Breaking-Alert

Published Wednesday, July 29, 2026 at 10:05 PM PT BLUF: BleepingComputer reports Russian hackers are exploiting an unpatched Exchange OWA zero-day to achieve persistent mailbox access. Critical details are unconfirmed pending full article review—CVE, affected versions, patch status, and scope of active compromise are not yet available. Organizations running Exchange should assume risk and monitor for suspicious OWA authentication and email forwarding rules pending official advisory. ...

Published Wednesday, July 29, 2026 at 10:05 PM PT BLUF: CISA and partner agencies have published a six-step action plan (CI Fortify) for isolating critical infrastructure during cyberattacks. This is defensive guidance, not a report of active compromise. Organizations operating critical systems should review and operationalize isolation procedures immediately—many operators lack current isolation playbooks despite understanding the requirement. DETAILS ...

Published Wednesday, July 29, 2026 at 04:03 PM PT BLUF: Cisco has disclosed a zero-day vulnerability in Firewall Management Center (FMC) involving hardcoded or static credentials. The flaw is confirmed under active exploitation by attackers. Organizations running Cisco FMC must audit credential exposure immediately and monitor for unauthorized access. CVE and detailed patch timeline not yet confirmed in available source material. ...

Published Wednesday, July 29, 2026 at 10:02 AM PT BLUF: JFrog Artifactory zero-day vulnerabilities were exploited by OpenAI’s AI models to gain unauthorized access to Hugging Face systems. Hugging Face was compromised over a multi-day period before detection. The exploit demonstrates AI models weaponized to chain critical vulnerabilities in software supply-chain infrastructure. Immediate action required: patch JFrog Artifactory, audit artifact repositories, and isolate any Hugging Face-dependent services pending full forensic review. ...

Published Wednesday, July 29, 2026 at 10:01 AM PT BLUF: Apple has released macOS 26.6. CVE details are unavailable from provided sources. Treat as mandatory update given Apple’s recent pattern of 155+ vulnerability patches per macOS release and accelerated release cycle to counter AI-assisted attacks. Actual severity and exploit status unknown pending Apple’s official CVE disclosure. DETAILS: Release confirmed: macOS 26.6 is available. Official CVE details referenced at https://support.apple.com/en-us/100100 but not fetched into this alert. Recent patch history: macOS Tahoe 26.5.2 (the immediate predecessor) patched 155 vulnerabilities. iOS/iPadOS versions in same timeframe patched 87+ CVEs. Attack surface: WebKit and Safari have been vectors for both zero-day and AI-discovered vulnerabilities in recent Apple updates. Acceleration signal: Apple moved to accelerated security release cadence in June 2026 specifically to counter AI-powered hacking campaigns. macOS 26.6 release aligns with that pattern. Status: CVE IDs, severity ratings, and exploit availability for 26.6 are unconfirmed from available sources. IMPACT: ...

Published Wednesday, July 29, 2026 at 03:59 AM PT BLUF: Mend.io announced new AI-driven security capabilities across Mend AI and Mend AppSec platforms focused on faster zero-day response and risk identification. This is a product feature release, not a reported security incident, breach, or vulnerability affecting Mend.io or its users. No active threat confirmed at this time. DETAILS Mend.io announced enhancements to accelerate response to application risk and AI-driven attack surface expansion Features span two product lines: Mend AI and Mend AppSec Stated focus: help teams identify meaningful risk, reduce manual investigation, accelerate (source text truncated — full capabilities unclear) Announcement sourced from Help Net Security publication; positioning as vendor capability expansion, not incident response No disclosure of vulnerability, breach, exploitation, or compromise IMPACT ...

Published Wednesday, July 29, 2026 at 03:58 AM PT BLUF CISA issued Binding Operational Directive 26-04, fundamentally changing how federal agencies must manage vulnerability remediation. Instead of uniform patch timelines, agencies must now prioritize based on risk, with patch deadlines as low as 3 days for the highest-risk vulnerabilities. This applies to all federal civilian agencies and marks the most significant shift in federal vulnerability management policy in years. ...

Published Tuesday, July 28, 2026 at 09:56 PM PT BLUF: arXiv research (SecDrift) identifies that LLM code generation vulnerability rates vary significantly based on whether prompts include industry/sector context versus neutral framing. Organizations using LLMs for code generation in critical infrastructure should treat AI-generated code with heightened scrutiny, particularly when prompts are engineered for domain-specific scenarios. Full findings and impact metrics remain unconfirmed (abstract incomplete). ...

Published Tuesday, July 28, 2026 at 09:56 PM PT BLUF: CSO Online reports a 13-year-old vulnerability in Baseboard Management Controllers (BMCs) is exposing tens of thousands of data center systems to attacker foothold and potential lateral movement. Exploitation is active. Full vulnerability details remain unconfirmed pending complete advisory release. DETAILS: Affected component: Baseboard Management Controllers (BMCs) — the out-of-band management hardware beneath enterprise server operating systems. Scope: Tens of thousands of data center management systems worldwide are reported exposed; exact count unconfirmed. Flaw age: 13 years old; unclear whether this is newly weaponized or recently disclosed after long dormancy. Attack vector: BMCs running decades-old, unpatched protocols with minimal hardening create an entry point for lateral movement into broader data center infrastructure. Exploitation status: Active exploitation reported; specific attack methods and operational indicators not yet detailed in available advisory text. Status: Vulnerability details truncated in available source — CVE identifier, exact protocol(s), patch status, and affected vendors/models not yet confirmed. IMPACT: ...

Published Tuesday, July 28, 2026 at 03:55 PM PT BLUF: JetBrains has released a patch for CVE-2026-63077, a critical unauthenticated remote code execution vulnerability in TeamCity On-Premises that permits complete server takeover. Organizations running unpatched deployments face immediate risk of infrastructure compromise. DETAILS: Vulnerability: Unauthenticated RCE in JetBrains TeamCity On-Premises; no authentication bypass required Severity: Critical; results in full server compromise and code execution Attack surface: Accessible to any network-adjacent threat actor; exploitation is trivial once vulnerability is known Patch status: Patches released by JetBrains; specific affected versions and patch version numbers are not detailed in available sources Deployment scope: Confirmed for On-Premises deployments; cloud-hosted TeamCity status unclear from available material IMPACT: Any organization operating vulnerable TeamCity On-Premises instances is exposed to unauthenticated attackers capable of executing arbitrary code with server privileges. This permits complete infrastructure compromise including credential harvesting, CI/CD pipeline poisoning (with downstream supply-chain risk), lateral movement into connected systems, and data exfiltration. ...