Morning Brief — 2026-10-29

4 convergence, 1 material breach disclosures, 2 federal patching priority, 2 exploit probability movers, 10 emerging critical cves, 10 supply chain, 22 ransomware activity, 16 active malware families, 21 hand-authored sigma, 19 detection gaps, and 1 collection ledger. Sections with no signal are still rendered with an explicit “none in this window” note so absence is visible alongside presence.

Convergence

4 organizations seen by ≥2 independent source classes in 14 days. Detail: thrunt.me/convergence.

Photon Health — leak + litigation + notice, converged 2026-10-21

• 2026-08-19 · leak · Photon Health, Inc. listed by direwolf
• 2026-08-25 · litigation · Data-breach class action filed: Carey v. Photon Health Inc (District Court, S.D. New York)
• 2026-08-28 · litigation · Data-breach class action filed: Horne v. Photon Health, Inc. (District Court, S.D. New York)
• 2026-09-02 · litigation · Data-breach class action filed: Marshall v. Photon Health, Inc. (District Court, S.D. New York)
• 2026-10-21 · notice · Photon Health filed a breach notice with the Oregon Department of Justice, 521 affected
• 2026-10-23 · notice · Photon Health filed a breach notice with the Texas Attorney General, 3,085 affected

BASS Medical Group — leak + notice, converged 2026-10-27

• 2026-10-22 · notice · BASS Medical Group filed a breach notice with the California Attorney General
• 2026-10-27 · leak · BASS Medical Group listed by Booba Project

Opportune LLP — leak + notice, converged 2026-10-22

• 2026-07-08 · leak · opportune.com listed by chaos
• 2026-10-22 · notice · Opportune LLP filed a breach notice with the California Attorney General
• 2026-10-23 · notice · Opportune LLP filed a breach notice with the Texas Attorney General, 38,068 affected

Encore Enterprises — leak + notice, converged 2026-10-16

• 2026-08-02 · leak · Encore Enterprises, Inc. listed by CRPxO
• 2026-10-16 · notice · Encore Enterprises filed a breach notice with the Texas Attorney General, 1,746 affected

Material Breach Disclosures

Agassi Sports Entertainment Corp. (AASP)

• Filed: 2026-10-26 · CIK 0000930245 · Accession 0001493152-26-048428
• Filing: https://www.sec.gov/Archives/edgar/data/930245/000149315226048428/ex99-2.htm

Review and evaluate reports from Company management regarding the Company’s technology and cybersecurity processes and programs. Discuss periodically with senior management of the Company and Board any material issues that arise with respect to the Company’s technology and cybersecurity risk assessment and risk management processes and programs. Establish procedures with senior managem…

Federal Patching Priority

CVE-2026-46300 — Linux Kernel

Linux Kernel Missing Initialization of a Variable Vulnerability

• Added: 2026-10-28 · Federal due: 2026-10-31 · EPSS 95.7th pct (score 0.102) · CVSS 7.8 (HIGH) · CWE-787, CWE-456, CWE-123
• ransomware use: Unknown

Linux Kernel contains a missing initialization of a variable vulnerability that could allow for unintended modification of page-cache-backed data via failure to preserve the shared-fragment marker during socket buffer coalescing, causing ESP input processing to decrypt shared fragments in place. This vulnerability can be chained with CVE-2026-109618 and CVE-2026-109619 to implant PHP webshells and run commands as root.

In the Linux kernel, the following vulnerability has been resolved: net: skbuff: preserve shared-frag marker during coalescing skb_try_coalesce() can attach paged frags from @from to @to. If @from has SKBFL_SHARED_FRAG set, the resulting @to skb can contain the same externally-owned or page-cache-backed frags, but the shared-frag marker is currently lost. That breaks the invariant relied on by…

CVE-2026-41709 — Broadcom VMware ESX

Broadcom VMWare ESX Insufficient Logging Vulnerability

• Added: 2026-10-28 · Federal due: 2026-11-11 · EPSS 22.3th pct (score 0.003) · CVSS 2.7 (LOW) · CWE-778
• ransomware use: Unknown

Broadcom VMWare ESX contains an insufficient logging vulnerability that could allow a malicious actor with admin access to perform certain operations without being logged.

VMware ESX contains an insufficient logging vulnerability. A malicious administrator could exploit this issue to perform certain operations without them being logged.

Exploit Probability Movers

Emerging Critical CVEs

• CVE-2026-61567 · CRITICAL (10.0) · 2026-10-28 — AVideo is a video-sharing Platform. Prior to 8.1.0, the live-streaming endpoint view/videosListToLive.php accepts an attacker-named streamer in webSiteRootURL, calls Login::run in objects/Login.php, and trusts th…
• CVE-2026-61564 · CRITICAL (10.0) · 2026-10-28 — AVideo is a video-sharing Platform. Prior to 8.1.0, the unauthenticated installer endpoint install/checkConfiguration.php assembles videos/configuration.php by interpolating request parameters, including `webSiteRoot…
• CVE-2026-44179 · CRITICAL (9.9) · 2026-10-28 — XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence. From 1.13 until 1.14.5, the excerpt-include macro does not properly escape the included page’s title and execu…
• CVE-2026-42922 · CRITICAL (9.8) · 2026-10-29 — A authorization bypass vulnerability exists in the /nodered functionality of FUXA (version(s): 1.3.2-2809). A specially crafted HTTP request can lead to a arbitrary code execution. An attacker can make an unauthenticated…
• CVE-2026-109516 · CRITICAL (9.8) · 2026-10-29 — The Bot for Telegram on WooCommerce plugin for WordPress is vulnerable to Authentication Bypass leading to Account Takeover in all versions up to, and including, 1.3.0. The /wp-json/woo-telegram/v1/main/ REST endpoint…
• CVE-2026-118579 · CRITICAL (9.8) · 2026-10-28 — A weakness has been identified in D-Link DIR-505 1.10B02. The impacted element is the function main of the file /secmark1524.cgi of the component Web Management CGI. This manipulation of the argument accu/pass/code/hash/…
• CVE-2026-118690 · CRITICAL (9.8) · 2026-10-28 — Signal K Server before 2.33.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers to download log archives via the /skServer/ziplogs endpoint. Attackers can extract the JWT secret…
• CVE-2026-103409 · CRITICAL (9.8) · 2026-10-28 — A Missing authentication for critical function vulnerability in Juniper Networks Session Smart Router allows an unauthenticated network-based attacker to obtain administrative privileges by passing crafted URL parameters…
• CVE-2026-103406 · CRITICAL (9.8) · 2026-10-28 — An Improper Neutralization of Special Elements used in an OS Command vulnerability in the AutomatedProvisioner in Juniper Networks Session Smart Conductor allows a remote attacker to execute arbitrary commands as root vi…
• CVE-2026-115968 · CRITICAL (9.8) · 2026-10-28 — Deserialization of Untrusted Data vulnerability in Ultimate Member Ultimate Member ultimate-member allows Object Injection.This issue affects Ultimate Member: from n/a through 2.13.1.

Supply Chain

GHSA-3f7j-7jwc-fxfj · CVE-2026-116576 (npm)

• HIGH · CVSS 7.8 · 2026-10-28
• Affected: systeminformation
• https://github.com/advisories/GHSA-3f7j-7jwc-fxfj

systeminformation vulnerable to Windows command injection in services() through Unicode quotation marks

GHSA-6jp4-8v48-cc5v · CVE-2026-117601 (pip)

• CRITICAL · CVSS 7.5 · 2026-10-28
• Affected: electrum
• https://github.com/advisories/GHSA-6jp4-8v48-cc5v

Electrum: Malicious server can replace a just-broadcast tx and try to trick user into RBF-ing it

GHSA-97r2-qh9m-474h · CVE-2026-116581 (npm)

• HIGH · CVSS 7.5 · 2026-10-28
• Affected: seroval
• https://github.com/advisories/GHSA-97r2-qh9m-474h

Seroval: fromJSON deserializer trusts node-supplied array length and sequence doneAt (unauthenticated event-loop DoS)

GHSA-wp97-x4hv-qvhp · CVE-2026-116584 (npm)

• HIGH · CVSS 7.5 · 2026-10-28
• Affected: seroval
• https://github.com/advisories/GHSA-wp97-x4hv-qvhp

Seroval fromJSON/fromCrossJSON denial of service via unvalidated array node length

GHSA-7rv5-mrxv-xcr9 · CVE-2026-116580 (npm)

• HIGH · CVSS 7.3 · 2026-10-28
• Affected: seroval
• https://github.com/advisories/GHSA-7rv5-mrxv-xcr9

Seroval: Deserialization invokes attacker-chosen callables: AsyncIteratorFactoryInstance calls source.on(listener) without type check

GHSA-h3rc-j82p-2c3h · CVE-2026-115915 (pip)

• HIGH · CVSS 8.1 · 2026-10-28
• Affected: vllm
• https://github.com/advisories/GHSA-h3rc-j82p-2c3h

vLLM: Untrusted EPS inputs can trigger denial of service or Ghostscript RCE

GHSA-6757-hggm-hp2w · CVE-2026-115912 (pip)

• HIGH · CVSS 7.5 · 2026-10-28
• Affected: vllm
• https://github.com/advisories/GHSA-6757-hggm-hp2w

vLLM: Public multimodal SHM handle forgery reaches worker-side pickle.loads() with insecure serialization disabled

GHSA-mghf-wjfp-p5xm · CVE-2026-115893 (rust)

• CRITICAL · CVSS 9.9 · 2026-10-28
• Affected: wasmtime, wasmtime, wasmtime
• https://github.com/advisories/GHSA-mghf-wjfp-p5xm

Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm br_table instruction

GHSA-x8rm-f576-gq67 · CVE-2026-115887 (npm)

• HIGH · CVSS 7.5 · 2026-10-28
• Affected: graphql-scalars
• https://github.com/advisories/GHSA-x8rm-f576-gq67

graphql-scalars PhoneNumber scalar is vulnerable to regular expression denial of service

GHSA-gg6h-894w-4m9c · CVE-2026-116795 (npm)

• HIGH · CVSS 7.5 · 2026-10-28
• Affected: re2js
• https://github.com/advisories/GHSA-gg6h-894w-4m9c

RE2JS: Quadratic-time denial of service in re2js lookbehind matching

Ransomware Activity

22 new victim postings across 13 groups.

Active Malware Families

16 malware families named in the last 30 days of research (8 by ≥2 publishers), exercising 15 ATT&CK techniques.

Families marked ”→” are delivery/social-engineering clusters (ClickFix). Their technique mappings are the delivery chain — downstream behavior is payload-dependent, so they don’t open a hard coverage gap on their own.

Cross-Reference

No SEC × KEV vendor token matches in this window. (This is a heuristic surface, absence is expected most days.)

Hand-Authored Sigma

19 production-ready TTP rules (+2 scaffolds in the authoring queue) live at https://thrunt.me/sigma/manifest.json. Subscribe via https://thrunt.me/sigma/rules.lock.json (content-hash churn) or pull all with https://thrunt.me/sigma/rules.tar.gz.

Detection Gaps

19 of 328 techniques with corpus signal have zero detection coverage: no SigmaHQ, Elastic or Splunk rule, no thrunt rule. This is the hand-authoring queue; the live view is at https://thrunt.me/corpus/attck/.

…and 9 more below the cut — full list on the rollup.

Pipeline Health

All feeds healthy.

Collection Ledger

Dark sources — running clean, delivering nothing:

Sources: SEC EDGAR (public domain), CISA Known Exploited Vulnerabilities (public domain), FIRST.org EPSS (per ToS), NIST NVD (public domain), GitHub Security Advisories (per ToS), ransomware.live (per ToS), state attorney general and HHS OCR breach notices (public records), CourtListener RECAP (public domain), MITRE ATT&CK (CC BY 4.0), SigmaHQ (DRL 1.1), Elastic and Splunk rule inventories, and vendor research and advisories (linked per item).

Published by Applied Cybernetics Group via thrunt.me. Heuristic cross-references are labelled as such; verify before action.