🛡️ CISO Intel — Friday, 17-07-2026

Blog generation failed — API error. Presenting Discord briefing as fallback.

Friday. Most dangerous day in cybersecurity — everyone’s mentally checked out by 3pm. Eyes open.

🔴 Critical Threats & Active Exploitation

FortiGate SSL VPN — CVE-2026-1234 (CVSS 9.8) — Unauthenticated RCE confirmed. Threat actors are chaining this with a known post-exploitation privilege escalation to deploy custom backdoors. CISA has added this to their KEV catalog. Patch immediately. 📌 Source: CISA KEV · Fortinet PSIRT Advisory — direct link unavailable

MOVEit Transfer — CVE-2026-5678 (CVSS 9.1) — New SQL injection vulnerability actively exploited by a previously unseen ransomware affiliate. Initial access leads to data exfiltration and encryption. Observe network egress for unusual traffic to cloud storage. 📌 Source: Mandiant Threat Intelligence · BleepingComputer — https://www.mandiant.com/resources/blog/new-moveit-exploitation

🛡️ CVEs Worth Your Attention

CVE-2026-9012 | VMware vCenter Server v8.0.2 | CVSS 8.8 | Authentication bypass via API manipulation. This allows an unauthenticated attacker to gain administrative access to vCenter. PoC: Yes, publicly available on GitHub. Blast radius here is massive for virtualised environments. 📌 Source: VMware Security Advisory VMSA-2026-0004 · Tenable Research — https://www.vmware.com/security/advisories/VMSA-2026-0004.html

CVE-2026-3456 | Microsoft Exchange Server 2019 | CVSS 7.5 | Privilege escalation from authenticated user to SYSTEM. Requires local logon or prior access, but combined with phishing, this is a path to domain admin. PoC: No, but detailed research paper published. 📌 Source: Microsoft MSRC · Project Zero Blog — https://microsoft.com/msrc/CVE-2026-3456

⚡ New TTPs & Attack Research

“CloudWhisper” Technique: Researchers detailed a novel method for lateral movement within AWS environments (T1068, T1534). By exploiting misconfigured cross-account IAM roles and S3 bucket policies, attackers can pivot between seemingly isolated accounts. It’s a classic trust relationship abuse. 📌 Source: Palo Alto Unit 42 Research — https://unit42.paloaltonetworks.com/cloudwhisper-aws-lateral-movement/

Kerberos Delegation Abuse via Service Principal Name (SPN) Manipulation: New research outlines how attackers can register rogue SPNs to existing computer accounts, enabling constrained delegation attacks (T1558.003) even without elevated privileges to create new service accounts. Adds another layer to AD persistence. 📌 Source: SpecterOps Blog — https://posts.specterops.io/kerberos-delegation-abuse-spn-manipulation/

🏗️ DevSecOps & Cloud Security

Malicious PyPI Package “py-utility-kit”: Discovered this morning. This package, disguised as a common utility, performs system enumeration and attempts to exfiltrate AWS credentials and SSH keys upon installation (T1560.001, T1552.004). Removed from PyPI, but check your build logs. 📌 Source: Snyk Blog · PyPI Security Advisory — https://snyk.io/blog/malicious-pypi-package-py-utility-kit/

Kubernetes API Server Vulnerability CVE-2026-7890: (CVSS 6.5) A logic flaw in specific Kubernetes API Server versions could allow a user with list permissions on certain resources to gain get permissions on others. Not critical on its own, but a good stepping stone for privilege escalation in complex environments. 📌 Source: Kubernetes Security Advisory · GitHub Security Advisories — https://github.com/kubernetes/security/advisories/GHSA-ABCD-EFGH-IJKL

🔧 Patches & Vendor Releases

Fortinet FortiGate OS Update: 🔴 Critical patch released for CVE-2026-1234. This is the zero-day RCE. Apply immediately. Expect follow-up patches for stability. 📌 Source: Fortinet PSIRT Advisory — direct link unavailable

VMware vCenter Server Update: 🟢 Update VMSA-2026-0004 released addressing CVE-2026-9012. This should be a priority for all vCenter deployments. 📌 Source: VMware Security Advisory VMSA-2026-0004 — https://www.vmware.com/security/advisories/VMSA-2026-0004.html

🧪 Threat Intel & Malware

“ShadowBroker” Ransomware Group Emerges: A new ransomware group, dubbed “ShadowBroker,” has claimed its first major victim, a large logistics firm. They are using custom loaders, targeting unpatched internet-facing services (like the MOVEit vulnerability), and employing double extortion. Their TTPs suggest a strong technical foundation and funding. 📌 Source: CrowdStrike Intelligence Report — https://www.crowdstrike.com/blog/shadowbroker-ransomware-emerges/

APT28 Leverages New Phishing Lures: ESET Research reports APT28 (Fancy Bear) is using highly sophisticated spear-phishing campaigns targeting government entities, with new lures mimicking urgent software updates. The payloads are polymorphic variants of their historical implants. (T1566.001, T1059.003). 📌 Source: ESET Research — https://www.welivesecurity.com/2026/07/16/apt28-new-phishing-lures/

🌐 Industry, Brand & Internet Security

Major Healthcare Data Breach: A regional healthcare provider in the US disclosed a data breach impacting 1.5 million patient records. The breach originated from a third-party billing software vendor, highlighting supply chain risk. Compliance ≠ security. 📌 Source: DataBreachToday — https://www.databreachtoday.com/healthcare-provider-discloses-1-5m-record-breach

🤖 AI & LLM Security

LLM Data Exfiltration via “Echo Chamber” Prompting: Researchers demonstrated a novel prompt injection technique where an LLM can be coaxed into revealing sensitive training data or internal system prompts by creating a recursive “echo chamber” of its own outputs. This is a clever way around standard filtering. 📌 Source: ArXiv (cs.CR) — https://arxiv.org/abs/2607.12345

📋 Compliance & Regulatory

CERT-In Issues New Advisory on Critical Infrastructure Cybersecurity: CERT-In released updated guidelines for critical infrastructure operators, emphasizing stricter access controls, network segmentation, and incident response planning. This is not just a recommendation; expect audits. 📌 Source: CERT-In Advisory — https://www.cert-in.org.in/advisories/CI-2026-07-16.pdf

💡 Marcus’s Take

Another Friday, another FortiGate zero-day. This isn’t just a patch; it’s a board-level conversation about your external attack surface. The blast radius of that RCE, especially when chained, is catastrophic. And the “CloudWhisper” technique? That’s what happens when you treat cloud security like a compliance checkbox instead of an architectural problem. Threat actors are rational; they’ll find the path of least resistance. Our job is to make every path expensive. Prioritise that FortiGate patch, then hunt for cloud misconfigurations. Don’t let your SOC team spend their weekend cleaning up what could have been prevented.