi-bin/ExportAllSettings.cgi of the component Settings Export CGI. Performing a manipulation of t…
• CVE-2026-97229 · CRITICAL (10.0) · 2026-10-13 — GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to exec…
• CVE-2026-89111 · CRITICAL (10.0) · 2026-10-13 — The SAP Cloud SDK for Python contains an OAuth2 SSRF vulnerability affecting multi-tenant BTP applications. An attacker who controls the tenant_subdomain parameter can redirect OAuth2 token requests to an attacker-contro…
• CVE-2026-108918 · CRITICAL (10.0) · 2026-10-12 — A vulnerability was identified in Edimax BR-6208AC 1.32. Impacted is an unknown function of the file /goform/formWlanMP. The manipulation of the argument readE2P leads to command injection. It is possible to initiate the…
• CVE-2026-108917 · CRITICAL (10.0) · 2026-10-12 — A vulnerability was determined in Edimax BR-6208AC 1.32. This issue affects some unknown processing of the file /goform/formAutoFWupgrade. Executing a manipulation of the argument tftpsIP can lead to command injection. T…
• CVE-2026-108907 · CRITICAL (10.0) · 2026-10-12 — A vulnerability was determined in Netcore NR268 1.7.121109. Affected is the function user_ok of the component CGI Execution. This manipulation causes improper authentication. The attack can be initiated remotely. The exp…
• CVE-2026-108892 · CRITICAL (10.0) · 2026-10-12 — A vulnerability was determined in Linksys E1700 1.0.0.4.003. This vulnerability affects the function ssid1MACFilter of the file /goform/ssid1MACFilter of the component Mac Filter. This manipulation of the argument newap_…
• CVE-2026-109108 · CRITICAL (9.9) · 2026-10-13 — A security vulnerability has been detected in Wavlink WL-WN530BE1-A 251117. This affects the function popen of the file /cgi-bin/uploadVpn.cgi. Such manipulation of the argument Type leads to os command injection. The at…
• CVE-2026-89110 · CRITICAL (9.9) · 2026-10-13 — SAP NetWeaver Visual Composer does not perform sufficient authorization checks in certain portal functionality. An attacker with low privileges could invoke internal operations on a preconfigured remote system. Depending…

Supply Chain

No high/critical GHSA advisories in this window.

Ransomware Activity

73 new victim postings across 14 groups.

IOC Volume

625 new IOCs in this window. By source:

Recent OSINT Events

No curated MISP events in this window (bulk-IOC contributions tallied in IOC Volume).

Active Malware Families

14 malware families active this week (1 corroborated across ≥2 sources), exercising 20 ATT&CK techniques. Family is the unit, not the indicator: the raw IOCs are drill-down evidence below, not the signal.

Families marked ”→” are delivery/social-engineering clusters (ClickFix, GuLoader, ClearFake). Their technique mappings are the delivery chain — downstream behavior is payload-dependent, so they don’t open a hard coverage gap on their own.

Multi-Source IOCs

1 IOC flagged by 2+ independent sources this window — the highest-confidence signal the cross-feed corpus produces.

MISP × KEV Correlation

No MISP events in this window referenced a CVE.

Cross-Reference

No recent SEC filings to cross-reference.

Intel Feeds

2 IOC feeds updated this run (5,142 indicators total) — each available as CSV, MISP JSON, and STIX 2.1. Subscribe at https://thrunt.me/intel/manifest.json.

Hand-Authored Sigma

16 production-ready TTP rules (+2 scaffolds in the authoring queue) live at https://thrunt.me/sigma/manifest.json. Subscribe via https://thrunt.me/sigma/rules.lock.json (content-hash churn) or pull all with https://thrunt.me/sigma/rules.tar.gz.

Detection Gaps

18 of 161 techniques with corpus signal have zero detection coverage — no SigmaHQ community rule, no thrunt rule. This is the hand-authoring queue; the live view is at https://thrunt.me/corpus/attck/.

…and 8 more below the cut — full list on the rollup.

Pipeline Health

Sources: SEC EDGAR (public domain), CISA Known Exploited Vulnerabilities (public domain), FIRST.org EPSS (per ToS), NIST NVD (public domain), GitHub Security Advisories (per ToS), abuse.ch URLhaus (CC0, attribution), ransomware.live (per ToS), MITRE ATT&CK (CC BY 4.0).

Published by Applied Cybernetics Group via thrunt.me. Heuristic cross-references are labelled as such; verify before action.