November 1, 2026 · Applied Cybernetics Group
Morning Brief — November 1, 2026
Morning Brief — 2026-11-01
4 convergence, 2 material breach disclosures, 10 emerging critical cves, 11 ransomware activity, 17 active malware families, 21 hand-authored sigma, 19 detection gaps, and 1 collection ledger. Sections with no signal are still rendered with an explicit “none in this window” note so absence is visible alongside presence.
Convergence
4 organizations seen by ≥2 independent source classes in 14 days. Detail: thrunt.me/convergence.
Photon Health — leak + litigation + notice, converged 2026-10-21
- 2026-08-19 · leak · Photon Health, Inc. listed by direwolf
- 2026-08-25 · litigation · Data-breach class action filed: Carey v. Photon Health Inc (District Court, S.D. New York)
- 2026-08-28 · litigation · Data-breach class action filed: Horne v. Photon Health, Inc. (District Court, S.D. New York)
- 2026-09-02 · litigation · Data-breach class action filed: Marshall v. Photon Health, Inc. (District Court, S.D. New York)
- 2026-10-21 · notice · Photon Health filed a breach notice with the Oregon Department of Justice, 521 affected
- 2026-10-23 · notice · Photon Health filed a breach notice with the Texas Attorney General, 3,085 affected
- 2026-10-30 · notice · Photon Health filed a breach notice with the California Attorney General
- 2026-10-31 · notice · Photon Health filed a breach notice with HHS OCR, 30,625 affected
Troutman Pepper Locke LLP — leak + notice, converged 2026-10-30
- 2026-08-18 · leak · Troutman Pepper Locke listed by SilentRansomGroup
- 2026-10-30 · notice · Troutman Pepper Locke LLP filed a breach notice with the California Attorney General
- 2026-10-30 · notice · Troutman Pepper Locke LLP filed a breach notice with the Texas Attorney General, 4,194 affected
BASS Medical Group — leak + notice, converged 2026-10-27
- 2026-10-22 · notice · BASS Medical Group filed a breach notice with the California Attorney General
- 2026-10-27 · leak · BASS Medical Group listed by Booba Project
Opportune LLP — leak + notice, converged 2026-10-22
- 2026-07-08 · leak · opportune.com listed by chaos
- 2026-10-22 · notice · Opportune LLP filed a breach notice with the California Attorney General
- 2026-10-23 · notice · Opportune LLP filed a breach notice with the Texas Attorney General, 38,068 affected
Material Breach Disclosures
Koil Energy Solutions, Inc. (KLNG)
- Filed: 2026-10-30 · CIK 0001110607 · Accession
0001683168-26-008210 - Filing: https://www.sec.gov/Archives/edgar/data/1110607/000168316826008210/koil_ex1001.htm
and the Subsidiaries are presently in compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Data and to the protection of such IT Systems and Data from unauthorized use, access, misappropr…
Agassi Sports Entertainment Corp. (AASP)
- Filed: 2026-10-26 · CIK 0000930245 · Accession
0001493152-26-048428 - Filing: https://www.sec.gov/Archives/edgar/data/930245/000149315226048428/ex99-2.htm
Review and evaluate reports from Company management regarding the Company’s technology and cybersecurity processes and programs. Discuss periodically with senior management of the Company and Board any material issues that arise with respect to the Company’s technology and cybersecurity risk assessment and risk management processes and programs. Establish procedures with senior managem…
Federal Patching Priority
No new KEV additions in this window.
Exploit Probability Movers
No CVEs with ≥0.20 EPSS movement in this window.
Emerging Critical CVEs
CVE-2026-120198· CRITICAL (10.0) · 2026-11-01 — A vulnerability has been found in WAVLINK WL-WN530BE1-A V251117. Affected is the function con_check_read_finish of the file /protocol.csp. Such manipulation of the argument group_name/IP-FROM leads to command injection.…CVE-2026-120195· CRITICAL (10.0) · 2026-11-01 — A security vulnerability has been detected in WAVLINK WL-WN579A3-A 2026-03-10-94f93d4. The impacted element is the function set_wzdgwMesh of the file /cgi-bin/adm.cgi of the component Initial Setup Wizard. The manipulati…CVE-2026-120189· CRITICAL (10.0) · 2026-11-01 — A vulnerability was identified in D-Link DIR-505 1.10B02. Affected is the function save_upload_file/mp_upload_file of the file /usr/bin/tftpd of the component TFTP Upload Filename Handler. The manipulation leads to stack…CVE-2026-120197· CRITICAL (9.9) · 2026-11-01 — A flaw has been found in WAVLINK WL-WN530HG4B M_V260724. This impacts the function port_forward of the file /cgi-bin/wapi.cgi. This manipulation of the argument Name causes os command injection. It is possible to initiat…CVE-2026-120196· CRITICAL (9.9) · 2026-11-01 — A vulnerability was detected in WAVLINK WN579X3-D V250402. This affects the function port_forward of the file /cgi-bin/wapi.cgi. The manipulation of the argument Name results in os command injection. The attack may be pe…CVE-2026-118636· CRITICAL (9.8) · 2026-10-31 — UNSUPPORTED WHEN ASSIGNED
JavaNativeMessageDecoder in the MINA 3.0 codec module calls ObjectInputStream.readObject() on frame bytes with no class filter, so an application that puts it in front of an untrusted peer…
CVE-2026-120209· CRITICAL (9.8) · 2026-10-31 — AJ-Report through 1.7.1 signs share tokens with a hard-coded JWT secret, allowing attackers to forge valid Share-Tokens offline. Attackers can mint a token with reportCode ‘dataSet’ to access the testTransform endpoint,…CVE-2026-120201· CRITICAL (9.8) · 2026-10-31 — Jpom 2.10.0 through 2.11.12 contains an authentication bypass vulnerability that allows unauthenticated attackers to gain super-administrator access by injecting query conditions into the JPOM-USER-TOKEN header. Attacker…CVE-2026-120203· HIGH (8.8) · 2026-10-31 — ShowDoc 2.8.14 before 3.9.6 contains a code injection vulnerability in its Mock feature that allows authenticated users to execute shell commands through mockjs templates. Attackers can store a template via MockControlle…CVE-2026-120205· HIGH (8.0) · 2026-10-31 — Thelia before 3.1.0 contains a stored cross-site scripting vulnerability in ForSomeCustomers::getSummary() that allows unauthenticated attackers to inject scripts via unescaped customer names. Attackers can register with…
Supply Chain
No high/critical GHSA advisories in this window.
Ransomware Activity
11 new victim postings across 7 groups.
| Group | Victims | Sample |
|---|---|---|
payload | 3 | Straze Garden Center, Kraft Lernen, SALEG (Sachsen-Anhaltische Landesentwicklung… |
Vexy Ransomware | 2 | System Soft, JHAMF Group |
qilin | 2 | Danser, Community Medical Center, Falls City Nebraska |
Barracuda | 1 | EVINOKS |
emperador | 1 | Punta Shopping |
nightspire | 1 | **F*A *.A |
rhysida | 1 | Phoenix Charter Academy |
Active Malware Families
17 malware families named in the last 30 days of research (7 by ≥2 publishers), exercising 15 ATT&CK techniques.
| Family | Type | Publishers | Reports | Techniques (✗ = coverage gap) |
|---|---|---|---|---|
| ConnectWise ScreenConnect (abuse) | rmm-abuse | 7 | 23 | T1219 |
| ClickFix | delivery → | 12 | 18 | T1059.001, T1204 |
| Mirai | botnet | 5 | 5 | T1110, T1498, T1499, T1584.005 |
| XMRig | miner | 4 | 5 | T1496 |
| Lumma | stealer | 4 | 4 | T1005, T1071, T1555 |
| Vidar | stealer | 4 | 4 | T1005, T1071, T1555 |
| njRAT | rat | 2 | 3 | T1056.001, T1059.003, T1071, T1219 |
| AgentTesla | stealer | 1 | 2 | T1056.001, T1071, T1114, T1555 |
| CoinMiner | miner | 1 | 2 | T1496 |
| ACRStealer | stealer | 1 | 1 | T1005, T1071, T1555 |
| AsyncRAT | rat | 1 | 1 | T1056.001, T1059.001, T1071, T1219 |
| Formbook | stealer | 1 | 1 | T1005, T1056.001, T1071, T1555 |
| NetSupport Manager (abuse) | rmm-abuse | 1 | 1 | T1219 |
| QuasarRAT | rat | 1 | 1 | T1056.001, T1059.001, T1071, T1219 |
| Remcos | rat | 1 | 1 | T1056.001, T1071, T1113 |
| Stealc | stealer | 1 | 1 | T1005, T1071, T1555 |
| XWorm | rat | 1 | 1 | T1056.001, T1071 |
Families marked ”→” are delivery/social-engineering clusters (ClickFix). Their technique mappings are the delivery chain — downstream behavior is payload-dependent, so they don’t open a hard coverage gap on their own.
Cross-Reference
No SEC × KEV vendor token matches in this window. (This is a heuristic surface, absence is expected most days.)
Hand-Authored Sigma
19 production-ready TTP rules (+2 scaffolds in the authoring queue) live at https://thrunt.me/sigma/manifest.json. Subscribe via https://thrunt.me/sigma/rules.lock.json (content-hash churn) or pull all with https://thrunt.me/sigma/rules.tar.gz.
| Rule | Status | YAML |
|---|---|---|
| T1037 Boot or Logon Initialization Scripts: Linux Init Script Modification | experimental | https://thrunt.me/sigma/t1037-linux-init-script-modification.yml |
| T1055 Process Injection: Rundll32 Spawning Explorer as an Injection Host | experimental | https://thrunt.me/sigma/t1055-rundll32-spawning-explorer-injection.yml |
| T1059 Process Launched from the PeopleSoft PSEMHUB.war Directory | experimental | https://thrunt.me/sigma/t1059-peoplesoft-psemhub-payload-execution.yml |
| T1071.004 DNS-over-HTTPS Resolution from a Non-Browser Process | experimental | https://thrunt.me/sigma/t1071-004-doh-resolver-non-browser-c2.yml |
| T1098.004 Account Manipulation: SSH Authorized Keys File Modification | experimental | https://thrunt.me/sigma/t1098-004-ssh-authorized-keys-write.yml |
| T1098.005 Okta Verify Enrollment from a Hypervisor Guest | experimental | https://thrunt.me/sigma/t1098-005-hypervisor-mfa-device-enrollment.yml |
| T1102.001 Dead Drop Resolver: EtherHiding Payload Retrieval from BNB Smart Chain Testnet | experimental | https://thrunt.me/sigma/t1102-001-etherhiding-bsc-testnet-dead-drop.yml |
| T1190 Oracle PeopleSoft PSEMHUB Request via a Non-Canonical Path (UNC6240 WAF Bypass) | experimental | https://thrunt.me/sigma/t1190-peoplesoft-psemhub-encoded-path-exploitation.yml |
| T1195.002 Compromise Software Supply Chain: Malicious Google Tag Manager Container | experimental | https://thrunt.me/sigma/t1195-002-unapproved-gtm-container-injection.yml |
| T1204.004 Malicious Copy and Paste: ClickFix macOS Terminal Execution | experimental | https://thrunt.me/sigma/t1204-004-clickfix-macos-terminal-execution.yml |
| T1204.004 Malicious Copy and Paste: ClickFix Run Dialog Execution | experimental | https://thrunt.me/sigma/t1204-004-clickfix-run-dialog-execution.yml |
| T1505.003 Web Shell or Payload Written into PeopleSoft PSEMHUB.war or PORTAL.war, or MeshAgent Staged in /tmp | experimental | https://thrunt.me/sigma/t1505-003-peoplesoft-psemhub-webshell-drop.yml |
| T1557 Okta Authentication or MFA via a Remote-Desktop / Proxy / Tor Tunnel | experimental | https://thrunt.me/sigma/t1557-aitm-cross-asn-session-mfa.yml |
| T1557 Claims Kit First-Party Exfil: X-Enc Single-Letter C2 | experimental | https://thrunt.me/sigma/t1557-claims-kit-single-letter-c2-xenc.yml |
| T1557 Okta Verify SVG Asset Served by a Non-Okta Host | experimental | https://thrunt.me/sigma/t1557-non-okta-host-oktaverify-svg.yml |
| T1557 reCAPTCHA-Skinned Cloudflare Turnstile Gate | experimental | https://thrunt.me/sigma/t1557-recaptcha-skinned-turnstile-gate.yml |
| T1566.002 Spearphishing Link: Luxembourg Hospitality SMS Phishing Campaign | experimental | https://thrunt.me/sigma/t1566-002-luxembourg-hospitality-sms-phish.yml |
| T1574.002 DLL Side-Loading: Signed javac.exe Loading jli.dll from a User-Writable Path | experimental | https://thrunt.me/sigma/t1574-002-signed-javac-sideload-jli.yml |
| T1583.001 Resolution of a ShinyHunters .claims Impersonation Domain | experimental | https://thrunt.me/sigma/t1583-001-claims-registration-conjunction.yml |
| T1003.008 OS Credential Dumping: /etc/shadow and /etc/gshadow Access | draft | https://thrunt.meundefined |
| T1530 Data from Cloud Storage: Detection | draft | https://thrunt.meundefined |
Detection Gaps
19 of 335 techniques with corpus signal have zero detection coverage: no SigmaHQ, Elastic or Splunk rule, no thrunt rule. This is the hand-authoring queue; the live view is at https://thrunt.me/corpus/attck/.
| Technique | Name | Active families | Reports | KEV |
|---|---|---|---|---|
T1573.001 | Symmetric Cryptography | — | 7 | 3 |
T1056.003 | Web Portal Capture | — | 2 | 0 |
T1678 | Delay Execution | — | 2 | 0 |
T1001.001 | Junk Data | — | 1 | 0 |
T1027.007 | Dynamic API Resolution | — | 1 | 0 |
T1027.012 | LNK Icon Smuggling | — | 1 | 0 |
T1027.016 | Junk Code Insertion | — | 1 | 0 |
T1070.009 | Clear Persistence | — | 1 | 0 |
T1132.002 | Non-Standard Encoding | — | 1 | 0 |
T1480.002 | Mutual Exclusion | — | 1 | 0 |
…and 9 more below the cut — full list on the rollup.
Pipeline Health
All feeds healthy.
Collection Ledger
Dark sources — running clean, delivering nothing:
| Source | Last delivered | Quiet | Expected within |
|---|---|---|---|
circl-misp | 2026-08-30 | 63d | 14d |
Sources: SEC EDGAR (public domain), CISA Known Exploited Vulnerabilities (public domain), FIRST.org EPSS (per ToS), NIST NVD (public domain), GitHub Security Advisories (per ToS), ransomware.live (per ToS), state attorney general and HHS OCR breach notices (public records), CourtListener RECAP (public domain), MITRE ATT&CK (CC BY 4.0), SigmaHQ (DRL 1.1), Elastic and Splunk rule inventories, and vendor research and advisories (linked per item).
Published by Applied Cybernetics Group via thrunt.me. Heuristic cross-references are labelled as such; verify before action.