August 26, 2026 · Applied Cybernetics Group
Morning Brief — August 26, 2026
Morning Brief — 2026-08-26
1 federal patching priority, 1 exploit probability movers, 10 emerging critical cves, 10 supply chain, 25 ransomware activity, 543 ioc volume, 18 active malware families, 2 multi-source iocs, 2 intel feeds, 12 hand-authored sigma, and 17 detection gaps. Sections with no signal are still rendered with an explicit “none in this window” note so absence is visible alongside presence.
Material Breach Disclosures
No new Item 1.05 8-K filings in this window.
Federal Patching Priority
CVE-2026-60004 — Gitea Gitea
Gitea Code Injection Vulnerability
- Added: 2026-08-25 · Federal due: 2026-08-28 · CWE-94
- ransomware use: Unknown
Gitea contains a code injection vulnerability that allows an attacker with repository write access to send a malicious patch to the diffpatch API endpoint to plant an executable Git hook and run shell commands as the Gitea service account.
Exploit Probability Movers
| CVE | Today | Prev | Δ | In KEV |
|---|---|---|---|---|
CVE-2026-61511 | 0.708 | 0.340 | ▲ 0.368 |
Emerging Critical CVEs
CVE-2026-79911· CRITICAL (10.0) · 2026-08-25 — A security vulnerability has been detected in TOTOLINK N600R 4.3.0cu.7647_B20210106. The affected element is the function setSystemConfig of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Such manipulation o…CVE-2026-76197· CRITICAL (10.0) · 2026-08-25 — Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an OS Command (‘OS Command Injection’) vulnerability that could result in arbitrary code execution in the context of the…CVE-2026-76195· CRITICAL (10.0) · 2026-08-25 — Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an OS Command (‘OS Command Injection’) vulnerability that could result in arbitrary code execution in the context of the…CVE-2026-76193· CRITICAL (10.0) · 2026-08-25 — Adobe Campaign Classic (ACC) is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerabilit…CVE-2026-65093· CRITICAL (9.9) · 2026-08-25 — NVIDIA OpenShell for Linux contains a vulnerability where an attacker could cause a sandbox escape. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, and i…CVE-2026-65083· CRITICAL (9.9) · 2026-08-25 — NVIDIA OpenShell for Linux contains a vulnerability in its sandbox provisioning API, where an attacker could cause an incomplete list of disallowed inputs. A successful exploit of this vulnerability might lead to code ex…CVE-2026-80138· CRITICAL (9.8) · 2026-08-25 — ClipBucket V5’s web installer fails to properly validate or escape the php_cli_filepath parameter before passing it to shell execution. Unauthenticated attackers can submit a crafted POST request to the installer with a…CVE-2026-80104· CRITICAL (9.8) · 2026-08-25 — DB-GPT builds the destination path for an uploaded skill from the multipart filename without constraining it to the upload directory. skill_upload in packages/dbgpt-app/src/dbgpt_app/openapi/api_v1/agentic_data_api.py ta…CVE-2026-45018· CRITICAL (9.8) · 2026-08-25 — Chainlit is a Python framework for building production-ready conversational AI applications. From 2.4.0rc0 until 2.12.0, Chainlit deployments with features.mcp.enabled set to true in .chainlit/config.toml expose the POST…CVE-2026-79787· CRITICAL (9.8) · 2026-08-25 — Alluxio’s S3 REST proxy fails to verify AWS Signature Version 4 signatures in its default configuration, allowing unauthenticated attackers to spoof user identity. Attackers can extract usernames from unsigned Authorizat…
Supply Chain
GHSA-cv84-9p8j-fj68 · CVE-2026-55099 (pip)
- HIGH · CVSS 7.5 · 2026-08-25
- Affected:
icalendar - https://github.com/advisories/GHSA-cv84-9p8j-fj68
icalendar has Algorithmic Complexity in Equality
GHSA-hvfh-5mj3-5f3j · CVE-2026-45019 (pip)
- HIGH · CVSS 7.2 · 2026-08-25
- Affected:
chainlit - https://github.com/advisories/GHSA-hvfh-5mj3-5f3j
Chainlist has SSRF via MCP SSE and streamable-http transports that allows unauthenticated internal network access
GHSA-w3fx-mc44-mf6j · CVE-2026-45018 (pip)
- CRITICAL · CVSS 9.8 · 2026-08-25
- Affected:
chainlit - https://github.com/advisories/GHSA-w3fx-mc44-mf6j
Chainlit has command injection via MCP stdio transport that allows unauthenticated remote code execution
GHSA-fh3r-g96v-f578 · CVE-2026-55604 (npm)
- HIGH · CVSS 8.6 · 2026-08-25
- Affected:
@arikusi/deepseek-mcp-server - https://github.com/advisories/GHSA-fh3r-g96v-f578
@arikusi/deepseek-mcp-server has an Authorization Bypass Through User-Controlled Key
GHSA-xc9g-j69q-37xw · CVE-2026-55609 (npm)
- HIGH · CVSS 7.1 · 2026-08-25
- Affected:
consciousness-explorer,sublinear-time-solver - https://github.com/advisories/GHSA-xc9g-j69q-37xw
consciousness-explorer / sublinear-time-solver MCP export_state has an arbitrary file write
GHSA-3vfr-4gwf-qxfp · CVE-2026-55629 (npm)
- HIGH · 2026-08-25
- Affected:
whistle - https://github.com/advisories/GHSA-3vfr-4gwf-qxfp
Whistle vulnerable to path traversal
GHSA-g7gc-gmgp-wgqg · CVE-2026-55620 (pip)
- HIGH · CVSS 7.5 · 2026-08-25
- Affected:
eml_parser - https://github.com/advisories/GHSA-g7gc-gmgp-wgqg
eml_parser vulnerable to DoS via deeply nested parens in Received headers
GHSA-777c-2fxx-qr28 · CVE-2026-49757 (erlang)
- CRITICAL · 2026-08-25
- Affected:
ash_authentication,ash_authentication - https://github.com/advisories/GHSA-777c-2fxx-qr28
AshAuthentication vulnerable to OAuth2/OIDC account takeover via email-based user matching
GHSA-6ccx-9c9f-327w · CVE-2026-53430 (erlang)
- HIGH · 2026-08-25
- Affected:
grpc - https://github.com/advisories/GHSA-6ccx-9c9f-327w
gRPC Erlang package has unbounded gzip decompression (decompression bomb)
GHSA-q8gf-9rvj-gmgj · CVE-2026-48854 (erlang)
- HIGH · 2026-08-25
- Affected:
grpc - https://github.com/advisories/GHSA-q8gf-9rvj-gmgj
gRPC Erlang package has unbounded request body accumulation in read_full_body/3
Ransomware Activity
25 new victim postings across 11 groups.
| Group | Victims | Sample |
|---|---|---|
qilin | 5 | Air International Thermal Systems, Brazosport College, SC PaderTeG Cabluri Elect… |
Global Secret Group | 3 | Tiseo Paving, Johnson City Honda, Lockheed Architectural Solutions, Inc. |
Orova | 3 | Central Florida Civil LLC, Arich Enterprise Co., Ltd., Bai-chi CPA Firm |
ShadowByt3$ | 3 | Sinar Mas Agribusiness and Food Golden Agri-Resources), A-Plus Software Limited,… |
chaos | 3 | parkderochie.com, mswalker.com, copcp.com |
akira | 2 | WINTER Ingenieure, Davis & Ferber |
direwolf | 2 | National Kidney Registry, Studio Legale ESE |
AuditTeam | 1 | ma***up |
Dark Project | 1 | Pump Engineering Company |
genesis | 1 | S******* |
safepay | 1 | industry.airliquide.kr |
IOC Volume
543 new IOCs in this window. By source:
| Source | Count |
|---|---|
urlhaus | 543 |
Recent OSINT Events
No curated MISP events in this window (bulk-IOC contributions tallied in IOC Volume).
Active Malware Families
18 malware families active this week (0 corroborated across ≥2 sources), exercising 16 ATT&CK techniques. Family is the unit, not the indicator: the raw IOCs are drill-down evidence below, not the signal.
| Family | Type | Corrob. | IOCs | Techniques (✗ = coverage gap) |
|---|---|---|---|---|
| Mirai | botnet | — | 775 | T1110, T1498, T1499, T1584.005 |
| ConnectWise ScreenConnect (abuse) | rmm-abuse | — | 89 | T1219 |
| ClickFix | delivery → | — | 19 | T1059.001, T1204 |
| AgentTesla | stealer | — | 12 | T1056.001, T1071, T1114, T1555 |
| XWorm | rat | — | 10 | T1056.001, T1071 |
| PureLogsStealer | stealer | — | 9 | T1005, T1071, T1555 |
| AsyncRAT | rat | — | 8 | T1056.001, T1059.001, T1071, T1219 |
| Formbook | stealer | — | 7 | T1005, T1056.001, T1071, T1555 |
| Remcos | rat | — | 7 | T1056.001, T1071, T1113 |
| CoinMiner | miner | — | 5 | T1496 |
| DDoSAgent | ddos | — | 4 | T1498, T1499 |
| Vidar | stealer | — | 3 | T1005, T1071, T1555 |
| ClearFake | delivery → | — | 2 | T1059.001, T1189, T1204 |
| MassLogger | stealer | — | 2 | T1056.001, T1071, T1555 |
| Stealc | stealer | — | 2 | T1005, T1071, T1555 |
| njRAT | rat | — | 1 | T1056.001, T1059.003, T1071, T1219 |
| PhantomStealer | stealer | — | 1 | T1005, T1555 |
| PureHVNC | rat | — | 1 | T1071, T1113 |
Families marked ”→” are delivery/social-engineering clusters (ClickFix, ClearFake). Their technique mappings are the delivery chain — downstream behavior is payload-dependent, so they don’t open a hard coverage gap on their own.
Multi-Source IOCs
2 IOCs flagged by 2+ independent sources this window — the highest-confidence signal the cross-feed corpus produces.
| IOC | Type | Sources | Last seen |
|---|---|---|---|
hypercorevector5.lol | domain | misp + urlhaus | 2026-08-26 |
iploglab.store | domain | misp + urlhaus | 2026-08-26 |
MISP × KEV Correlation
No MISP events in this window referenced a CVE.
Cross-Reference
No recent SEC filings to cross-reference.
Intel Feeds
2 IOC feeds updated this run (2,786 indicators total) — each available as CSV, MISP JSON, and STIX 2.1. Subscribe at https://thrunt.me/intel/manifest.json.
| Feed | Source | Type | Count | Downloads |
|---|---|---|---|---|
| URLhaus — Malware Distribution URLs | urlhaus | url | 2,617 | CSV · MISP · STIX |
| URLhaus — Malware Distribution Domains | urlhaus | domain | 169 | CSV · MISP · STIX |
Hand-Authored Sigma
10 production-ready TTP rules (+2 scaffolds in the authoring queue) live at https://thrunt.me/sigma/manifest.json. Subscribe via https://thrunt.me/sigma/rules.lock.json (content-hash churn) or pull all with https://thrunt.me/sigma/rules.tar.gz.
| Rule | Status | YAML |
|---|---|---|
| T1037 Boot or Logon Initialization Scripts — Linux Init Script Modification | experimental | https://thrunt.me/sigma/t1037-linux-init-script-modification.yml |
| T1055 Process Injection — Rundll32 Spawning Explorer as an Injection Host | experimental | https://thrunt.me/sigma/t1055-rundll32-spawning-explorer-injection.yml |
| T1071.004 DNS-over-HTTPS Resolution from a Non-Browser Process | experimental | https://thrunt.me/sigma/t1071-004-doh-resolver-non-browser-c2.yml |
| T1098.004 Account Manipulation — SSH Authorized Keys File Modification | experimental | https://thrunt.me/sigma/t1098-004-ssh-authorized-keys-write.yml |
| T1102.001 Dead Drop Resolver — EtherHiding Payload Retrieval from BNB Smart Chain Testnet | experimental | https://thrunt.me/sigma/t1102-001-etherhiding-bsc-testnet-dead-drop.yml |
| T1195.002 Compromise Software Supply Chain — Malicious Google Tag Manager Container | experimental | https://thrunt.me/sigma/t1195-002-unapproved-gtm-container-injection.yml |
| T1204.004 Malicious Copy and Paste — ClickFix macOS Terminal Execution | experimental | https://thrunt.me/sigma/t1204-004-clickfix-macos-terminal-execution.yml |
| T1204.004 Malicious Copy and Paste — ClickFix Run Dialog Execution | experimental | https://thrunt.me/sigma/t1204-004-clickfix-run-dialog-execution.yml |
| T1566.002 Spearphishing Link — Luxembourg Hospitality SMS Phishing Campaign | experimental | https://thrunt.me/sigma/t1566-002-luxembourg-hospitality-sms-phish.yml |
| T1574.002 DLL Side-Loading — Signed javac.exe Loading jli.dll from a User-Writable Path | experimental | https://thrunt.me/sigma/t1574-002-signed-javac-sideload-jli.yml |
| T1003.008 OS Credential Dumping — /etc/shadow and /etc/gshadow Access | draft | https://thrunt.meundefined |
| T1530 Data from Cloud Storage — Detection | draft | https://thrunt.meundefined |
Detection Gaps
17 of 156 techniques with corpus signal have zero detection coverage — no SigmaHQ community rule, no thrunt rule. This is the hand-authoring queue; the live view is at https://thrunt.me/corpus/attck/.
| Technique | Name | Active families | MISP | KEV |
|---|---|---|---|---|
T1011 | Exfiltration Over Other Network Medium | — | 0 | 4 |
T1497 | Virtualization/Sandbox Evasion | — | 0 | 4 |
T1562 | — | — | 0 | 3 |
T1573.001 | Symmetric Cryptography | — | 0 | 3 |
T1001 | Data Obfuscation | — | 0 | 2 |
T1499.002 | Service Exhaustion Flood | — | 0 | 2 |
T1530 | Data from Cloud Storage | — | 0 | 2 |
T1562.001 | — | — | 0 | 2 |
T1003.008 | /etc/passwd and /etc/shadow | — | 0 | 1 |
T1070.001 | — | — | 0 | 1 |
…and 7 more below the cut — full list on the rollup.
Pipeline Health
All feeds healthy.
Sources: SEC EDGAR (public domain), CISA Known Exploited Vulnerabilities (public domain), FIRST.org EPSS (per ToS), NIST NVD (public domain), GitHub Security Advisories (per ToS), abuse.ch URLhaus (CC0, attribution), ransomware.live (per ToS), MITRE ATT&CK (CC BY 4.0).
Published by Applied Cybernetics Group via thrunt.me. Heuristic cross-references are labelled as such; verify before action.