Military

Published Friday, July 17, 2026 at 02:28 PM PT 17 JUL 2026 BLUF: Critical SharePoint RCE (CVE-2026-58644) actively exploited in wild; Windows LegacyHive zero-day privilege escalation disclosed; FortiSandbox command injection added to KEV catalog with active attack evidence. Immediate patching required across production environments. CYBER • CVE-2026-58644 (Microsoft SharePoint RCE) — ACTIVE EXPLOITATION: Microsoft published advisory 14 JUL on critical RCE affecting on-premises SharePoint Server (CVSS 9.8). Threat actors exploiting in wild within 72 hours of disclosure. [Rapid7, Microsoft Security] [HIGH CONFIDENCE]. Affects all on-premises deployments; cloud instances unaffected. Patch availability confirmed; deployment timeline critical for SRE teams managing legacy SharePoint infrastructure. ...

Published Thursday, July 16, 2026 at 09:00 AM PT 16 JUL 2026 BLUF: Two actively-exploited Microsoft zero-days (SharePoint, AD FS) and SonicWall remote-access appliance zero-days pose immediate risk to federal and enterprise infrastructure; CISA enforcement deadline Saturday for Oracle E-Business flaw; Iran military escalation ongoing with US strikes. CYBER • Microsoft SharePoint/AD FS Zero-Days (CVE-2026-56164, CVE-2026-56155) — Both vulnerabilities actively exploited in the wild as of 16 JUL. CISA has issued urgent hardening guidance for SharePoint deployments. [CISA] [HIGH CONFIDENCE] Patch Tuesday (July 2026) patches available; federal agencies and critical infrastructure operators should prioritize deployment within 48 hours. ...

Published Wednesday, July 15, 2026 at 09:00 AM PT 15 JUL 2026 BLUF: Microsoft Patch Tuesday (July 2026) released 570+ CVEs including two actively exploited flaws; SonicWall SMA 1000 zero-days under active attack; AsyncAPI npm supply chain compromise affecting 2M weekly downloads; Iran cyber operations targeting US water infrastructure PLCs. CYBER • Microsoft CVE-2026-56155 / CVE-2026-[redacted] — Active Exploitation: Two Microsoft vulnerabilities confirmed in active use by threat actors as of 07 JUL. [CISA Known Exploited Vulnerabilities catalog] [HIGH CONFIDENCE]. Patch Tuesday release included 570+ total advisories, highest volume recorded; AI-assisted vulnerability discovery cited as driver. [Help Net Security] Immediate patching required for Windows infrastructure. ...

Published Tuesday, July 14, 2026 at 12:37 PM PT 14 JUL 2026 BLUF: Russian state actors actively exploiting router vulnerabilities to target critical infrastructure across NATO; concurrent AI-enabled cyberattacks now executing full attack chains with minimal human intervention; SAP NetWeaver critical flaws pose immediate risk to enterprise systems; Iran-US military escalation has closed Strait of Hormuz, disrupting global energy infrastructure. CYBER • Russian APT targeting critical infrastructure via router exploitation. UK and EU intelligence attribute campaign to Russian state-sponsored unit; Poland’s power grid was target of attempted breach. Attack vector: weak router security configurations enabling lateral movement into SCADA/ICS environments. [NCSC-UK, EU] [HIGH CONFIDENCE] ...

Published Tuesday, July 14, 2026 at 09:00 AM PT 14 JUL 2026 BLUF: Active exploitation of Microsoft 365 and SAP infrastructure ongoing; OAuth spoofing campaign targeting Entra ID at scale; supply chain compromise in JavaScript ecosystem; Iran conflict escalation with first armed surface drone combat employment. CYBER • Microsoft 365 Account Takeover Campaign (Forg365 PaaS): Phishing-as-a-service platform distributed via Telegram lowering technical barrier to M365 account compromise; new kits evade MFA via OAuth client ID spoofing. [BleepingComputer, Help Net Security] [HIGH CONFIDENCE]. Affects millions of Entra ID accounts; credential validation now possible without user interaction. ...

Published Monday, July 13, 2026 at 09:00 AM PT 13 JUL 2026 BLUF: Russian GRU cyber operations against critical infrastructure escalating globally; US/allies issued coordinated warning 13 JUL. RabbitMQ broker vulnerabilities (OAuth secret exposure, complete takeover risk) require immediate patching in production environments. Iran conflict kinetic activity ongoing with new maritime drone employment. CYBER • Russian GRU Critical Infrastructure Campaign — ACTIVE THREAT: US, UK, NCSC, and allied cybersecurity authorities issued joint advisory 13 JUL warning of sustained Russian state cyber targeting of critical infrastructure sectors globally. Focus on poorly configured external-facing systems and legacy protocols. [NCSC-UK, CISA] [HIGH CONFIDENCE] ...

Published Sunday, July 12, 2026 at 09:00 AM PT 12 JUL 2026 | PREPARED FOR: SENIOR SRE/INFRASTRUCTURE ENGINEER, LOS ANGELES BLUF: Multiple actively-exploited vulnerabilities in CMS platforms and enterprise software now weaponized in coordinated global campaign; supply chain compromise in npm ecosystem (jscrambler 8.14.0) delivering Rust infostealer; U-Boot secure boot bypass affects millions of embedded devices; internal network anomalies flagged requiring immediate investigation. ...

Published Saturday, July 11, 2026 at 09:00 AM PT 11 JUL 2026 BLUF: Ghostcommit prompt-injection-via-image technique poses active threat to AI-assisted code review pipelines; six new exploits in wild for Linux kernel, Apache Tomcat, and Zimbra; Glendale Community College breach (793K records) confirms education sector remains high-value target; U-Boot firmware vulnerabilities enable pre-boot code execution. CYBER • Ghostcommit prompt injection attack now weaponized — Researchers demonstrated method to embed malicious prompts in image files, bypassing AI-driven code review processes and enabling secret exfiltration from development environments. [BleepingComputer, news4hackers] [HIGH CONFIDENCE]. Immediate risk to CI/CD pipelines using vision-capable LLM agents for security scanning. ...

Published Friday, July 10, 2026 at 09:00 AM PT 10 JUL 2026 BLUF: GigaWiper backdoor poses dual espionage-destruction risk to critical infrastructure; Iran-Russia military coordination escalating amid failed ceasefire; Election Assistance Commission governance gap creates election security vulnerability. CYBER • GigaWiper Backdoor — Active Threat to Critical Infrastructure. Microsoft disclosed new backdoor malware blurring espionage/wiper functionality; enables on-demand destructive payload execution. Targets unclear but infrastructure operators should assume critical systems in scope. [Microsoft/CSO Online] [HIGH CONFIDENCE]. Immediate action: scan for C2 beaconing, review EDR logs for suspicious command execution patterns. ...

Published Thursday, July 09, 2026 at 09:00 AM PT 09 JUL 2026 BLUF: Manufacturing sector remains primary ransomware target; AI-assisted coding tools exploited to bypass sandbox controls; US-Iran military escalation ongoing with Strait of Hormuz weaponization risk. CYBER • Manufacturing Ransomware Surge: ZeroFox reporting manufacturing remains highest-value ransomware target amid critical infrastructure threats. [ZeroFox] [HIGH CONFIDENCE] — operational priority for SRE teams managing industrial control systems or OT-adjacent cloud infrastructure. ...