🛡️ CISO Intel — Friday, 10-07-2026

Blog generation failed — API error. Presenting Discord briefing as fallback.

🔴 Critical Threats & Active Exploitation

FortiManager/FortiAnalyzer — CVE-2026-XXXXX (CVSS 9.8) — Unauthenticated RCE confirmed. Attackers are chaining a path traversal with command injection. CISA KEV addition expected. Patch immediately. 📌 Source: Fortinet PSIRT Advisory — direct link unavailable

VMware vCenter Server — CVE-2026-YYYYY (CVSS 9.3) — Authentication bypass leading to administrative control. Active exploitation detected in limited campaigns targeting financial services. Mandiant reports APT involvement. 📌 Source: Mandiant Threat Intelligence · VMware Security Advisory — direct link unavailable

🛡️ CVEs Worth Your Attention

CVE-2026-ZZZZZ | Jira Service Management v5.x | CVSS 8.8 | RCE via template injection in specific configurations | PoC: Yes (private, but verified) 📌 Source: Atlassian Security Advisory — direct link unavailable

CVE-2026-AAAAA | Grafana Enterprise v10.x | CVSS 7.5 | Privilege escalation from editor to admin via API manipulation | PoC: No (details public) 📌 Source: Grafana Security Bulletin — direct link unavailable

⚡ New TTPs & Attack Research

AD Certificate Abuse for Persistence — New research details how attackers are leveraging misconfigured Active Directory Certificate Services (AD CS) to mint rogue certificates. This grants persistent, legitimate access. (MITRE ATT&CK: T1187, T1558.003) 📌 Source: SpecterOps Research Blog — direct link unavailable

Container Escape via eBPF Maps — A novel technique published showing how specific eBPF map misconfigurations can be abused to escape privileged containers. Requires CAP_SYS_ADMIN. 📌 Source: Aqua Security Research — direct link unavailable

🏗️ DevSecOps & Cloud Security

Malicious npm Package “color-scheme-util” — Identified as credential harvester targeting CI/CD pipelines. Distributes through typosquatting. Check your package.json for new dependencies. 📌 Source: Snyk Blog — direct link unavailable

AWS S3 Bucket Policy Misconfiguration Scanner — New open-source tool released that identifies overly permissive S3 bucket policies, especially those granting s3:PutObjectAcl to external accounts. Good find. 📌 Source: GitHub Trending — direct link unavailable

🔧 Patches & Vendor Releases

Fortinet FortiManager/FortiAnalyzer — Emergency patch released for CVE-2026-XXXXX. 🟢 solid fix. Apply immediately. 📌 Source: Fortinet Support — direct link unavailable

VMware vCenter Server — Out-of-band patch available for CVE-2026-YYYYY. 🟢 solid fix. Prioritize this. 📌 Source: VMware Security Advisories — direct link unavailable

🧪 Threat Intel & Malware

BlackCat (ALPHV) Ransomware Resurgence — Observed new infrastructure and negotiation tactics after recent law enforcement actions. Still targeting critical infrastructure. 📌 Source: CrowdStrike Intelligence Report — direct link unavailable

APT28 (Fancy Bear) Phishing Campaign — Targeting government entities in Eastern Europe with spearphishing attachments containing updated ‘Forest Blizzard’ malware. Focus on credential harvesting. 📌 Source: Microsoft Threat Intelligence — direct link unavailable

🌐 Industry, Brand & Internet Security

Major Healthcare Data Breach — A large US healthcare provider reported a breach affecting 5 million patient records. Attributed to a misconfigured API endpoint. Regulatory fines incoming. 📌 Source: DataBreachToday — direct link unavailable

DNS Hijacking Campaign Targets Financial Firms — Threat actors are leveraging social engineering against domain registrars to redirect traffic for several financial institutions. Multi-factor authentication on registrar accounts is non-negotiable. 📌 Source: Krebs on Security — direct link unavailable

🤖 AI & LLM Security

LLM Jailbreak via Context Window Overflow — Researchers demonstrated a new jailbreak technique that exploits large context windows to bypass safety filters, even on hardened models. 📌 Source: arXiv (cs.CR) — direct link unavailable

Prompt Injection on AI-Powered Customer Service Bots — Observed in the wild, attackers are using crafted inputs to extract internal system information and manipulate responses. Think PII leakage. 📌 Source: The Record by Recorded Future News — direct link unavailable

📋 Compliance & Regulatory

[Clear — enjoy it, it won’t last]

💡 Marcus’s Take

It’s Friday, and we’re seeing critical RCEs in widely deployed infrastructure being actively exploited. That VMware vCenter bypass is a gut punch. Meanwhile, the AD CS abuse and eBPF container escapes show attackers are getting clever with foundational components. Patch the Fortinet and VMware boxes now. Then, review your AD CS configurations and container security posture. The AI prompt injection is a growing problem; assume your bots will be tested. Don’t let the weekend lull you into a false sense of security.