Latest / Daily DefSec Brief / Daily DefSec Brief - Cyber Security News for July 17 2026
Transcript
- Jerry: If you're running a Fortinet sandbox appliance, this is your first job this morning because it just landed on Cecus Kevlist with a two-day patch clock. and while you're at it, there's a fresh batch of HTTP2 servers that can be knocked over by nothing more than a client that stops talking. Happy Friday, friends. This is the daily Def Sec Brief. I'm Jerry Bell. Your few minutes on what defenders need to know for today, July 17th, 2026. Fortus Sandbox has an OS command injection flaw and it's now being used in the wild. An unauthenticated attacker can send a crafted HTTP request to the appliance and run arbitrary commands on it. no login required, which is about as bad as it gets for a box whose whole job is to sit and inspect suspicious files. It's tracked as CVE 2026 25089, and it hits Fortusandbox, Fortusandbox Cloud, and the pass version. Get that thing patched and rethink whether the API should be publicly accessible. Next up is a denial of service issue in HTTP2, and if it sounds familiar, it's from the same family as the old rapid reset problem. Some HTTP2 server implementations don't properly cap memory when a client installs its outbound data across a lot of streams at once, using standard flow control settings. An attacker can use that to exhaust the server's memory and take the service down. CC has the details in their vulnerability note and the EPSS on this one is high, which tells me people expect it to get used. So the action here is to check your HTTP2 terminating servers and proxies against search CC's vendor list. Apply whatever patches are available and make sure your flow control buffering actually has resource limits on it. And if you want a detection signal, watch for spikes in stalled streams. Alright, moving on. 7Zip patch to heap overflow in its XZ decompression. And since 7Z is more or less on everything, it's worth mentioning, even though this is a straightforward one, malformed XZ chunk data can trigger a heap-based buffer overflow whilst decompressing, and that lets an attacker run code with the privileges of whoever opened the archive. It's tracked as CVE 2026-14266. It needs user interaction, so someone has to actually open a malicious archive. And there's no proof of concept or active exploitation in the reporting yet. So this is a clean go update item. Move 7 zip to the current release and keep treating unsolicited compressed archives with the same suspicion you give any untrusted content. Our last story is a research one worth knowing about before you hand your AI agents more autonomy. Researchers are describing something they call agent data injection or ADI. The idea here is that instead of hijacking the agent's instructions the way classic prompt injection does, you plant content inside the data the agent already trusts. A sender name, a button ID, a code comment. The agent reads that, takes an unintended action, and the whole time it still thinks is doing exactly the task you asked for. The distinction they draw is that it doesn't corrupt the goal. It corrupts the facts feeding the goal. this is theoretical for now. in a paper posted on july sixth with No in the Wild reports, But it affects agents and coding assistants that pull in external attacker reachable content like reviews, comments, and web pages as part of their work. So the takeaway for me is to treat any external content an agent reads as untrusted input, not just the instruction channel. If you're deploying agents that can click, buy, or run commands, add provenance checks or allow lists on the data they can act on, rather than only filtering the prompts. So we're early on this, but this is the right time to be thinking about it. Okay, before we wrap a few quick ones, Microsoft is tracking ACR Stealer, which harvests Microsoft's 365 files and browser tokens through clickfix lures. And their guidance is to hunt for click fix prompts, obfuscated PowerShell and web dev activity, and to revoke tokens rather than just rotate passwords. Sandworm is now using fake captcha pages to get Ukrainian targets to paste malicious PowerShell themselves. So block clipboard triggering PowerShell and train people to recognize that pattern. And SG Lang's expert parallel backup subsystem has an unpatched pickles deserialization bug that gives remote code execution with no vendor response yet. So disable that subsystem or block network access to it until there's a fix. That's the brief. Thanks for watching. All the sources are in the show notes. If this was useful, like and subscribe and pass it along to a friend who'll use it. I'm Jerry Bell and I'll see you again tomorrow.