Daily DefSec Brief

Jul 27, 20263m

1. Fastjson RCE under active exploitation in the Java ecosystem — Risky Business News — https://news.risky.biz/risky-bulletin-a-json-rce-bug-is-about-to-rock-the-java-world/ 2. Ransomware crews mass-exploiting edge VPN/f

Jul 24, 20263m

1. Russian espionage group reads Western mailboxes through zero-click Zimbra flaw — CVE-2025-66376 — CISA — https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-204a 2. Clop exploits critical PTC Windchill/Flex

Jul 23, 20265m

1. Check Point SmartConsole authentication bypass zero-day (active exploitation) — CVE-2026-16232, CVE-2026-50751 — CISA KEV: https://www.cisa.gov/known-exploited-vulnerabilities-catalog · BleepingComputer: https://www.b

Jul 22, 20264m

1. CISA adds DD-WRT UPnP buffer overflow to KEV — CVE-2021-27137 — CISA KEV — https://www.cisa.gov/known-exploited-vulnerabilities-catalog 2. Kratos AiTM phishing-kit infrastructure taken down — The Hacker News — https:/

Jul 21, 20264m

1. Palo Alto GlobalProtect auth-bypass now used in Qilin ransomware attacks — CVE-2026-0257 — BleepingComputer — https://www.bleepingcomputer.com/news/security/critical-globalprotect-vpn-bug-now-exploited-in-ransomware-a

Jul 20, 20263m

1. ServiceNow AI Platform RCE now under active exploitation — CVE-2026-6875 — BleepingComputer — https://www.bleepingcomputer.com/news/security/critical-servicenow-code-execution-flaw-now-exploited-in-attacks/ 2. WP2Shel

Jul 17, 20264m

1. FortiSandbox OS command injection added to CISA KEV, actively exploited — CVE-2026-25089 — CISA KEV — https://www.cisa.gov/known-exploited-vulnerabilities-catalog 2. New HTTP/2 flow-control stall DoS — CVE-2019-9511,

Jul 16, 20264m

1. CISA adds actively exploited Oracle E-Business Suite flaw to KEV, feds have until Saturday — CVE-2026-46817 — CISA KEV https://www.cisa.gov/known-exploited-vulnerabilities-catalog · BleepingComputer https://www.bleepi

Jul 15, 20264m

1. CISA adds SharePoint and AD FS zero-days to KEV, deadline Friday — CVE-2026-56164, CVE-2026-56155 (also CVE-2026-32201, CVE-2026-45659, CVE-2026-58644, CVE-2026-55040) — CISA KEV https://www.cisa.gov/known-exploited-v

Jul 14, 20265m

1. CISA adds 18-year-old Cisco IOS flaw to KEV catalog — CVE-2008-4128 — CISA KEV — https://www.cisa.gov/known-exploited-vulnerabilities-catalog 2. Microsoft maps a year of ShinyHunters-style OAuth abuse against Salesfor

Jul 13, 20264m

1. Progress tells ShareFile customers to shut down Storage Zone Controller servers — CVE-2026-2699, CVE-2026-2701 — SecurityWeek — https://www.securityweek.com/progress-prompts-sharefile-storage-zone-controller-shutdown-

Jul 11, 20268m

1. Langflow authorization bypass on KEV, plus the first fully autonomous LLM-driven ransomware campaign — CVE-2026-55255, CVE-2025-3248 — CISA KEV https://www.cisa.gov/known-exploited-vulnerabilities-catalog · Dark Readi

Jul 10, 20265m

1. Initial access broker weaponizing CitrixBleed 2 to deploy Dragonforce ransomware — CVE-2025-5777 (referencing CVE-2023-4966, CVE-2026-4368) — Huntress — https://www.huntress.com/blog/citrixbleed-2-dragonforce-ransomwa

Jul 9, 20264m

Apologies for the dog barking. She was mad that she had not yet received her morning allotment of cheese. 1. Microsoft patches the RoguePlanet Defender zero-day after a month of public exploit code — CVE-2026-50656 (rela

Jul 8, 20265m

1. CISA adds ColdFusion, Langflow, and two Joomla plugins to KEV — patch by Friday — CVE-2026-48282, CVE-2026-55255, CVE-2026-48908, CVE-2026-56290 — CISA KEV: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Jul 7, 20265m

1. BeyondTrust patches critical auth-bypass flaws in Remote Support and Privileged Remote Access — CVE-2026-40138, CVE-2026-40139 — BleepingComputer — https://www.bleepingcomputer.com/news/security/beyondtrust-warns-of-c

Jul 6, 20265m

1. Attackers phishing Microsoft's device-code login flow — no CVE (flow abuse) — Securelist (Kaspersky) — https://securelist.com/microsoft-device-code-phishing-attack/120350/ 2. Unauthenticated PHP-FPM crash via TLS stre