Morning Brief — 2026-08-23

10 emerging critical cves, 1 supply chain, 54 ransomware activity, 504 ioc volume, 22 active malware families, 2 multi-source iocs, 2 intel feeds, 12 hand-authored sigma, and 17 detection gaps. Sections with no signal are still rendered with an explicit “none in this window” note so absence is visible alongside presence.

Material Breach Disclosures

No new Item 1.05 8-K filings in this window.

Federal Patching Priority

No new KEV additions in this window.

Exploit Probability Movers

No CVEs with ≥0.20 EPSS movement in this window.

Emerging Critical CVEs

• CVE-2026-77946 · CRITICAL (10.0) · 2026-08-22 — A vulnerability was determined in TRENDnet TEW-821DAP 2.2.01b05. Affected by this vulnerability is the function uci_safe_get of the file /cgi-bin/apply_time.cgi of the component NTP Timezone Configuration Handler. Execut…
• CVE-2026-78050 · CRITICAL (9.9) · 2026-08-23 — A vulnerability was found in Comfast CF-N1-S 2.6.0.1. The affected element is the function sub_41AD7C of the file /cgi-bin/mbox-config?method=SET&section=ntp_timezone of the component Web Management. The manipulation of…
• CVE-2026-4703 · CRITICAL (9.8) · 2026-08-22 — The WS Form LITE – Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.10.80 via deserialization of untrusted input from form submission met…
• CVE-2026-16149 · HIGH (8.8) · 2026-08-23 — The Security Hardener plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 2.4.4. The vulnerability exists because the plugin’s user-enumeration protection, which is enabled b…
• CVE-2026-0551 · HIGH (8.8) · 2026-08-23 — The PPWP – Password Protect Pages plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.9.18 via deserialization of untrusted input from the ‘post_protection_roles’ vulnerable…
• CVE-2026-71513 · HIGH (8.8) · 2026-08-22 — NLTK before 3.10.3 contains a remote code execution vulnerability in AllowlistUnpickler that validates only the pickle module string and not the global name, allowing attackers to resolve dotted names by attribute traver…
• CVE-2026-59808 · HIGH (8.8) · 2026-08-22 — AVideo through commit 9c39d8c8 contains an authentication bypass vulnerability where deduplicateByEncoderQueueId() returns video_id_hash credentials for any video by encoder_queue_id without ownership verification, and u…
• CVE-2026-60084 · HIGH (8.7) · 2026-08-22 — SiYuan versions before v3.7.4 contain an arbitrary file deletion vulnerability in the /api/search/removeTemplate endpoint that accepts an unvalidated path parameter passed directly to os.RemoveAll. Authenticated admin at…
• CVE-2026-78136 · HIGH (7.8) · 2026-08-23 — chirpmyradio CHIRP before 39178db allows eval injection via crafted CSV data. This occurs in _clean_tmode in drivers/kenwood_itm.py.
• CVE-2026-68766 · HIGH (7.8) · 2026-08-22 — hashcat fails to restrict command-line options when parsing restore files, allowing attackers to inject output-redirecting options like —outfile and —potfile-path. Attackers can craft restore files with malicious optio…

Supply Chain

No high/critical GHSA advisories in the 24h window — exploitation-evidence hits below.

Exploitation evidence, 7-day window (severity-agnostic — evidence trumps labels):

• GHSA-7gwp-5pfp-969j (CVE-2026-64849, pip) · 2026-08-17 — in CISA KEV · EPSS p94.4

Ransomware Activity

54 new victim postings across 13 groups.

IOC Volume

504 new IOCs in this window. By source:

Recent OSINT Events

No curated MISP events in this window (bulk-IOC contributions tallied in IOC Volume).

Active Malware Families

22 malware families active this week (0 corroborated across ≥2 sources), exercising 22 ATT&CK techniques. Family is the unit, not the indicator: the raw IOCs are drill-down evidence below, not the signal.

Families marked ”→” are delivery/social-engineering clusters (ClickFix, GuLoader, ClearFake). Their technique mappings are the delivery chain — downstream behavior is payload-dependent, so they don’t open a hard coverage gap on their own.

Multi-Source IOCs

2 IOCs flagged by 2+ independent sources this window — the highest-confidence signal the cross-feed corpus produces.

MISP × KEV Correlation

No MISP events in this window referenced a CVE.

Cross-Reference

No recent SEC filings to cross-reference.

Intel Feeds

2 IOC feeds updated this run (2,996 indicators total) — each available as CSV, MISP JSON, and STIX 2.1. Subscribe at https://thrunt.me/intel/manifest.json.

Hand-Authored Sigma

10 production-ready TTP rules (+2 scaffolds in the authoring queue) live at https://thrunt.me/sigma/manifest.json. Subscribe via https://thrunt.me/sigma/rules.lock.json (content-hash churn) or pull all with https://thrunt.me/sigma/rules.tar.gz.

Detection Gaps

17 of 158 techniques with corpus signal have zero detection coverage — no SigmaHQ community rule, no thrunt rule. This is the hand-authoring queue; the live view is at https://thrunt.me/corpus/attck/.

…and 7 more below the cut — full list on the rollup.

Pipeline Health

All feeds healthy.

Sources: SEC EDGAR (public domain), CISA Known Exploited Vulnerabilities (public domain), FIRST.org EPSS (per ToS), NIST NVD (public domain), GitHub Security Advisories (per ToS), abuse.ch URLhaus (CC0, attribution), ransomware.live (per ToS), MITRE ATT&CK (CC BY 4.0).

Published by Applied Cybernetics Group via thrunt.me. Heuristic cross-references are labelled as such; verify before action.