October 15, 2026 · Applied Cybernetics Group
Morning Brief — October 15, 2026
Morning Brief — 2026-10-15
1 material breach disclosures, 4 federal patching priority, 10 emerging critical cves, 1 supply chain, 28 ransomware activity, 613 ioc volume, 13 active malware families, 2 multi-source iocs, 2 intel feeds, 18 hand-authored sigma, and 18 detection gaps. Sections with no signal are still rendered with an explicit “none in this window” note so absence is visible alongside presence.
Material Breach Disclosures
Park Dental Partners, Inc. (PARK)
- Filed: 2026-10-13 · CIK 0002069604 · Accession
0001104659-26-115541 - Filing: https://www.sec.gov/Archives/edgar/data/2069604/000110465926115541/park-20261007x8k.htm
As previously reported, on August 28, 2026, Park Dental Partners, Inc. (“Company”) identified unauthorized access to its computer network. The Company promptly initiated its incident response protocols, engaged external cybersecurity experts and forensic specialists and notified law enforcement. The investigation has determined that data was subject to unauthorized acquisition as a result of the i…
Federal Patching Priority
CVE-2026-105134 — Ahsay AhsayCBS
Ahsay AhsayCBS Command Injection Vulnerability
- Added: 2026-10-14 · Federal due: 2026-10-17 · EPSS 78.6th pct (score 0.018) · CVSS 10.0 (CRITICAL) · CWE-77, CWE-78
- ransomware use: Unknown
Ahsay AhsayCBS contains a command injection vulnerability that could allow a remote attacker to execute operating system commands via manipulation of the random parameter in the Replication Receiver component’s /rps/api/json/UpdateReceivers.do endpoint. This vulnerability can be chained with CVE-2026-105133.
A flaw has been found in Ahsay AhsayCBS up to 10.3.2. This vulnerability affects unknown code of the file /rps/api/json/UpdateReceivers.do of the component Replication Receiver. Executing a manipulation of the argument random can lead to os command injection. It is possible to launch the attack remotely. The exploit has been published and may be used. Upgrading to version 10.3.4 is able to…
CVE-2026-105133 — Ahsay AhsayCBS
Ahsay AhsayCBS Improper Authentication Vulnerability
- Added: 2026-10-14 · Federal due: 2026-10-17 · EPSS 30.7th pct (score 0.004) · CVSS 7.3 (HIGH) · CWE-287
- ransomware use: Unknown
Ahsay AhsayCBS contains an improper authentication vulnerability that could allow a remote attacker to bypass authentication via manipulation of the random parameter in the API component’s checkSysPwd function. This vulnerability can be chained with CVE-2026-105134.
A vulnerability was detected in Ahsay AhsayCBS up to 10.3.2. This affects the function checkSysPwd of the file com/ahsay/obs/api/ApiStructsAction.java of the component API. Performing a manipulation of the argument random results in improper authentication. It is possible to initiate the attack remotely. The exploit is now public and may be used. Upgrading to version 10.3.4 is able to mitigate…
CVE-2026-76519 — Cisco Secure Email Gateway
Cisco Secure Email Gateway Relative Path Traversal Vulnerability
- Added: 2026-10-14 · Federal due: 2026-10-17 · CVSS 9.8 (CRITICAL) · CWE-23
- ransomware use: Unknown
Cisco Secure Email Gateway contains a relative path traversal vulnerability that could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system.
A vulnerability in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system. This vulnerability is due to improper handling of email attachments when the file reputation service is enabled. An attacker could exploit this vulnerability by sending an email that contains a…
CVE-2026-0322 — Palo Alto Networks PAN-OS
Palo Alto Networks PAN-OS Code Injection Vulnerability
- Added: 2026-10-14 · Federal due: 2026-10-17 · CWE-94
- ransomware use: Unknown
Palo Alto Networks PAN-OS contains a code injection vulnerability that could allow an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall.
A remote code execution (RCE) vulnerability in the management interface of Palo Alto Networks PAN-OS® software enables an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall. The security risk posed by this issue is minimized by restricting access to the management interface to only trusted internal IP addresses according to our recommended…
Exploit Probability Movers
No CVEs with ≥0.20 EPSS movement in this window.
Emerging Critical CVEs
CVE-2026-110536· CRITICAL (10.0) · 2026-10-14 — A vulnerability was determined in D-Link DIR-868L 2.01b05. This impacts the function system of the file /htdocs/cgibin of the component HNAP CGI Handler. Executing a manipulation of the argument SOAPACTION can lead to os…CVE-2026-55572· CRITICAL (10.0) · 2026-10-14 — e107 is a content management system (CMS). Prior to 2.3.7, the bundled alt_auth plugin’s otherdb and e107db authentication backends interpolate the submitted login username directly into SQL in e107_plugins/alt_auth/othe…CVE-2026-108390· CRITICAL (9.9) · 2026-10-14 — Hestia Control Panel is a lightweight and powerful control panel for the modern web. From version 1.9.7 through 1.10.4, update_object_value() in func/main.sh does not escape single quotes when writing a custom document-r…CVE-2026-77524· CRITICAL (9.9) · 2026-10-14 — KEDA is a Kubernetes-based Event Driven Autoscaling component. In version 2.20.2 and earlier, a namespace administrator who can create TriggerAuthentication and ScaledObject resources can set hashiCorpVault.address to a…CVE-2026-108587· CRITICAL (9.8) · 2026-10-15 — The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.34.10 via the compressCustom function. This…CVE-2026-110911· CRITICAL (9.8) · 2026-10-15 — Wheels 1.1.8 through 4.1.1 allows SQL injection when caller-supplied quoted values are parsed again as SQL by dynamic finders (such as findOneByEmail), the query builder’s where(property, value) and where(property, opera…CVE-2026-55684· CRITICAL (9.8) · 2026-10-14 — WeGIA is a web manager for charitable institutions. Prior to 3.8.6, the unauthenticated web/html/socio/sistema/cadastro_cobrancas_geracao.php endpoint accepts form-encoded POST data through extract($_REQUEST) and interpo…CVE-2026-55683· CRITICAL (9.8) · 2026-10-14 — WeGIA is a web manager for charitable institutions. Prior to 3.8.6, the unauthenticated web/html/socio/sistema/cadastro_cobranca.php endpoint accepts POST input through extract($_REQUEST) and directly incorporates valor,…CVE-2026-55680· CRITICAL (9.8) · 2026-10-14 — WeGIA is a web manager for charitable institutions. Prior to 3.8.6, unauthenticated POST requests to web/html/socio/sistema/cadastro_cobranca.php can place a quoted SQL expression in the codigo parameter, which extract($…CVE-2026-55573· CRITICAL (9.8) · 2026-10-14 — e107 is a content management system (CMS). Prior to 2.3.7, install.php decodes the attacker-controlled previous_steps POST parameter and passes it to unserialize() at file scope and again in the e_install constructor wit…
Supply Chain
GHSA-7pxr-59rr-hqj2 · CVE-2026-72923 (nuget)
- HIGH · CVSS 7.5 · 2026-10-14
- Affected:
Microsoft.OpenApi.YamlReader,Microsoft.OpenApi.YamlReader,Microsoft.OpenApi.Readers - https://github.com/advisories/GHSA-7pxr-59rr-hqj2
Microsoft.OpenApi.YamlReader vulnerable to denial of service via YAML alias expansion
Ransomware Activity
28 new victim postings across 13 groups.
| Group | Victims | Sample |
|---|---|---|
N0n | 6 | Company #69, Company #68, Company #67, Company #66, Interior Technologies, Tries… |
lockbit5 | 4 | poolegroup.com.au, saintpierredescorps.fr, skycc.co.th, kordhotels.gr |
akira | 3 | FOODMatch, Shediac Lobster Shop, Torns Enterprises |
Eclipse | 2 | Taiwan Otsuka Pharmaceutical, japantimes.co.jp |
Wallstreet | 2 | E-Z Pack Trucks, Green Clinic |
emperador | 2 | MPI LTDA, MyM ODONTOCLINICA S.A |
qilin | 2 | MOA Architecture, Joliet Public Schools District 86 |
spacebears | 2 | Alma Center Servizi Medicali S.r.l., Holistic Health Group, Inc. (d/b/a Suncraft… |
aurora | 1 | Estrategias BigMat S.L.U. |
blacknevas | 1 | Amity University Dubai |
iah6477 | 1 | alera |
incransom | 1 | FINANCIAMENTO LTDA |
kairos | 1 | Oceania Digital Communications |
IOC Volume
613 new IOCs in this window. By source:
| Source | Count |
|---|---|
urlhaus | 613 |
Recent OSINT Events
No curated MISP events in this window (bulk-IOC contributions tallied in IOC Volume).
Active Malware Families
13 malware families active this week (1 corroborated across ≥2 sources), exercising 21 ATT&CK techniques. Family is the unit, not the indicator: the raw IOCs are drill-down evidence below, not the signal.
| Family | Type | Corrob. | IOCs | Techniques (✗ = coverage gap) |
|---|---|---|---|---|
| ConnectWise ScreenConnect (abuse) | rmm-abuse | ✓ | 2 | T1219 |
| Mirai | botnet | — | 184 | T1110, T1498, T1499, T1584.005 |
| ClickFix | delivery → | — | 45 | T1059.001, T1204 |
| AsyncRAT | rat | — | 12 | T1056.001, T1059.001, T1071, T1219 |
| CoinMiner | miner | — | 12 | T1496 |
| SilverFox | rat | — | 8 | T1059, T1071, T1219 |
| AgentTesla | stealer | — | 5 | T1056.001, T1071, T1114, T1555 |
| AMOS (Atomic macOS Stealer) | stealer | — | 5 | T1005, T1056.002, T1071, T1555.001 |
| Formbook | stealer | — | 5 | T1005, T1056.001, T1071, T1555 |
| GuLoader | loader → | — | 5 | T1027, T1071, T1105 |
| Remcos | rat | — | 4 | T1056.001, T1071, T1113 |
| Amadey | loader → | — | 2 | T1071, T1105, T1547 |
| ClearFake | delivery → | — | 2 | T1059.001, T1189, T1204 |
Families marked ”→” are delivery/social-engineering clusters (ClickFix, GuLoader, Amadey, ClearFake). Their technique mappings are the delivery chain — downstream behavior is payload-dependent, so they don’t open a hard coverage gap on their own.
Multi-Source IOCs
2 IOCs flagged by 2+ independent sources this window — the highest-confidence signal the cross-feed corpus produces.
| IOC | Type | Sources | Last seen |
|---|---|---|---|
example.com | domain | misp + urlhaus | 2026-10-15 |
swervimgbackj.top | domain | misp + urlhaus | 2026-10-15 |
MISP × KEV Correlation
No MISP events in this window referenced a CVE.
Cross-Reference
No SEC × KEV vendor token matches in this window. (This is a heuristic surface, absence is expected most days.)
Intel Feeds
2 IOC feeds updated this run (4,466 indicators total) — each available as CSV, MISP JSON, and STIX 2.1. Subscribe at https://thrunt.me/intel/manifest.json.
| Feed | Source | Type | Count | Downloads |
|---|---|---|---|---|
| URLhaus — Malware Distribution URLs | urlhaus | url | 4,305 | CSV · MISP · STIX |
| URLhaus — Malware Distribution Domains | urlhaus | domain | 161 | CSV · MISP · STIX |
Hand-Authored Sigma
16 production-ready TTP rules (+2 scaffolds in the authoring queue) live at https://thrunt.me/sigma/manifest.json. Subscribe via https://thrunt.me/sigma/rules.lock.json (content-hash churn) or pull all with https://thrunt.me/sigma/rules.tar.gz.
| Rule | Status | YAML |
|---|---|---|
| T1037 Boot or Logon Initialization Scripts — Linux Init Script Modification | experimental | https://thrunt.me/sigma/t1037-linux-init-script-modification.yml |
| T1055 Process Injection — Rundll32 Spawning Explorer as an Injection Host | experimental | https://thrunt.me/sigma/t1055-rundll32-spawning-explorer-injection.yml |
| T1071.004 DNS-over-HTTPS Resolution from a Non-Browser Process | experimental | https://thrunt.me/sigma/t1071-004-doh-resolver-non-browser-c2.yml |
| T1098.004 Account Manipulation — SSH Authorized Keys File Modification | experimental | https://thrunt.me/sigma/t1098-004-ssh-authorized-keys-write.yml |
| T1098.005 Okta Verify Enrollment from a Hypervisor Guest | experimental | https://thrunt.me/sigma/t1098-005-hypervisor-mfa-device-enrollment.yml |
| T1102.001 Dead Drop Resolver — EtherHiding Payload Retrieval from BNB Smart Chain Testnet | experimental | https://thrunt.me/sigma/t1102-001-etherhiding-bsc-testnet-dead-drop.yml |
| T1195.002 Compromise Software Supply Chain — Malicious Google Tag Manager Container | experimental | https://thrunt.me/sigma/t1195-002-unapproved-gtm-container-injection.yml |
| T1204.004 Malicious Copy and Paste — ClickFix macOS Terminal Execution | experimental | https://thrunt.me/sigma/t1204-004-clickfix-macos-terminal-execution.yml |
| T1204.004 Malicious Copy and Paste — ClickFix Run Dialog Execution | experimental | https://thrunt.me/sigma/t1204-004-clickfix-run-dialog-execution.yml |
| T1557 Okta Authentication or MFA via a Remote-Desktop / Proxy / Tor Tunnel | experimental | https://thrunt.me/sigma/t1557-aitm-cross-asn-session-mfa.yml |
| T1557 Claims Kit First-Party Exfil — X-Enc Single-Letter C2 | experimental | https://thrunt.me/sigma/t1557-claims-kit-single-letter-c2-xenc.yml |
| T1557 Okta Verify SVG Asset Served by a Non-Okta Host | experimental | https://thrunt.me/sigma/t1557-non-okta-host-oktaverify-svg.yml |
| T1557 reCAPTCHA-Skinned Cloudflare Turnstile Gate | experimental | https://thrunt.me/sigma/t1557-recaptcha-skinned-turnstile-gate.yml |
| T1566.002 Spearphishing Link — Luxembourg Hospitality SMS Phishing Campaign | experimental | https://thrunt.me/sigma/t1566-002-luxembourg-hospitality-sms-phish.yml |
| T1574.002 DLL Side-Loading — Signed javac.exe Loading jli.dll from a User-Writable Path | experimental | https://thrunt.me/sigma/t1574-002-signed-javac-sideload-jli.yml |
| T1583.001 Resolution of a ShinyHunters .claims Impersonation Domain | experimental | https://thrunt.me/sigma/t1583-001-claims-registration-conjunction.yml |
| T1003.008 OS Credential Dumping — /etc/shadow and /etc/gshadow Access | draft | https://thrunt.meundefined |
| T1530 Data from Cloud Storage — Detection | draft | https://thrunt.meundefined |
Detection Gaps
18 of 161 techniques with corpus signal have zero detection coverage — no SigmaHQ community rule, no thrunt rule. This is the hand-authoring queue; the live view is at https://thrunt.me/corpus/attck/.
| Technique | Name | Active families | MISP | KEV |
|---|---|---|---|---|
T1011 | Exfiltration Over Other Network Medium | — | 0 | 4 |
T1497 | Virtualization/Sandbox Evasion | — | 0 | 4 |
T1573.001 | Symmetric Cryptography | — | 1 | 3 |
T1562 | — | — | 0 | 3 |
T1001 | Data Obfuscation | — | 0 | 2 |
T1499.002 | Service Exhaustion Flood | — | 0 | 2 |
T1530 | Data from Cloud Storage | — | 0 | 2 |
T1562.001 | — | — | 0 | 2 |
T1003.008 | /etc/passwd and /etc/shadow | — | 0 | 1 |
T1070.001 | — | — | 0 | 1 |
…and 8 more below the cut — full list on the rollup.
Pipeline Health
All feeds healthy.
Sources: SEC EDGAR (public domain), CISA Known Exploited Vulnerabilities (public domain), FIRST.org EPSS (per ToS), NIST NVD (public domain), GitHub Security Advisories (per ToS), abuse.ch URLhaus (CC0, attribution), ransomware.live (per ToS), MITRE ATT&CK (CC BY 4.0).
Published by Applied Cybernetics Group via thrunt.me. Heuristic cross-references are labelled as such; verify before action.