Stay updated with the latest cybersecurity news! This daily roundup covers critical vulnerabilities, emerging threats, data breaches, and active exploits to keep you informed and secure in the ever-evolving digital landscape. Here are the key updates from the past day or so (primarily July 27 reporting).
1. Hackers Target US Firms in FastJson RCE Zero-Day Attacks
Published: 2026-07-27
Hackers are actively exploiting a critical remote code execution vulnerability (CVE-2026-16723, CVSS ~9.0) in the FastJson open-source Java library (versions 1.2.68–1.2.83). The flaw enables unauthenticated RCE without user interaction or elevated privileges, particularly in Spring Boot fat-JAR deployments with SafeMode disabled by default. Attacks primarily hit US organizations across financial services, healthcare, retail, and other sectors, with limited activity also seen in Singapore and Canada. No 1.x patch is available; mitigation involves enabling SafeMode or migrating to Fastjson2.
2. Arista Patches VeloCloud Orchestrator Zero-Day Exploited in Attacks
Published: 2026-07-27
Arista has released patches for a maximum-severity (CVSS 10.0) unauthenticated OS command injection vulnerability (CVE-2026-16812) in on-premises VeloCloud Orchestrator (VCO) deployments. The flaw allows remote attackers to access privileged internal functionality, potentially compromising the orchestrator’s confidentiality, integrity, and availability. It is under active exploitation. Affected versions include certain 5.2.x, 6.1.x, 6.4.x, and 7.0.x releases; hosted/dedicated versions were already patched. Immediate upgrades to fixed releases (e.g., 5.2.3.14+, 6.1.3.4+) are recommended.
3. New Dysphoria DDoS Botnet Spreads to 200k Devices Worldwide
Published: 2026-07-27
The Dysphoria IoT botnet has compromised approximately 200,000 devices globally and is used for DDoS attacks and traffic relay operations. It evolved from earlier families (JackSkid/fbot), adding blockchain-based C2 resolution via Ethereum ENS and Solana SNS domains, plus victim-device relays that complicate takedowns. Propagation relies on weak credentials and known router vulnerabilities (including older CVEs). Operators claim up to 4 Tbps capacity. Researchers urge patching exposed IoT devices, removing weak credentials, and disabling unnecessary remote management.
4. New Certighost PoC Exploit Lets Attackers Hijack Windows Domains
Published: 2026-07-27
A public proof-of-concept exploit for “Certighost” (CVE-2026-54121, CVSS 8.8) in Microsoft Active Directory Certificate Services (AD CS) has been released. The flaw (patched in July 14 Patch Tuesday) allows a low-privileged authenticated domain user to abuse a chase/fallback mechanism, obtain a Domain Controller certificate, perform DCSync, and extract the krbtgt secret—enabling full domain compromise (Golden Ticket potential). It leverages default MachineAccountQuota settings. Organizations should apply the July updates urgently and audit AD CS configurations.
5. Coca-Cola Confirms Data Theft in Fairlife Ransomware Attack
Published: 2026-07-27
Coca-Cola confirmed that the ransomware attack on its Fairlife dairy subsidiary (which temporarily halted US production earlier in July) involved data theft. The Anubis group claimed responsibility, alleging encryption of systems and theft of ~1 TB of confidential data, while threatening to leak it. Most production capacity has since been restored, with no material financial impact expected and no effects on product quality/safety. The incident highlights ongoing risks to industrial and supply-chain operations.
6. Ernst & Young Data Breach Claimed by ShinyHunters Extortion Gang
Published: 2026-07-27
The ShinyHunters extortion group has claimed responsibility for a recently disclosed Ernst & Young (EY) data breach involving a third-party support ticket system used by IT personnel. Attackers accessed the platform (March 28–April 12 period) and downloaded documents that may contain client tax information. ShinyHunters asserts credentials were obtained via a supply-chain attack enabling access to Jira, GitHub, and Azure environments, and has listed EY on its leak site with a July 31 deadline. EY previously notified affected clients and is providing credit monitoring.
7. 75 Million Revolut Records Allegedly for Sale
Published: 2026-07-27
A threat actor listed a database allegedly containing 75 million Revolut customer records for sale on a cybercrime forum. Sample data reviewed by researchers included partial card details, emails, names, phone numbers, addresses, device info, and hashed credentials (newest samples ~May 2025). The claimed scale appears unusually large relative to the low asking price, and verification is ongoing. Revolut is investigating; users should remain alert to phishing and monitor accounts closely.
8. Check Point SmartConsole Authentication Bypass Actively Exploited and Added to CISA KEV
Published: 2026-07-27 (coverage)/earlier advisory
CISA added Check Point’s critical SmartConsole authentication bypass (CVE-2026-16232, CVSS ~9.3) to its Known Exploited Vulnerabilities catalog after confirmed active exploitation. The flaw allows unauthenticated remote attackers to obtain an application login token and gain full administrative access to Security Management or Multi-Domain Management servers (when internet-exposed without Trusted Clients restrictions). Check Point released jumbo hotfixes; organizations must patch immediately, restrict management access, and check logs for signs of compromise.
Stay Vigilant
Cyber threats continue to evolve rapidly, with zero-days, AI-adjacent risks, supply-chain issues, and ransomware remaining persistent themes. Prioritize patching (especially internet-facing management interfaces and widely used libraries), monitor for anomalous activity, enforce least privilege and network segmentation, and maintain robust backup/incident response plans. Subscribe for ongoing daily or weekly updates, and consider continuous monitoring tools suited to your environment. Stay safe online!