Daily Security Briefing

Published Friday, July 24, 2026 at 09:00 AM PT BLUF: US-Iran strike cycle intensifies as Russian state actors target unpatched infrastructure; concurrent critical Azure/Windows vulns + Tycoon2FA disruption reshape threat landscape; AI supply-chain attacks proliferate. CYBER • Laundry Bear (Russian SVR) exploiting unpatched Zimbra servers — ongoing campaign targeting government and commercial email for ≥12 months. Indicates adversary prioritizes legacy infrastructure over zero-days; vulnerability remains unpatched on critical systems. [Help Net Security] [MODERATE CONFIDENCE] ...

Published Thursday, July 23, 2026 at 09:01 AM PT 23 JUL 2026 BLUF: Russian state actors exploiting zero-day in Zimbra servers with credential-harvesting JavaScript; CVE-2026-64600 (RefluXFS Linux kernel) enables local-to-root on RHEL defaults in production; 7-Zip RCE (CVE-2026-14266) circulating. CENTCOM sustains Iran air operations into week two; unconfirmed Su-57 loss near Moscow. US-Saudi nuclear deal announced amid nonproliferation pushback. CYBER Russian Zimbra campaign (zero-day + credential theft). CISA / Unit 42 reporting active exploitation of Zimbra Collaboration Suite using previously undisclosed zero-day; attackers inject JavaScript into webmail to harvest login credentials and bypass MFA via pass-the-cookie. High volume, targeting Western organizations. No patch available as of 23 JUL 0600Z. [CISA Alert / Unit 42] [HIGH CONFIDENCE] ...

Published Wednesday, July 22, 2026 at 09:00 AM PT BLUF: Actively-exploited Langflow RCE + OpenAI model sandbox escape require immediate patching; U.S. casualties in Jordan escalate Iran conflict; Oracle CPU delivery (1,449 patches) strains update cycles; Microsoft Exchange 2016/2019 support ends October 2026. CYBER • Langflow RCE (actively exploited). CISA issued urgent action order on unauthenticated remote code execution in Langflow. Attack observed in production. Patch immediately if deployed. [CISA] [HIGH CONFIDENCE] ...

Published Tuesday, July 21, 2026 at 11:33 AM PT BLUF: Qilin ransomware actively exploiting critical Palo Alto VPN zero-day; Oracle EBS zero-day used in live breach (Estée Lauder); AI agent sandbox escapes enable code execution on developer systems; government sector targeted with 187 ransomware incidents in H1 2026. CYBER • Palo Alto Networks VPN critical vulnerability actively exploited by Qilin ransomware gang. Exploitation in the wild; no patch details released yet. [BleepingComputer] [HIGH CONFIDENCE] ...

Published Tuesday, July 21, 2026 at 10:52 AM PT BLUF: Palo Alto VPN zero-day actively exploited by ransomware; Oracle EBS zero-day hit Estée Lauder supply chain; N-day window collapsing to hours. CYBER Palo Alto Networks VPN critical vulnerability now exploited by Qilin ransomware gang. Unpatched instances exposed to remote code execution. Widespread adoption in enterprise/critical infrastructure makes this immediate threat vector. [BleepingComputer] [HIGH CONFIDENCE] Oracle EBS zero-day (unpatched) breached Estée Lauder. Supply chain reconnaissance indicator; attackers testing enterprise cloud infrastructure entry points. [news4hackers] [HIGH CONFIDENCE] ...

Published Monday, July 20, 2026 at 09:00 AM PT 20 JUL 2026 BLUF: WordPress pre-authentication RCE (wp2shell, CVE-2026-63030/60137) actively exploited; Hugging Face breach via autonomous AI agent; Russian IP camera compromise targeting NATO logistics; critical water infrastructure cybersecurity expansion underway. CYBER • WordPress Core RCE Chain (wp2shell) — Two chained vulnerabilities (CVE-2026-63030, CVE-2026-60137) enable pre-authentication remote code execution in recent WordPress versions. Unauthenticated attackers can achieve RCE without credentials. [Tenable, CSO Online] [HIGH CONFIDENCE]. Immediate patching required for any WordPress installations in production; REST API endpoints particularly exposed. ...

Published Sunday, July 19, 2026 at 09:00 AM PT BLUF: China-nexus APT targeting US medical/defense AI research; SonicWall SMA zero-days actively exploited; Coca-Cola subsidiary ransomware disruption ongoing; WordPress critical RCE variants in wild. CYBER • China-nexus threat actor conducting sustained campaign against US medical and defense research institutions. Target set includes public and private medical organizations pursuing AI, cyber, medical, and national defense research. [Google Threat Intelligence] [HIGH CONFIDENCE] — Indicates strategic focus on dual-use AI/medical technology with potential military application. Organizations have been notified; remediation assistance offered. ...

Published Friday, July 17, 2026 at 02:28 PM PT 17 JUL 2026 BLUF: Critical SharePoint RCE (CVE-2026-58644) actively exploited in wild; Windows LegacyHive zero-day privilege escalation disclosed; FortiSandbox command injection added to KEV catalog with active attack evidence. Immediate patching required across production environments. CYBER • CVE-2026-58644 (Microsoft SharePoint RCE) — ACTIVE EXPLOITATION: Microsoft published advisory 14 JUL on critical RCE affecting on-premises SharePoint Server (CVSS 9.8). Threat actors exploiting in wild within 72 hours of disclosure. [Rapid7, Microsoft Security] [HIGH CONFIDENCE]. Affects all on-premises deployments; cloud instances unaffected. Patch availability confirmed; deployment timeline critical for SRE teams managing legacy SharePoint infrastructure. ...

Published Thursday, July 16, 2026 at 09:00 AM PT 16 JUL 2026 BLUF: Two actively-exploited Microsoft zero-days (SharePoint, AD FS) and SonicWall remote-access appliance zero-days pose immediate risk to federal and enterprise infrastructure; CISA enforcement deadline Saturday for Oracle E-Business flaw; Iran military escalation ongoing with US strikes. CYBER • Microsoft SharePoint/AD FS Zero-Days (CVE-2026-56164, CVE-2026-56155) — Both vulnerabilities actively exploited in the wild as of 16 JUL. CISA has issued urgent hardening guidance for SharePoint deployments. [CISA] [HIGH CONFIDENCE] Patch Tuesday (July 2026) patches available; federal agencies and critical infrastructure operators should prioritize deployment within 48 hours. ...

Published Wednesday, July 15, 2026 at 09:00 AM PT 15 JUL 2026 BLUF: Microsoft Patch Tuesday (July 2026) released 570+ CVEs including two actively exploited flaws; SonicWall SMA 1000 zero-days under active attack; AsyncAPI npm supply chain compromise affecting 2M weekly downloads; Iran cyber operations targeting US water infrastructure PLCs. CYBER • Microsoft CVE-2026-56155 / CVE-2026-[redacted] — Active Exploitation: Two Microsoft vulnerabilities confirmed in active use by threat actors as of 07 JUL. [CISA Known Exploited Vulnerabilities catalog] [HIGH CONFIDENCE]. Patch Tuesday release included 570+ total advisories, highest volume recorded; AI-assisted vulnerability discovery cited as driver. [Help Net Security] Immediate patching required for Windows infrastructure. ...