Daily Security Briefing

Published Tuesday, July 14, 2026 at 12:37 PM PT 14 JUL 2026 BLUF: Russian state actors actively exploiting router vulnerabilities to target critical infrastructure across NATO; concurrent AI-enabled cyberattacks now executing full attack chains with minimal human intervention; SAP NetWeaver critical flaws pose immediate risk to enterprise systems; Iran-US military escalation has closed Strait of Hormuz, disrupting global energy infrastructure. CYBER • Russian APT targeting critical infrastructure via router exploitation. UK and EU intelligence attribute campaign to Russian state-sponsored unit; Poland’s power grid was target of attempted breach. Attack vector: weak router security configurations enabling lateral movement into SCADA/ICS environments. [NCSC-UK, EU] [HIGH CONFIDENCE] ...

Published Tuesday, July 14, 2026 at 09:00 AM PT 14 JUL 2026 BLUF: Active exploitation of Microsoft 365 and SAP infrastructure ongoing; OAuth spoofing campaign targeting Entra ID at scale; supply chain compromise in JavaScript ecosystem; Iran conflict escalation with first armed surface drone combat employment. CYBER • Microsoft 365 Account Takeover Campaign (Forg365 PaaS): Phishing-as-a-service platform distributed via Telegram lowering technical barrier to M365 account compromise; new kits evade MFA via OAuth client ID spoofing. [BleepingComputer, Help Net Security] [HIGH CONFIDENCE]. Affects millions of Entra ID accounts; credential validation now possible without user interaction. ...

Published Monday, July 13, 2026 at 09:00 AM PT 13 JUL 2026 BLUF: Russian GRU cyber operations against critical infrastructure escalating globally; US/allies issued coordinated warning 13 JUL. RabbitMQ broker vulnerabilities (OAuth secret exposure, complete takeover risk) require immediate patching in production environments. Iran conflict kinetic activity ongoing with new maritime drone employment. CYBER • Russian GRU Critical Infrastructure Campaign — ACTIVE THREAT: US, UK, NCSC, and allied cybersecurity authorities issued joint advisory 13 JUL warning of sustained Russian state cyber targeting of critical infrastructure sectors globally. Focus on poorly configured external-facing systems and legacy protocols. [NCSC-UK, CISA] [HIGH CONFIDENCE] ...

Published Sunday, July 12, 2026 at 09:00 AM PT 12 JUL 2026 | PREPARED FOR: SENIOR SRE/INFRASTRUCTURE ENGINEER, LOS ANGELES BLUF: Multiple actively-exploited vulnerabilities in CMS platforms and enterprise software now weaponized in coordinated global campaign; supply chain compromise in npm ecosystem (jscrambler 8.14.0) delivering Rust infostealer; U-Boot secure boot bypass affects millions of embedded devices; internal network anomalies flagged requiring immediate investigation. ...

Published Saturday, July 11, 2026 at 09:00 AM PT 11 JUL 2026 BLUF: Ghostcommit prompt-injection-via-image technique poses active threat to AI-assisted code review pipelines; six new exploits in wild for Linux kernel, Apache Tomcat, and Zimbra; Glendale Community College breach (793K records) confirms education sector remains high-value target; U-Boot firmware vulnerabilities enable pre-boot code execution. CYBER • Ghostcommit prompt injection attack now weaponized — Researchers demonstrated method to embed malicious prompts in image files, bypassing AI-driven code review processes and enabling secret exfiltration from development environments. [BleepingComputer, news4hackers] [HIGH CONFIDENCE]. Immediate risk to CI/CD pipelines using vision-capable LLM agents for security scanning. ...

Published Friday, July 10, 2026 at 09:00 AM PT 10 JUL 2026 BLUF: GigaWiper backdoor poses dual espionage-destruction risk to critical infrastructure; Iran-Russia military coordination escalating amid failed ceasefire; Election Assistance Commission governance gap creates election security vulnerability. CYBER • GigaWiper Backdoor — Active Threat to Critical Infrastructure. Microsoft disclosed new backdoor malware blurring espionage/wiper functionality; enables on-demand destructive payload execution. Targets unclear but infrastructure operators should assume critical systems in scope. [Microsoft/CSO Online] [HIGH CONFIDENCE]. Immediate action: scan for C2 beaconing, review EDR logs for suspicious command execution patterns. ...

Published Thursday, July 09, 2026 at 09:00 AM PT 09 JUL 2026 BLUF: Manufacturing sector remains primary ransomware target; AI-assisted coding tools exploited to bypass sandbox controls; US-Iran military escalation ongoing with Strait of Hormuz weaponization risk. CYBER • Manufacturing Ransomware Surge: ZeroFox reporting manufacturing remains highest-value ransomware target amid critical infrastructure threats. [ZeroFox] [HIGH CONFIDENCE] — operational priority for SRE teams managing industrial control systems or OT-adjacent cloud infrastructure. ...

Published Tuesday, July 07, 2026 at 09:00 AM PT 07 JUL 2026 BLUF: SolarWinds Web Help Desk RCE (CVE-2025-26399) actively exploited in wild; axios npm supply chain compromise ongoing; NATO Ankara summit convenes amid Ukraine endgame planning; power constraints threaten AI datacenter expansion in US regions. CYBER • SolarWinds Web Help Desk RCE — Active Exploitation. CVE-2025-26399 (deserialization/RCE) confirmed in active exploitation against Web Help Desk deployments. [Huntress] [HIGH CONFIDENCE]. Immediate patch/isolation required for any WHD instances in production; this is not theoretical. ...

Published Sunday, July 05, 2026 at 09:00 AM PT BLUF: EDR bypass techniques and RMM tool exploitation remain active TTPs; new APT group targeting power infrastructure across three countries with AI-assisted malware; NATO summit security posture elevated amid Russia-Ukraine tensions. CYBER • EDR bypass via exception handler abuse documented in active use; adversaries hooking user-mode EDR hooks to evade detection. Technique lowers barrier to entry for commodity malware operators. [MalwareTech] [MODERATE CONFIDENCE] ...

Published Saturday, July 04, 2026 at 09:00 AM PT 04 JUL 2026 BLUF: Confidential computing’s attestation layer is cryptographically broken; Sednit APT resurging with operational tempo; critical RMM/Exchange vulnerabilities remain actively exploited across US SMB infrastructure. CYBER • Confidential Computing Attestation Compromise — Core trust mechanism in confidential computing (Intel SGX, AMD SEV, ARM CCA) contains fundamental cryptographic flaw with no known remediation path. Affects all cloud providers offering confidential VMs. [The Register Security] [HIGH CONFIDENCE] — Immediate implication: encrypted workload attestation cannot be trusted; supply chain validation for containerized infrastructure at scale now suspect. ...