October 17, 2026 · Applied Cybernetics Group
Morning Brief — October 17, 2026
Morning Brief — 2026-10-17
1 material breach disclosures, 2 federal patching priority, 1 exploit probability movers, 10 emerging critical cves, 7 supply chain, 33 ransomware activity, 541 ioc volume, 11 active malware families, 2 multi-source iocs, 2 intel feeds, 18 hand-authored sigma, and 18 detection gaps. Sections with no signal are still rendered with an explicit “none in this window” note so absence is visible alongside presence.
Material Breach Disclosures
Park Dental Partners, Inc. (PARK)
- Filed: 2026-10-13 · CIK 0002069604 · Accession
0001104659-26-115541 - Filing: https://www.sec.gov/Archives/edgar/data/2069604/000110465926115541/park-20261007x8k.htm
As previously reported, on August 28, 2026, Park Dental Partners, Inc. (“Company”) identified unauthorized access to its computer network. The Company promptly initiated its incident response protocols, engaged external cybersecurity experts and forensic specialists and notified law enforcement. The investigation has determined that data was subject to unauthorized acquisition as a result of the i…
Federal Patching Priority
CVE-2026-102764 — BeyondTrust Remote Support
BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability
- Added: 2026-10-16 · Federal due: 2026-10-19 · EPSS 47.6th pct (score 0.006) · CVSS 9.8 (CRITICAL) · CWE-290
- ransomware use: Unknown
BeyondTrust Remote Support contains an authentication bypass by spoofing vulnerability that could allow a remote attacker to perform file operations on the appliance.
The vulnerability exists within internal components of BeyondTrust’s Remote Support product. The components did not adequately validate the origin of the messages it received. Under the right conditions, this could allow an attacker to perform file operations on the appliance.
CVE-2025-61624 — Fortinet Multiple Products
Fortinet Multiple Products Path Traversal Vulnerability
- Added: 2026-10-16 · Federal due: 2026-10-19 · EPSS 46.6th pct (score 0.006) · CVSS 6.0 (MEDIUM) · CWE-22
- ransomware use: Unknown
FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager contain a path traversal vulnerability that may allow an authenticated attacker with admin profile and at least read-write permissions to write or delete arbitrary files via specific CLI commands.
An Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’) [CWE-22] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiPAM 1.7.0, FortiPAM 1.6 all versions, FortiPAM 1.5 all versions, FortiPAM 1.4 all versions, FortiPAM 1.3 all versions, FortiPAM 1.2 all…
Exploit Probability Movers
| CVE | Today | Prev | Δ | In KEV |
|---|---|---|---|---|
CVE-2026-43284 | 0.942 | 0.025 | ▲ 0.917 |
Emerging Critical CVEs
CVE-2026-95182· CRITICAL (10.0) · 2026-10-16 — An untrusted search path in DeepSeek Harness (dsh) commit c291e796 allows attackers to execute arbitrary code via supplying and opening crafted executable files in place of legitimate content.CVE-2026-92262· CRITICAL (9.9) · 2026-10-16 — MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the #mysql50# bypass prefix is affected because it allows the #mysql50# prefix to by…CVE-2026-85748· CRITICAL (9.9) · 2026-10-16 — MariaDB server is a community developed fork of MySQL server. From 12.3.1 until 12.3.3 and 13.0.2, SYS_REFCURSOR handling is affected because cursor-array reallocation can leave stale references in routine contexts. A lo…CVE-2026-85746· CRITICAL (9.9) · 2026-10-16 — MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, ST_AsText can write beyond an allocated output buffer when converting deeply nested…CVE-2026-104736· CRITICAL (9.8) · 2026-10-17 — The LearnPress plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 4.4.10 via deserialization of untrusted input from the ‘checkout-email’ request parameter during the checkout AJ…CVE-2026-111823· CRITICAL (9.8) · 2026-10-17 — Mage OSS through 0.9.80 before 76c4f46 can proceed with session creation upon encountering an unknown OAuth provider.CVE-2026-111711· CRITICAL (9.8) · 2026-10-16 — Netcore NR256CN through 1.5.140116 contains a pre-authentication stack overflow vulnerability in the Boa web server’s user_ok() function, which copies Basic-auth usernames with unbounded strcpy() calls into 64-byte stack…CVE-2026-111708· CRITICAL (9.8) · 2026-10-16 — WhaTicket Community through commit cf04795 contains an authentication bypass vulnerability that allows unauthenticated attackers to self-register as administrators via POST /auth/signup. Attackers can omit the profile fi…CVE-2026-111704· CRITICAL (9.8) · 2026-10-16 — LangChat through commit 2a6285a contains a missing authentication vulnerability that allows unauthenticated remote attackers to access REST controllers because no Sa-Token interceptor is registered. Attackers can query /…CVE-2026-111693· CRITICAL (9.8) · 2026-10-16 — DataBuff ai-apm-web through 0.1.10 contains a hard-coded default credentials vulnerability that allows unauthenticated attackers to gain administrator access using the built-in admin/Databuff@123 account. Attackers can P…
Supply Chain
GHSA-pw5q-rjx4-7f7p · CVE-2026-96627 (go)
- HIGH · CVSS 8.8 · 2026-10-16
- Affected:
github.com/getarcaneapp/arcane/backend/v2 - https://github.com/advisories/GHSA-pw5q-rjx4-7f7p
Arcane: Delegated users:update permission allows admin account takeover via password reset (no privilege-hierarchy check)
GHSA-w5f2-9q9c-ff4h · CVE-2026-105192 (pip)
- CRITICAL · CVSS 9.8 · 2026-10-16
- Affected:
lmcache - https://github.com/advisories/GHSA-w5f2-9q9c-ff4h
LMCache: Remote code execution via unsafe deserialization in multiprocess mode transport
GHSA-74vm-87hj-r66f · CVE-2026-100349 (go)
- HIGH · 2026-10-16
- Affected:
github.com/getkin/kin-openapi - https://github.com/advisories/GHSA-74vm-87hj-r66f
kin-openapi openapi3filter: nil-pointer panic in ValidateResponse on a response header declared with content
GHSA-6fj4-rcr3-r7rr (rust)
- HIGH · CVSS 7.5 · 2026-10-16
- Affected:
lopdf - https://github.com/advisories/GHSA-6fj4-rcr3-r7rr
lopdf has a stack overflow via deeply nested PDF objects
GHSA-rxjv-24xq-76wc · CVE-2026-102834 (maven)
- HIGH · CVSS 7.5 · 2026-10-16
- Affected:
org.bytedeco:javacv - https://github.com/advisories/GHSA-rxjv-24xq-76wc
JavaCV: Integer Overflow in IPCameraFrameGrabber Causes Infinite-Loop DoS
GHSA-h4mw-j7qp-8mwm · CVE-2026-96620 (pip)
- CRITICAL · 2026-10-16
- Affected:
claude-agent-sdk - https://github.com/advisories/GHSA-h4mw-j7qp-8mwm
Claude Agent SDK: Argument Injection via resume Option Allows Arbitrary Command Execution
GHSA-cv23-7vc5-jfh7 · CVE-2026-102941 (go)
- HIGH · CVSS 7.5 · 2026-10-16
- Affected:
github.com/gomarkdown/markdown - https://github.com/advisories/GHSA-cv23-7vc5-jfh7
gomarkdown/markdown IsSafeURL panics on short URLs
Ransomware Activity
33 new victim postings across 8 groups.
| Group | Victims | Sample |
|---|---|---|
N0n | 17 | Company #86, Company #85, Company #84, Prafesta Ind. e Com. de Embalagens Ltda, … |
everest | 4 | Kissei Shoji, Chugoku Bend, Taekwang Network, Brenner Base Tunnel |
play | 4 | WSBI-ESBG, New Tec Tool Limited, MicroSearch Corporation, Pure Options |
pear | 3 | Macfarlan Capital Partners, Solar Communications International, Caretaker Landsc… |
Redact | 2 | ONEOK, Inc., Parker-Hannifin Corporation |
Vexy Ransomware | 1 | Data-Core Systems |
Wallstreet | 1 | Girl Scouts of Eastern Massachusetts |
bravox | 1 | Minkon |
IOC Volume
541 new IOCs in this window. By source:
| Source | Count |
|---|---|
urlhaus | 541 |
Recent OSINT Events
No curated MISP events in this window (bulk-IOC contributions tallied in IOC Volume).
Active Malware Families
11 malware families active this week (1 corroborated across ≥2 sources), exercising 19 ATT&CK techniques. Family is the unit, not the indicator: the raw IOCs are drill-down evidence below, not the signal.
| Family | Type | Corrob. | IOCs | Techniques (✗ = coverage gap) |
|---|---|---|---|---|
| ConnectWise ScreenConnect (abuse) | rmm-abuse | ✓ | 2 | T1219 |
| ClickFix | delivery → | — | 43 | T1059.001, T1204 |
| Mirai | botnet | — | 16 | T1110, T1498, T1499, T1584.005 |
| AMOS (Atomic macOS Stealer) | stealer | — | 12 | T1005, T1056.002, T1071, T1555.001 |
| AsyncRAT | rat | — | 12 | T1056.001, T1059.001, T1071, T1219 |
| SilverFox | rat | — | 12 | T1059, T1071, T1219 |
| CoinMiner | miner | — | 7 | T1496 |
| AgentTesla | stealer | — | 5 | T1056.001, T1071, T1114, T1555 |
| Amadey | loader → | — | 2 | T1071, T1105, T1547 |
| Formbook | stealer | — | 2 | T1005, T1056.001, T1071, T1555 |
| GuLoader | loader → | — | 2 | T1027, T1071, T1105 |
Families marked ”→” are delivery/social-engineering clusters (ClickFix, Amadey, GuLoader). Their technique mappings are the delivery chain — downstream behavior is payload-dependent, so they don’t open a hard coverage gap on their own.
Multi-Source IOCs
2 IOCs flagged by 2+ independent sources this window — the highest-confidence signal the cross-feed corpus produces.
| IOC | Type | Sources | Last seen |
|---|---|---|---|
example.com | domain | misp + urlhaus | 2026-10-17 |
swervimgbackj.top | domain | misp + urlhaus | 2026-10-17 |
MISP × KEV Correlation
No MISP events in this window referenced a CVE.
Cross-Reference
No SEC × KEV vendor token matches in this window. (This is a heuristic surface, absence is expected most days.)
Intel Feeds
2 IOC feeds updated this run (3,983 indicators total) — each available as CSV, MISP JSON, and STIX 2.1. Subscribe at https://thrunt.me/intel/manifest.json.
| Feed | Source | Type | Count | Downloads |
|---|---|---|---|---|
| URLhaus — Malware Distribution URLs | urlhaus | url | 3,813 | CSV · MISP · STIX |
| URLhaus — Malware Distribution Domains | urlhaus | domain | 170 | CSV · MISP · STIX |
Hand-Authored Sigma
16 production-ready TTP rules (+2 scaffolds in the authoring queue) live at https://thrunt.me/sigma/manifest.json. Subscribe via https://thrunt.me/sigma/rules.lock.json (content-hash churn) or pull all with https://thrunt.me/sigma/rules.tar.gz.
| Rule | Status | YAML |
|---|---|---|
| T1037 Boot or Logon Initialization Scripts — Linux Init Script Modification | experimental | https://thrunt.me/sigma/t1037-linux-init-script-modification.yml |
| T1055 Process Injection — Rundll32 Spawning Explorer as an Injection Host | experimental | https://thrunt.me/sigma/t1055-rundll32-spawning-explorer-injection.yml |
| T1071.004 DNS-over-HTTPS Resolution from a Non-Browser Process | experimental | https://thrunt.me/sigma/t1071-004-doh-resolver-non-browser-c2.yml |
| T1098.004 Account Manipulation — SSH Authorized Keys File Modification | experimental | https://thrunt.me/sigma/t1098-004-ssh-authorized-keys-write.yml |
| T1098.005 Okta Verify Enrollment from a Hypervisor Guest | experimental | https://thrunt.me/sigma/t1098-005-hypervisor-mfa-device-enrollment.yml |
| T1102.001 Dead Drop Resolver — EtherHiding Payload Retrieval from BNB Smart Chain Testnet | experimental | https://thrunt.me/sigma/t1102-001-etherhiding-bsc-testnet-dead-drop.yml |
| T1195.002 Compromise Software Supply Chain — Malicious Google Tag Manager Container | experimental | https://thrunt.me/sigma/t1195-002-unapproved-gtm-container-injection.yml |
| T1204.004 Malicious Copy and Paste — ClickFix macOS Terminal Execution | experimental | https://thrunt.me/sigma/t1204-004-clickfix-macos-terminal-execution.yml |
| T1204.004 Malicious Copy and Paste — ClickFix Run Dialog Execution | experimental | https://thrunt.me/sigma/t1204-004-clickfix-run-dialog-execution.yml |
| T1557 Okta Authentication or MFA via a Remote-Desktop / Proxy / Tor Tunnel | experimental | https://thrunt.me/sigma/t1557-aitm-cross-asn-session-mfa.yml |
| T1557 Claims Kit First-Party Exfil — X-Enc Single-Letter C2 | experimental | https://thrunt.me/sigma/t1557-claims-kit-single-letter-c2-xenc.yml |
| T1557 Okta Verify SVG Asset Served by a Non-Okta Host | experimental | https://thrunt.me/sigma/t1557-non-okta-host-oktaverify-svg.yml |
| T1557 reCAPTCHA-Skinned Cloudflare Turnstile Gate | experimental | https://thrunt.me/sigma/t1557-recaptcha-skinned-turnstile-gate.yml |
| T1566.002 Spearphishing Link — Luxembourg Hospitality SMS Phishing Campaign | experimental | https://thrunt.me/sigma/t1566-002-luxembourg-hospitality-sms-phish.yml |
| T1574.002 DLL Side-Loading — Signed javac.exe Loading jli.dll from a User-Writable Path | experimental | https://thrunt.me/sigma/t1574-002-signed-javac-sideload-jli.yml |
| T1583.001 Resolution of a ShinyHunters .claims Impersonation Domain | experimental | https://thrunt.me/sigma/t1583-001-claims-registration-conjunction.yml |
| T1003.008 OS Credential Dumping — /etc/shadow and /etc/gshadow Access | draft | https://thrunt.meundefined |
| T1530 Data from Cloud Storage — Detection | draft | https://thrunt.meundefined |
Detection Gaps
18 of 160 techniques with corpus signal have zero detection coverage — no SigmaHQ community rule, no thrunt rule. This is the hand-authoring queue; the live view is at https://thrunt.me/corpus/attck/.
| Technique | Name | Active families | MISP | KEV |
|---|---|---|---|---|
T1011 | Exfiltration Over Other Network Medium | — | 0 | 4 |
T1497 | Virtualization/Sandbox Evasion | — | 0 | 4 |
T1573.001 | Symmetric Cryptography | — | 1 | 3 |
T1562 | — | — | 0 | 3 |
T1001 | Data Obfuscation | — | 0 | 2 |
T1499.002 | Service Exhaustion Flood | — | 0 | 2 |
T1530 | Data from Cloud Storage | — | 0 | 2 |
T1562.001 | — | — | 0 | 2 |
T1003.008 | /etc/passwd and /etc/shadow | — | 0 | 1 |
T1070.001 | — | — | 0 | 1 |
…and 8 more below the cut — full list on the rollup.
Pipeline Health
All feeds healthy.
Sources: SEC EDGAR (public domain), CISA Known Exploited Vulnerabilities (public domain), FIRST.org EPSS (per ToS), NIST NVD (public domain), GitHub Security Advisories (per ToS), abuse.ch URLhaus (CC0, attribution), ransomware.live (per ToS), MITRE ATT&CK (CC BY 4.0).
Published by Applied Cybernetics Group via thrunt.me. Heuristic cross-references are labelled as such; verify before action.