Morning Brief — 2026-09-22

2 material breach disclosures, 1 federal patching priority, 20 exploit probability movers, 10 emerging critical cves, 3 supply chain, 28 ransomware activity, 1195 ioc volume, 12 active malware families, 3 multi-source iocs, 2 intel feeds, 18 hand-authored sigma, and 18 detection gaps. Sections with no signal are still rendered with an explicit “none in this window” note so absence is visible alongside presence.

Material Breach Disclosures

Nutex Health Inc. (NUTX)

• Filed: 2026-09-11 · CIK 0001479681 · Accession 0001628280-26-061432
• Filing: https://www.sec.gov/Archives/edgar/data/1479681/000162828026061432/materiality_assessmentxupd.htm

Forward-Looking StatementsCertain statements and information included in this press release constitute “forward-looking statements” within the meaning of the Private Securities Litigation Reform Act of 1995. When used in this press release, the words or phrases “will,” “will likely result,” “expected to,” “will continue,” “anticipated,” “estimate,” “projected,” “intend,” “goal,” or similar express…

BOSTON SCIENTIFIC CORP (BSX)

• Filed: 2026-09-08 · CIK 0000885725 · Accession 0000885725-26-000059
• Filing: https://www.sec.gov/Archives/edgar/data/885725/000088572526000059/bsx-20260907.htm

As previously disclosed in a Current Report on Form 8-K filed on August 26, 2026 with the Securities and Exchange Commission, on August 25, 2026, Boston Scientific Corporation (the “Company”) identified a cybersecurity incident that affected certain of its information technology systems and resulted in a global disruption to the Company’s operations. Upon detection, the Company activated its incid…

Federal Patching Priority

CVE-2026-7273 — Zyxel GS1900 Series Switches

Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability

• Added: 2026-09-21 · Federal due: 2026-09-24 · EPSS 24.6th pct (score 0.003) · CVSS 8.8 (HIGH) · CWE-121
• ransomware use: Unknown

Zyxel GS1900 series switches contain a stack-based buffer overflow vulnerability in the CGI program which could allow a LAN-based, unauthenticated attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request.

A stack-based buffer overflow vulnerability in the CGI program of Zyxel GS1900-48HPv2 firmware versions through 2.90(ABTQ.1)C0 could allow a LAN-based, unauthenticated attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request.

Exploit Probability Movers

Emerging Critical CVEs

• CVE-2026-93952 · CRITICAL (10.0) · 2026-09-22 — VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confi…
• CVE-2026-94493 · CRITICAL (10.0) · 2026-09-22 — A vulnerability was detected in Gigatech PDV5701 1.0.31_240305_112640. This issue affects some unknown processing of the file /index.html of the component WebSocket Service. The manipulation results in missing authentica…
• CVE-2026-77521 · CRITICAL (10.0) · 2026-09-21 — MaxKB is an open-source AI assistant for enterprise. Prior to version 2.10.5-lts, assistants with a tool, MCP tool, skill, or sub-application use SandboxShellBackend, which exposes an execute shell tool without excluding…
• CVE-2026-79920 · CRITICAL (9.9) · 2026-09-21 — Ajenti is a Linux & BSD modular server admin panel. Prior to version 2.2.16, any authenticated user can call /api/core/tasks/start to enqueue InstallPlugin, UnInstallPlugin, or UpgradeAll from plugins/plugins/tasks.py wi…
• CVE-2026-19658 · CRITICAL (9.8) · 2026-09-22 — The Give Tributes plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.3.1 via deserialization of untrusted input . This makes it possible for unauthenticated attackers to in…
• CVE-2026-13355 · CRITICAL (9.8) · 2026-09-22 — The Meta Box AIO plugin for WordPress is vulnerable to Privilege Escalation to Administrator in versions up to, and including, 3.11.0. This is due to a chained flaw: the populate_via_query_string() function in the mb-fro…
• CVE-2026-85751 · CRITICAL (9.8) · 2026-09-21 — Mailu is a mail server distributed as a set of Docker images. From Mailu 2.0 until 2024.06.55 and prior to Mailu helm-charts 2.7.3, deployments with PROXY_AUTH_WHITELIST configured but REAL_IP_HEADER unset trusted a clie…
• CVE-2026-94301 · CRITICAL (9.8) · 2026-09-21 — The fix for CVE-2026-47065/ZDRES-232 (“resolveProxyClass Not Overridden - acceptMatchers Filter Bypass via java.lang.reflect.Proxy”), released on 2026-06-02 and announced as “Fully addressed” in MINA 2.2.8, 2.1.13 and 2.…
• CVE-2026-58491 · CRITICAL (9.3) · 2026-09-21 — Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.25.5, the /@warpgate/api/sso/providers/:name/start endpoint stores an attacker-controlled next parameter that the POST /@warpgate/api/sso…
• CVE-2026-79916 · CRITICAL (9.1) · 2026-09-21 — MaxKB is an open-source AI assistant for enterprise. Prior to 2.10.5-lts, authenticated workspace members can inject control characters into AWS Bedrock access_key_id and secret_access_key fields that _update_aws_credent…

Supply Chain

GHSA-pxcx-fv34-x9p5 · CVE-2026-61628 (go)

• HIGH · CVSS 8.1 · 2026-09-21
• Affected: github.com/lucasdillmann/nginx-ignition
• https://github.com/advisories/GHSA-pxcx-fv34-x9p5

nginx ignition has Unauthenticated Admin Account Creation via Onboarding Race Condition

GHSA-jr34-h97m-9hpx · CVE-2026-61629 (go)

• HIGH · CVSS 7.5 · 2026-09-21
• Affected: github.com/lucasdillmann/nginx-ignition
• https://github.com/advisories/GHSA-jr34-h97m-9hpx

nginx ignition has ParseAcceptLanguage _ separator bypass that enables ~75x CPU amplification via Accept-Language header in i18nMiddleware

GHSA-phg3-3g28-wq9v · CVE-2026-61687 (go)

• HIGH · CVSS 7.1 · 2026-09-21
• Affected: hatchet
• https://github.com/advisories/GHSA-phg3-3g28-wq9v

Hatchet - Unauthenticated OAuth state CSRF / login-CSRF via empty-state collision in ValidateOAuthState

Ransomware Activity

28 new victim postings across 16 groups.

IOC Volume

1195 new IOCs in this window. By source:

Recent OSINT Events

No curated MISP events in this window (bulk-IOC contributions tallied in IOC Volume).

Active Malware Families

12 malware families active this week (1 corroborated across ≥2 sources), exercising 16 ATT&CK techniques. Family is the unit, not the indicator: the raw IOCs are drill-down evidence below, not the signal.

Families marked ”→” are delivery/social-engineering clusters (ClickFix). Their technique mappings are the delivery chain — downstream behavior is payload-dependent, so they don’t open a hard coverage gap on their own.

Multi-Source IOCs

3 IOCs flagged by 2+ independent sources this window — the highest-confidence signal the cross-feed corpus produces.

MISP × KEV Correlation

No MISP events in this window referenced a CVE.

Cross-Reference

No SEC × KEV vendor token matches in this window. (This is a heuristic surface, absence is expected most days.)

Intel Feeds

2 IOC feeds updated this run (4,131 indicators total) — each available as CSV, MISP JSON, and STIX 2.1. Subscribe at https://thrunt.me/intel/manifest.json.

Hand-Authored Sigma

16 production-ready TTP rules (+2 scaffolds in the authoring queue) live at https://thrunt.me/sigma/manifest.json. Subscribe via https://thrunt.me/sigma/rules.lock.json (content-hash churn) or pull all with https://thrunt.me/sigma/rules.tar.gz.

Detection Gaps

18 of 160 techniques with corpus signal have zero detection coverage — no SigmaHQ community rule, no thrunt rule. This is the hand-authoring queue; the live view is at https://thrunt.me/corpus/attck/.

…and 8 more below the cut — full list on the rollup.

Pipeline Health

All feeds healthy.

Sources: SEC EDGAR (public domain), CISA Known Exploited Vulnerabilities (public domain), FIRST.org EPSS (per ToS), NIST NVD (public domain), GitHub Security Advisories (per ToS), abuse.ch URLhaus (CC0, attribution), ransomware.live (per ToS), MITRE ATT&CK (CC BY 4.0).

Published by Applied Cybernetics Group via thrunt.me. Heuristic cross-references are labelled as such; verify before action.