Morning Brief — 2026-07-20

3 material breach disclosures, 7 emerging critical cves, 1 supply chain, 16 ransomware activity, 708 ioc volume, 17 active malware families, 25 multi-source iocs, 4 intel feeds, 5 hand-authored sigma, and 17 detection gaps. Sections with no signal are still rendered with an explicit “none in this window” note so absence is visible alongside presence.

Material Breach Disclosures

River Financial Corp (RVRF)

• Filed: 2026-07-17 · CIK 0001641601 · Accession 0001193125-26-307288
• Filing: https://www.sec.gov/Archives/edgar/data/1641601/000119312526307288/ck0001641601-20260619.htm

As set forth in its Form 8-K filed July 10, 2026, two class action lawsuits were filed relating to the unauthorized threat actor gaining access to the network environment of River Financial Corporation, including River Bank & Trust (together, “River”). A third class action was filed against River on July 10, 2026 and a fourth class action was filed against River on July 16, 2026.

 

The principal…

River Financial Corp (RVRF)

• Filed: 2026-07-10 · CIK 0001641601 · Accession 0001193125-26-300763
• Filing: https://www.sec.gov/Archives/edgar/data/1641601/000119312526300763/ck0001641601-20260619.htm

Since the date of the original filing, River’s investigation has progressed. River has determined that an unauthorized threat actor accessed portions of its network and removed certain data from its environment. River is working to determine the nature and scope of the information involved, including whether any personally identifiable information was affected. To date, River is not aware of any r…

River Financial Corp (RVRF)

• Filed: 2026-07-06 · CIK 0001641601 · Accession 0001193125-26-295704
• Filing: https://www.sec.gov/Archives/edgar/data/1641601/000119312526295704/ck0001641601-20260619.htm

Since the date of the original filing, River’s investigation has progressed. River has reason to believe that certain data was potentially impacted and is working to determine the nature and scope of the information involved, including whether any personally identifiable information was affected. To date, there is no evidence that accounts have been impacted.

As of the date of this filing, the…

Federal Patching Priority

No new KEV additions in this window.

Exploit Probability Movers

No CVEs with ≥0.20 EPSS movement in this window.

Emerging Critical CVEs

• CVE-2026-44359 · CRITICAL (10.0) · 2026-07-20 — Meshtastic is an open source mesh networking solution. Prior to version 2.7.21.1370b23, the Meshtastic GitHub repository’s main_matrix.yml workflow is triggered by pull_request_target and multiple jobs check out the att…
• CVE-2026-16242 · CRITICAL (9.4) · 2026-07-20 — A flaw was found in the Konnectivity proxy-server configuration for hosted control planes. The agent-facing listener was started without —cluster-ca-cert (and without token-based agent authentication), so client certifi…
• CVE-2026-12484 · HIGH (7.8) · 2026-07-19 — A vulnerability in keras-team/keras version 3.15.0 allows unsafe deserialization of attacker-controlled PyTorch pickle data through the public keras.layers.TorchModuleWrapper.from_config method. This method invokes `to…
• CVE-2026-42566 · HIGH (7.5) · 2026-07-20 — Meshtastic is an open source mesh networking solution. Prior to version 2.7.23.b246bcd, a single node advertising a User.long_name that contains a malformed character encoding can render other radios unusable over BLE wh…
• CVE-2026-16221 · HIGH (7.5) · 2026-07-19 — Impact: fast-uri versions from 2.3.1 through 4.1.0 (including the 3.x line up to 3.1.3 and the 2.x line up to 2.4.2) do not treat a literal backslash character (U+005C) as an authority delimiter. Node’s native WHATWG URL…
• CVE-2026-16228 · HIGH (7.3) · 2026-07-19 — A vulnerability was detected in SourceCodester Class and Exam Timetabling System 1.0. Affected is an unknown function of the file /edit_schoolyr.php. Performing a manipulation of the argument ID results in sql injection.…
• CVE-2026-16227 · HIGH (7.3) · 2026-07-19 — A security vulnerability has been detected in SourceCodester Class and Exam Timetabling System 1.0. This impacts an unknown function of the file /edit_subject.php. Such manipulation of the argument ID leads to sql inject…

Supply Chain

No high/critical GHSA advisories in the 24h window — exploitation-evidence hits below.

Exploitation evidence, 7-day window (severity-agnostic — evidence trumps labels):

• GHSA-8qw8-rq86-9pc2 (CVE-2026-27771, go) · 2026-07-17 — EPSS p98.5

Ransomware Activity

16 new victim postings across 8 groups.

IOC Volume

708 new IOCs in this window. By source:

Recent OSINT Events

No curated MISP events in this window (bulk-IOC contributions tallied in IOC Volume).

Active Malware Families

17 malware families active this week (6 corroborated across ≥2 sources), exercising 21 ATT&CK techniques. Family is the unit, not the indicator: the raw IOCs are drill-down evidence below, not the signal.

Families marked ”→” are delivery/social-engineering clusters (ClearFake, ClickFix, GuLoader). Their technique mappings are the delivery chain — downstream behavior is payload-dependent, so they don’t open a hard coverage gap on their own.

Multi-Source IOCs

25 IOCs flagged by 2+ independent sources this window — the highest-confidence signal the cross-feed corpus produces.

MISP × KEV Correlation

No MISP events in this window referenced a CVE.

Cross-Reference

No SEC × KEV vendor token matches in this window. (This is a heuristic surface, absence is expected most days.)

Intel Feeds

4 IOC feeds updated this run (6,250 indicators total) — each available as CSV, MISP JSON, and STIX 2.1. Subscribe at https://thrunt.me/intel/manifest.json.

Hand-Authored Sigma

3 production-ready TTP rules (+2 scaffolds in the authoring queue) live at https://thrunt.me/sigma/manifest.json. Subscribe via https://thrunt.me/sigma/rules.lock.json (content-hash churn) or pull all with https://thrunt.me/sigma/rules.tar.gz.

Detection Gaps

17 of 158 techniques with corpus signal have zero detection coverage — no SigmaHQ community rule, no thrunt rule. This is the hand-authoring queue; the live view is at https://thrunt.me/corpus/attck/.

…and 7 more below the cut — full list on the rollup.

Pipeline Health

All feeds healthy.

Sources: SEC EDGAR (public domain), CISA Known Exploited Vulnerabilities (public domain), FIRST.org EPSS (per ToS), NIST NVD (public domain), GitHub Security Advisories (per ToS), abuse.ch URLhaus (CC0, attribution), ransomware.live (per ToS), MITRE ATT&CK (CC BY 4.0).

Published by Applied Cybernetics Group via thrunt.me. Heuristic cross-references are labelled as such; verify before action.