Breaking-Alert

Published Saturday, July 25, 2026 at 09:15 AM PT BLUF: Iranian-affiliated cyber actors are conducting active exploitation campaigns against internet-exposed programmable logic controllers (PLCs) across US critical infrastructure. All organizations operating networked PLCs must immediately audit internet-facing assets and apply manufacturer hardening. Exploitation enables remote code execution and potential operational disruption in energy, water, manufacturing, and other critical sectors. ...

Published Friday, July 24, 2026 at 10:19 PM PT BLUF: IPS detected a lateral scan from 192.168.1.86 attempting connections to 5 ports on 192.168.1.138 (nova-core subnet) over 60 seconds. Source and intent are unconfirmed; immediate identification of both endpoints and network isolation assessment required. DETAILS Event: Port probe targeting nova-core (192.168.1.138) from internal source 192.168.1.86; 5 distinct ports scanned in 60-second window. Scope: Internal network only (no external routing observed in alert). Status: Lateral movement detected (reconnaissance phase); no confirmation yet of successful connection, shell access, or data movement. Source endpoint unknown: 192.168.1.86 identity not provided in alert; could be user workstation, IoT device, compromised endpoint, or misconfigured service. Requires immediate ARP/DHCP lookup. Target endpoint: nova-core infrastructure. Which specific nova-core services/ports are unclear from alert metadata alone. IMPACT ...

Published Friday, July 24, 2026 at 03:12 PM PT BLUF: Critical zero-day remote code execution vulnerability disclosed in FastJson 1.2.68–1.2.83 (CVSS 9.0). Java applications using Spring Boot are affected. Inventory and patch all affected instances immediately; exploitation is trivial and active exploitation should be assumed imminent. DETAILS • Vulnerability: Unsafe deserialization in FastJson JSON processing library enables unauthenticated remote code execution when application processes untrusted JSON input. ...

Published Friday, July 24, 2026 at 09:10 AM PT BLUF: Russian state-backed threat actors are actively exploiting a zero-click vulnerability in Zimbra Collaboration Suite to access emails and multi-factor authentication codes from unpatched servers worldwide. Targeted organizations should assume compromise if running unpatched Zimbra and take immediate containment action. DETAILS Attack Vector: Zero-click (or near-zero-click) exploitation requiring no user interaction — attackers bypass standard security warnings and phishing-resistance controls by directly compromising the mail server. ...

Published Friday, July 24, 2026 at 09:09 AM PT BLUF: Zscaler assesses that frontier AI is materially reducing attack timelines by automating reconnaissance, path mapping, and vulnerability discovery. Traditional patch-based defenses now lag threat velocity. No specific incidents confirmed; this reflects strategic threat landscape shift. Organizations relying on patch windows as primary defense control should assume breach-before-remediation scenarios and pivot to zero-trust architecture and continuous deception. DETAILS • Cost compression confirmed. Zscaler reports frontier AI has collapsed the cost (time + resources) required to conduct reconnaissance, map network attack paths, and discover exploitable weaknesses. Attackers no longer assume patching will outpace discovery. ...

Published Friday, July 24, 2026 at 03:08 AM PT BLUF: Google has launched CodeMender, an AI agent that scans code for security flaws, confirms exploitability, and auto-generates fixes. Framed as defensive response to attacker use of AI. CRITICAL: Patch quality, false-positive rates, and long-term security implications remain unverified in preview. Do not auto-deploy generated patches. DETAILS Tool function: CodeMender performs vulnerability detection → exploitability confirmation → patch generation in sequence Positioning: Google argues defenders need AI automation to match attacker speed; tool presented as necessary arms-race response Scope: Preview release (production maturity unknown); generated patches require human review before deployment Related initiative: Parallel launch of Gemini 3.5 Flash Cyber, a specialized vulnerability-hunting model (coverage scope and accuracy both unclear) Coverage: Languages, frameworks, and vulnerability classes supported are NOT detailed in available summaries IMPACT ...

Published Friday, July 24, 2026 at 03:07 AM PT BLUF: US agencies (NSA/CISA/FBI) have updated an advisory warning of active Iranian-affiliated cyber operations targeting internet-exposed industrial control systems—specifically PLCs from Siemens, Schneider Electric, and Rockwell Automation—deployed across critical infrastructure sectors. Organizations managing remote or exposed PLC infrastructure require immediate network segmentation and credential rotation. DETAILS Updated advisory: US agencies re-issued joint cybersecurity advisory first published April 2026; update indicates ongoing, not historical, Iranian threat activity Attack vector: Targeting Programmable Logic Controllers (PLCs) deliberately exposed to the internet or accessible via weak remote access (RDP, SSH, Telnet reported in prior advisories) Affected equipment vendors: Siemens, Schneider Electric, and Rockwell Automation devices identified as primary targets; multi-vendor exploitation suggests broad scanning for vulnerable ICS Scope: Confirmed activity observed across critical infrastructure sectors (water/wastewater treatment systems explicitly mentioned in related disclosures; energy, transportation, and manufacturing facilities presumed at risk) Actor attribution: Iranian-affiliated cyber group; operational tempo assessed as ongoing (not opportunistic) IMPACT ...

Published Thursday, July 23, 2026 at 09:06 PM PT BLUF: Academic researchers have published a segmented fuzzing methodology (“Proton”) that identifies message progression vulnerabilities in Electron applications by chaining exploits across processes. Testing on 589 real-world Electron apps validates end-to-end exploitation potential. Uncertainty: Paper does not disclose which apps are affected, vulnerability counts, or whether findings have been reported to vendors. Assess your Electron supply chain immediately; patch status unknown. ...

Published Thursday, July 23, 2026 at 03:05 PM PT BLUF: Russian state-sponsored actors are actively exploiting a zero-day vulnerability in Zimbra Collaboration Suite to gain unauthorized access to email accounts and steal two-factor authentication codes. Organizations running unpatched Zimbra instances should assume compromise and patch immediately. No public exploit code exists yet, but attacks are ongoing. DETAILS Vulnerability: Zero-click (or “half-click”) flaw in Zimbra Collaboration Suite allows unauthenticated remote code execution without user interaction or social engineering; enables attackers to steal mail, calendar data, and authentication tokens including 2FA recovery codes. ...

Published Thursday, July 23, 2026 at 03:04 PM PT BLUF: Russian state-sponsored espionage group (assessed as Laundry Bear) has been exploiting a Zimbra Collaboration Suite zero-day vulnerability for at least five months (discovered early 2025, patched November 2025) to harvest email and two-factor authentication codes from Western government and private-sector targets. The group continues active exploitation in unpatched or improperly-updated environments. All organizations running Zimbra must immediately verify patch status and isolation posture—patching alone is insufficient without concurrent access reviews. ...