Morning Brief — 2026-10-19

1 material breach disclosures, 10 emerging critical cves, 18 ransomware activity, 664 ioc volume, 11 active malware families, 1 multi-source iocs, 2 intel feeds, 18 hand-authored sigma, and 19 detection gaps. Sections with no signal are still rendered with an explicit “none in this window” note so absence is visible alongside presence.

Material Breach Disclosures

Park Dental Partners, Inc. (PARK)

• Filed: 2026-10-13 · CIK 0002069604 · Accession 0001104659-26-115541
• Filing: https://www.sec.gov/Archives/edgar/data/2069604/000110465926115541/park-20261007x8k.htm

As previously reported, on August 28, 2026, Park Dental Partners, Inc. (“Company”) identified unauthorized access to its computer network. The Company promptly initiated its incident response protocols, engaged external cybersecurity experts and forensic specialists and notified law enforcement. The investigation has determined that data was subject to unauthorized acquisition as a result of the i…

Federal Patching Priority

No new KEV additions in this window.

Exploit Probability Movers

No CVEs with ≥0.20 EPSS movement in this window.

Emerging Critical CVEs

• CVE-2026-108983 · CRITICAL (9.8) · 2026-10-19 — A vulnerability is in Web Server default connection ports under the process name GeoWebServer.exe .
• CVE-2026-111998 · CRITICAL (9.8) · 2026-10-18 — Vanus 0.8.0 through 0.9.0 contains a default credentials vulnerability that allows unauthenticated remote attackers to gain cluster-admin access by using the hardcoded admin token. Attackers can send the fixed Bearer tok…
• CVE-2026-110886 · CRITICAL (9.8) · 2026-10-18 — Deserialization of Untrusted Data vulnerability in QuantumCloud Conversational Forms for ChatBot conversational-forms allows Object Injection.This issue affects Conversational Forms for ChatBot: from n/a through 1.5.1.
• CVE-2026-110372 · CRITICAL (9.8) · 2026-10-18 — Incorrect Privilege Assignment vulnerability in Brainstorm Force OttoKit suretriggers allows Privilege Escalation.This issue affects OttoKit: from n/a through 1.1.40.
• CVE-2026-109894 · CRITICAL (9.3) · 2026-10-18 — Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in Arraytics Booktics booktics allows SQL Injection.This issue affects Booktics: from n/a through 1.0.29.
• CVE-2026-107436 · HIGH (8.8) · 2026-10-18 — Deserialization of Untrusted Data vulnerability in WP Chill Strong Testimonials strong-testimonials allows Object Injection.This issue affects Strong Testimonials: from n/a through 3.3.12.
• CVE-2026-110895 · HIGH (8.5) · 2026-10-18 — Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in DevItems Support Genix support-genix-lite allows SQL Injection.This issue affects Support Genix: from n/a through 1.4.…
• CVE-2026-16487 · HIGH (8.1) · 2026-10-19 — A flaw was found in bootc when operating with the default containers signature policy. Automatic or manual upgrades of a mutable image tag may apply unsigned content for registries that fall through to insecureAcceptAnyt…
• CVE-2026-111441 · HIGH (8.1) · 2026-10-19 — 在 openGauss-server 的 src/gausskernel/cbb/utils/hll/hll.cpp 中，内置函数 HllObjectUnpack() 存在长度校验缺陷。该函数从用户提供的 packed HLL 解析 lenUsed 与 lenTotal 后，仅检查输入长度足以覆盖 HLL_HEAD_SIZE + lenUsed，随后按 lenTotal 分配缓冲区、按 lenUsed 调用 memcpy_s() 拷贝输…
• CVE-2026-110373 · HIGH (8.1) · 2026-10-18 — Incorrect Privilege Assignment vulnerability in Hamid Alinia Login with phone number login-with-phone-number allows Privilege Escalation.This issue affects Login with phone number: from n/a through 1.8.77.

Supply Chain

No high/critical GHSA advisories in this window.

Ransomware Activity

18 new victim postings across 7 groups.

IOC Volume

664 new IOCs in this window. By source:

Recent OSINT Events

No curated MISP events in this window (bulk-IOC contributions tallied in IOC Volume).

Active Malware Families

11 malware families active this week (0 corroborated across ≥2 sources), exercising 21 ATT&CK techniques — 1 of them with no detection coverage. Family is the unit, not the indicator: the raw IOCs are drill-down evidence below, not the signal.

Families marked ”→” are delivery/social-engineering clusters (ClickFix, Amadey, GuLoader). Their technique mappings are the delivery chain — downstream behavior is payload-dependent, so they don’t open a hard coverage gap on their own.

Multi-Source IOCs

1 IOC flagged by 2+ independent sources this window — the highest-confidence signal the cross-feed corpus produces.

MISP × KEV Correlation

No MISP events in this window referenced a CVE.

Cross-Reference

No SEC × KEV vendor token matches in this window. (This is a heuristic surface, absence is expected most days.)

Intel Feeds

2 IOC feeds updated this run (3,400 indicators total) — each available as CSV, MISP JSON, and STIX 2.1. Subscribe at https://thrunt.me/intel/manifest.json.

Hand-Authored Sigma

16 production-ready TTP rules (+2 scaffolds in the authoring queue) live at https://thrunt.me/sigma/manifest.json. Subscribe via https://thrunt.me/sigma/rules.lock.json (content-hash churn) or pull all with https://thrunt.me/sigma/rules.tar.gz.

Detection Gaps

19 of 162 techniques with corpus signal have zero detection coverage — no SigmaHQ community rule, no thrunt rule. 1 is actively exercised by malware families this week. This is the hand-authoring queue; the live view is at https://thrunt.me/corpus/attck/.

…and 9 more below the cut — full list on the rollup.

Pipeline Health

All feeds healthy.

Sources: SEC EDGAR (public domain), CISA Known Exploited Vulnerabilities (public domain), FIRST.org EPSS (per ToS), NIST NVD (public domain), GitHub Security Advisories (per ToS), abuse.ch URLhaus (CC0, attribution), ransomware.live (per ToS), MITRE ATT&CK (CC BY 4.0).

Published by Applied Cybernetics Group via thrunt.me. Heuristic cross-references are labelled as such; verify before action.