October 20, 2026 · Applied Cybernetics Group
Morning Brief — October 20, 2026
Morning Brief — 2026-10-20
1 material breach disclosures, 10 emerging critical cves, 5 supply chain, 29 ransomware activity, 777 ioc volume, 11 active malware families, 1 multi-source iocs, 2 intel feeds, 18 hand-authored sigma, and 19 detection gaps. Sections with no signal are still rendered with an explicit “none in this window” note so absence is visible alongside presence.
Material Breach Disclosures
Park Dental Partners, Inc. (PARK)
- Filed: 2026-10-13 · CIK 0002069604 · Accession
0001104659-26-115541 - Filing: https://www.sec.gov/Archives/edgar/data/2069604/000110465926115541/park-20261007x8k.htm
As previously reported, on August 28, 2026, Park Dental Partners, Inc. (“Company”) identified unauthorized access to its computer network. The Company promptly initiated its incident response protocols, engaged external cybersecurity experts and forensic specialists and notified law enforcement. The investigation has determined that data was subject to unauthorized acquisition as a result of the i…
Federal Patching Priority
No new KEV additions in this window.
Exploit Probability Movers
No CVEs with ≥0.20 EPSS movement in this window.
Emerging Critical CVEs
CVE-2026-111057· CRITICAL (10.0) · 2026-10-19 — Mercury is a Python framework for sharing Jupyter notebooks as web applications and dashboards. From 3.0.0 until 3.2.4, a missing comma in BLOCKED_PATTERNS concatenates the /lab and /api/terminals regular-expression lite…CVE-2026-112371· CRITICAL (9.9) · 2026-10-19 — A vulnerability was determined in H3C Magic NX15 NX15V100R017. Impacted is the function write of the file /api/esps of the component RPC Interface. Executing a manipulation of the argument path can lead to code injection…CVE-2026-112370· CRITICAL (9.9) · 2026-10-19 — A vulnerability was found in H3C Magic NX15 100R017. This issue affects the function sub_416874 of the file /usr/bin/usrlist. Performing a manipulation results in os command injection. Remote exploitation of the attack i…CVE-2026-111406· CRITICAL (9.9) · 2026-10-19 — Unrestricted Upload of File with Dangerous Type vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactive-vector-maps allows Upload a Web Shell to a Web Server.This issue affects MapSVG: from n/a throu…CVE-2026-110887· CRITICAL (9.9) · 2026-10-19 — Improper Control of Generation of Code (‘Code Injection’) vulnerability in HivePress HivePress hivepress allows Remote Code Inclusion.This issue affects HivePress: from n/a through 1.7.32.CVE-2026-77936· CRITICAL (9.8) · 2026-10-20 — Letta through 0.16.8 ships a compose.yaml that does not enable LETTA_SERVER_SECURE, so the password middleware is never added and all API routes are unauthenticated, and it exposes a superuser PostgreSQL port with defaul…CVE-2026-77933· CRITICAL (9.8) · 2026-10-20 — DB-GPT through 0.8.2 contains a hardcoded credentials vulnerability in its default docker-compose.yml that sets a static MYSQL_ROOT_PASSWORD and publishes port 3306 on all interfaces. Attackers reaching port 3306 or the…CVE-2026-77932· CRITICAL (9.8) · 2026-10-20 — DB-GPT through 0.8.2 contains an unauthenticated remote code execution vulnerability because the /api/v1/chat/react-agent endpoint relies on a mock get_user_from_headers function that grants every caller the admin role.…CVE-2026-75128· CRITICAL (9.8) · 2026-10-20 — Langchain-Chatchat through 0.3.1.3 exposes a POST /tools/call API endpoint that invokes any registered tool by name without authentication, leaving the always-registered shell tool callable. Remote attackers can send a s…CVE-2026-109442· CRITICAL (9.8) · 2026-10-20 — piflow 2.0.0 through 2.0.1 contains a remote code execution vulnerability in its DeepAgents chat agent, whose POST /chat and POST /chat/stream endpoints lack authentication. Attackers can instruct the agent to call the e…
Supply Chain
GHSA-5wr8-gcqf-gqf3 · CVE-2026-111064 (pip)
- HIGH · 2026-10-19
- Affected:
aiohttp - https://github.com/advisories/GHSA-5wr8-gcqf-gqf3
aiohttp server lacks an initial request/header timeout
GHSA-2g87-pp6c-29x5 (pip)
- HIGH · 2026-10-19
- Affected:
aiohttp - https://github.com/advisories/GHSA-2g87-pp6c-29x5
aiohttp: Multiple instances of excessive or unbounded memory/CPU use
GHSA-f8c7-rwf9-fmgm · CVE-2026-111057 (pip)
- CRITICAL · CVSS 10.0 · 2026-10-19
- Affected:
mercury - https://github.com/advisories/GHSA-f8c7-rwf9-fmgm
Mercury: Unauthenticated Remote Code Execution in /api/terminals - access control bypass
GHSA-rv4m-xm3f-3ccq · CVE-2026-111058 (pip)
- CRITICAL · CVSS 9.8 · 2026-10-19
- Affected:
mercury - https://github.com/advisories/GHSA-rv4m-xm3f-3ccq
Mercury: Unauthenticated Remote Code Execution via /api/kernels
GHSA-vx2m-gpq4-8j5q · CVE-2026-108372 (pip)
- HIGH · 2026-10-19
- Affected:
loopx - https://github.com/advisories/GHSA-vx2m-gpq4-8j5q
LoopX serve-status permissive CORS policy exposes control-plane state and private Markdown files
Ransomware Activity
29 new victim postings across 12 groups.
| Group | Victims | Sample |
|---|---|---|
qilin | 9 | GardaWorld, Toyota Canarias, WalkingTree Technologies, SkyWorld Air Cargo, Johns… |
N0n | 8 | Company #97, Company #96, Company #95, Vormittag Associates Inc, Froggys Fog, Ho… |
Global Secret Group | 2 | Rosenberg & Pittinsky, Seminole Schools |
payload | 2 | BW Office World, Brüninghoff Group |
Redact | 1 | Baker Donelson |
SilentRansomGroup | 1 | Latham & Watkins |
anubis | 1 | Fisher59 |
emperador | 1 | GTL Concreto e Logística LTDA |
fulcrumsec | 1 | PingCAP / TiDB Cloud |
incransom | 1 | Seetelhotels.de |
lockbit5 | 1 | chooseultimate.com |
nitrogen | 1 | Walbro |
IOC Volume
777 new IOCs in this window. By source:
| Source | Count |
|---|---|
urlhaus | 777 |
Recent OSINT Events
No curated MISP events in this window (bulk-IOC contributions tallied in IOC Volume).
Active Malware Families
11 malware families active this week (0 corroborated across ≥2 sources), exercising 21 ATT&CK techniques — 1 of them with no detection coverage. Family is the unit, not the indicator: the raw IOCs are drill-down evidence below, not the signal.
| Family | Type | Corrob. | IOCs | Techniques (✗ = coverage gap) |
|---|---|---|---|---|
| Mirai | botnet | — | 1,318 | T1110, T1498, T1499, T1584.005 |
| ClickFix | delivery → | — | 36 | T1059.001, T1204 |
| AMOS (Atomic macOS Stealer) | stealer | — | 25 | T1005, T1056.002, T1071, T1555.001 |
| CoinMiner | miner | — | 16 | T1496 |
| Amadey | loader → | — | 12 | T1071, T1105, T1547 |
| AsyncRAT | rat | — | 8 | T1056.001, T1059.001, T1071, T1219 |
| ConnectWise ScreenConnect (abuse) | rmm-abuse | — | 8 | T1219 |
| SilverFox | rat | — | 8 | T1059, T1071, T1219 |
| Remcos | rat | — | 5 | T1056.001, T1071, T1113 |
| GuLoader | loader → | — | 2 | T1027, T1071, T1105 |
| Kinsing | miner | — | 2 | T1059.004, T1190, T1496, T1610 ✗ |
Families marked ”→” are delivery/social-engineering clusters (ClickFix, Amadey, GuLoader). Their technique mappings are the delivery chain — downstream behavior is payload-dependent, so they don’t open a hard coverage gap on their own.
Multi-Source IOCs
1 IOC flagged by 2+ independent sources this window — the highest-confidence signal the cross-feed corpus produces.
| IOC | Type | Sources | Last seen |
|---|---|---|---|
example.com | domain | misp + urlhaus | 2026-10-20 |
MISP × KEV Correlation
No MISP events in this window referenced a CVE.
Cross-Reference
No SEC × KEV vendor token matches in this window. (This is a heuristic surface, absence is expected most days.)
Intel Feeds
2 IOC feeds updated this run (3,633 indicators total) — each available as CSV, MISP JSON, and STIX 2.1. Subscribe at https://thrunt.me/intel/manifest.json.
| Feed | Source | Type | Count | Downloads |
|---|---|---|---|---|
| URLhaus — Malware Distribution URLs | urlhaus | url | 3,488 | CSV · MISP · STIX |
| URLhaus — Malware Distribution Domains | urlhaus | domain | 145 | CSV · MISP · STIX |
Hand-Authored Sigma
16 production-ready TTP rules (+2 scaffolds in the authoring queue) live at https://thrunt.me/sigma/manifest.json. Subscribe via https://thrunt.me/sigma/rules.lock.json (content-hash churn) or pull all with https://thrunt.me/sigma/rules.tar.gz.
| Rule | Status | YAML |
|---|---|---|
| T1037 Boot or Logon Initialization Scripts — Linux Init Script Modification | experimental | https://thrunt.me/sigma/t1037-linux-init-script-modification.yml |
| T1055 Process Injection — Rundll32 Spawning Explorer as an Injection Host | experimental | https://thrunt.me/sigma/t1055-rundll32-spawning-explorer-injection.yml |
| T1071.004 DNS-over-HTTPS Resolution from a Non-Browser Process | experimental | https://thrunt.me/sigma/t1071-004-doh-resolver-non-browser-c2.yml |
| T1098.004 Account Manipulation — SSH Authorized Keys File Modification | experimental | https://thrunt.me/sigma/t1098-004-ssh-authorized-keys-write.yml |
| T1098.005 Okta Verify Enrollment from a Hypervisor Guest | experimental | https://thrunt.me/sigma/t1098-005-hypervisor-mfa-device-enrollment.yml |
| T1102.001 Dead Drop Resolver — EtherHiding Payload Retrieval from BNB Smart Chain Testnet | experimental | https://thrunt.me/sigma/t1102-001-etherhiding-bsc-testnet-dead-drop.yml |
| T1195.002 Compromise Software Supply Chain — Malicious Google Tag Manager Container | experimental | https://thrunt.me/sigma/t1195-002-unapproved-gtm-container-injection.yml |
| T1204.004 Malicious Copy and Paste — ClickFix macOS Terminal Execution | experimental | https://thrunt.me/sigma/t1204-004-clickfix-macos-terminal-execution.yml |
| T1204.004 Malicious Copy and Paste — ClickFix Run Dialog Execution | experimental | https://thrunt.me/sigma/t1204-004-clickfix-run-dialog-execution.yml |
| T1557 Okta Authentication or MFA via a Remote-Desktop / Proxy / Tor Tunnel | experimental | https://thrunt.me/sigma/t1557-aitm-cross-asn-session-mfa.yml |
| T1557 Claims Kit First-Party Exfil — X-Enc Single-Letter C2 | experimental | https://thrunt.me/sigma/t1557-claims-kit-single-letter-c2-xenc.yml |
| T1557 Okta Verify SVG Asset Served by a Non-Okta Host | experimental | https://thrunt.me/sigma/t1557-non-okta-host-oktaverify-svg.yml |
| T1557 reCAPTCHA-Skinned Cloudflare Turnstile Gate | experimental | https://thrunt.me/sigma/t1557-recaptcha-skinned-turnstile-gate.yml |
| T1566.002 Spearphishing Link — Luxembourg Hospitality SMS Phishing Campaign | experimental | https://thrunt.me/sigma/t1566-002-luxembourg-hospitality-sms-phish.yml |
| T1574.002 DLL Side-Loading — Signed javac.exe Loading jli.dll from a User-Writable Path | experimental | https://thrunt.me/sigma/t1574-002-signed-javac-sideload-jli.yml |
| T1583.001 Resolution of a ShinyHunters .claims Impersonation Domain | experimental | https://thrunt.me/sigma/t1583-001-claims-registration-conjunction.yml |
| T1003.008 OS Credential Dumping — /etc/shadow and /etc/gshadow Access | draft | https://thrunt.meundefined |
| T1530 Data from Cloud Storage — Detection | draft | https://thrunt.meundefined |
Detection Gaps
19 of 162 techniques with corpus signal have zero detection coverage — no SigmaHQ community rule, no thrunt rule. 1 is actively exercised by malware families this week. This is the hand-authoring queue; the live view is at https://thrunt.me/corpus/attck/.
| Technique | Name | Active families | MISP | KEV |
|---|---|---|---|---|
T1610 | Deploy Container | Kinsing | 0 | 0 |
T1011 | Exfiltration Over Other Network Medium | — | 0 | 4 |
T1497 | Virtualization/Sandbox Evasion | — | 0 | 4 |
T1573.001 | Symmetric Cryptography | — | 1 | 3 |
T1562 | — | — | 0 | 3 |
T1001 | Data Obfuscation | — | 0 | 2 |
T1499.002 | Service Exhaustion Flood | — | 0 | 2 |
T1530 | Data from Cloud Storage | — | 0 | 2 |
T1562.001 | — | — | 0 | 2 |
T1003.008 | /etc/passwd and /etc/shadow | — | 0 | 1 |
…and 9 more below the cut — full list on the rollup.
Pipeline Health
All feeds healthy.
Sources: SEC EDGAR (public domain), CISA Known Exploited Vulnerabilities (public domain), FIRST.org EPSS (per ToS), NIST NVD (public domain), GitHub Security Advisories (per ToS), abuse.ch URLhaus (CC0, attribution), ransomware.live (per ToS), MITRE ATT&CK (CC BY 4.0).
Published by Applied Cybernetics Group via thrunt.me. Heuristic cross-references are labelled as such; verify before action.