Morning Brief — 2026-09-09

4 material breach disclosures, 4 federal patching priority, 1 exploit probability movers, 10 emerging critical cves, 11 supply chain, 27 ransomware activity, 574 ioc volume, 14 active malware families, 2 intel feeds, 12 hand-authored sigma, and 18 detection gaps. Sections with no signal are still rendered with an explicit “none in this window” note so absence is visible alongside presence.

Material Breach Disclosures

BOSTON SCIENTIFIC CORP (BSX)

• Filed: 2026-09-08 · CIK 0000885725 · Accession 0000885725-26-000059
• Filing: https://www.sec.gov/Archives/edgar/data/885725/000088572526000059/bsx-20260907.htm

As previously disclosed in a Current Report on Form 8-K filed on August 26, 2026 with the Securities and Exchange Commission, on August 25, 2026, Boston Scientific Corporation (the “Company”) identified a cybersecurity incident that affected certain of its information technology systems and resulted in a global disruption to the Company’s operations. Upon detection, the Company activated its incid…

Park Dental Partners, Inc. (PARK)

• Filed: 2026-09-01 · CIK 0002069604 · Accession 0001104659-26-104300
• Filing: https://www.sec.gov/Archives/edgar/data/2069604/000110465926104300/park-20260828x8k.htm

On August 28, 2026, Park Dental Partners, Inc. (“we” or the “Company”) identified unauthorized access to its computer network. The Company promptly initiated its incident response protocols, and engaged its external cybersecurity and forensic specialists. The Company is continuing to investigate the nature and scope of this incident, including the scope of any compromise of personal or protected h…

NovoCure Ltd (NVCR)

• Filed: 2026-09-01 · CIK 0001645113 · Accession 0001645113-26-000065
• Filing: https://www.sec.gov/Archives/edgar/data/1645113/000164511326000065/nvcr-20260901.htm

Forward-Looking StatementsIn addition to historical facts or statements of current condition, this press release may contain forward-looking statements. Forward-looking statements provide Novocure’s current expectations or forecasts of future events. These may include statements regarding anticipated scientific progress on its research programs, clinical study progress, development of potential pr…

Nutex Health Inc. (NUTX)

• Filed: 2026-08-31 · CIK 0001479681 · Accession 0001628280-26-059602
• Filing: https://www.sec.gov/Archives/edgar/data/1479681/000162828026059602/nutx-20260831.htm

remediation of the incident. Readers are cautioned that these forward-looking statements are not guarantees of future events or outcomes and they should not be unduly relied on, as they are based on information available to the Company and on management’s current beliefs and expectations as of the date of this Current Report on Form 8-K and are therefore inherently uncertain and subject to risks,…

Federal Patching Priority

CVE-2026-75650 — Adobe Commerce and Magento

Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine Vulnerability

• Added: 2026-09-08 · Federal due: 2026-09-11 · EPSS 50.0th pct (score 0.007) · CVSS 10.0 (CRITICAL) · CWE-1336
• ransomware use: Unknown

Adobe Commerce and Magento Open Source contain an improper neutralization of special elements used in a template engine vulnerability that could allow an attacker to execute arbitrary code.

Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

CVE-2026-86218 — N-able N-central

N-able N-central Static Code Injection Vulnerability

• Added: 2026-09-08 · Federal due: 2026-09-11 · EPSS 34.3th pct (score 0.004) · CVSS 9.8 (CRITICAL) · CWE-96
• ransomware use: Unknown

N-able N-central contains a static code injection vulnerability that could allow for pre-authentication remote code execution.

N-central is vulnerable to a pre-auth remote code execution This issue affects N-central: before 2026.3.1.14.

CVE-2026-81963 — Microsoft Windows

Microsoft Windows Link Following Vulnerability

• Added: 2026-09-08 · Federal due: 2026-09-22 · CVSS 7.8 (HIGH) · CWE-59, CWE-284
• ransomware use: Unknown

Microsoft Windows Update Stack contains a link following vulnerability that allows a local attacker to escalate privileges locally up to SYSTEM.

Improper link resolution before file access (‘link following’) in Windows Update Stack allows an authorized attacker to elevate privileges locally.

CVE-2026-85880 — Microsoft Windows

Microsoft Windows Heap-Based Buffer Overflow Vulnerability

• Added: 2026-09-08 · Federal due: 2026-09-22 · CVSS 7.8 (HIGH) · CWE-122, CWE-908
• ransomware use: Unknown

Microsoft Windows Advanced Local Procedure Call contains a heap-based buffer overflow vulnerability that allows an attacker to elevate privileges locally.

Heap-based buffer overflow in Windows ALPC allows an authorized attacker to elevate privileges locally.

Exploit Probability Movers

Emerging Critical CVEs

• CVE-2026-82004 · CRITICAL (10.0) · 2026-09-08 — Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an OS Command (‘OS Command Injection’) vulnerability that could result in arbitrary code execution in the context of the…
• CVE-2026-84869 · CRITICAL (9.9) · 2026-09-08 — A condition in the ScreenConnect client may allow files to be transferred and executed through an active remote session without authorization or Host confirmation in certain circumstances. ScreenConnect servers are not i…
• CVE-2026-48273 · CRITICAL (9.9) · 2026-09-08 — ColdFusion is affected by an Improper Neutralization of Directives in Dynamically Evaluated Code (‘Eval Injection’) vulnerability that could result in arbitrary code execution in the context of the current user. A low-pr…
• CVE-2026-19232 · CRITICAL (9.9) · 2026-09-08 — Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the v…
• CVE-2026-83941 · CRITICAL (9.9) · 2026-09-08 — Missing authorization in Entra ID allows an authorized attacker to elevate privileges over a network.
• CVE-2026-26084 · CRITICAL (9.9) · 2026-09-08 — A improper access control vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox Cloud 5.0.4 through 5.0.5, FortiSandbox PaaS 5.0.4 through 5.0.5 may allow attacker to…
• CVE-2026-12650 · CRITICAL (9.9) · 2026-09-08 — A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server.
• CVE-2026-12647 · CRITICAL (9.9) · 2026-09-08 — A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server.
• CVE-2026-12646 · CRITICAL (9.9) · 2026-09-08 — A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server.
• CVE-2026-12645 · CRITICAL (9.9) · 2026-09-08 — A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server.

Supply Chain

GHSA-2x7j-588g-ccc2 (npm)

• HIGH · CVSS 7.5 · 2026-09-08
• Affected: nodemailer
• https://github.com/advisories/GHSA-2x7j-588g-ccc2

Nodemailer: Quadratic (O(n²)) time complexity in addressparser allows remote denial of service via a crafted address list

GHSA-2q42-4q24-7rgv (npm)

• HIGH · CVSS 7.1 · 2026-09-08
• Affected: @typespec/openapi3, @typespec/compiler
• https://github.com/advisories/GHSA-2q42-4q24-7rgv

OpenAPI3 version value escapes emitterOutputDir and overwrites YAML/JSON outside the output tree

GHSA-wc9g-mqfw-jrwm · CVE-2026-77078 (npm)

• HIGH · CVSS 7.5 · 2026-09-08
• Affected: multer
• https://github.com/advisories/GHSA-wc9g-mqfw-jrwm

multer vulnerable to Denial of Service via crafted multipart field names

GHSA-qfvm-cv95-jqjf · CVE-2026-77037 (npm)

• HIGH · CVSS 7.5 · 2026-09-08
• Affected: multer
• https://github.com/advisories/GHSA-qfvm-cv95-jqjf

multer vulnerable to Denial of Service via file descriptor leak on aborted uploads

GHSA-535w-7cp7-47q4 · CVE-2026-82333 (npm)

• HIGH · CVSS 7.5 · 2026-09-08
• Affected: multer
• https://github.com/advisories/GHSA-535w-7cp7-47q4

multer vulnerable to Denial of Service via oversized array index in field names

GHSA-96p9-rh4f-92cf · CVE-2026-84452 (pip)

• HIGH · 2026-09-08
• Affected: winml-cli
• https://github.com/advisories/GHSA-96p9-rh4f-92cf

Windows ML CLI: CORS misconfig enables localhost RCE

GHSA-65fr-j4p9-vc33 · CVE-2026-81525 (composer)

• HIGH · CVSS 8.1 · 2026-09-08
• Affected: mongodb/mongodb, mongodb/mongodb
• https://github.com/advisories/GHSA-65fr-j4p9-vc33

mongodb: Reject ”.” and NUL bytes in database and collection names

GHSA-26w7-cxv4-gfx2 (npm)

• CRITICAL · CVSS 9.8 · 2026-09-08
• Affected: astro
• https://github.com/advisories/GHSA-26w7-cxv4-gfx2

Astro: Remote code execution through AVIF image optimization

GHSA-rvx4-ffvw-m9q3 · CVE-2026-84361 (composer)

• HIGH · 2026-09-08
• Affected: composer/composer, composer/composer
• https://github.com/advisories/GHSA-rvx4-ffvw-m9q3

Composer arbitrary command execution via a malicious package’s Perforce source URL

GHSA-rgj7-g3m4-5g8c (npm)

• HIGH · 2026-09-08
• Affected: sharp
• https://github.com/advisories/GHSA-rgj7-g3m4-5g8c

sharp: Vulnerabilities in libheif: GHSA-g89c-p67h-r497 and GHSA-2jg2-4ch7-h545

Exploitation evidence, 7-day window (severity-agnostic — evidence trumps labels):

• GHSA-rcr6-4jqh-j84m (CVE-2026-60004, go) · 2026-09-08 — in CISA KEV · EPSS p99.7

Ransomware Activity

27 new victim postings across 11 groups.

IOC Volume

574 new IOCs in this window. By source:

Recent OSINT Events

No curated MISP events in this window (bulk-IOC contributions tallied in IOC Volume).

Active Malware Families

14 malware families active this week (0 corroborated across ≥2 sources), exercising 17 ATT&CK techniques. Family is the unit, not the indicator: the raw IOCs are drill-down evidence below, not the signal.

Families marked ”→” are delivery/social-engineering clusters (ClickFix, GuLoader). Their technique mappings are the delivery chain — downstream behavior is payload-dependent, so they don’t open a hard coverage gap on their own.

Multi-Source IOCs

No IOCs corroborated across multiple sources in this window. Each feed reported uniquely.

MISP × KEV Correlation

No MISP events in this window referenced a CVE.

Cross-Reference

No SEC × KEV vendor token matches in this window. (This is a heuristic surface, absence is expected most days.)

Intel Feeds

2 IOC feeds updated this run (3,117 indicators total) — each available as CSV, MISP JSON, and STIX 2.1. Subscribe at https://thrunt.me/intel/manifest.json.

Hand-Authored Sigma

10 production-ready TTP rules (+2 scaffolds in the authoring queue) live at https://thrunt.me/sigma/manifest.json. Subscribe via https://thrunt.me/sigma/rules.lock.json (content-hash churn) or pull all with https://thrunt.me/sigma/rules.tar.gz.

Detection Gaps

18 of 158 techniques with corpus signal have zero detection coverage — no SigmaHQ community rule, no thrunt rule. This is the hand-authoring queue; the live view is at https://thrunt.me/corpus/attck/.

…and 8 more below the cut — full list on the rollup.

Pipeline Health

All feeds healthy.

Sources: SEC EDGAR (public domain), CISA Known Exploited Vulnerabilities (public domain), FIRST.org EPSS (per ToS), NIST NVD (public domain), GitHub Security Advisories (per ToS), abuse.ch URLhaus (CC0, attribution), ransomware.live (per ToS), MITRE ATT&CK (CC BY 4.0).

Published by Applied Cybernetics Group via thrunt.me. Heuristic cross-references are labelled as such; verify before action.