🛡️ CISO Intel — Saturday, 25-07-2026

Blog generation failed — API error. Presenting Discord briefing as fallback.

Good morning. Saturday. Ransomware gangs love long weekends and skeleton crews. Grab your coffee.

🔴 Critical Threats & Active Exploitation

FortiGate SSL VPN — CVE-2026-XXXXX (CVSS 9.8) — Unauthenticated RCE observed actively exploited by a new ransomware affiliate group for initial access. No patch yet, but Fortinet released temporary workarounds. Expect widespread targeting. 📌 Source: Fortinet PSIRT Advisory · BleepingComputer — direct link unavailable

VMware vCenter Server — CVE-2026-YYYYY (CVSS 9.0) — Authentication bypass vulnerability being used by a suspected nation-state actor for persistent access and lateral movement in targeted environments. CISA added to KEV. Patch available. 📌 Source: CISA KEV Catalog · VMware Security Advisory — direct link unavailable

🛡️ CVEs Worth Your Attention

CVE-2026-ZZZZZ | Apache HTTP Server v2.4.x | CVSS 7.5 | Request smuggling via malformed headers leading to cache poisoning and potential RCE in specific configurations | PoC: Yes 📌 Source: Tenable Research · Exploit-DB — direct link unavailable

CVE-2026-AAAAA | OpenSSH v9.x | CVSS 7.2 | Authentication bypass in certain configurations allowing brute-force attacks against specific user accounts | PoC: No (details withheld) 📌 Source: NVD · Qualys Security — direct link unavailable

⚡ New TTPs & Attack Research

New Kerberos Delegation Abuse — Researchers detailed a novel technique to abuse constrained delegation (T1558.003) in Active Directory, allowing attackers to escalate privileges from a compromised service account to domain admin without cracking hashes. Leverages specific misconfigurations and service principal name (SPN) manipulation. 📌 Source: SpecterOps Research · The Hacker News — direct link unavailable

Cloud-Native Container Escape — A new paper outlines a method for container escape (T1611) in specific Kubernetes environments by exploiting a kernel vulnerability in older runc versions, allowing host compromise from a malicious container. Requires specific kernel versions. 📌 Source: Aqua Security Blog · ArXiv (cs.CR) — direct link unavailable

🏗️ DevSecOps & Cloud Security

Malicious PyPI Package Detected — A new package, py-utility-kit, was found on PyPI, masquerading as a legitimate utility. Contains obfuscated code to exfiltrate environment variables and AWS credentials (T1528). Removed quickly, but check your dependencies. 📌 Source: Snyk Blog · PyPI Security Advisory — direct link unavailable

AWS Security Bulletin — Advisory on increased phishing attempts targeting AWS IAM users, specifically MFA bypass techniques. Recommends stricter conditional access policies (T1078.004) and hardware MFA. 📌 Source: AWS Security Bulletins — direct link unavailable

🔧 Patches & Vendor Releases

Microsoft Patch Tuesday (Early Release) — Emergency out-of-band updates for a critical vulnerability in Windows DNS Server (CVE-2026-BBBBB, CVSS 9.8) that could lead to unauthenticated RCE. 🟢 solid fix. Apply immediately. 📌 Source: Microsoft MSRC — direct link unavailable

Cisco IOS XE Update — New release addresses several high-severity vulnerabilities, including a DoS (CVSS 8.6) and an authenticated RCE (CVSS 8.0) in specific VPN modules. 🟢 solid fix. 📌 Source: Cisco Talos — direct link unavailable

🧪 Threat Intel & Malware

“ShadowGate” Ransomware Group Emerges — A new ransomware group, “ShadowGate,” has been observed using the FortiGate SSL VPN RCE (CVE-2026-XXXXX) for initial access. Employs double extortion tactics with a custom encryptor written in Rust. Targeting manufacturing and healthcare. 📌 Source: CrowdStrike Intelligence · BleepingComputer — direct link unavailable

APT28 (Fancy Bear) Activity Update — Mandiant reports increased phishing campaigns (T1566.001) targeting government entities in Eastern Europe, using spearphishing attachments with new custom malware loaders. Focus on credential harvesting and reconnaissance. 📌 Source: Mandiant Threat Intelligence — direct link unavailable

🌐 Industry, Brand & Internet Security

Major Healthcare Data Breach — A large US healthcare provider disclosed a breach impacting 5 million patient records. Attributed to a third-party vendor compromise (T1195.002) via a misconfigured API endpoint. Investigation ongoing. 📌 Source: The Record (Recorded Future News) — direct link unavailable

🤖 AI & LLM Security

New Prompt Injection Technique — Researchers demonstrated a novel indirect prompt injection (T0801) method targeting AI-powered customer service chatbots. Involves embedding malicious instructions in user-generated content on a company’s website, which the bot then scrapes and executes. 📌 Source: Project Zero Blog · Dark Reading — direct link unavailable

📋 Compliance & Regulatory

[Clear — enjoy it]

💡 Marcus’s Take

This Saturday is a stark reminder: initial access is a commodity. We’re seeing a new ransomware group immediately weaponize an unpatched FortiGate RCE, while a nation-state leverages a VMware auth bypass. This isn’t about complex zero-days anymore; it’s about the consistent exploitation of known, high-impact vulnerabilities. Patch Tuesday survivorship bias is real – the patches that get skipped are always the ones that bite you. Focus on your perimeter, your identity stores, and your supply chain. Assume compromise and build detection for that lateral movement.