October 21, 2026 · Applied Cybernetics Group
Morning Brief — October 21, 2026
Morning Brief — 2026-10-21
1 material breach disclosures, 6 federal patching priority, 10 emerging critical cves, 10 supply chain, 25 ransomware activity, 565 ioc volume, 12 active malware families, 1 multi-source iocs, 2 intel feeds, 18 hand-authored sigma, and 19 detection gaps. Sections with no signal are still rendered with an explicit “none in this window” note so absence is visible alongside presence.
Material Breach Disclosures
Park Dental Partners, Inc. (PARK)
- Filed: 2026-10-13 · CIK 0002069604 · Accession
0001104659-26-115541 - Filing: https://www.sec.gov/Archives/edgar/data/2069604/000110465926115541/park-20261007x8k.htm
As previously reported, on August 28, 2026, Park Dental Partners, Inc. (“Company”) identified unauthorized access to its computer network. The Company promptly initiated its incident response protocols, engaged external cybersecurity experts and forensic specialists and notified law enforcement. The investigation has determined that data was subject to unauthorized acquisition as a result of the i…
Federal Patching Priority
CVE-2026-106931 — EG Secure Solutions SiteGuard Server Edition
EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability
- Added: 2026-10-20 · Federal due: 2026-10-23 · EPSS 50.8th pct (score 0.007) · CVSS 7.8 (HIGH) · CWE-78
- ransomware use: Unknown
EG Secure Solutions SiteGuard Server Edition contains an OS command injection vulnerability which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product.
SiteGuard Server Edition contains an OS command injection vulnerability, which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product.
CVE-2026-96656 — Plex Media Server
Plex Media Server External Control of File Name or Path Vulnerability
- Added: 2026-10-20 · Federal due: 2026-10-23 · EPSS 32.3th pct (score 0.004) · CVSS 7.2 (HIGH) · CWE-73
- ransomware use: Unknown
Plex Media Server contains an external control of file name or path vulnerability which can allow an admin user to write arbitrary files that may be executed on load. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96655.
Plex Media Server before 1.43.3.10861 allows an admin user to write arbitrary files that may be executed on load. The preference TranscoderH264Options is appended verbatim to x264’s option string on every transcode. At startup, all .so files are run without signature, execute bit, or symbol checks.
CVE-2026-96654 — Plex Media Server
Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability
- Added: 2026-10-20 · Federal due: 2026-10-23 · EPSS 12.6th pct (score 0.002) · CVSS 6.5 (MEDIUM) · CWE-84
- ransomware use: Unknown
Plex Media Server contains an improper neutralization of encoded URI schemes in a web page vulnerability that could allow an attacker to call other plugins’ functions and supply their own parameters. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96655, and CVE-2026-96656.
Plex Media Server before 1.43.3.10861 does not correctly neutralize URL values included in ‘searchOne,’ allowing an attacker to call other plugins’ functions and supply their own parameters.
CVE-2026-96652 — Plex Media Server
Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability
- Added: 2026-10-20 · Federal due: 2026-11-03 · EPSS 12.0th pct (score 0.002) · CVSS 4.3 (MEDIUM) · CWE-918
- ransomware use: Unknown
Plex Media Server contains a server-side request forgery (SSRF) vulnerability which could allow an attacker using any X-Plex-Token value to include a full URL in the ‘protocol’ parameter and force the Plex server to POST to the attacker’s chosen destination. This vulnerability can be chained with CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656.
Plex Media Server before 1.43.3.10861 allows SSRF via ‘/player/timeline’. An attacker using any X-Plex-Token value can include a full URL in the ‘protocol’ parameter and force the Plex server to POST to the attacker’s chosen destination.
CVE-2026-96655 — Plex Media Server
Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability
- Added: 2026-10-20 · Federal due: 2026-11-03 · EPSS 12.0th pct (score 0.002) · CVSS 4.3 (MEDIUM) · CWE-918
- ransomware use: Unknown
Plex Media Server contains a server-side request forgery (SSRF) vulnerability that could allow an authenticated user to request arbitrary internal or external addresses via the ‘/video/:/transcode/universal’ path parameter. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96656.
Plex Media Server before 1.43.3.10861 allows an authenticated user to request arbitrary internal or external addresses via the ‘/video/:/transcode/universal’ path parameter.
CVE-2026-110936 — Siemens Software Center
Siemens Software Center Uncontrolled Search Path Element Vulnerability
- Added: 2026-10-20 · Federal due: 2026-11-03 · EPSS 2.7th pct (score 0.001) · CVSS 6.7 (MEDIUM) · CWE-427
- ransomware use: Unknown
Siemens Software Center contains an uncontrolled search path element vulnerability that could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application searches, leading to arbitrary code execution with the privileges of the affected application.
A vulnerability has been identified in Siemens Software Center (All versions < V4.0.9.8). The affected application loads dynamic-link libraries (DLLs) from an uncontrolled search path. This could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application searches, leading to arbitrary code execution with the privileges of the affected application.
Exploit Probability Movers
No CVEs with ≥0.20 EPSS movement in this window.
Emerging Critical CVEs
CVE-2026-113744· CRITICAL (10.0) · 2026-10-21 — A security vulnerability has been detected in Tenda AC19 16.03.10.07. The impacted element is the function formSetFirewallCfg of the file /goform/SetFirewallCfg of the component httpd Web Management Service. Such manipul…CVE-2026-91299· CRITICAL (10.0) · 2026-10-20 — Vulnerability in the JD Edwards EnterpriseOne Orchestrator product of Oracle JD Edwards (component: E1 IOT Orchestrator Security). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerabil…CVE-2026-91231· CRITICAL (10.0) · 2026-10-20 — Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Adapters). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticat…CVE-2026-91221· CRITICAL (10.0) · 2026-10-20 — Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthent…CVE-2026-91216· CRITICAL (10.0) · 2026-10-20 — Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthent…CVE-2026-87337· CRITICAL (10.0) · 2026-10-20 — Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability al…CVE-2026-81212· CRITICAL (10.0) · 2026-10-20 — IBM DataStage on Cloud Pak for Data 5.4.0.0 allows an unauthenticated user to perform an arbitrary write into shared Redis under any tenant’s key. This collapses the platform’s credential-encryption boundary and lets an…CVE-2026-101809· CRITICAL (10.0) · 2026-10-20 — Vulnerability in the Workflow product of Oracle E-Business Suite (component: Workflow Notification Mailer). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticate…CVE-2026-71195· CRITICAL (9.9) · 2026-10-21 — In OpenStack Manila before 23.0.1, multiple Manila API operations on public shares do not verify that the caller owns the share. The API controllers authorize operations against the caller’s own project context, then loa…CVE-2026-91663· CRITICAL (9.9) · 2026-10-20 — Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via T3, IIOP to compromis…
Supply Chain
GHSA-4fpj-g9jf-9rgg · CVE-2026-111765 (maven)
- HIGH · CVSS 7.5 · 2026-10-20
- Affected:
org.a2aproject.sdk:a2a-java-sdk-http-client-android - https://github.com/advisories/GHSA-4fpj-g9jf-9rgg
A2A Java SDK: Android synchronous POST forwards credentials across authorities after incomplete redirect fix
GHSA-qw47-mcm5-934w · CVE-2026-111764 (maven)
- HIGH · CVSS 7.5 · 2026-10-20
- Affected:
org.a2aproject.sdk:a2a-java-sdk-server-common - https://github.com/advisories/GHSA-qw47-mcm5-934w
A2A Java SDK has a fail-open default task authorization
GHSA-58r4-6rv3-gfh8 · CVE-2026-112397 (pip)
- HIGH · 2026-10-20
- Affected:
Pillow - https://github.com/advisories/GHSA-58r4-6rv3-gfh8
Pillow: Out-of-bounds access in _imagingmorph on a zero-width image
GHSA-65qm-jvmh-6pqg · CVE-2026-112400 (pip)
- HIGH · 2026-10-20
- Affected:
Pillow - https://github.com/advisories/GHSA-65qm-jvmh-6pqg
Pillow: GIF seek keeps rejected size after DecompressionBombError, allowing DoS
GHSA-q45j-58j2-45rg · CVE-2026-112897 (pip)
- HIGH · 2026-10-20
- Affected:
Pillow - https://github.com/advisories/GHSA-q45j-58j2-45rg
Pillow: TiffDecode returns uninitialized memory as pixels for short JPEG strips
GHSA-pchr-8j38-3x4p · CVE-2026-112896 (pip)
- HIGH · 2026-10-20
- Affected:
Pillow - https://github.com/advisories/GHSA-pchr-8j38-3x4p
Pillow: TIFF encoder ColorMap plane-size mismatch causes a heap out-of-bounds read
GHSA-p4wg-p73j-c528 · CVE-2026-112895 (pip)
- HIGH · 2026-10-20
- Affected:
pillow - https://github.com/advisories/GHSA-p4wg-p73j-c528
Pillow: Unbounded recursion parsing a PDF page tree or trailer chain (incomplete fix for CVE-2026-42310)
GHSA-c6hw-5grf-ff96 · CVE-2026-112404 (pip)
- HIGH · 2026-10-20
- Affected:
Pillow - https://github.com/advisories/GHSA-c6hw-5grf-ff96
Pillow: OOB read in TiffDecode.c tile and RGBA paths leaks heap memory into pixels
GHSA-8g5g-8vmr-9782 · CVE-2026-112403 (pip)
- CRITICAL · 2026-10-20
- Affected:
Pillow - https://github.com/advisories/GHSA-8g5g-8vmr-9782
Pillow: Heap buffer overflow in ImagingJpegDecode
GHSA-gfr2-rv44-r23c · CVE-2026-111758 (npm)
- HIGH · CVSS 7.5 · 2026-10-20
- Affected:
markdown-it,markdown-it - https://github.com/advisories/GHSA-gfr2-rv44-r23c
markdown-it: Quadratic-time rendering of a single multi-line link reference definition with default options (regression since 14.0)
Ransomware Activity
25 new victim postings across 12 groups.
| Group | Victims | Sample |
|---|---|---|
Booba Project | 6 | Research Foundation of The City University of New York, Chicago Vein Institute, … |
Dark Project | 3 | Beach Eye Medical Group, Asensus Surgical, The Excalibur Group |
Scarlettgroup | 3 | police.rajasthan.gov.in, genesys.com, nbcuniversal.com |
SilentRansomGroup | 3 | M… M…, P… H…, P…S…R… |
Mimori | 2 | OpenText, Aveva |
N0n | 2 | Xylanpicks, 51Ridge (Newark NJ hosting/IT) |
Global Secret Group | 1 | Graves Fireplaces, Inc. |
aurora | 1 | Duarte Nursery, Inc. |
bravox | 1 | GSE-M Technology Sdn. Bhd. |
clop | 1 | LEGAL-RECORDS.US |
emperador | 1 | Bruin Group LLC |
incransom | 1 | centralrogers.com |
IOC Volume
565 new IOCs in this window. By source:
| Source | Count |
|---|---|
urlhaus | 565 |
Recent OSINT Events
No curated MISP events in this window (bulk-IOC contributions tallied in IOC Volume).
Active Malware Families
12 malware families active this week (1 corroborated across ≥2 sources), exercising 21 ATT&CK techniques — 1 of them with no detection coverage. Family is the unit, not the indicator: the raw IOCs are drill-down evidence below, not the signal.
| Family | Type | Corrob. | IOCs | Techniques (✗ = coverage gap) |
|---|---|---|---|---|
| ClickFix | delivery → | ✓ | 47 | T1059.001, T1204 |
| Mirai | botnet | — | 1,143 | T1110, T1498, T1499, T1584.005 |
| AMOS (Atomic macOS Stealer) | stealer | — | 26 | T1005, T1056.002, T1071, T1555.001 |
| CoinMiner | miner | — | 22 | T1496 |
| Amadey | loader → | — | 10 | T1071, T1105, T1547 |
| AsyncRAT | rat | — | 8 | T1056.001, T1059.001, T1071, T1219 |
| ConnectWise ScreenConnect (abuse) | rmm-abuse | — | 8 | T1219 |
| SilverFox | rat | — | 8 | T1059, T1071, T1219 |
| Remcos | rat | — | 4 | T1056.001, T1071, T1113 |
| GuLoader | loader → | — | 2 | T1027, T1071, T1105 |
| Kinsing | miner | — | 2 | T1059.004, T1190, T1496, T1610 ✗ |
| XWorm | rat | — | 1 | T1056.001, T1071 |
Families marked ”→” are delivery/social-engineering clusters (ClickFix, Amadey, GuLoader). Their technique mappings are the delivery chain — downstream behavior is payload-dependent, so they don’t open a hard coverage gap on their own.
Multi-Source IOCs
1 IOC flagged by 2+ independent sources this window — the highest-confidence signal the cross-feed corpus produces.
| IOC | Type | Sources | Last seen |
|---|---|---|---|
injurylawsocal.com | domain | misp + urlhaus | 2026-10-21 |
MISP × KEV Correlation
No MISP events in this window referenced a CVE.
Cross-Reference
No SEC × KEV vendor token matches in this window. (This is a heuristic surface, absence is expected most days.)
Intel Feeds
2 IOC feeds updated this run (3,518 indicators total) — each available as CSV, MISP JSON, and STIX 2.1. Subscribe at https://thrunt.me/intel/manifest.json.
| Feed | Source | Type | Count | Downloads |
|---|---|---|---|---|
| URLhaus — Malware Distribution URLs | urlhaus | url | 3,377 | CSV · MISP · STIX |
| URLhaus — Malware Distribution Domains | urlhaus | domain | 141 | CSV · MISP · STIX |
Hand-Authored Sigma
16 production-ready TTP rules (+2 scaffolds in the authoring queue) live at https://thrunt.me/sigma/manifest.json. Subscribe via https://thrunt.me/sigma/rules.lock.json (content-hash churn) or pull all with https://thrunt.me/sigma/rules.tar.gz.
| Rule | Status | YAML |
|---|---|---|
| T1037 Boot or Logon Initialization Scripts — Linux Init Script Modification | experimental | https://thrunt.me/sigma/t1037-linux-init-script-modification.yml |
| T1055 Process Injection — Rundll32 Spawning Explorer as an Injection Host | experimental | https://thrunt.me/sigma/t1055-rundll32-spawning-explorer-injection.yml |
| T1071.004 DNS-over-HTTPS Resolution from a Non-Browser Process | experimental | https://thrunt.me/sigma/t1071-004-doh-resolver-non-browser-c2.yml |
| T1098.004 Account Manipulation — SSH Authorized Keys File Modification | experimental | https://thrunt.me/sigma/t1098-004-ssh-authorized-keys-write.yml |
| T1098.005 Okta Verify Enrollment from a Hypervisor Guest | experimental | https://thrunt.me/sigma/t1098-005-hypervisor-mfa-device-enrollment.yml |
| T1102.001 Dead Drop Resolver — EtherHiding Payload Retrieval from BNB Smart Chain Testnet | experimental | https://thrunt.me/sigma/t1102-001-etherhiding-bsc-testnet-dead-drop.yml |
| T1195.002 Compromise Software Supply Chain — Malicious Google Tag Manager Container | experimental | https://thrunt.me/sigma/t1195-002-unapproved-gtm-container-injection.yml |
| T1204.004 Malicious Copy and Paste — ClickFix macOS Terminal Execution | experimental | https://thrunt.me/sigma/t1204-004-clickfix-macos-terminal-execution.yml |
| T1204.004 Malicious Copy and Paste — ClickFix Run Dialog Execution | experimental | https://thrunt.me/sigma/t1204-004-clickfix-run-dialog-execution.yml |
| T1557 Okta Authentication or MFA via a Remote-Desktop / Proxy / Tor Tunnel | experimental | https://thrunt.me/sigma/t1557-aitm-cross-asn-session-mfa.yml |
| T1557 Claims Kit First-Party Exfil — X-Enc Single-Letter C2 | experimental | https://thrunt.me/sigma/t1557-claims-kit-single-letter-c2-xenc.yml |
| T1557 Okta Verify SVG Asset Served by a Non-Okta Host | experimental | https://thrunt.me/sigma/t1557-non-okta-host-oktaverify-svg.yml |
| T1557 reCAPTCHA-Skinned Cloudflare Turnstile Gate | experimental | https://thrunt.me/sigma/t1557-recaptcha-skinned-turnstile-gate.yml |
| T1566.002 Spearphishing Link — Luxembourg Hospitality SMS Phishing Campaign | experimental | https://thrunt.me/sigma/t1566-002-luxembourg-hospitality-sms-phish.yml |
| T1574.002 DLL Side-Loading — Signed javac.exe Loading jli.dll from a User-Writable Path | experimental | https://thrunt.me/sigma/t1574-002-signed-javac-sideload-jli.yml |
| T1583.001 Resolution of a ShinyHunters .claims Impersonation Domain | experimental | https://thrunt.me/sigma/t1583-001-claims-registration-conjunction.yml |
| T1003.008 OS Credential Dumping — /etc/shadow and /etc/gshadow Access | draft | https://thrunt.meundefined |
| T1530 Data from Cloud Storage — Detection | draft | https://thrunt.meundefined |
Detection Gaps
19 of 162 techniques with corpus signal have zero detection coverage — no SigmaHQ community rule, no thrunt rule. 1 is actively exercised by malware families this week. This is the hand-authoring queue; the live view is at https://thrunt.me/corpus/attck/.
| Technique | Name | Active families | MISP | KEV |
|---|---|---|---|---|
T1610 | Deploy Container | Kinsing | 0 | 0 |
T1011 | Exfiltration Over Other Network Medium | — | 0 | 4 |
T1497 | Virtualization/Sandbox Evasion | — | 0 | 4 |
T1573.001 | Symmetric Cryptography | — | 1 | 3 |
T1562 | — | — | 0 | 3 |
T1001 | Data Obfuscation | — | 0 | 2 |
T1499.002 | Service Exhaustion Flood | — | 0 | 2 |
T1530 | Data from Cloud Storage | — | 0 | 2 |
T1562.001 | — | — | 0 | 2 |
T1003.008 | /etc/passwd and /etc/shadow | — | 0 | 1 |
…and 9 more below the cut — full list on the rollup.
Pipeline Health
All feeds healthy.
Sources: SEC EDGAR (public domain), CISA Known Exploited Vulnerabilities (public domain), FIRST.org EPSS (per ToS), NIST NVD (public domain), GitHub Security Advisories (per ToS), abuse.ch URLhaus (CC0, attribution), ransomware.live (per ToS), MITRE ATT&CK (CC BY 4.0).
Published by Applied Cybernetics Group via thrunt.me. Heuristic cross-references are labelled as such; verify before action.