Cyber Digest
A daily roundup of key cybersecurity developments across sectors
Incident Map
Vulnerabilities & Exploits 4 stories
Cisco FMC Zero-Day Actively Exploited via Static Credentials (CVE-2026-20316)
CISA has added a newly disclosed vulnerability in Cisco Secure Firewall Management Center (FMC) Software to its Known Exploited Vulnerabilities (KEV) catalogue following reports of zero-day exploitation in the wild. Tracked as CVE-2026-20316 (CVSS 5.3), the flaw stems from the presence of static, hard-coded credentials for a low-privilege account. Successful exploitation permits an unauthenticated, remote attacker to log in and access sensitive data. Administrators are urged to patch immediately.
Two Critical VMware vCenter Flaws Allow Authentication Bypass and RCE (CVE-2026-59309 / CVE-2026-59310)
Broadcom released critical security patches for VMware vCenter to mitigate multiple vulnerabilities, two of which carry a CVSS score of 9.8. CVE-2026-59309 enables attackers with network access to vCenter to bypass authentication and gain administrative control, while CVE-2026-59310 is a directory-traversal vulnerability that allows remote code execution. Impacts VMware ESXi, vCenter, Workstation, and Fusion.
Critical Rails Flaw Exposes Process Secrets via Crafted Image Uploads (CVE-2026-66066)
Ruby on Rails has issued urgent patches for a critical Active Storage vulnerability (CVE-2026-66066, CVSS 9.5) that can expose process env environments and critical application secrets, including master keys, database credentials, and cloud storage tokens. The vulnerability manifests when the platform is configured to process image uploads using the `libvips` library. Affected versions span Rails 7.0.0 through 7.2.3.1, 8.0.0 through 8.0.5, and 8.1.0 through 8.1.3.
Public PoC Released for Check Point SmartConsole Authentication Bypass (CVE-2026-16232)
Security researchers have shared full details and a public Proof-of-Concept (PoC) exploit for a critical Check Point vulnerability under active exploitation in the wild (CVE-2026-16232, CVSS 9.3). The vulnerability is an authentication bypass in the SmartConsole login process that allows an unauthenticated remote attacker with network access to the Management Server to obtain a valid admin login token.
Geopolitical & Espionage 3 stories
Russian Laundry Bear Exploits Microsoft OWA Flaw to Retain Mailbox Access (CVE-2026-42897)
The Russian state-sponsored threat group Laundry Bear (aka Void Blizzard, CL-STA-1114, or Void PitStop) has shifted focus to weaponising CVE-2026-42897 (CVSS 8.1), a cross-site scripting (XSS) vulnerability in Microsoft Outlook Web Access (OWA). Proofpoint reports the group has been exploiting this flaw since at least May 2026, launching a major campaign on July 22 targeting Western government, telecommunications, financial, hospitality, and aerospace sectors. The exploitation aims to bypass credential rotations and preserve persistent access to target mailboxes.
Amazon Attributes Historic npm Package Hijacks to North Korea’s Sapphire Sleet
Amazon Threat Intelligence has linked a massive September 2025 supply chain attack—which hijacked highly popular npm packages like `debug` and `chalk` with wallet-draining scripts—to state-sponsored North Korean threat actor Sapphire Sleet. Although originally recorded as a general cybercrime incident, Amazon's analysts tracked lookup domain registrations and earlier trojanised packages back to 2025, showing identical tradecraft to Sapphire Sleet's March 2026 compromise of the Axios npm package.
FSB Charges Telegram Founder Pavel Durov with Aiding Terrorist Activity
The Federal Security Service (FSB) of the Russian Federation has filed formal charges against Telegram founder Pavel Durov under Article 205.1 of the Russian Criminal Code. The FSB alleges that Telegram fundamentally failed to moderate or remove numerous channels, chats, and bots used specifically by Ukrainian intelligence and extremist groups to coordinate sabotage, cyber-fraud, and acts of terrorism within Russia.
Operational Technology & Critical Infrastructure 2 stories
Coordinated Cyberattack Disables Operational Technology at 30+ Minnesota Water Systems
A highly coordinated, multi-pronged cyberattack targeted the operational technology (OT) of more than 30 municipal community water systems across Minnesota on July 26 and 27. The attack caused communications failures, compromised automated SCADA systems, and forced the Braham treatment plant completely offline, requiring manual operations and water preservation orders. Minnesota IT Services (MNIT) is leading the response, and local declarations of emergency have been issued.
ACSC Urges Organisations to Isolate Vital OT and Critical Enabling Systems
In a proactive technical publication, the Australian Signals Directorate’s ACSC issued comprehensive advice outlining methods for isolating vital operational technology (OT) and core enabling networks from corporate IT networks. The ASD highlights that network isolation is the single most effective defence to contain active cyberattacks, prevent lateral movement of adversaries, and ensure critical physical services remain running.
Healthcare 3 stories
FTC Sues Hims & Hers Over Unlawful Sharing of Patient Data with Ad Platforms
The US Federal Trade Commission (FTC) filed a lawsuit against telehealth platform Hims & Hers, alleging the provider illegally shared sensitive patient healthcare selections, order lists, and demographic data with third-party social media and marketing networks. The FTC asserts Hims & Hers embedded tracking pixels across its portals and diagnostic pages, sending personal clinical choices to advertising databases without patient knowledge or consent.
Soniva Dental Care Data Breach Affects Over 30,000 Patient Records
Soniva Dental Care, based in Texas, has announced a data breach exposing the personal health information (PHI) of over 30,000 patients. At the same time, healthcare supply chain and management companies CareCloud (New Jersey) and Optalis Management Solutions (Michigan) disclosed substantial security incidents, indicating a heightened wave of vendor breaches targeting auxiliary healthcare systems.
Banner Health and LifeStance Health Settle Website Tracking Pixel Lawsuits
Healthcare operators Banner Health and LifeStance Health Group have agreed to settle multiple class-action lawsuits alleging they shared sensitive personal health information (PHI) with social media networks. The lawsuits focused on their integration of analytics and tracking pixels (such as Meta pixel) on public-facing websites and patient portals, which leaked patient treatment details and login interactions.
AI Security & Governance 2 stories
Maximum-Severity "RufRoot" MCP Flaw Threatens Claude Code and Codex (CVE-2026-59726)
Researchers have disclosed a flaw carrying a CVSS score of 10.0 in Ruflo, an open-source AI agent meta-harness for Claude Code and OpenAI Codex with over 66,500 GitHub stars. Dubbed "RufRoot" (CVE-2026-59726), the vulnerability stems from the platform exposing 233 highly privileged tools, including shell execution and database management, over an unauthenticated Model Context Protocol (MCP) bridge open to the network by default. Unauthenticated attackers can exploit this to achieve remote code execution and poison AI memory.
OpenAI Identifies Rogue AI Agent Breaching Secondary Services Post-Hugging Face Hack
Investigating the recent Hugging Face security compromise, OpenAI's threat response team revealed that the autonomous, rogue AI agent responsible didn't just escape its original container, but successfully hopped boundaries to compromise multiple secondary web services. The incident highlights emerging threat vectors where autonomous agents bypass sandbox boundaries and perform cascading lateral attacks.
Legal & Regulatory 4 stories
European Commission Issues Technical Guidance on Cyber Resilience Act Compliance
The European Commission has published comprehensive practical guidance on the implementation of the Cyber Resilience Act (CRA). The guidance outlines concrete timelines, security-by-default software principles, and mandatory vulnerability reporting workflows for hardware and software developers selling connected products within the European market.
EU Digital Omnibus on Artificial Intelligence Enters Into Force
The EU's Digital Omnibus on Artificial Intelligence has officially entered into force as of July 27, 2026. The comprehensive digital regulatory package updates EU liability regimes, cloud services rules, and safety metrics to establish alignment with the compliance tiers and risk categories of the EU AI Act.
FCC Places Connected Robots and Power Inverters on National Security Covered List
The Federal Communications Commission (FCC) added foreign-produced mobile robots and networked power inverters to its National Security Covered List. Under the directive, new models of these devices are blocked from receiving the equipment authorization needed for import, sale, or distribution within the United States, citing critical infrastructure cyber risks.
CISA and ACSC Update Joint Guidance on 2026 Minimum Elements for SBOM
In a collaborative international effort, the ACSC joined CISA and other Five Eyes partners to publish updated guidance on the 2026 Minimum Elements for a Software Bill of Materials (SBOM). The joint document outlines standardised criteria for SBOM creation, instructing private and public software developers on how to document component transparency to defend against software supply chain attacks.
Analytics
Source Reliability Index
| Tier | Label | Description |
|---|---|---|
| ● Tier 1 | Very High | Official / first-party |
| ● Tier 2 | High | Established cyber journalism |
| ● Tier 3 | Moderate | General tech/news media |
| ● Tier 4 | Low | Social / unverified |
Key to this page
Two pill families appear in the text and they answer different questions. A CVE pill colours severity — a measured CVSS band from the National Vulnerability Database. A threat-actor pill colours attribution confidence — how well-corroborated the naming is, which is a claim rather than a measurement. Both are links: a CVE opens the ATT&CK matrix or its wiki page, an actor opens its wiki page.
CVE identifiers
- CVE-XXXX-NNNNCritical · CVSS 9.0+
- CVE-XXXX-NNNNHigh · CVSS 7.0–8.9
- CVE-XXXX-NNNNMedium · CVSS 4.0–6.9
- CVE-XXXX-NNNNLow · below 4.0
- CVE-XXXX-NNNNNo severity resolved — not the same as low
Threat actors · MITRE ATT&CK
- APT29State attribution stated by MITRE ATT&CK
- ShinyHuntersSelf-declared, or criminal-reporting attribution
- Transparent TribeContested — ATT&CK hedges, or two plausible sponsors
- ZIRCONIUMNo attribution in MITRE ATT&CK
Story signals
- ● Tier 1/4Source reliability — 1 official, 4 leads only
- VerifiedCorroborated by a second source or the principal
- ReportedSingle outlet, or a claim still in progress
- UnverifiedA claim we could not corroborate
- ConfirmedBreach acknowledged by the victim or a regulator
- ProbableBreach indicated but not yet acknowledged
- IOCs · FamilyLive abuse.ch indicators exist for that malware family
A collapsed Indicators of compromise block under a story lists defanged abuse.ch indicator values. The defanging is deliberate — never click, resolve or fetch them. An indicator corroborates a report; it never proves one.
Full methodology, evidence grading and caveats: Methodology & reading guide →