Morning Brief — 2026-10-16

1 material breach disclosures, 1 federal patching priority, 3 exploit probability movers, 10 emerging critical cves, 10 supply chain, 41 ransomware activity, 621 ioc volume, 12 active malware families, 2 multi-source iocs, 2 intel feeds, 18 hand-authored sigma, and 18 detection gaps. Sections with no signal are still rendered with an explicit “none in this window” note so absence is visible alongside presence.

Material Breach Disclosures

Park Dental Partners, Inc. (PARK)

• Filed: 2026-10-13 · CIK 0002069604 · Accession 0001104659-26-115541
• Filing: https://www.sec.gov/Archives/edgar/data/2069604/000110465926115541/park-20261007x8k.htm

As previously reported, on August 28, 2026, Park Dental Partners, Inc. (“Company”) identified unauthorized access to its computer network. The Company promptly initiated its incident response protocols, engaged external cybersecurity experts and forensic specialists and notified law enforcement. The investigation has determined that data was subject to unauthorized acquisition as a result of the i…

Federal Patching Priority

CVE-2026-21589 — Atlassian Multiple Products

Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability

• Added: 2026-10-15 · Federal due: 2026-10-18 · EPSS 86.1th pct (score 0.028) · CVSS 7.5 (HIGH) · CWE-552
• ransomware use: Unknown

Multiple Atlassian products (Bitbucket Data Center ,Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible and Fisheye) contain a files or directories accessible to external parties vulnerability which could allow an unauthenticated attacker to access specific files within the web application root directory in affected versions.

This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center. Crowd Data Center, Crucible and Fisheye. This Arbitrary File Access vulnerability allows an unauthenticated attacker to access specific files within the web application root directory in affected versions. Exploitation requires prior…

Exploit Probability Movers

Emerging Critical CVEs

• CVE-2026-94169 · CRITICAL (10.0) · 2026-10-16 — Improper Control of Generation of Code (‘Code Injection’) vulnerability in Theme-one The Grid the-grid allows Command Injection.This issue affects The Grid: from n/a through 2.8.1.
• CVE-2026-110958 · CRITICAL (10.0) · 2026-10-15 — A vulnerability was found in Wavlink WN530HG4B M30HG4B_V260724. The impacted element is an unknown function of the file api.cgi. The manipulation results in heap-based buffer overflow. It is possible to launch the attack…
• CVE-2026-110957 · CRITICAL (10.0) · 2026-10-15 — A vulnerability has been found in Wavlink WL-WN530BE2-A up to M30BE2_V250604. The affected element is the function sub_12580 of the file api.cgi of the component Login Processing. The manipulation of the argument REMOTE_…
• CVE-2026-105037 · CRITICAL (9.9) · 2026-10-15 — EnergizeLab station-middleware (NestJS) Docker images 1.6.5 through 1.8.2 allow any registered, low-privilege account to read arbitrary files from the server by supplying an attacker-controlled file path. This exposes mi…
• CVE-2026-110812 · CRITICAL (9.9) · 2026-10-15 — Deserialization of untrusted data in the Gremlin graph data import component in Amazon Neptune engine might allow an authenticated remote actor with standard database permissions to execute arbitrary code and access inte…
• CVE-2026-57155 · CRITICAL (9.9) · 2026-10-15 — OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the Firewall Alias GeoIP importer’s process_zip() and process_gzip() paths in src/opnsense/scripts/filter/lib/alias/geoip.py use an unv…
• CVE-2026-104730 · CRITICAL (9.8) · 2026-10-16 — The Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.7.4 via deserialization of untrusted in…
• CVE-2026-89079 · CRITICAL (9.8) · 2026-10-16 — The Theme My Login plugin for WordPress is vulnerable to privilege escalation via account takeover in versions up to, and including, 7.2.1. This is due to the plugin not properly validating a user’s identity prior to upd…
• CVE-2026-103768 · CRITICAL (9.8) · 2026-10-16 — The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.3.7 via the initMailPart function. This is due to insufficient f…
• CVE-2026-109515 · CRITICAL (9.8) · 2026-10-16 — The MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc. plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2.78.6 This is due to the `sub…

Supply Chain

GHSA-qx66-fv34-fjm8 · CVE-2026-102989 (npm)

• CRITICAL · CVSS 9.3 · 2026-10-15
• Affected: @tanstack/start-server-core, @tanstack/react-start, @tanstack/solid-start
• https://github.com/advisories/GHSA-qx66-fv34-fjm8

TanStack Router: Unauthenticated reflected XSS in TanStack Start server-function responses

GHSA-2cvf-wqm6-wr9g · CVE-2026-94603 (go)

• CRITICAL · CVSS 10.0 · 2026-10-15
• Affected: github.com/containers/podman, go.podman.io/podman/v6
• https://github.com/advisories/GHSA-2cvf-wqm6-wr9g

Podman: The podman run command can be instructed to disable almost all sandboxing by image annotation

GHSA-pq7j-f95f-qfcv · CVE-2026-86063 (npm)

• HIGH · 2026-10-15
• Affected: @anthropic-ai/claude-code
• https://github.com/advisories/GHSA-pq7j-f95f-qfcv

Claude Code: Plugin Hash Pin Bypass Allows Bypass of Hash Pinning

GHSA-x586-xvc8-g7q6 · CVE-2026-84994 (npm)

• HIGH · 2026-10-15
• Affected: @builder.io/qwik, @qwik.dev/core
• https://github.com/advisories/GHSA-x586-xvc8-g7q6

Qwik: Crashing any Qwik Server via Resource thenable

GHSA-p7v4-vr35-mj6f · CVE-2026-95837 (go)

• HIGH · CVSS 7.8 · 2026-10-15
• Affected: github.com/containerd/containerd/v2, github.com/containerd/containerd/v2
• https://github.com/advisories/GHSA-p7v4-vr35-mj6f

containerd CRI plugin: Checkpoint restore bypasses destination security context

GHSA-vrcc-3ch7-hppw · CVE-2026-100353 (go)

• HIGH · CVSS 7.5 · 2026-10-15
• Affected: github.com/getkin/kin-openapi
• https://github.com/advisories/GHSA-vrcc-3ch7-hppw

kin-openapi: Incomplete Fix for GHSA-p6wj-qrr4-pgh5: Three Unpatched nil-Items Panic Paths in openapi3filter

GHSA-g8cf-rcjf-c8cf · CVE-2026-100354 (go)

• HIGH · CVSS 7.5 · 2026-10-15
• Affected: github.com/getkin/kin-openapi
• https://github.com/advisories/GHSA-g8cf-rcjf-c8cf

kin-openapi: Uncontrolled Recursion on Circular allOf/anyOf/oneOf Schemas Causes Fatal Process Crash

GHSA-rj39-cv6w-8wv7 · CVE-2026-100352 (go)

• HIGH · CVSS 7.5 · 2026-10-15
• Affected: github.com/getkin/kin-openapi
• https://github.com/advisories/GHSA-rj39-cv6w-8wv7

kin-openapi: YAML NaN/Inf Values Bypass Built-in Guards and Panic via OAS 3.1 Validation Path

GHSA-637c-6jxx-4rwm · CVE-2026-77524 (go)

• CRITICAL · CVSS 9.9 · 2026-10-15
• Affected: github.com/kedacore/keda, github.com/kedacore/keda/v2
• https://github.com/advisories/GHSA-637c-6jxx-4rwm

KEDA: Privilege escalation from namespace admin to cluster admin via KEDA TriggerAuthentication

GHSA-fmxq-cgp8-87wp · CVE-2026-77459 (go)

• CRITICAL · CVSS 9.9 · 2026-10-15
• Affected: github.com/argoproj/argo-cd/v2, github.com/argoproj/argo-cd/v3, github.com/argoproj/argo-cd/v3
• https://github.com/advisories/GHSA-fmxq-cgp8-87wp

Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks

Ransomware Activity

41 new victim postings across 10 groups.

IOC Volume

621 new IOCs in this window. By source:

Recent OSINT Events

No curated MISP events in this window (bulk-IOC contributions tallied in IOC Volume).

Active Malware Families

12 malware families active this week (1 corroborated across ≥2 sources), exercising 20 ATT&CK techniques. Family is the unit, not the indicator: the raw IOCs are drill-down evidence below, not the signal.

Families marked ”→” are delivery/social-engineering clusters (ClickFix, GuLoader, Amadey). Their technique mappings are the delivery chain — downstream behavior is payload-dependent, so they don’t open a hard coverage gap on their own.

Multi-Source IOCs

2 IOCs flagged by 2+ independent sources this window — the highest-confidence signal the cross-feed corpus produces.

MISP × KEV Correlation

No MISP events in this window referenced a CVE.

Cross-Reference

No SEC × KEV vendor token matches in this window. (This is a heuristic surface, absence is expected most days.)

Intel Feeds

2 IOC feeds updated this run (4,183 indicators total) — each available as CSV, MISP JSON, and STIX 2.1. Subscribe at https://thrunt.me/intel/manifest.json.

Hand-Authored Sigma

16 production-ready TTP rules (+2 scaffolds in the authoring queue) live at https://thrunt.me/sigma/manifest.json. Subscribe via https://thrunt.me/sigma/rules.lock.json (content-hash churn) or pull all with https://thrunt.me/sigma/rules.tar.gz.

Detection Gaps

18 of 161 techniques with corpus signal have zero detection coverage — no SigmaHQ community rule, no thrunt rule. This is the hand-authoring queue; the live view is at https://thrunt.me/corpus/attck/.

…and 8 more below the cut — full list on the rollup.

Pipeline Health

All feeds healthy.

Sources: SEC EDGAR (public domain), CISA Known Exploited Vulnerabilities (public domain), FIRST.org EPSS (per ToS), NIST NVD (public domain), GitHub Security Advisories (per ToS), abuse.ch URLhaus (CC0, attribution), ransomware.live (per ToS), MITRE ATT&CK (CC BY 4.0).

Published by Applied Cybernetics Group via thrunt.me. Heuristic cross-references are labelled as such; verify before action.