Morning Brief — 2026-10-30

4 convergence, 1 material breach disclosures, 2 federal patching priority, 3 exploit probability movers, 10 emerging critical cves, 10 supply chain, 30 ransomware activity, 17 active malware families, 21 hand-authored sigma, 19 detection gaps, and 1 collection ledger. Sections with no signal are still rendered with an explicit “none in this window” note so absence is visible alongside presence.

Convergence

4 organizations seen by ≥2 independent source classes in 14 days. Detail: thrunt.me/convergence.

Photon Health — leak + litigation + notice, converged 2026-10-21

• 2026-08-19 · leak · Photon Health, Inc. listed by direwolf
• 2026-08-25 · litigation · Data-breach class action filed: Carey v. Photon Health Inc (District Court, S.D. New York)
• 2026-08-28 · litigation · Data-breach class action filed: Horne v. Photon Health, Inc. (District Court, S.D. New York)
• 2026-09-02 · litigation · Data-breach class action filed: Marshall v. Photon Health, Inc. (District Court, S.D. New York)
• 2026-10-21 · notice · Photon Health filed a breach notice with the Oregon Department of Justice, 521 affected
• 2026-10-23 · notice · Photon Health filed a breach notice with the Texas Attorney General, 3,085 affected

BASS Medical Group — leak + notice, converged 2026-10-27

• 2026-10-22 · notice · BASS Medical Group filed a breach notice with the California Attorney General
• 2026-10-27 · leak · BASS Medical Group listed by Booba Project

Opportune LLP — leak + notice, converged 2026-10-22

• 2026-07-08 · leak · opportune.com listed by chaos
• 2026-10-22 · notice · Opportune LLP filed a breach notice with the California Attorney General
• 2026-10-23 · notice · Opportune LLP filed a breach notice with the Texas Attorney General, 38,068 affected

Encore Enterprises — leak + notice, converged 2026-10-16

• 2026-08-02 · leak · Encore Enterprises, Inc. listed by CRPxO
• 2026-10-16 · notice · Encore Enterprises filed a breach notice with the Texas Attorney General, 1,746 affected

Material Breach Disclosures

Agassi Sports Entertainment Corp. (AASP)

• Filed: 2026-10-26 · CIK 0000930245 · Accession 0001493152-26-048428
• Filing: https://www.sec.gov/Archives/edgar/data/930245/000149315226048428/ex99-2.htm

Review and evaluate reports from Company management regarding the Company’s technology and cybersecurity processes and programs. Discuss periodically with senior management of the Company and Board any material issues that arise with respect to the Company’s technology and cybersecurity risk assessment and risk management processes and programs. Establish procedures with senior managem…

Federal Patching Priority

CVE-2026-97229 — GitLab Community Edition and Enterprise Edition

GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Vulnerability

• Added: 2026-10-29 · Federal due: 2026-11-01 · EPSS 97.2th pct (score 0.184) · CVSS 10.0 (CRITICAL) · CWE-190
• ransomware use: Unknown

GitLab Community Edition and Enterprise Edition contain a integer overflow or wraparound vulnerability that could allow an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation.

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation.

CVE-2026-76418 — Cisco Secure Firewall ASA Software and Cisco Secure FTD Software

Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL Pointer Dereference Vulnerability

• Added: 2026-10-29 · Federal due: 2026-11-01 · EPSS 47.3th pct (score 0.006) · CVSS 8.6 (HIGH) · CWE-690
• ransomware use: Unknown

Cisco Secure Firewall ASA Software and Cisco Secure FTD Software contains an unchecked return value to NULL pointer dereference vulnerability that could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition.

A vulnerability in the Remote Access SSL VPN service of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition. This vulnerability is due to logic errors when secondary authentication is…

Exploit Probability Movers

Emerging Critical CVEs

• CVE-2026-84295 · CRITICAL (10.0) · 2026-10-29 — Improper authentication in Progress Software WS_FTP Server versions prior to 2024.0.6 and 2025.0.3 on Windows could allow an unauthenticated remote attacker to access sensitive information, including administrative crede…
• CVE-2026-61991 · CRITICAL (10.0) · 2026-10-29 — Unauthenticated Remote Code Execution (RCE) in AjaxLoadMore Cache <= 3.1.1 versions.
• CVE-2026-90868 · CRITICAL (9.9) · 2026-10-29 — An OS command injection vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow arbitrary command execution under certain configurations.
• CVE-2026-119145 · CRITICAL (9.9) · 2026-10-29 — Frappe before 15.121.0 and 16.x before 16.34.0 contains a path traversal vulnerability because certain file-upload handling does not validate the destination path before writing to disk. Authenticated attackers can uploa…
• CVE-2026-107329 · CRITICAL (9.9) · 2026-10-29 — IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary code due to improper control of code generation.
• CVE-2026-107328 · CRITICAL (9.9) · 2026-10-29 — IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of code in eval/exec.
• CVE-2026-107327 · CRITICAL (9.9) · 2026-10-29 — IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary code due to missing authorization.
• CVE-2026-103039 · CRITICAL (9.8) · 2026-10-30 — The Gravity Forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.1.2 via a Post Custom Field whose input type is List. This is due to GFFormsModel::create_post() passin…
• CVE-2026-107058 · CRITICAL (9.8) · 2026-10-29 — An issue in Shelter versionCode 445 allows attackers to register their own auth_key and execute a takeover of another user’s binder service API and preference state.
• CVE-2026-93680 · CRITICAL (9.8) · 2026-10-29 — IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker to bypass security restrictions due to improper authentication.

Supply Chain

GHSA-qr28-fpjm-wq7f · CVE-2026-118664 (npm)

• HIGH · 2026-10-29
• Affected: decode-uri-component
• https://github.com/advisories/GHSA-qr28-fpjm-wq7f

decode-uri-component vulnerable to denial of service via quadratic replacement of percent-encoded runs

GHSA-vpp8-g58w-m8mp (pip)

• HIGH · CVSS 7.5 · 2026-10-29
• Affected: Twisted
• https://github.com/advisories/GHSA-vpp8-g58w-m8mp

Twisted: Unauthenticated Remote Denial of Service in the Twisted HTTP/2 Server via Rapid Stream Reset

GHSA-9hj8-73fh-9963 · CVE-2026-115907 (rust)

• HIGH · CVSS 7.5 · 2026-10-29
• Affected: zip
• https://github.com/advisories/GHSA-9hj8-73fh-9963

zip: legacy Shrink/Reduce/Implode decoder: denial of service from attacker-controlled ZIP64 uncompressed size

GHSA-hjqx-j4rw-g7xv · CVE-2026-115908 (rust)

• HIGH · CVSS 7.4 · 2026-10-29
• Affected: zip
• https://github.com/advisories/GHSA-hjqx-j4rw-g7xv

zip: Arbitrary file write outside the extraction directory, because ZipArchive::extract validates symlink targets lexically.

GHSA-q7v9-x93c-xqv3 · CVE-2026-115909 (rust)

• HIGH · CVSS 7.5 · 2026-10-29
• Affected: zip
• https://github.com/advisories/GHSA-q7v9-x93c-xqv3

zip: Unbounded Symlink-Target Handling Can Abort Or Exhaust Memory During Extraction

GHSA-6j52-38f8-qhxr · CVE-2026-63414 (rubygems)

• HIGH · 2026-10-29
• Affected: shopify_app
• https://github.com/advisories/GHSA-6j52-38f8-qhxr

Shopify App: Token exchange shop context confusion may allow cross-shop authorization bypass in affected apps

GHSA-8rvj-mm4h-c258 · CVE-2026-62290 (go)

• HIGH · CVSS 7.3 · 2026-10-29
• Affected: github.com/cert-manager/cert-manager, github.com/cert-manager/cert-manager
• https://github.com/advisories/GHSA-8rvj-mm4h-c258

cert-manager: Direct ACME Challenge resources can bypass Issuer DNS01 solver policy and use ClusterIssuer DNS credentials

GHSA-v3f7-2p4r-mwfw · CVE-2026-9086 (maven)

• HIGH · CVSS 7.3 · 2026-10-29
• Affected: org.keycloak:keycloak-services
• https://github.com/advisories/GHSA-v3f7-2p4r-mwfw

Keycloak vulnerable to cross-site scripting (xss) via case-insensitive uri validation bypass

GHSA-f5p5-6xmx-p252 · CVE-2026-9800 (maven)

• HIGH · CVSS 8.1 · 2026-10-29
• Affected: org.keycloak:keycloak-services, org.keycloak:keycloak-policy-enforcer
• https://github.com/advisories/GHSA-f5p5-6xmx-p252

Keycloak vulnerable to authorization bypass via incorrect uri comparison

GHSA-w9x9-j56r-h98r (npm)

• HIGH · CVSS 8.2 · 2026-10-29
• Affected: @eeacms/volto-chatbot
• https://github.com/advisories/GHSA-w9x9-j56r-h98r

@eeacms/volto-chatbot has Unauthenticated Danswer API Confused Deputy Proxy

Ransomware Activity

30 new victim postings across 13 groups.

Active Malware Families

17 malware families named in the last 30 days of research (9 by ≥2 publishers), exercising 15 ATT&CK techniques.

Families marked ”→” are delivery/social-engineering clusters (ClickFix). Their technique mappings are the delivery chain — downstream behavior is payload-dependent, so they don’t open a hard coverage gap on their own.

Cross-Reference

No SEC × KEV vendor token matches in this window. (This is a heuristic surface, absence is expected most days.)

Hand-Authored Sigma

19 production-ready TTP rules (+2 scaffolds in the authoring queue) live at https://thrunt.me/sigma/manifest.json. Subscribe via https://thrunt.me/sigma/rules.lock.json (content-hash churn) or pull all with https://thrunt.me/sigma/rules.tar.gz.

Detection Gaps

19 of 335 techniques with corpus signal have zero detection coverage: no SigmaHQ, Elastic or Splunk rule, no thrunt rule. This is the hand-authoring queue; the live view is at https://thrunt.me/corpus/attck/.

…and 9 more below the cut — full list on the rollup.

Pipeline Health

All feeds healthy.

Collection Ledger

Dark sources — running clean, delivering nothing:

Sources: SEC EDGAR (public domain), CISA Known Exploited Vulnerabilities (public domain), FIRST.org EPSS (per ToS), NIST NVD (public domain), GitHub Security Advisories (per ToS), ransomware.live (per ToS), state attorney general and HHS OCR breach notices (public records), CourtListener RECAP (public domain), MITRE ATT&CK (CC BY 4.0), SigmaHQ (DRL 1.1), Elastic and Splunk rule inventories, and vendor research and advisories (linked per item).

Published by Applied Cybernetics Group via thrunt.me. Heuristic cross-references are labelled as such; verify before action.