Stay updated with the latest cybersecurity news! This daily roundup covers critical vulnerabilities, emerging threats, AI-driven attacks, state-sponsored campaigns, and significant incidents from the past few days to keep you informed and secure in the rapidly evolving digital landscape.
1. Researcher Publishes GitLab RCE PoC Letting Authenticated Users Run Commands as Git
Published: 2026-07-25
Security researcher Yuhang Wu (depthfirst) released a working proof-of-concept exploit that allows an ordinary authenticated user to execute commands as the git user on unpatched self-managed GitLab 18.11.3 servers. The chain works by committing two crafted Jupyter notebooks and requesting their diff—no admin rights, CI runner access, or victim interaction required.
2. Cl0p Affiliates Target Internet-Exposed PTC Windchill and FlexPLM with Unauthenticated RCE
Published: 2026-07-25
Cl0p ransomware affiliates are actively exploiting CVE-2026-12569 (CVSS 9.3), an unauthenticated remote code execution flaw in PTC Windchill and FlexPLM product lifecycle management software. Attackers deploy web shells for file enumeration and double-extortion operations targeting manufacturing, automotive, aerospace, and retail organizations. CISA has urged immediate patching.
3. Fastjson 1.x RCE Vulnerability Targeted in Attacks With No Patch Available
Published: 2026-07-25
Attackers are actively exploiting CVE-2026-16723, a critical remote code execution flaw (CVSS 9.0) in Fastjson 1.x that affects many Spring Boot applications. Malicious JSON requests can trigger unauthenticated code execution. No official patch exists yet; recommended mitigations include enabling SafeMode or migrating to Fastjson2.
4. BlueNoroff Zoom Phishing Kit Profiles Crypto Wallets Before Malware Delivery
Published: 2026-07-24
North Korean threat actors (BlueNoroff) are operating an active phishing kit that impersonates Zoom and Microsoft Teams via typosquatted domains. The kit profiles victims’ cryptocurrency wallets, hijacks trusted Telegram accounts, uses AI-generated faces, and delivers malware selectively to high-value targets through ClickFix-style social engineering.
5. Certighost Exploit Lets Low-Privileged Active Directory Users Impersonate a Domain Controller
Published: 2026-07-24
Researchers released a public proof-of-concept for CVE-2026-54121 (“Certighost”), a flaw in Active Directory Certificate Services. A low-privileged domain user can obtain a Domain Controller certificate, authenticate as that machine, and perform DCSync to retrieve the krbtgt secret—enabling full domain compromise. Microsoft patched it in the July 2026 updates.
6. ChatGPT AgentForger Flaw Could Deploy Rogue Workspace Agents via a Phishing Link
Published: 2026-07-24
Zenity Labs disclosed “AgentForger,” a critical vulnerability in OpenAI’s ChatGPT Workspace Agents (patched June 8). A single phishing link could silently create, authorize, and deploy an autonomous AI agent inside a victim’s organization with the employee’s access rights, bypassing approval prompts and enabling persistent data access and further attacks.
7. Bing Images Flaws Let Crafted SVGs Run Commands as SYSTEM on Microsoft’s Servers
Published: 2026-07-24
Researchers at XBOW found critical remote code execution flaws (CVE-2026-32194 and related) in Bing’s image-processing pipeline. A crafted SVG uploaded via public image search could execute commands as NT AUTHORITY\SYSTEM on Windows workers and as root on Linux machines in the same fleet—no authentication or user interaction required. Microsoft has remediated the issues server-side.
8. Hotel Wi-Fi Routers Compromised to Steal Corporate Login Credentials via DNS Poisoning
Published: 2026-07-24
ReliaQuest reported a widespread campaign compromising hotel and conference-center Wi-Fi captive portal gateways. Attackers use DNS poisoning to redirect Microsoft 365 login traffic to fake pages, harvesting credentials and tokens from traveling employees without phishing emails or endpoint malware. Activity has been observed in the US, India, and Saudi Arabia since at least June 2026.
Stay Vigilant
Cyber threats continue to evolve rapidly—especially with AI agents being used for both defense and offense, zero-click exploits, and supply-chain targeting of enterprise tools. Prioritize timely patching of critical systems (GitLab, AD CS, PTC products, Zimbra, etc.), enforce always-on full-tunnel VPNs for travelers, monitor for unusual AI agent activity, and review certificate services configurations. Subscribe for daily or weekly updates, and consider continuous vulnerability monitoring tools for your environment. Stay safe online!