October 14, 2026 · Applied Cybernetics Group
Morning Brief — October 14, 2026
Morning Brief — 2026-10-14
1 material breach disclosures, 2 federal patching priority, 10 emerging critical cves, 10 supply chain, 52 ransomware activity, 770 ioc volume, 14 active malware families, 2 multi-source iocs, 2 intel feeds, 18 hand-authored sigma, and 18 detection gaps. Sections with no signal are still rendered with an explicit “none in this window” note so absence is visible alongside presence.
Material Breach Disclosures
Park Dental Partners, Inc. (PARK)
- Filed: 2026-10-13 · CIK 0002069604 · Accession
0001104659-26-115541 - Filing: https://www.sec.gov/Archives/edgar/data/2069604/000110465926115541/park-20261007x8k.htm
As previously reported, on August 28, 2026, Park Dental Partners, Inc. (“Company”) identified unauthorized access to its computer network. The Company promptly initiated its incident response protocols, engaged external cybersecurity experts and forensic specialists and notified law enforcement. The investigation has determined that data was subject to unauthorized acquisition as a result of the i…
Federal Patching Priority
CVE-2026-104935 — Ivanti Connect Secure
Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability
- Added: 2026-10-13 · Federal due: 2026-10-16 · CVSS 8.6 (HIGH) · CWE-290
- ransomware use: Unknown
Ivanti Connect Secure contains an authentication bypass by spoofing vulnerability that allows a remote unauthenticated attacker to execute arbitrary commands.
Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands. This does not impact ICS version 22.7R2.14 or prior.
CVE-2026-96951 — Microsoft Windows
Microsoft Windows Command Injection Vulnerability
- Added: 2026-10-13 · Federal due: 2026-10-16 · CVSS 8.8 (HIGH) · CWE-77
- ransomware use: Unknown
Microsoft Windows Shell contains a command injection vulnerability that allows an unauthorized attacker to bypass a security feature over a network.
Improper neutralization of special elements used in a command (‘command injection’) in Windows Shell allows an unauthorized attacker to bypass a security feature over a network.
Exploit Probability Movers
No CVEs with ≥0.20 EPSS movement in this window.
Emerging Critical CVEs
CVE-2026-106624· CRITICAL (10.0) · 2026-10-13 — ColdFusion is affected by an Improper Control of Generation of Code (‘Code Injection’) vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulner…CVE-2026-106622· CRITICAL (10.0) · 2026-10-13 — ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. Exploitation of this issue does not require user interaction. Scope is changed.CVE-2026-105899· CRITICAL (10.0) · 2026-10-13 — ColdFusion is affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to…CVE-2026-90532· CRITICAL (10.0) · 2026-10-13 — Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the v…CVE-2026-48383· CRITICAL (10.0) · 2026-10-13 — Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the v…CVE-2026-48382· CRITICAL (10.0) · 2026-10-13 — Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the v…CVE-2026-110130· CRITICAL (10.0) · 2026-10-13 — Dockhand before 1.0.45 contains an authentication bypass in which the global auth hook skips authentication for any path ending in a static-asset extension such as .js, including /api/* routes, and the user-mutation hand…CVE-2026-103849· CRITICAL (10.0) · 2026-10-13 — Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining e…CVE-2026-94603· CRITICAL (10.0) · 2026-10-13 — Podman is a tool for managing OCI containers and pods. From 4.4.0 until 5.8.8 and 6.1.3, podman run treats an image carrying the io.podman.annotations.checkpoint.runtime.name annotation as a checkpoint and silently ignor…CVE-2026-55675· CRITICAL (10.0) · 2026-10-13 — The Salty documentation repository builds and deploys the docs.saltbox.dev website. Prior to commit 649c9aea2daef1168eeb0415b44e65dbbde9f220, .github/workflows/trigger-pr-build.yml records an untrusted fork commit in the…
Supply Chain
GHSA-4j9v-h7pp-725h · CVE-2026-70035 (nuget)
- HIGH · CVSS 8.8 · 2026-10-13
- Affected:
Microsoft.WindowsDesktop.App.Runtime.win-arm64,Microsoft.WindowsDesktop.App.Runtime.win-x64,Microsoft.WindowsDesktop.App.Runtime.win-x86 - https://github.com/advisories/GHSA-4j9v-h7pp-725h
Microsoft Security Advisory CVE-2026-70035 - .NET and Visual Studio Remote Code Execution Vulnerability
GHSA-mf4x-w4gh-4656 · CVE-2026-70186 (nuget)
- HIGH · CVSS 7.5 · 2026-10-13
- Affected:
Microsoft.AspNetCore.App.Runtime.linux-arm,Microsoft.AspNetCore.App.Runtime.linux-arm64,Microsoft.AspNetCore.App.Runtime.linux-musl-arm - https://github.com/advisories/GHSA-mf4x-w4gh-4656
Microsoft Security Advisory CVE-2026-70186 - ASP.NET Core Denial of Service Vulnerability
GHSA-pfwj-2f93-rf42 · CVE-2026-70007 (nuget)
- HIGH · CVSS 8.8 · 2026-10-13
- Affected:
Microsoft.WindowsDesktop.App.Runtime.win-arm64,Microsoft.WindowsDesktop.App.Runtime.win-x64,Microsoft.WindowsDesktop.App.Runtime.win-x86 - https://github.com/advisories/GHSA-pfwj-2f93-rf42
Microsoft Security Advisory CVE-2026-70007 - .NET and Visual Studio Remote Code Execution Vulnerability
GHSA-c27m-942f-rcfh · CVE-2026-87697 (nuget)
- HIGH · CVSS 8.8 · 2026-10-13
- Affected:
Microsoft.WindowsDesktop.App.Runtime.win-arm64,Microsoft.WindowsDesktop.App.Runtime.win-x64,Microsoft.WindowsDesktop.App.Runtime.win-x86 - https://github.com/advisories/GHSA-c27m-942f-rcfh
Microsoft Security Advisory CVE-2026-87697 - .NET and Visual Studio Remote Code Execution Vulnerability
GHSA-w6wh-p4g7-mpj2 · CVE-2026-96225 (nuget)
- HIGH · CVSS 7.8 · 2026-10-13
- Affected:
Microsoft.NETCore.App.Runtime.linux-arm,Microsoft.NETCore.App.Runtime.linux-arm64,Microsoft.NETCore.App.Runtime.linux-musl-arm - https://github.com/advisories/GHSA-w6wh-p4g7-mpj2
Microsoft Security Advisory CVE-2026-96225 - .NET and Visual Studio Elevation of Privilege Vulnerability
GHSA-qjpx-jqm5-h2c4 · CVE-2026-96230 (nuget)
- HIGH · CVSS 8.8 · 2026-10-13
- Affected:
Microsoft.AspNetCore.Components.WebAssembly.Server,Microsoft.AspNetCore.Components.WebAssembly.Server,Microsoft.AspNetCore.Components.WebAssembly.Server - https://github.com/advisories/GHSA-qjpx-jqm5-h2c4
Microsoft Security Advisory CVE-2026-96230 - ASP.NET Core Remote Code Execution Vulnerability
GHSA-vrrp-6v32-2p8g · CVE-2026-70179 (nuget)
- HIGH · CVSS 7.5 · 2026-10-13
- Affected:
Microsoft.AspNetCore.Authentication.Negotiate,Microsoft.AspNetCore.Authentication.Negotiate,Microsoft.AspNetCore.Authentication.Negotiate - https://github.com/advisories/GHSA-vrrp-6v32-2p8g
Microsoft Security Advisory CVE-2026-70179 - ASP.NET Core Elevation of Privilege Vulnerability
GHSA-xq57-crx4-g373 · CVE-2026-96224 (nuget)
- HIGH · CVSS 8.8 · 2026-10-13
- Affected:
Microsoft.WindowsDesktop.App.Runtime.win-arm64,Microsoft.WindowsDesktop.App.Runtime.win-x64,Microsoft.WindowsDesktop.App.Runtime.win-x86 - https://github.com/advisories/GHSA-xq57-crx4-g373
Microsoft Security Advisory CVE-2026-96224 - .NET and Visual Studio Remote Code Execution Vulnerability
GHSA-f63g-mx39-3r38 · CVE-2026-85363 (nuget)
- HIGH · CVSS 8.8 · 2026-10-13
- Affected:
Microsoft.WindowsDesktop.App.Runtime.win-arm64,Microsoft.WindowsDesktop.App.Runtime.win-x64,Microsoft.WindowsDesktop.App.Runtime.win-x86 - https://github.com/advisories/GHSA-f63g-mx39-3r38
Microsoft Security Advisory CVE-2026-85363 - .NET and Visual Studio Remote Code Execution Vulnerability
GHSA-c399-9853-6jmj · CVE-2026-96959 (nuget)
- HIGH · CVSS 7.5 · 2026-10-13
- Affected:
System.Security.Cryptography.Xml,System.Security.Cryptography.Xml,System.Security.Cryptography.Xml - https://github.com/advisories/GHSA-c399-9853-6jmj
Microsoft Security Advisory CVE-2026-96959 - .NET and Visual Studio Denial of Service Vulnerability
Ransomware Activity
52 new victim postings across 17 groups.
| Group | Victims | Sample |
|---|---|---|
Wallstreet | 11 | Ahlqvist & Almqvist Arkitekter AB, Englunds Konsultbyrå AB, Spectrum Arkitekter … |
HYFLOCK | 8 | YYC Advisors, Cooper Tec Solutions, nodhom.com, IGPL, ocean beverages, tdotnet, … |
N0n | 6 | Company #65, Company #63, Company #64, Hunter Neurology, MarieBelle New York, PG… |
AuditTeam | 4 | Admirals Trading, ADed, Zece, Sa***ge |
qilin | 4 | The Golden Legacy Financing, Iliff, Meredith, Wildberger & Brennan, P.C, Milstei… |
Orova | 3 | Durga Bearings, Codar (Pte) Ltd, Alfameli Group |
everest | 3 | KVH, Laerdal, Topcon Healthcare |
Panzer | 2 | Valode & Pistre, Zenidoc |
incransom | 2 | Great Lakes, Wolf & Sofsky GmbH |
nightspire | 2 | Colorado Texas, o se Solutions |
BYOD | 1 | Decorolala |
Vexy Ransomware | 1 | Guarufilme |
direwolf | 1 | Interseguro |
dragonforce | 1 | Lane Equipment |
emperador | 1 | CMC AUDITORES SRL |
ransomhouse | 1 | Excess Baggage |
sarcoma | 1 | victim |
IOC Volume
770 new IOCs in this window. By source:
| Source | Count |
|---|---|
urlhaus | 770 |
Recent OSINT Events
No curated MISP events in this window (bulk-IOC contributions tallied in IOC Volume).
Active Malware Families
14 malware families active this week (1 corroborated across ≥2 sources), exercising 21 ATT&CK techniques. Family is the unit, not the indicator: the raw IOCs are drill-down evidence below, not the signal.
| Family | Type | Corrob. | IOCs | Techniques (✗ = coverage gap) |
|---|---|---|---|---|
| ConnectWise ScreenConnect (abuse) | rmm-abuse | ✓ | 5 | T1219 |
| Mirai | botnet | — | 570 | T1110, T1498, T1499, T1584.005 |
| ClickFix | delivery → | — | 53 | T1059.001, T1204 |
| CoinMiner | miner | — | 11 | T1496 |
| AgentTesla | stealer | — | 9 | T1056.001, T1071, T1114, T1555 |
| AsyncRAT | rat | — | 9 | T1056.001, T1059.001, T1071, T1219 |
| SilverFox | rat | — | 8 | T1059, T1071, T1219 |
| Remcos | rat | — | 6 | T1056.001, T1071, T1113 |
| AMOS (Atomic macOS Stealer) | stealer | — | 5 | T1005, T1056.002, T1071, T1555.001 |
| Formbook | stealer | — | 5 | T1005, T1056.001, T1071, T1555 |
| GuLoader | loader → | — | 5 | T1027, T1071, T1105 |
| XWorm | rat | — | 3 | T1056.001, T1071 |
| Amadey | loader → | — | 2 | T1071, T1105, T1547 |
| ClearFake | delivery → | — | 2 | T1059.001, T1189, T1204 |
Families marked ”→” are delivery/social-engineering clusters (ClickFix, GuLoader, Amadey, ClearFake). Their technique mappings are the delivery chain — downstream behavior is payload-dependent, so they don’t open a hard coverage gap on their own.
Multi-Source IOCs
2 IOCs flagged by 2+ independent sources this window — the highest-confidence signal the cross-feed corpus produces.
| IOC | Type | Sources | Last seen |
|---|---|---|---|
example.com | domain | misp + urlhaus | 2026-10-14 |
swervimgbackj.top | domain | misp + urlhaus | 2026-10-14 |
MISP × KEV Correlation
No MISP events in this window referenced a CVE.
Cross-Reference
No SEC × KEV vendor token matches in this window. (This is a heuristic surface, absence is expected most days.)
Intel Feeds
2 IOC feeds updated this run (5,157 indicators total) — each available as CSV, MISP JSON, and STIX 2.1. Subscribe at https://thrunt.me/intel/manifest.json.
| Feed | Source | Type | Count | Downloads |
|---|---|---|---|---|
| URLhaus — Malware Distribution URLs | urlhaus | url | 5,000 | CSV · MISP · STIX |
| URLhaus — Malware Distribution Domains | urlhaus | domain | 157 | CSV · MISP · STIX |
Hand-Authored Sigma
16 production-ready TTP rules (+2 scaffolds in the authoring queue) live at https://thrunt.me/sigma/manifest.json. Subscribe via https://thrunt.me/sigma/rules.lock.json (content-hash churn) or pull all with https://thrunt.me/sigma/rules.tar.gz.
| Rule | Status | YAML |
|---|---|---|
| T1037 Boot or Logon Initialization Scripts — Linux Init Script Modification | experimental | https://thrunt.me/sigma/t1037-linux-init-script-modification.yml |
| T1055 Process Injection — Rundll32 Spawning Explorer as an Injection Host | experimental | https://thrunt.me/sigma/t1055-rundll32-spawning-explorer-injection.yml |
| T1071.004 DNS-over-HTTPS Resolution from a Non-Browser Process | experimental | https://thrunt.me/sigma/t1071-004-doh-resolver-non-browser-c2.yml |
| T1098.004 Account Manipulation — SSH Authorized Keys File Modification | experimental | https://thrunt.me/sigma/t1098-004-ssh-authorized-keys-write.yml |
| T1098.005 Okta Verify Enrollment from a Hypervisor Guest | experimental | https://thrunt.me/sigma/t1098-005-hypervisor-mfa-device-enrollment.yml |
| T1102.001 Dead Drop Resolver — EtherHiding Payload Retrieval from BNB Smart Chain Testnet | experimental | https://thrunt.me/sigma/t1102-001-etherhiding-bsc-testnet-dead-drop.yml |
| T1195.002 Compromise Software Supply Chain — Malicious Google Tag Manager Container | experimental | https://thrunt.me/sigma/t1195-002-unapproved-gtm-container-injection.yml |
| T1204.004 Malicious Copy and Paste — ClickFix macOS Terminal Execution | experimental | https://thrunt.me/sigma/t1204-004-clickfix-macos-terminal-execution.yml |
| T1204.004 Malicious Copy and Paste — ClickFix Run Dialog Execution | experimental | https://thrunt.me/sigma/t1204-004-clickfix-run-dialog-execution.yml |
| T1557 Okta Authentication or MFA via a Remote-Desktop / Proxy / Tor Tunnel | experimental | https://thrunt.me/sigma/t1557-aitm-cross-asn-session-mfa.yml |
| T1557 Claims Kit First-Party Exfil — X-Enc Single-Letter C2 | experimental | https://thrunt.me/sigma/t1557-claims-kit-single-letter-c2-xenc.yml |
| T1557 Okta Verify SVG Asset Served by a Non-Okta Host | experimental | https://thrunt.me/sigma/t1557-non-okta-host-oktaverify-svg.yml |
| T1557 reCAPTCHA-Skinned Cloudflare Turnstile Gate | experimental | https://thrunt.me/sigma/t1557-recaptcha-skinned-turnstile-gate.yml |
| T1566.002 Spearphishing Link — Luxembourg Hospitality SMS Phishing Campaign | experimental | https://thrunt.me/sigma/t1566-002-luxembourg-hospitality-sms-phish.yml |
| T1574.002 DLL Side-Loading — Signed javac.exe Loading jli.dll from a User-Writable Path | experimental | https://thrunt.me/sigma/t1574-002-signed-javac-sideload-jli.yml |
| T1583.001 Resolution of a ShinyHunters .claims Impersonation Domain | experimental | https://thrunt.me/sigma/t1583-001-claims-registration-conjunction.yml |
| T1003.008 OS Credential Dumping — /etc/shadow and /etc/gshadow Access | draft | https://thrunt.meundefined |
| T1530 Data from Cloud Storage — Detection | draft | https://thrunt.meundefined |
Detection Gaps
18 of 161 techniques with corpus signal have zero detection coverage — no SigmaHQ community rule, no thrunt rule. This is the hand-authoring queue; the live view is at https://thrunt.me/corpus/attck/.
| Technique | Name | Active families | MISP | KEV |
|---|---|---|---|---|
T1011 | Exfiltration Over Other Network Medium | — | 0 | 4 |
T1497 | Virtualization/Sandbox Evasion | — | 0 | 4 |
T1573.001 | Symmetric Cryptography | — | 1 | 3 |
T1562 | — | — | 0 | 3 |
T1001 | Data Obfuscation | — | 0 | 2 |
T1499.002 | Service Exhaustion Flood | — | 0 | 2 |
T1530 | Data from Cloud Storage | — | 0 | 2 |
T1562.001 | — | — | 0 | 2 |
T1003.008 | /etc/passwd and /etc/shadow | — | 0 | 1 |
T1070.001 | — | — | 0 | 1 |
…and 8 more below the cut — full list on the rollup.
Pipeline Health
All feeds healthy.
Sources: SEC EDGAR (public domain), CISA Known Exploited Vulnerabilities (public domain), FIRST.org EPSS (per ToS), NIST NVD (public domain), GitHub Security Advisories (per ToS), abuse.ch URLhaus (CC0, attribution), ransomware.live (per ToS), MITRE ATT&CK (CC BY 4.0).
Published by Applied Cybernetics Group via thrunt.me. Heuristic cross-references are labelled as such; verify before action.