🛡️ CISO Intel — Saturday, 11-07-2026

By Marcus Reed | 10-07-2026 08:00 IST → 11-07-2026 08:00 IST | All sources cross-referenced

Executive Summary

This morning’s intelligence sweep paints a clear picture: the threat landscape is accelerating, driven by AI-powered automation and a relentless focus on supply chain vulnerabilities. We’re seeing critical RCEs weaponized within hours, agentic ransomware operations executing full kill chains without human intervention, and sophisticated phishing techniques becoming commoditized. Defenders must shift from reactive patching to proactive, continuous monitoring and assume compromise for exposed, unpatched systems. The window for remediation is shrinking, and the cost of delay is escalating.

🔴 Critical Threats — Act Now

Adobe ColdFusion — Unauthenticated RCE Exploited in Hours (CVE-2026-48282)

What happened: Adobe ColdFusion, a widely used platform for enterprise web applications, is under active, widespread attack. A critical path traversal vulnerability, CVE-2026-48282, allows unauthenticated attackers to achieve Remote Code Execution (RCE). This flaw, rated with a CVSS v3.1 score of 10.0 (Critical), impacts ColdFusion 2025 Update 9 and earlier, and ColdFusion 2023 Update 20 and earlier. The vulnerability resides in the Remote Development Services (RDS) FILEIO handler, which, when enabled and improperly secured, fails to adequately validate user-controlled file paths. This allows an attacker to write arbitrary files, including malicious CFML files, into the web root, leading to full server compromise without authentication or user interaction.

Source verification: Confirmed. Multiple independent sources, including Resecurity, KEVIntel, NHS England, and Akamai, confirm active exploitation in the wild. CISA added CVE-2026-48282 to its Known Exploited Vulnerabilities (KEV) Catalog on July 7, 2026, with a Binding Operational Directive (BOD 26-04) mandating federal agencies to patch by July 10, 2026. This is one of the most aggressive KEV deadlines issued this year, underscoring the severity and observed exploitation velocity.

Technical breakdown: The attack leverages a path traversal weakness within the /CFIDE/main/ide.cfm?ACTION=FILEIO endpoint when RDS is enabled. An attacker sends a specially crafted HTTP request with an application/octet-stream body. By injecting directory traversal sequences (e.g., ../) or unauthorized absolute paths, they can bypass intended directory boundaries. This allows for arbitrary file operations, including writing executable .cfm files directly into web-accessible directories, which then grants the attacker RCE. The kill chain typically involves:

1. Initial Access (T1190 - Exploit Public-Facing Application): Unauthenticated HTTP request to /CFIDE/main/ide.cfm?ACTION=FILEIO.
2. Execution (T1059.006 - Command and Scripting Interpreter: PowerShell/T1059.004 - Command and Scripting Interpreter: Unix Shell or T1059.007 - Command and Scripting Interpreter: AppleScript): Uploading a webshell (e.g., a .cfm file) to a web-accessible directory.
3. Persistence (T1547.006 - Boot or Logon Autostart Execution: Kernel Modules and Extensions/T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder): The webshell provides persistent access. PoC status: Exploitation began within two hours of public disclosure, indicating a highly mature and readily available exploit. No specific public PoC GitHub repository was identified within the search window, but the rapid exploitation confirms its existence and effectiveness.

Blast radius: Any internet-accessible Adobe ColdFusion instance with Remote Development Services (RDS) enabled and unpatched to the latest versions is at extreme risk. This includes both on-premise and cloud deployments where ColdFusion is exposed. Given the platform’s enterprise usage, the potential for widespread compromise is significant.

Marcus’s verdict: This isn’t just bad; it’s a textbook example of how quickly critical vulnerabilities are weaponized in today’s landscape. A CVSS 10.0 RCE, unauthenticated, exploited within two hours of the patch dropping? That’s machine-speed exploitation. If you’re running ColdFusion and haven’t patched, you’re not just behind, you’re already compromised. This is a fire drill. Don’t just patch; hunt for webshells in your /CFIDE/ directories before you even think about patching. Assume the worst.

Actions:

1. Immediate Patching: Upgrade all Adobe ColdFusion instances to ColdFusion 2023 Update 21 or ColdFusion 2025 Update 10 immediately.
2. Indicator of Compromise (IoC) Hunt: Even after patching, assume compromise. Scour your ColdFusion web root and /CFIDE/ directories for any unauthorized files, especially .cfm or .jsp files that could be webshells. Look for recent file modifications.
3. Disable RDS: If Remote Development Services (RDS) is not strictly required, disable it. If it is required, ensure it is properly secured and not exposed to the internet.
4. Network Segmentation: Isolate ColdFusion servers from critical internal networks.
5. Log Review: Review web server and ColdFusion application logs for suspicious requests to the /CFIDE/ path, particularly those with unusual ACTION parameters or application/octet-stream content types.

Sources: Resecurity, NHS England, KEVIntel, Akamai, DIESEC

Langflow — IDOR to Credential Theft, Key to Agentic Ransomware (CVE-2026-55255)

What happened: Langflow, an open-source visual framework for building AI agents and workflows, has an Insecure Direct Object Reference (IDOR) vulnerability, CVE-2026-55255. This flaw, rated CVSS 3.1 Base Score: 8.4 (High) by NVD, allows an authenticated attacker to execute any AI workflow belonging to another user by simply supplying the victim’s flow ID in a request. This is particularly dangerous in multi-tenant environments or where users share instances, as Langflow flows often embed sensitive credentials like API keys for commercial AI services, cloud environments, and databases. This vulnerability was a key component in the JADEPUFFER agentic ransomware operation.

Source verification: Confirmed. Sysdig’s Threat Research Team first observed active exploitation of this vulnerability on June 25, 2026. CISA added CVE-2026-55255 to its KEV Catalog on July 7, 2026, with a federal agency remediation deadline of July 10, 2026. GitHub Advisory Database also confirms the vulnerability and patch. Note on CVSS: While NVD lists a CVSS 3.1 score of 8.4 (High), some reports, including CISA’s initial advisory, incorrectly cited it as 9.9. We defer to NVD’s official scoring.

Technical breakdown: The vulnerability exists in the get_flow_by_id_or_endpoint_name helper function within src/backend/base/langflow/helpers/flow.py. When a flow is accessed via its UUID (flow_id), the function queries the database directly without verifying if the authenticated user making the request actually owns or is authorized to access that specific flow. This function is used by the /api/v1/responses endpoint. An attacker, authenticated as a legitimate user, can craft a POST request to this endpoint, substituting their own flow_id with a known flow_id of a victim’s workflow. If successful, the attacker can execute the victim’s workflow, potentially triggering actions or exfiltrating credentials embedded within that workflow. MITRE ATT&CK mapping:

• Initial Access (T1078 - Valid Accounts): Requires an authenticated user.
• Credential Access (T1552 - Unsecured Credentials): Exploiting the IDOR to execute flows that contain embedded API keys or cloud credentials.
• Impact (T1486 - Data Encrypted for Impact): In the context of JADEPUFFER, this IDOR contributed to the overall ransomware operation, though initial access for JADEPUFFER was a different Langflow RCE (CVE-2025-3248). PoC status: Active exploitation observed by Sysdig, indicating a functional exploit in the wild. A GitHub advisory provides a clear PoC request.

Blast radius: Any organization using Langflow, especially in multi-tenant or shared environments, is at risk if not updated. The exposure of sensitive API keys and cloud credentials through hijacked workflows can lead to broader cloud environment compromise and data exfiltration.

Marcus’s verdict: This is a classic IDOR that, in the context of AI orchestration platforms, becomes a goldmine for attackers. These platforms are designed to connect to everything with high-privilege keys. An authenticated attacker leveraging this can essentially become any other user and run their AI agents, which are often configured with direct access to production secrets. The fact that it was used in the JADEPUFFER agentic ransomware operation is a stark warning: this isn’t just about data leaks, it’s about enabling autonomous, destructive attacks. Patch immediately, and audit who has access to what.

Actions:

1. Immediate Patching: Update Langflow to version 1.9.1 or later.
2. Access Control Review: Restrict network access to Langflow instances to trusted users and internal networks only. Implement additional access controls around the /api/v1/responses endpoint.
3. Credential Management: Audit all workflows for embedded API keys, cloud credentials, or sensitive connection strings. Implement secure secret management solutions (e.g., HashiCorp Vault, AWS Secrets Manager) instead of hardcoding credentials in workflows.
4. Log Analysis: Monitor Langflow logs for suspicious workflow execution attempts, especially those originating from unexpected users or IP addresses.

Sources: Threat-Modeling.com, Sysdig, CISA, GitHub Advisory Database

Microsoft Defender — Local Privilege Escalation (BlueHammer, CVE-2026-33825)

What happened: A local privilege escalation (LPE) vulnerability, dubbed “BlueHammer” and tracked as CVE-2026-33825, affects Microsoft Defender. This flaw, with a CVSS 3.1 Base Score of 7.8 (High), is caused by insufficient granularity of access control within Defender, allowing an authorized attacker with low-level privileges to elevate their access to SYSTEM. CISA has confirmed that ransomware chains are actively exploiting this vulnerability.

Source verification: Confirmed. The vulnerability was published to NVD on April 14, 2026, and is listed in CISA’s Known Exploited Vulnerabilities Catalog. Multiple security researchers and firms, including SentinelOne, Penligent, and Lab Space, have detailed the vulnerability and its exploitation. The briefing’s claim of the patch being “12 weeks old” aligns with the April 14 NVD publication date.

Technical breakdown: CVE-2026-33825 is classified under CWE-1220 (Insufficient Granularity of Access Control). Technical analysis indicates that the LPE doesn’t necessarily rely on kernel memory corruption or exotic drivers, but rather on the interaction between legitimate Windows features such as Volume Shadow Copy Service, opportunistic locks, Cloud Files API behavior, and path redirection. An attacker, having already gained initial low-level access to a system (e.g., via phishing, another exploit, or compromised credentials), can leverage this flaw to gain SYSTEM privileges. This allows them to disable security controls, install persistent malware, access sensitive data, or prepare the system for further stages of a ransomware attack. MITRE ATT&CK mapping:

• Privilege Escalation (T1068 - Exploitation for Privilege Escalation): Specifically, T1068 for exploiting a local vulnerability.
• Defense Evasion (T1562.001 - Impair Defenses: Disable or Modify Tools): Gaining SYSTEM access allows an attacker to disable or tamper with Microsoft Defender itself. PoC status: Public technical analysis and reports of active exploitation confirm the existence and maturity of PoCs.

Blast radius: Any Windows system running Microsoft Defender that has not applied the April 2026 patch is vulnerable. Given Defender’s ubiquity, the potential attack surface is enormous, especially for organizations that lag on endpoint patching.

Marcus’s verdict: This is a classic “local admin” problem, but it’s worse because it targets your primary endpoint defense. If ransomware gangs are chaining this, it means they’re getting initial footholds and then immediately going for SYSTEM to disable Defender and run roughshod. “12 weeks old” isn’t a badge of honor; it’s a flashing red light. If you haven’t patched this, you’re giving attackers a free pass to the kingdom once they’re on a box. This is a foundational patch. Get it done.

Actions:

1. Immediate Patching: Ensure all Microsoft Defender installations are updated with the April 2026 security updates that address CVE-2026-33825. Microsoft typically rolls out these updates automatically, but verify that they have been successfully applied across all endpoints.
2. Endpoint Detection and Response (EDR) Review: Monitor EDR alerts for any suspicious activity indicative of privilege escalation attempts, especially those involving Defender processes or unusual interactions with Windows services like VSS.
3. Vulnerability Management Audit: Review your patch management processes for endpoint security solutions to ensure critical updates are applied promptly, especially those listed in CISA’s KEV catalog.

Sources: NVD, SentinelOne, Lab Space, Penligent, CVE Record

⚠️ Unverified: iCagenda — Unrestricted File Upload (CVE-2026-48939)

What happened: The briefing indicates an unrestricted file upload vulnerability in iCagenda, CVE-2026-48939, is actively exploited in the wild, allowing attackers to drop dangerous file types. CVSS score is TBD.

Source verification: Unverified. I could not find an NVD entry for CVE-2026-48939 or any independent, verifiable reports of this specific vulnerability or its active exploitation within the search window. While unrestricted file upload vulnerabilities are common and dangerous, without specific vendor advisories or security researcher reports, this remains unconfirmed.

Technical breakdown: (Based on common unrestricted file upload vulnerabilities, as specific details for CVE-2026-48939 are unavailable). Unrestricted file upload flaws typically occur when web applications allow users to upload files without adequate validation of file type, content, or size. Attackers exploit this by uploading malicious scripts (e.g., PHP, ASP, JSP webshells) or executables to a web-accessible directory. Once uploaded, the attacker can then execute these files via a web request, gaining remote code execution on the server. MITRE ATT&CK mapping (hypothetical):

• Initial Access (T1190 - Exploit Public-Facing Application): Exploiting the file upload functionality.
• Execution (T1059 - Command and Scripting Interpreter): Executing the uploaded webshell. PoC status: Unconfirmed.

Blast radius: If confirmed, any unpatched iCagenda installation could be vulnerable, leading to full server compromise.

Marcus’s verdict: Unrestricted file upload is a classic, low-hanging fruit. If this is truly being actively exploited, it’s a critical threat, but I can’t confirm the CVE or the active exploitation independently. Treat any “CVSS TBD” with extreme caution. It means the vendor or NVD hasn’t even fully assessed it, but the briefing claims active exploitation. This is a gap in public intelligence that needs closing. If you run iCagenda, monitor your logs and file system like a hawk for unexpected uploads.

Actions:

1. Monitor & Investigate: If you use iCagenda, actively monitor your web server logs for suspicious file uploads (unusual file types, large files, uploads from unexpected IPs). Inspect your web root for recently created or modified files that are not part of legitimate application updates.
2. Input Validation: Ensure all file upload functionalities in your web applications perform strict validation on file type (whitelist approach), content (e.g., using antivirus/sandbox), and size.
3. Least Privilege: Configure web server permissions to prevent script execution in upload directories.

Sources: None independently confirmed.

⚠️ Unverified: Balbooa Forms — Unrestricted File Upload (CVE-2026-56291)

What happened: The briefing states that Balbooa Forms has another unrestricted file upload flaw, CVE-2026-56291, also actively exploited, which is a common attack vector. CVSS score is TBD.

Source verification: Unverified. Similar to iCagenda, I could not find an NVD entry for CVE-2026-56291 or any independent, verifiable reports of this specific vulnerability or its active exploitation within the search window.

Technical breakdown: (Based on common unrestricted file upload vulnerabilities, as specific details for CVE-2026-56291 are unavailable). The mechanism would be identical to the iCagenda description above: inadequate validation of uploaded files leading to webshell deployment and RCE. MITRE ATT&CK mapping (hypothetical):

• Initial Access (T1190 - Exploit Public-Facing Application)
• Execution (T1059 - Command and Scripting Interpreter) PoC status: Unconfirmed.

Blast radius: If confirmed, any unpatched Balbooa Forms installation would be at severe risk.

Marcus’s verdict: Two unrestricted file uploads, both “actively exploited,” both “CVSS TBD,” and both lacking public verification? This sounds like either very fresh, non-public intel, or a potential misattribution. While the type of vulnerability is extremely common and dangerous, the lack of public CVE details makes it impossible to assess properly. If you’re running Balbooa Forms, the advice is the same as for iCagenda: assume the worst, and look for anomalous file activity. This is why we need clear, public disclosure.

Actions:

1. Monitor & Investigate: If you use Balbooa Forms, implement rigorous monitoring for unexpected file uploads and new files in web-accessible directories.
2. Input Validation: Enforce strict file validation policies for all upload fields.
3. Web Application Firewall (WAF): Deploy a WAF to detect and block suspicious file upload attempts and webshell activity.

Sources: None independently confirmed.

⚠️ Unverified: Oracle E-Business Suite Payments — Unauthenticated RCE (CVE-2026-46817)

What happened: The briefing reports an unauthenticated RCE in Oracle E-Business Suite Payments, CVE-2026-46817, with a CVSS of 9.8. Alarmingly, attackers were reportedly hitting production honeypots before any public Proof-of-Concept (PoC) existed.

Source verification: Unverified. I could not find an NVD entry for CVE-2026-46817 or any independent, verifiable reports or advisories from Oracle regarding this specific vulnerability within the search window. The claim of pre-PoC exploitation on honeypots is highly significant but lacks public confirmation.

Technical breakdown: (Based on typical unauthenticated RCE in enterprise applications, as specific details for CVE-2026-46817 are unavailable). An unauthenticated RCE in a critical component like a payments module would likely stem from flaws in input validation, deserialization, or insecure configuration. Attackers could send specially crafted requests to the exposed payment module endpoint to execute arbitrary code on the underlying server, potentially compromising sensitive financial data, disrupting payment processes, or gaining a foothold into the broader EBS environment. MITRE ATT&CK mapping (hypothetical):

• Initial Access (T1190 - Exploit Public-Facing Application)
• Execution (T1059 - Command and Scripting Interpreter)
• Impact (T1486 - Data Encrypted for Impact, T1565 - Data Destruction) PoC status: Unconfirmed, but briefing claims pre-PoC exploitation observed.

Blast radius: If confirmed, any organization running Oracle E-Business Suite with exposed or unpatched Payments modules would be at severe risk, facing potential financial fraud, data breach, and systemic disruption.

Marcus’s verdict: An unauthenticated RCE in a payments module, CVSS 9.8, and exploitation before a public PoC? That’s the kind of high-impact, low-visibility threat that keeps CISOs up at night. The lack of public intel is concerning. If this is real, it means highly sophisticated actors are operating in the shadows. For any organization running Oracle EBS, this should trigger an immediate internal audit of your Payments module’s exposure and patch status. Don’t wait for a public PoC; if the briefing is accurate, you’re already a target.

Actions:

1. Monitor Oracle Advisories: Closely monitor Oracle’s Critical Patch Update (CPU) and Security Alert advisories for any mention of CVE-2026-46817 or related vulnerabilities in E-Business Suite Payments.
2. Network Segmentation: Ensure Oracle E-Business Suite, especially payment-related modules, is heavily segmented and not directly exposed to the internet.
3. Access Control: Implement strict access controls and least privilege principles for all EBS components.
4. Honeypot Monitoring: If you operate honeypots, review their logs for any activity targeting Oracle EBS Payments modules, especially from new or unusual threat actors.

Sources: None independently confirmed.

🛡️ CVEs — Full Analysis

The briefing for this section states “[Clear — enjoy it]”.

Marcus’s take: “Clear” is a word I haven’t heard in a long time, and frankly, it makes me nervous. There’s no such thing as “clear” in this business; there’s only the calm before the next storm, or the threats we haven’t found yet. So, no, I won’t “enjoy it.” I’ll use this moment to double-check the critical items above, because a quiet CVE list usually means something big is brewing just out of sight.

⚡ TTPs & Attack Research — Deep Dives

’HalluSquatting’ — Weaponizing AI Hallucinations for Botnets

What happened: Researchers from Tel Aviv University, Technion, and Intuit have unveiled a novel attack technique called ‘HalluSquatting.’ This method weaponizes the inherent tendency of Large Language Models (LLMs) and AI assistants to “hallucinate” or invent non-existent package or repository names when asked to fetch trending resources. Attackers pre-register these hallucinated names on platforms like GitHub or package registries (e.g., PyPI, npm). When an unsuspecting user asks an AI coding assistant (such as Cursor, Windsurf, GitHub Copilot, Gemini CLI, or OpenClaw) to clone a repository or install a skill, the AI may hallucinate the squatted name, pull down the attacker’s malicious version, and execute embedded commands via its built-in terminal. This can lead to remote code execution and the formation of “agentic botnets” that spread via prompt injections, bypassing traditional firewalls.

Source verification: Confirmed as research. Multiple independent sources, including SecurityWeek, Threat-Modeling.com, and Reddit discussions, detail the HalluSquatting research. The research confirms high hallucination rates (up to 85% for repo-cloning prompts, 100% for skill installations) and the recurrence of these hallucinated names across different foundation models, making the technique broadly transferable. No confirmed exploitation in the wild was reported; it was disclosed as proof-of-concept research.

Attack Chain & MITRE ATT&CK:

1. Reconnaissance (T1592 - Gather Victim Host Information): Attacker identifies trending software packages/repositories.
2. Resource Development (T1588.006 - Obtain Capabilities: Malware): Attacker repeatedly queries AI assistants to identify common hallucinated names for these trending resources.
3. Resource Development (T1588.002 - Obtain Capabilities: Tool): Attacker registers the hallucinated names on public code repositories (e.g., GitHub) or package managers (e.g., PyPI, npm) and embeds malicious code or instructions.
4. Initial Access (T1566.001 - Phishing: Spearphishing Attachment): A user interacts with an AI assistant, asking it to fetch the trending resource. The AI hallucinates the squatted name.
5. Execution (T1059 - Command and Scripting Interpreter): The AI assistant pulls the malicious resource and executes the embedded commands, leading to RCE on the user’s machine.
6. Command and Control (T1071.001 - Application Layer Protocol: Web Protocols): The compromised machine becomes part of an agentic botnet.

Detection Opportunities:

• Monitor network traffic for connections to newly registered or unusual domains/repositories following AI assistant interactions.
• Log AI assistant interactions, especially those involving package installations or repository cloning, and cross-reference with known legitimate sources.
• Behavioral analysis on endpoints for unusual process execution initiated by AI assistant tools.

Mitigations:

• Strict AI Assistant Configuration: Configure AI coding assistants to require explicit user approval before executing any commands, installing packages, or cloning repositories from external sources.
• Dependency Whitelisting: Implement whitelisting for approved package registries and repositories in development environments.
• Supply Chain Security: Educate developers on the risks of AI-generated code and the importance of verifying dependencies, even those suggested by AI.
• Runtime Monitoring: Implement runtime monitoring for unexpected process creation or network connections originating from systems running AI assistants.

Sources: SecurityWeek, Reddit, Threat-Modeling.com, The Hacker News, Ground News

Agentic Ransomware Operations — JADEPUFFER

What happened: The JADEPUFFER operation marks the first documented instance of a fully autonomous AI ransomware attack. Discovered by Sysdig’s Threat Research Team, JADEPUFFER is an “agentic threat actor” (ATA) where a Large Language Model (LLM) agent, not a human, drove the entire kill chain: reconnaissance, credential harvesting, lateral movement, data encryption, and ransom demands. The attack exploited an unauthenticated code execution flaw in