Published Thursday, July 23, 2026 at 09:01 AM PT
23 JUL 2026
BLUF: Russian state actors exploiting zero-day in Zimbra servers with credential-harvesting JavaScript; CVE-2026-64600 (RefluXFS Linux kernel) enables local-to-root on RHEL defaults in production; 7-Zip RCE (CVE-2026-14266) circulating. CENTCOM sustains Iran air operations into week two; unconfirmed Su-57 loss near Moscow. US-Saudi nuclear deal announced amid nonproliferation pushback.
CYBER
Russian Zimbra campaign (zero-day + credential theft). CISA / Unit 42 reporting active exploitation of Zimbra Collaboration Suite using previously undisclosed zero-day; attackers inject JavaScript into webmail to harvest login credentials and bypass MFA via pass-the-cookie. High volume, targeting Western organizations. No patch available as of 23 JUL 0600Z. [CISA Alert / Unit 42] [HIGH CONFIDENCE]
CVE-2026-64600 (RefluXFS Linux local privilege escalation). 9-year-old vulnerability in kernel default on RHEL; allows unprivileged user to escalate to root. Affects standard RHEL builds. No widespread evidence of active exploitation in wild yet, but disclosure imminent and confidence in exploit development is high. [SOC Prime / BleepingComputer / The Hacker News] [MODERATE-to-HIGH CONFIDENCE]
CVE-2026-14266 (7-Zip heap overflow RCE). Newly disclosed flaw in 7-Zip archive handling enables remote code execution via malicious archives. User-driven exploitation vector; low barrier to weaponization. No known active campaign yet. [SOC Prime] [MODERATE CONFIDENCE]
Check Point zero-day (active exploitation). Significant vulnerability in Check Point software confirmed actively exploited by unknown threat actor(s). Patch status and scope not yet disclosed. [news4hackers] [MODERATE CONFIDENCE]
msaRAT malware using browser routing. New variant of msaRAT routes C2 traffic via Chrome/Edge process hijacking, evading network-level detection. Linked to APT targeting Windows environments. [BleepingComputer] [MODERATE CONFIDENCE]
TrickBot DNS-based C&C variant. Fortinet FortiGuard Labs detected new TrickBot iteration using DNS for command & control instead of HTTP, improving evasion and persistence. [news4hackers] [MODERATE CONFIDENCE]
GitHub Actions runners weaponized vs. cPanel/WHM. Threat actors abusing GitHub Actions CI/CD runners to launch attacks against cPanel and WHM control panels on hosted servers. Indicates targeting of managed infrastructure providers. [The Hacker News] [MODERATE CONFIDENCE]
PyPI upload restrictions implemented. Python Package Index tightened package upload restrictions to reduce supply-chain risk surface; defensive measure, not response to active campaign. [news4hackers] [HIGH CONFIDENCE]
Microsoft 365 outage (Teams, SharePoint). Operational incident affecting Teams, SharePoint, and other M365 services. No evidence of malicious cause; appears to be infrastructure failure. Status unknown as of briefing time. [Multiple sources] [HIGH CONFIDENCE — operational issue, not attack]
Exchange Online quarantine bug. Microsoft investigating unauthorized mailbox quarantine issues in Exchange Online; some customers reporting unexpected account locks. Cause under investigation. [news4hackers] [MODERATE CONFIDENCE]
Upbound Group $13M fraud loss. Texas consumer-finance firm disclosed cybersecurity incident resulting in $13M in fraudulent contract losses; breach of customer data (scope TBD). [news4hackers] [HIGH CONFIDENCE — financial impact confirmed]
MILITARY / GEOPOLITICAL
CENTCOM Iran air campaign sustained (week 2). US military conducting ongoing strikes against Iranian targets; campaign now ~14 days old. President Trump threatened yesterday to “destroy” Iran. Attrition math remains asymmetric: US precision munitions costly; Iranian response includes proxy retaliation. No cease-fire signals. [DoDLive / Long War Journal / Task & Purpose] [HIGH CONFIDENCE]
Unconfirmed Su-57 crash near Moscow (23 JUL). Military aircraft crashed in Zvenigorod region outside Moscow; unconfirmed reports identify airframe as Su-57 Felon (5th-gen Russian fighter). Pilot reportedly ejected. Russian military has not formally confirmed loss or airframe type. [The Aviationist / Defence Blog / Russian media] [MODERATE CONFIDENCE — visual identification only, no official Russian statement]
Sikorsky Nomad 100 UAS initial flight tests complete. DARPA EVADE program milestone: Sikorsky completed ground and initial flight testing of Nomad 100 rotor-blown-wing VTOL drone. Demonstrates progress in distributed autonomous air operations. [Soldier Systems / US military sources] [HIGH CONFIDENCE]
RIMPAC 26 exercises ongoing with SINKEX. US and allied navies conducting RIMPAC exercises; sinking exercise (SINKEX) with live fire completed. USS Springfield (SSN-761) shifting homeport to San Diego. [US Navy] [HIGH CONFIDENCE]
Department of War supplemental budget request. Secretary Hegseth and CJCS Gen. Dan Caine testified before Congress requesting additional funding; details not yet public. Likely reflects ongoing Iran operations and Ukraine/NATO posture. [Homeland Preparedness News] [HIGH CONFIDENCE]
Cyber Shield 2026 initiatives announced. DoD emphasizing operational technology (OT) defense and cyber resilience across military installations; new accreditation pathways for ISA/IEC 62443. [Industrial Cyber] [HIGH CONFIDENCE — policy initiative, not tactical threat]
NUCLEAR / WMD
US-Saudi nuclear cooperation deal (23 JUL). Trump administration announced civil nuclear power agreement with Saudi Arabia. Arms Control Association and nonproliferation experts express concern that deal circumvents traditional IAEA enrichment safeguards and sets precedent for weakened oversight. No weapons-program language detected; appears civilian-power-focused. [Arms Control Association / Military sources] [HIGH CONFIDENCE]
IAEA / NPT guardrails erosion risk. Nonproliferation experts assess Saudi deal as potentially undermining 20+ years of safeguard protocols. No immediate IAEA enforcement action signaled. [ACA] [MODERATE CONFIDENCE — expert assessment, not confirmed diplomatic action]
PHYSICAL / LOCAL
- NOSIG. No significant physical security events reported in Los Angeles / Southern California region. Internal infrastructure posture summary unavailable.
ASSESSMENT
Cyber pressure is elevated. The Zimbra zero-day with active credential harvesting represents an immediate risk to any organization using ZCS (mail/groupware servers). RefluXFS on RHEL defaults is a slower-burn threat but affects standard enterprise Linux deployments. Organizations should: (1) isolate Zimbra instances from untrusted networks pending patch; (2) audit for RefluXFS on RHEL 7.x+ and plan kernel updates; (3) validate 7-Zip handling in automation and user workflows.
Military posture toward Iran remains high-risk. Two-week air campaign with no diplomatic off-ramp increases miscalculation risk. Su-57 loss (if confirmed) signals Russian air defense capability degradation but does not change Iran escalation calculus. Saudi nuclear deal signals US shift toward regional power-balancing; counterintuitive if Iran de-escalation is intended.
No imminent WMD events detected. Saudi deal is diplomatic, not weapons-related. No IAEA inspection violations or nuclear test activity reported.
KEY JUDGMENTS: (1) Active Zimbra exploitation and RefluXFS disclosure create twin production-infrastructure risks requiring immediate mitigation; Windows and Linux shops equally affected across different attack surfaces. (2) Iran military operations continue with no settlement indicators; US-Saudi nuke agreement may signal long-game hedging rather than near-term conflict resolution. (3) Cyber threat tempo remains high; supply-chain (PyPI, GitHub Actions, archives) and credential-harvesting campaigns are the primary vectors; traditional malware (TrickBot, msaRAT) persists but evolving toward network-evasion techniques.
Our own posture, for context:
