Security

Published Thursday, July 02, 2026 at 07:26 AM PT BLUF: CISA has confirmed a Microsoft SharePoint remote code execution (RCE) vulnerability is being actively exploited in the wild. Organizations running on-premises SharePoint deployments should treat patching as an immediate priority. DETAILS CISA has added a Microsoft SharePoint RCE flaw to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation is occurring. The vulnerability allows remote code execution, meaning an attacker could potentially execute arbitrary code on affected SharePoint servers without requiring physical access. Specific CVE identifier, CVSS score, and technical exploitation details are not confirmed in available reporting at this time — treat scope as developing. CISA’s KEV listing triggers a mandatory remediation deadline for U.S. federal civilian executive branch (FCEB) agencies; private sector organizations are strongly advised to follow the same timeline. Attribution to a specific threat actor or campaign has not been confirmed in available reporting. IMPACT ...

Published Thursday, July 02, 2026 at 07:25 AM PT BLUF: CISA has added CVE-2026-45659, a remote code execution vulnerability in Microsoft SharePoint, to its Known Exploited Vulnerabilities (KEV) catalog following confirmed active exploitation by threat actors. All organizations running affected SharePoint versions should patch immediately. DETAILS CVE-2026-45659 is a remote code execution (RCE) vulnerability affecting Microsoft SharePoint; it has been described as “recently patched” at time of CISA’s warning CISA confirmed active exploitation by threat actors and added the CVE to its KEV catalog — indicating real-world exploitation is verified, not theoretical Multiple outlets (SecurityWeek, BleepingComputer, The Hacker News) are independently reporting active exploitation, corroborating CISA’s assessment NOTE — UNCERTAINTY: Specific technical details of the exploit mechanism, the identity of threat actors involved, and the full scope of affected SharePoint versions have not been confirmed in available source material and should not be assumed NOTE — UNCERTAINTY: CVE-2026-45659 does not match standard current CVE year conventions; treat the CVE identifier as reported but verify against official CISA KEV and Microsoft advisories directly IMPACT Who is affected: Any organization running a vulnerable, unpatched version of Microsoft SharePoint — including on-premises deployments; SharePoint Online status is unconfirmed Scope: SharePoint is widely deployed across enterprise, government, and critical infrastructure environments; exposure potential is broad Risk: Successful RCE exploitation could allow attackers to execute arbitrary code, move laterally, exfiltrate data, or deploy ransomware with no confirmed attribution at this time Federal agencies are subject to mandatory remediation timelines under CISA’s KEV directive (BOD 22-01) RECOMMENDED ACTIONS Patch immediately — Apply Microsoft’s available patch for CVE-2026-45659; confirm patch status across all SharePoint instances Verify scope — Audit all SharePoint deployments (on-premises and hybrid) for affected versions Check for indicators of compromise — Review SharePoint server logs for anomalous activity, particularly unusual process execution or outbound connections Isolate if unpatched — If patching cannot be completed immediately, consider restricting external access to SharePoint instances until remediation is complete Federal agencies — Comply with BOD 22-01 remediation deadlines as specified in the CISA KEV catalog entry SOURCES SecurityWeek — CISA Warns of Actively Exploited Microsoft SharePoint Vulnerability BleepingComputer — CISA: Microsoft SharePoint RCE flaw now actively exploited The Hacker News — SharePoint RCE CVE-2026-45659 Added to CISA KEV After Active Exploitation CISA Known Exploited Vulnerabilities Catalog — verify directly at cisa.gov/known-exploited-vulnerabilities-catalog Microsoft Security Response Center — cross-reference for patch availability and affected version list ⚠️ Verify CVE identifier and affected version scope against official Microsoft and CISA advisories before briefing leadership or initiating enterprise-wide response.

Published Thursday, July 02, 2026 at 01:24 AM PT BLUF: Huntress has disclosed zero-day vulnerabilities in unspecified MSP-facing platforms. Managed Service Providers and their downstream clients are potentially exposed. MSPs should review Huntress’s full disclosure immediately and assess affected platform usage. DETAILS Huntress, a blue team-focused security vendor with an established track record of MSP threat research, has published findings on zero-day vulnerabilities affecting platforms used by MSPs Specific platforms, CVE identifiers, and technical exploitation details are NOT confirmed in available data at this time — full disclosure is contained in the Huntress source publication Huntress has previously identified active exploitation of MSP-adjacent tooling, including RMM abuse and billing software vulnerabilities, indicating a pattern of threat actor focus on MSP supply chain targets Zero-day status indicates no patch was publicly available at time of disclosure; patch availability cannot be confirmed from current data Scope of exploitation — whether vulnerabilities are being actively exploited in the wild — is unconfirmed pending review of the full Huntress report IMPACT Primary: MSPs and IT service providers using affected platform(s) Secondary: SMB and enterprise clients managed through affected MSP tooling — downstream exposure potential is HIGH given MSP access breadth Scope: Unknown until platform identification is confirmed; MSP-targeting vulnerabilities historically carry outsized blast radius due to privileged access and multi-tenant environments RECOMMENDED ACTIONS Immediately access and review the full Huntress disclosure at huntress.com to identify affected platforms and available mitigations Audit all RMM, PSA, and MSP management platform versions in your environment against any disclosed vulnerable versions If affected platforms are identified, isolate or restrict access pending patch availability Monitor Huntress and vendor channels for patch releases and apply on emergency timeline Review MSP-to-client access paths for anomalous activity as a precautionary measure SOURCES Primary: Huntress — Zero-Day Vulnerabilities in Platforms Could Leave MSPs Exposed (huntress.com) Supporting Context: Huntress prior research on RMM abuse, billing software exploitation, and WSUS RCE exploitation ⚠️ UNCERTAINTY FLAG: Platform names, CVE numbers, patch status, and active exploitation status are NOT confirmed in available feed data. This alert should be treated as a heads-up requiring immediate source verification — not a fully characterized threat. Operators must consult the primary Huntress source before taking disruptive action.

Published Thursday, July 02, 2026 at 01:23 AM PT BLUF: The third annual Pwn2Own Automotive 2026 competition has concluded in Tokyo, Japan. A record 73 entries were submitted targeting automotive systems. Affected vendors have been notified per ZDI responsible disclosure policy and should expect coordinated patch timelines. Security teams supporting automotive OEMs, EV charging infrastructure, and in-vehicle infotainment systems should monitor ZDI advisories immediately. ...

Published Wednesday, July 01, 2026 at 10:52 PM PT BLUF: Huntress has published threat intelligence identifying active and escalating cyber threats targeting critical infrastructure sectors. Operators of OT/ICS environments, healthcare networks, and mid-sized enterprises should review defensive posture immediately. DETAILS Huntress has released a dedicated advisory — Defending Critical Infrastructure Against Cyber Threats — indicating observed threat activity relevant to critical infrastructure operators. Specific CVEs, threat actor attributions, and incident timelines from this report are not confirmed in available source data at this time. Corroborating Huntress research identifies three dominant 2024 threat vectors: RMM tool abuse, Bring Your Own Vulnerable Driver (BYOVD) attacks, and a third vector not fully confirmed in available context. Treat all three as active. Huntress has separately documented adversary defense impairment techniques — including disabling Microsoft Defender, killing endpoint monitoring tools, and credential dumping — consistent with pre-ransomware staging behavior. Healthcare has been explicitly flagged by Huntress as a high-priority target, with ransomware and Business Email Compromise (BEC) identified as primary attack types in that sector. Mid-sized businesses were identified in 2023 Huntress research as disproportionately exposed relative to their defensive capabilities — this population remains at elevated risk. IMPACT Sectors at risk: Critical infrastructure broadly; healthcare specifically called out as under active targeting pressure. Asset types: Endpoints, servers, identity infrastructure, and environments relying on RMM tools for remote management. Scope: Not limited to enterprise scale — mid-sized and under-resourced organizations explicitly identified as target population. RECOMMENDED ACTIONS Review RMM tool access controls immediately — audit authorized users, active sessions, and external-facing configurations. Disable unused RMM instances. Verify endpoint detection and response (EDR) and antivirus tooling is active and unimpaired — confirm Defender and monitoring agents are running and tamper-protection is enabled. Implement or audit Identity Threat Detection and Response (ITDR) — credential dumping activity indicates identity infrastructure is a primary adversary objective. Healthcare operators: Elevate BEC monitoring and validate email authentication controls (DMARC/DKIM/SPF). Access the full Huntress advisory directly for confirmed IOCs, TTPs, and sector-specific guidance. ⚠️ UNCERTAINTY FLAGS Specific threat actor names, CVE identifiers, affected vendor products, and confirmed incident counts from the Huntress critical infrastructure report are not available in current source data. This alert is based on Huntress publication metadata and corroborating research context. Verify against the primary source before operational decisions. ...

Published Wednesday, July 01, 2026 at 01:21 PM PT BLUF: Apple has released security updates for iOS 26.5.2, iPadOS 26.5.2, macOS Tahoe 26.5.2, and Safari 26.5.2, patching 37 unique CVEs. All users of affected Apple platforms should apply updates immediately. DETAILS 37 unique CVEs have been addressed across iOS/iPadOS 26.5.2, macOS Tahoe 26.5.2, and Safari 26.5.2 in Apple’s June 2026 security release cycle. WebKit vulnerabilities are confirmed among the patched flaws, including bugs reportedly discovered via AI-assisted analysis, per corroborating reporting from The Hacker News and SecurityWeek. CVE-2026-43725 and CVE-2026-43701 are specifically flagged by Zero Day Initiative analysts as potentially high-severity — ZDI characterizes the bug class as consistent with “weaponizable, possibly Pwn2Own-grade” vulnerabilities. ⚠️ Severity ratings are analyst assessment only; Apple does not publish CVSS scores. Apple has not publicly confirmed active exploitation of any of the 37 CVEs at time of publication. Exploitation status should be treated as unconfirmed until Apple or credible threat intelligence sources indicate otherwise. No patch has been released for older, out-of-support OS versions. Users on legacy Apple platforms remain unpatched. IMPACT Affected platforms: iOS 26, iPadOS 26, macOS Tahoe 26, Safari 26 — all prior to the .5.2 point release. Scope: Consumer and enterprise users globally across iPhone, iPad, and Mac ecosystems. WebKit exposure is particularly broad — WebKit underlies all browsers on iOS/iPadOS regardless of vendor, meaning third-party browser users on Apple mobile devices are equally exposed until the OS update is applied. Enterprise environments with managed Apple device fleets face elevated risk if MDM patch deployment is delayed. RECOMMENDED ACTIONS Apply updates immediately: Navigate to Settings → General → Software Update on iOS/iPadOS; System Settings → General → Software Update on macOS. Prioritize WebKit-exposed devices — iPhones, iPads, and Macs used for web browsing carry the highest surface area risk. Enterprise/MDM administrators: Push 26.5.2 updates to managed fleets without waiting for standard patch cycle windows given the presence of potentially weaponizable WebKit bugs. Monitor Apple’s Security Advisories page (support.apple.com/en-us/100100) for any updated exploitation status disclosures. Do not assume Safari-only exposure on iOS — all iOS browsers use WebKit and are affected. SOURCES Zero Day Initiative — The June 2026 Apple Security Update Review SecurityWeek — Apple Patches Dozens of Vulnerabilities Across iOS, macOS, and Safari The Hacker News — Apple Patches 30+ iOS, macOS, Safari Flaws, Including AI-Discovered WebKit Bugs Note: Full CVE severity details, exploitation-in-the-wild status, and complete technical analysis are pending. This alert will be updated as confirmed information becomes available.

Published Wednesday, July 01, 2026 at 01:20 PM PT BLUF: Apple has patched two WebKit sandbox-escape vulnerabilities in its June 2026 security update that could allow a malicious website to break out of the browser sandbox and establish a path toward kernel-level access. All users of Apple devices running unpatched macOS and iOS versions are affected. Apply Apple’s June 2026 security updates immediately. ...

Published Wednesday, July 01, 2026 at 10:00 AM PT BLUF: Apple has released macOS 26.5.2, patching multiple security vulnerabilities. All macOS users should apply this update immediately. Specific CVE details are available via Apple’s official security release page. DETAILS Apple has officially released macOS 26.5.2 as a security update; the release is confirmed and available for installation. Apple’s security release notes page (https://support.apple.com/en-us/100100) contains the authoritative list of patched CVEs — users should consult this directly for full vulnerability disclosure. Recent Apple security cycles have addressed 30+ vulnerabilities across macOS, iOS, and Safari, including flaws in WebKit and AI-assisted discovery of additional bugs, per reporting from SecurityWeek and The Hacker News. It is unconfirmed whether these specific CVEs are addressed in this release. Prior Apple security releases in this cycle have patched vulnerabilities exploitable by standard non-admin accounts to silently disable endpoint security agents — a high-severity class of flaw. Whether this release addresses similar issues is unconfirmed. Active macOS malware campaigns are ongoing, including variants designed to evade AI-assisted security analysis tools. IMPACT Who is affected: All users running macOS versions prior to 26.5.2. Scope: Potentially broad — recent Apple patch cycles have addressed remotely exploitable and privilege-escalation vulnerabilities. Specific scope for this release is pending CVE review. Enterprise risk: Organizations using macOS endpoints with endpoint security tooling should treat this as elevated priority given recent confirmed vulnerabilities targeting endpoint security agents on macOS. RECOMMENDED ACTIONS Apply macOS 26.5.2 immediately via System Settings → General → Software Update. Review the official CVE list at https://support.apple.com/en-us/100100 to assess specific vulnerability exposure. Verify endpoint security agents are functioning correctly post-update, particularly in enterprise environments. Prioritize managed device fleets — push update via MDM where applicable; do not wait for user self-service. Do not assume low severity until CVE details are reviewed — recent Apple releases have included critical and high-severity findings. SOURCES Apple Security Releases: https://support.apple.com/en-us/100100 SecurityWeek: Apple Patches Dozens of Vulnerabilities Across iOS, macOS, and Safari The Hacker News: Apple Patches 30+ iOS, macOS, Safari Flaws, Including AI-Discovered WebKit Bugs SecurityWeek: macOS Weaknesses Chained to Silently Disable Endpoint Security Agents ⚠️ UNCERTAINTY NOTE: CVE specifics, severity ratings, and exploitation status for this exact release have not been independently verified at time of publication. Treat as high priority pending full CVE review. ...

Published Tuesday, June 30, 2026 at 07:18 PM PT BLUF: CrowdStrike has issued a browser security advisory emphasizing that zero-day vulnerabilities represent only a fraction of the browser threat landscape. Organizations relying solely on patch cadence to secure browser environments are likely underprotected. Security teams should audit browser extension inventories and session security controls immediately. DETAILS CrowdStrike’s advisory explicitly frames zero-days as one component of a broader browser attack surface — the full scope of additional vectors cited in the advisory is not confirmed in detail available at this time; treat specifics beyond this framing as unverified pending full advisory review Corroborating threat activity is active in the wild: a confirmed malicious browser extension has been identified injecting JavaScript into customer-facing web pages and hijacking outbound clicks via affiliate infrastructure (source: Scott Helme) A separate malicious Chromium extension using AI-related branding has been observed redirecting browser search queries (source: Microsoft Security) — consistent with extension-based attack patterns flagged in the CrowdStrike advisory context A novel “BioShocking” attack technique has been reported targeting AI-enabled browsers to leak user credentials (source: The Hacker News) — confirmation and technical details are pending independent verification An allegation by Fairlinked e.V. claims LinkedIn has been covertly scanning users’ installed browser extensions — this remains an allegation; not independently confirmed IMPACT Who is affected: Any organization or individual using Chromium-based or AI-integrated browsers in enterprise or consumer environments Scope: Extension-based attacks, session hijacking, credential theft, and search redirection represent active, non-zero-day threat vectors currently being exploited Elevated risk: Environments that have not audited installed browser extensions or that rely on browser-native AI features without additional controls RECOMMENDED ACTIONS Audit all browser extensions across managed endpoints immediately — remove unrecognized or unvetted extensions, particularly those using AI-related branding Review browser security policy — do not treat patch management alone as sufficient browser defense Monitor for anomalous JavaScript execution on customer-facing web properties; check for unauthorized script injection or affiliate redirect activity Restrict extension installation via policy (e.g., allowlisting) on managed devices where not already enforced Pull and review the full CrowdStrike advisory for complete technical indicators — details beyond the headline framing are not confirmed in this alert SOURCES CrowdStrike: Browser Security: Zero-Days Are Only Part of the Problem Scott Helme: Malicious browser extension disclosure (affiliate hijack/JS injection) Microsoft Security: Chromium AI-branding extension redirect report The Hacker News: BioShocking attack report (unverified — treat as unconfirmed) Fairlinked e.V.: LinkedIn extension scanning allegation (unconfirmed — allegation only)

Published Tuesday, June 30, 2026 at 07:18 PM PT BLUF: Citrix has released a security bulletin addressing six vulnerabilities in NetScaler, including one high-severity flaw drawing comparisons to CitrixBleed (CVE-2023-4966) — a vulnerability that was actively exploited at scale in 2023. Organizations running NetScaler ADC or NetScaler Gateway should prioritize patching immediately. DETAILS Citrix has published a security bulletin covering six NetScaler vulnerabilities; one high-severity flaw is the focal point of concern due to its structural similarities to CitrixBleed The specific CVE identifier, CVSS score, and technical exploitation details for the new high-severity flaw have not been confirmed in available reporting — treat scope as preliminary CitrixBleed (CVE-2023-4966) was a memory disclosure vulnerability that allowed unauthenticated attackers to hijack authenticated sessions; it was exploited by ransomware groups and nation-state actors before and after patching No active exploitation of the new flaw has been confirmed at time of publication — however, the CitrixBleed precedent demonstrates that NetScaler vulnerabilities attract rapid threat actor attention post-disclosure Citrix has issued patches; the bulletin is live IMPACT Affected products: NetScaler ADC and NetScaler Gateway (specific version ranges not yet confirmed in available reporting) Affected organizations: Enterprises, government agencies, and managed service providers using Citrix NetScaler for remote access, load balancing, or application delivery — a widely deployed population Risk profile: If exploitation characteristics mirror CitrixBleed, unauthenticated remote exploitation enabling session hijacking or memory disclosure is a plausible threat model — this is not yet confirmed for the new flaw Prior CitrixBleed exploitation resulted in breaches at major organizations including Boeing, DP World, and Allen & Overy RECOMMENDED ACTIONS Apply Citrix patches immediately — consult the official Citrix security bulletin for affected versions and patch packages Audit NetScaler exposure — identify all internet-facing NetScaler ADC and Gateway instances in your environment Review active sessions — given CitrixBleed precedent, terminate and re-authenticate all active sessions post-patching as a precaution Monitor for exploitation indicators — watch CISA KEV catalog and threat intelligence feeds for confirmation of active exploitation Do not wait for exploitation confirmation — the CitrixBleed timeline showed threat actors moved within days of public disclosure SOURCES CyberScoop: “Citrix patches a new NetScaler flaw with echoes of CitrixBleed” Historical context: Citrix CVE-2023-4966 (CitrixBleed) public record ⚠ NOTE: CVE identifier, full technical details, and confirmed exploitation status for the new vulnerability are not yet available in sourced reporting. This alert will require update as Citrix’s bulletin details are confirmed.