Morning Brief — 2026-10-31

4 convergence, 2 material breach disclosures, 2 federal patching priority, 10 emerging critical cves, 10 supply chain, 100 ransomware activity, 17 active malware families, 21 hand-authored sigma, 19 detection gaps, and 1 collection ledger. Sections with no signal are still rendered with an explicit “none in this window” note so absence is visible alongside presence.

Convergence

4 organizations seen by ≥2 independent source classes in 14 days. Detail: thrunt.me/convergence.

Photon Health — leak + litigation + notice, converged 2026-10-21

• 2026-08-19 · leak · Photon Health, Inc. listed by direwolf
• 2026-08-25 · litigation · Data-breach class action filed: Carey v. Photon Health Inc (District Court, S.D. New York)
• 2026-08-28 · litigation · Data-breach class action filed: Horne v. Photon Health, Inc. (District Court, S.D. New York)
• 2026-09-02 · litigation · Data-breach class action filed: Marshall v. Photon Health, Inc. (District Court, S.D. New York)
• 2026-10-21 · notice · Photon Health filed a breach notice with the Oregon Department of Justice, 521 affected
• 2026-10-23 · notice · Photon Health filed a breach notice with the Texas Attorney General, 3,085 affected
• 2026-10-30 · notice · Photon Health filed a breach notice with the California Attorney General

Troutman Pepper Locke LLP — leak + notice, converged 2026-10-30

• 2026-08-18 · leak · Troutman Pepper Locke listed by SilentRansomGroup
• 2026-10-30 · notice · Troutman Pepper Locke LLP filed a breach notice with the California Attorney General
• 2026-10-30 · notice · Troutman Pepper Locke LLP filed a breach notice with the Texas Attorney General, 4,194 affected

BASS Medical Group — leak + notice, converged 2026-10-27

• 2026-10-22 · notice · BASS Medical Group filed a breach notice with the California Attorney General
• 2026-10-27 · leak · BASS Medical Group listed by Booba Project

Opportune LLP — leak + notice, converged 2026-10-22

• 2026-07-08 · leak · opportune.com listed by chaos
• 2026-10-22 · notice · Opportune LLP filed a breach notice with the California Attorney General
• 2026-10-23 · notice · Opportune LLP filed a breach notice with the Texas Attorney General, 38,068 affected

Material Breach Disclosures

Koil Energy Solutions, Inc. (KLNG)

• Filed: 2026-10-30 · CIK 0001110607 · Accession 0001683168-26-008210
• Filing: https://www.sec.gov/Archives/edgar/data/1110607/000168316826008210/koil_ex1001.htm

and the Subsidiaries are presently in compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Data and to the protection of such IT Systems and Data from unauthorized use, access, misappropr…

Agassi Sports Entertainment Corp. (AASP)

• Filed: 2026-10-26 · CIK 0000930245 · Accession 0001493152-26-048428
• Filing: https://www.sec.gov/Archives/edgar/data/930245/000149315226048428/ex99-2.htm

Review and evaluate reports from Company management regarding the Company’s technology and cybersecurity processes and programs. Discuss periodically with senior management of the Company and Board any material issues that arise with respect to the Company’s technology and cybersecurity risk assessment and risk management processes and programs. Establish procedures with senior managem…

Federal Patching Priority

CVE-2026-111357 — Ivanti Connect Secure

Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability

• Added: 2026-10-30 · Federal due: 2026-11-02 · EPSS 24.6th pct (score 0.003) · CVSS 7.0 (HIGH) · CWE-829
• ransomware use: Unknown

Ivanti Connect Secure contains a missing authentication for critical function vulnerability that could allow a local authenticated attacker to escalate their privileges. This vulnerability can be chained with CVE-2026-104935 and CVE-2026-118527.

Ivanti Connect Secure 22.8R2.4 mishandles the manner in which the dsinvoked broker trusts DSCache configuration data, leading to privilege escalation to root, as exploited in the wild in October 2026.

CVE-2026-118527 — Ivanti Connect Secure

Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability

• Added: 2026-10-30 · Federal due: 2026-11-13 · CWE-340
• ransomware use: Unknown

Ivanti Connect Secure contains a generation of predictable numbers or identifiers vulnerability that allows a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk. This vulnerability can be chained with CVE-2026-104935 and CVE-2026-111357.

Exploit Probability Movers

No CVEs with ≥0.20 EPSS movement in this window.

Emerging Critical CVEs

• CVE-2026-61826 · CRITICAL (10.0) · 2026-10-30 — Bazarr is a companion application to Sonarr and Radarr. Prior to 1.5.7-beta.14, the api_ns_plex namespace in bazarr/api/plex/oauth.py omits @authenticate on its Resource handlers, while normal APIs require an API k…
• CVE-2026-61738 · CRITICAL (10.0) · 2026-10-30 — SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. Prior to 0.1.77, POST /api/scoutsuite/generate-gcp-report in `backend/app/integrations/scoutsuite/routes/scoutsuit…
• CVE-2026-62853 · CRITICAL (9.9) · 2026-10-30 — ThingLinks is an enterprise IoT platform. Prior to 1.4.0, the /groovyScriptTest/registerScript endpoint accepts user-supplied Groovy script content and passes it to an unsandboxed Groovy compilation and loading flow.…
• CVE-2026-116241 · CRITICAL (9.9) · 2026-10-30 — pgAdmin 4’s Import/Export Data tool wraps a user’s query export in a psql \copy (…) TO command and checks that the query’s parentheses are balanced so that nothing can escape the wrapper. The check rejected a backslash…
• CVE-2026-61728 · CRITICAL (9.9) · 2026-10-30 — SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. In affected snapshots preceding the respective 0.1.70 and 0.1.76 sink repairs, portal users, including `customer_use…
• CVE-2026-118235 · CRITICAL (9.8) · 2026-10-31 — The SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.10.2 via the handle_upload functio…
• CVE-2026-119096 · CRITICAL (9.8) · 2026-10-31 — The Uncanny Toolkit for LearnDash plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 3.8.2 via the email parameter of the uo_login_action() function. This is due to a parser…
• CVE-2026-116512 · CRITICAL (9.8) · 2026-10-31 — The Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.1.1 via the ‘id’ param…
• CVE-2026-109220 · CRITICAL (9.8) · 2026-10-31 — The PDF Invoice for WooCommerce + Drag and Drop Template Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 7.1.1 via the ‘customer_note’ parameter parameter. This is…
• CVE-2026-63377 · CRITICAL (9.8) · 2026-10-30 — TAKO AI Agent for Okta is a local-first AI agent that helps Okta administrators query tenant data using natural language. Prior to 3.0.1-beta, POST /api/auth/setup in src/api/routers/auth.py allows an unauthenticated…

Supply Chain

GHSA-8fmv-6rg5-5924 · CVE-2026-118761 (go)

• HIGH · CVSS 7.5 · 2026-10-30
• Affected: github.com/kubeflow/pipelines, github.com/kubeflow/pipelines
• https://github.com/advisories/GHSA-8fmv-6rg5-5924

Kubeflow Pipelines: Pipeline archive upload allows decompression bomb to exhaust server memory

GHSA-wg5q-x4j9-qm54 · CVE-2026-118759 (go)

• HIGH · CVSS 7.5 · 2026-10-30
• Affected: github.com/kubeflow/pipelines, github.com/kubeflow/pipelines
• https://github.com/advisories/GHSA-wg5q-x4j9-qm54

Kubeflow Pipelines: Run-log endpoint permits unauthorized access to pod logs

GHSA-5849-834g-hvw5 · CVE-2026-119203 (pip)

• HIGH · 2026-10-30
• Affected: pypdf
• https://github.com/advisories/GHSA-5849-834g-hvw5

pypdf has possible infinite loop when hitting EOF in standard xref table during trailer search

GHSA-cggf-277g-3q54 · CVE-2026-119204 (pip)

• HIGH · 2026-10-30
• Affected: pypdf
• https://github.com/advisories/GHSA-cggf-277g-3q54

pypdf has possible large memory usage when parsing page tree

GHSA-mfr5-77xh-9j7h · CVE-2026-119205 (pip)

• HIGH · 2026-10-30
• Affected: pypdf
• https://github.com/advisories/GHSA-mfr5-77xh-9j7h

pypdf has possible infinite loop when cloning dictionaries

GHSA-4528-x5fx-h6hg · CVE-2026-118772 (npm)

• HIGH · CVSS 7.5 · 2026-10-30
• Affected: joi, @hapi/joi, joi
• https://github.com/advisories/GHSA-4528-x5fx-h6hg

joi: quadratic-time split in string().email({ multiple: true }) allows denial of service

GHSA-8494-f6mr-cjpv · CVE-2026-119202 (npm)

• HIGH · CVSS 7.5 · 2026-10-30
• Affected: @hapi/content, content
• https://github.com/advisories/GHSA-8494-f6mr-cjpv

@hapi/content: quadratic-time parsing of Content-Disposition parameters allows denial of service

GHSA-c73q-w75p-j82v · CVE-2026-116672 (pip)

• HIGH · CVSS 8.8 · 2026-10-30
• Affected: Authlib
• https://github.com/advisories/GHSA-c73q-w75p-j82v

Authlib RFC 7592 examples omit registration-access-token client binding

GHSA-42gh-23hr-vphw · CVE-2026-119206 (pip)

• HIGH · 2026-10-30
• Affected: pypdf
• https://github.com/advisories/GHSA-42gh-23hr-vphw

pypdf has possible long runtimes when retrieving page labels

GHSA-4vqv-7265-gm2w · CVE-2026-119207 (pip)

• HIGH · 2026-10-30
• Affected: pypdf
• https://github.com/advisories/GHSA-4vqv-7265-gm2w

pypdf has possible large memory usage for exceptions in strict mode

Ransomware Activity

100 new victim postings across 18 groups.

Active Malware Families

17 malware families named in the last 30 days of research (7 by ≥2 publishers), exercising 15 ATT&CK techniques.

Families marked ”→” are delivery/social-engineering clusters (ClickFix). Their technique mappings are the delivery chain — downstream behavior is payload-dependent, so they don’t open a hard coverage gap on their own.

Cross-Reference

No SEC × KEV vendor token matches in this window. (This is a heuristic surface, absence is expected most days.)

Hand-Authored Sigma

19 production-ready TTP rules (+2 scaffolds in the authoring queue) live at https://thrunt.me/sigma/manifest.json. Subscribe via https://thrunt.me/sigma/rules.lock.json (content-hash churn) or pull all with https://thrunt.me/sigma/rules.tar.gz.

Detection Gaps

19 of 335 techniques with corpus signal have zero detection coverage: no SigmaHQ, Elastic or Splunk rule, no thrunt rule. This is the hand-authoring queue; the live view is at https://thrunt.me/corpus/attck/.

…and 9 more below the cut — full list on the rollup.

Pipeline Health

All feeds healthy.

Collection Ledger

Dark sources — running clean, delivering nothing:

Sources: SEC EDGAR (public domain), CISA Known Exploited Vulnerabilities (public domain), FIRST.org EPSS (per ToS), NIST NVD (public domain), GitHub Security Advisories (per ToS), ransomware.live (per ToS), state attorney general and HHS OCR breach notices (public records), CourtListener RECAP (public domain), MITRE ATT&CK (CC BY 4.0), SigmaHQ (DRL 1.1), Elastic and Splunk rule inventories, and vendor research and advisories (linked per item).

Published by Applied Cybernetics Group via thrunt.me. Heuristic cross-references are labelled as such; verify before action.