FlagThis — Daily Cybersecurity Intelligence Briefing

Broadcom VMware vCenter Server is affected by a critical directory traversal vulnerability, CVE-2026-59310 (CVSS 9.8), enabling unauthenticated remote code execution (RCE) via network access. An unidentified APT group is actively exploiting this flaw in a global campaign spanning 47 countries, utilizing a distributed infrastructure of 361 unique IP addresses. Because attackers may have established persistence prior to remediation, applying official vendor patches alone may not fully secure compromised environments. Full system compromise and subsequent lateral movement within virtualized infrastructure represent the primary operational risks.

CVE-2026-65400 is a high-severity state management vulnerability within the macOS screen sharing capability affecting macOS Tahoe, Sequoia, and Sonoma. Attackers targeting exposed Port 5900 can bypass authentication to gain immediate root-level access, enabling full remote takeover of the user interface, including screen visibility and input manipulation. The Netherlands National Cyber Security Centrum (NCSC) has confirmed active exploitation in the wild, primarily utilizing the flaw to deploy Monero cryptominers for resource theft. Immediate remediation requires updating to the latest macOS versions and implementing network restrictions to prevent direct internet exposure of VNC services.

AgentBaiting is a strategic environmental poisoning campaign, part of the larger "FakeGit" operation, targeting agentic AI frameworks including Claude Code, Gemini, and ChatGPT. Attackers leverage malicious Model Context Protocol (MCP) servers and fraudulent AI "skills" to deceive agents into installing malware or executing unauthorized remote commands. The attack surface is expanded via "Hallusquatting"—registering domains that match AI-generated hallucinations—and "Agent Data Injection," utilizing poisoned GitHub comments and product reviews to manipulate agent decision-making. Researchers have identified approximately 7,600 malicious GitHub repositories, with over 800 specifically masquerading as AI tools to facilitate remote code execution (RCE) and unauthorized system access.

Researcher elttam has identified a critical vulnerability in Ruby 4.0 involving a universal Remote Code Execution (RCE) gadget chain within the Marshal.load method. Unlike previous deserialization attacks that relied on specific third-party gems or frameworks to build exploit chains, this discovery utilizes a sequence of Ruby core class instantiations to trigger arbitrary command execution. By passing a specifically crafted binary payload to any Marshal.load sink processing untrusted input, attackers can achieve full system compromise. This finding shifts the threat model from application-specific risk to a systemic vulnerability inherent in the Ruby 4.0 core serialization mechanism, necessitating immediate transition to safer serialization formats like JSON.

Zoom has patched a critical zero-click Remote Code Execution (RCE) vulnerability chain, dubbed "ZOOMSDAY," affecting the Zoom annotation engine. The flaw stems from improper validation of packet sizes during the deserialization of in-memory annotation objects, leading to buffer overflows (CVE-2026-53413) and Use-After-Free errors (CVE-2026-53415) within fixed 128-byte buffers. A malicious actor can achieve RCE on any meeting participant's device without user interaction simply by joining the session. The discovery is notable for its AI-accelerated timeline, where an AI agent reduced the vulnerability research cycle from months to under 24 hours.

WordPress Core is affected by a critical RCE chain dubbed "wp2shell," combining CVE-2026-60137 (SQL injection in WP_Query's author__not_in parameter) and CVE-2026-63030 (REST API batch-route confusion). Unauthenticated remote attackers can exploit the /wp-json/batch/v1 endpoint to bypass security controls and execute arbitrary code without user interaction or plugin dependencies. The vulnerability is exacerbated in environments lacking persistent object caching. Immediate remediation requires updating to versions 6.9.5, 7.0.2, or 7.1 Beta 2. Active exploitation is confirmed, with AI-assisted tools accelerating PoC development and patch diffing.

CVE-2026-20230 is a critical vulnerability in Cisco Unified Communications Manager (Unified CM) and Session Management Edition (SME) that enables unauthenticated remote attackers to achieve root-level system compromise. The attack chain exploits improper input validation in the WebDialer service to trigger a Server-Side Request Forgery (SSRF). By leveraging the file:// URI scheme, attackers can perform arbitrary file writes to the underlying operating system, allowing for the deployment of a rogue Apache Axis service and subsequent webshell installation. Active exploitation involving automated sweeps and Tor-based activity has been observed since late June 2026. Immediate patching to versions 14SU6 or 15SU5 is required, or the WebDialer service must be disabled.

Threat actor UTA0533 is actively exploiting a dual-vulnerability chain targeting SonicWall SMA1000 Series appliances to achieve full perimeter compromise. The attack initiates with CVE-2026-15409, an unauthenticated SSRF in the /wsproxy websocket proxy, allowing attackers to establish TCP tunnels to internal services. This enables the exploitation of CVE-2026-15410, a path traversal vulnerability within the ctrl-service remove_hotfix workflow, resulting in root-level RCE. Post-exploitation activities include the theft of TOTP MFA seeds, session databases, and LDAP credentials, facilitating "VPN-less" lateral movement to internal Domain Controllers. CISA has mandated remediation before the July 17, 2026 deadline.

Adobe has released security update APSB26-68 to address seven maximum-severity vulnerabilities in ColdFusion, headlined by CVE-2026-48281. This vulnerability carries a CVSS 10.0 rating, enabling unauthenticated remote code execution (RCE) by exploiting improper input validation or deserialization flaws within specific ColdFusion tags or functions, such as <cfinvoke> and <cfcomponent>. Successful exploitation allows an attacker to achieve full system control, facilitating lateral movement and privilege escalation within the enterprise network. Organizations running legacy ColdFusion environments face heightened risk, especially as Proof-of-Concept (PoC) research and exploit availability increase following public disclosure. Immediate patching is required to mitigate the risk of widespread exploitation.

Researchers from Mozilla 0DIN have identified critical Indirect Prompt Injection (IPI) vulnerabilities within Claude Code and other agentic AI coding tools. By embedding malicious instructions in seemingly benign external data, such as GitHub README files or bug reports, attackers can manipulate the agent's control flow to execute unauthorized system commands. This exploitation enables Remote Code Execution (RCE) on developer workstations, often bypassing traditional EDR/AV via instruction-based hijacking rather than traditional binary-based malware. Specifically, the research demonstrates an escalation path where the agent is coerced into establishing a reverse shell through DNS TXT records, providing a covert Command and Control (C2) channel that facilitates full machine compromise.

CVE-2026-6875 is a critical pre-authentication code injection vulnerability in the ServiceNow AI Platform scripting sandbox. The flaw allows unauthenticated attackers to achieve a full sandbox escape, leading to Remote Code Execution (RCE) on the underlying host. Exploitation enables OS command execution and the creation of unauthorized administrative accounts. Furthermore, attackers can pivot from the ServiceNow cloud tenant into internal corporate networks via MID Server integrations. While patches were released on July 14, 2026, active exploitation began July 17, 2026, with threat actors utilizing adaptive payloads to bypass signature-based mitigations and the containment layer.

Microsoft has released emergency security patches to address several critical vulnerabilities, most notably CVE-2026-41089, a Windows Netlogon Remote Code Execution (RCE) flaw currently under active exploitation. The threat, associated with the "BlueHammer" campaign, leverages this flaw to achieve total domain compromise through "domain-killing" mechanics. Additionally, at least three zero-day vulnerabilities in Microsoft Defender have been identified, compromising endpoint security integrity. These vulnerabilities affect the Windows kernel and core network services, providing attackers with high-privilege access and the ability to bypass standard security controls. Organizations must remediate these flaws before the June 2026 deadline to prevent widespread enterprise infiltration and potential loss of Active Directory integrity.

The ClawHavoc campaign targets the OpenClaw Marketplace by distributing poisoned AI agent "skills" designed to exploit CVE-2026-25253. This critical remote code execution (RCE) vulnerability allows attackers to escape the sandboxed execution context of an AI agent and gain access to the underlying host system. By integrating these malicious skills into enterprise workflows, threat actors weaponize the agent's inherent permissions to achieve full host compromise, facilitate lateral movement, and enable unauthorized data exfiltration. This represents a significant escalation in AI supply chain risks, where the trust-based model of agentic extensibility is used to bypass traditional security perimeters and compromise critical infrastructure.

Microsoft's AI Red Team and Lakera AI have identified a critical vulnerability in agentic AI systems utilizing the Model Context Protocol (MCP). Adversaries can poison the natural language descriptions of MCP tools to deceive AI agents into "Goal Hijacking," redirecting the agent from its intended objective to attacker-defined tasks. This vulnerability enables zero-click exploit chains where agents autonomously execute malicious actions, including remote code execution (RCE) in agentic IDEs and unauthorized data exfiltration, without requiring user interaction beyond the agent's initial deployment. This mechanism effectively bypasses traditional human-in-the-loop safeguards by exploiting the agent's inherent trust in tool metadata.

Google has released a massive security update for Chrome version 149, remediating a record-breaking 429 vulnerabilities. This deployment targets over 100 high-severity flaws, including 22 critical vulnerabilities capable of facilitating Remote Code Execution (RCE) and sandbox escapes. Technical analysis indicates the update primarily addresses memory safety regressions, specifically Use-after-free (UAF) primitives within the V8 JavaScript engine and the Blink rendering engine. Furthermore, the patch mitigates improper input validation logic and Mojo IPC (Inter-Process Communication) flaws, which serve as primary pathways for privilege escalation and breaking out of the browser's security sandbox.

Microsoft researchers identified "AutoJack," a critical exploit chain in AutoGen Studio's Model Context Protocol (MCP) WebSocket implementation. The attack allows a single malicious webpage to trigger host-level Remote Code Execution (RCE) by exploiting origin confusion and an authentication bypass in MCP paths. Specifically, unvalidated server_params passed via URL enable arbitrary command injection into process-spawning mechanisms like Bash or PowerShell. While patched in source builds, the vulnerability highlights a systemic risk in agentic frameworks that combine autonomous web browsing with privileged access to localhost services, effectively neutralizing traditional local security boundaries.

CISA has added several Microsoft SharePoint on-premises vulnerabilities to the Known Exploited Vulnerabilities (KEV) catalog, signaling active weaponization. The attack surface includes critical RCE via insecure deserialization (CVE-2026-58644, CVSS 9.8) and unauthenticated remote exploitation via CVE-2026-56164. These flaws enable attackers to establish initial footholds, facilitating lateral movement toward Domain Controllers and backup systems for full infrastructure encryption. Remediation requires immediate patching, AMSI integration, and the rotation of SharePoint machine keys to neutralize persistent access.

Google has issued emergency patches for the Chrome V8 JavaScript engine following the discovery of active, in-the-wild exploitation of multiple zero-day vulnerabilities, including CVE-2024-4947 and CVE-2024-5274. These vulnerabilities facilitate remote code execution (RCE) through sophisticated exploitation of the V8 Just-In-Time (JIT) compiler, specifically targeting type confusion and heap buffer overflow conditions. Threat actors utilize malicious site redirections and drive-by downloads to trigger memory corruption, allowing for arbitrary code execution within the browser context. Given the approximately 3.5 billion user base, immediate patching is critical to mitigate risks from advanced persistent threat (APT) activity and increasingly complex browser-based exploit chains.

CVE-2026-20253 is a critical vulnerability in Splunk Enterprise stemming from an unauthenticated PostgreSQL sidecar service endpoint. Attackers can issue unauthenticated HTTP requests to the sidecar port to perform arbitrary file creation and modification operations. By leveraging these file write primitives, an unauthenticated remote attacker can overwrite critical configuration files or inject malicious binaries, escalating the flaw to Remote Code Execution (RCE). With a CVSS score of 9.8, this vulnerability bypasses application-level authentication entirely. Given its active exploitation in the wild and inclusion in the CISA Known Exploited Vulnerabilities (KEV) catalog, immediate patching and forensic investigation of Splunk installation directories are required to mitigate the risk of full system compromise.

Researchers at Cato Networks have identified "DuneSlide," a pair of critical vulnerabilities (CVE-2026-50548 and CVE-2026-50549) in the Cursor AI IDE. These flaws enable prompt-injection-driven sandbox escapes, escalating from LLM interactions to full operating system-level Remote Code Execution (RCE). Attackers can leverage malicious Model Context Protocol (MCP) servers or poisoned web search results to manipulate the run_terminal_cmd tool and bypass path canonicalization logic via symbolic links. Successful exploitation allows unauthorized file writes outside the project root, enabling attackers to overwrite the cursorsandbox executable, modify shell configurations, or establish persistence via macOS LaunchAgents, resulting in total system compromise.

Web Agent Retrieval Poisoning (WARP) is a critical evolution in indirect prompt injection targeting agentic AI systems, including OpenAI Deep Research, Google Gemini Deep Research, and Claude Code. Attackers embed instructions within seemingly benign source material, such as public GitHub repositories, to exploit an AI agent's automated error-recovery instincts. By triggering specific logic, attackers force the agent to fetch second-stage payloads via non-file-based channels like DNS TXT records. This technique bypasses static analysis, secret scanners, and human code review, ultimately enabling Remote Code Execution (RCE) through reverse shells on developer workstations or within CI/CD pipelines.

The June 2026 security updates for Microsoft and Adobe address a systemic surge in vulnerabilities, highlighting a "resilience paradox" where AI-accelerated discovery outpaces human remediation. Critical risks include wormable RCEs in the Windows Kernel (CVE-2026-45657), HTTP.sys (CVE-2026-47291), and the DHCP Client (CVE-2026-44815), all rated CVSS 9.8. Adobe Campaign Classic (APSB26-66) reached a CVSS 10.0. Active exploitation of CVE-2026-41091 (Defender EoP) is confirmed. Remediation requires immediate kernel patching, specific registry modifications for HTTP.sys to mitigate unauthenticated remote execution, and urgent deployment of Adobe bulletins to prevent total environment compromise.

CVE-2026-8037 is a critical pre-authentication remote code execution (RCE) vulnerability in Progress Kemp LoadMaster appliances. The flaw stems from an uninitialized heap vulnerability within the device's API, allowing unauthenticated attackers to send crafted network requests that trigger OS command injection. Successful exploitation grants immediate root-level privileges, leading to total system compromise. Disclosed in June 2026 and subsequently observed in active exploitation by threat actors targeting critical infrastructure, the vulnerability carries a CVSS score of 9.8. Immediate remediation via vendor-supplied patches or disabling the API is required to prevent full appliance takeover.

CVE-2026-3300 is a critical insecure deserialization vulnerability in Everest Forms Pro that enables unauthenticated remote code execution (RCE). The flaw originates from the plugin passing unsanitized user-supplied serialized strings to the PHP unserialize() function, facilitating PHP Object Injection. Attackers can leverage gadget chains to trigger sinks like call_user_func() and file_put_contents(), allowing the deployment of web shells and full server compromise. Immediate patching is required to prevent unauthorized system takeover and subsequent lateral movement within the hosting environment.

GitLab released patch 18.10.3 to address a cluster of critical vulnerabilities, including CVE-2026-1606 and CVE-2026-3074, affecting both Community (CE) and Enterprise (EE) editions. These flaws enable Remote Code Execution (RCE) and significant information disclosure, primarily via code injection vectors within the GitLab Snippets feature and unauthenticated API endpoints. Successful exploitation allows attackers to achieve full system takeover, exfiltrate sensitive source code, and access stored credentials. This marks a shift from historical unauthenticated RCEs to more complex injection flaws requiring immediate version upgrades and rigorous auditing of snippet usage patterns to prevent unauthorized system access.

AI orchestration platforms, specifically Langflow, are facing critical exploitation cycles involving RCE vulnerabilities CVE-2026-33017 and CVE-2025-34291. Attackers have utilized these flaws to deploy the Flodric botnet, achieving full system compromise within a 20-hour window from vulnerability disclosure. To counter this, Atsigns has introduced AI Architect, a platform leveraging cryptographic invisibility to mask application identities. Unlike traditional network-layer filtering, this approach removes the discoverable attack surface, preventing unauthorized actors from identifying or interacting with the AI pipeline, thereby neutralizing the primary vector for RCE and account takeover exploits.

Fortinet FortiSandbox is under active exploitation via a cluster of critical vulnerabilities, most notably CVE-2026-25089 and CVE-2026-26083 (CVSS 9.8). Attackers leverage OS Command Injection (CWE-78) and Missing Authorization (CWE-862) to execute arbitrary commands with high privileges without authentication. This is often chained with CVE-2026-39813 (Path Traversal in the JRPC API) and CVE-2026-39808 to bypass security controls and gain full system access. The primary impact is the complete compromise of the sandbox appliance, allowing adversaries to manipulate the malware analysis environment and potentially pivot deeper into the corporate network.

GuardFall is a systemic architectural flaw affecting 91% of tested open-source AI coding agents, including Aider, Open Interpreter, and OpenHands. The vulnerability arises from the agents' reliance on superficial safety filters to block "dangerous" shell commands. Attackers can bypass these filters using classical shell injection metacharacters via prompt injection, leading to arbitrary command execution. Because these agents typically operate with the full privileges of the host user, exploitation enables the theft of environment secrets, API keys, and the full compromise of CI/CD pipelines and host systems.

CISA has added CVE-2026-12569 to its Known Exploited Vulnerabilities (KEV) catalog, targeting PTC Windchill and FlexPLM product lifecycle management (PLM) software. This critical unsafe deserialization vulnerability (CVSS 9.3) allows unauthenticated remote attackers to achieve Remote Code Execution (RCE) via the Windchill PDMLink web component. Threat actors are actively leveraging this flaw to deploy web shells, facilitating persistent access and lateral movement within sensitive engineering and manufacturing environments. Given the concentration of proprietary CAD designs and bills of materials (BOM) within these systems, exploitation poses an extreme risk of industrial espionage and intellectual property theft across the defense, aerospace, and automotive sectors.

F5 has issued emergency patches for CVE-2026-42945, a critical heap buffer overflow vulnerability within the NGINX rewrite module, known as "NGINX Rift." Discovered through AI-driven LLM grounding, this flaw has persisted in legacy code for approximately 18 years. The vulnerability enables unauthenticated Remote Code Execution (RCE) and Denial of Service (DoS) by exploiting specific 'rewrite' rule syntax. Given NGINX's ubiquity as a reverse proxy, API gateway, and edge load balancer, the attack surface is massive, posing a significant risk of complete system compromise and service disruption for critical internet-facing infrastructure.