Latest / Daily DefSec Brief / Daily DefSec Brief - Cyber Security News for July 15 2026
Transcript
- Jerry: TISA added four actively exploited bugs to the Kev catalog overnight. Two of them are patch Tuesday's own zero days and every one of them is due Friday. So if you run on-prem SharePoint, ADFS, or Sonicwall Remote Access, you've got some work to do. This is your daily DefSec brief. I'm Jerry Bell, your few minutes on what defenders need to know for today, July 15th, 2026. First the Big One. CISA added two Tuesday's zero days to the Cav catalog. They're privilege escalation bugs in SharePoint Server and ADFS. both were already confirmed under attack when Microsoft shipped July's Patch Tuesday. The SharePoint one is tracked as CVE 2026 56164, and the ADFS one is CVE 2026 56155. This hits all supported on-prem SharePoint servers subscription edition 2019 and 2016 and ADFS on supported Windows servers. By the way, this is bigger than just those two. C says put out a SharePoint hardening advisory that flags three more CVs tied to the same on-prem exploitation wave, and Rapid7 disclosed a new auth bypass in the same product whose remote cut execution half won't be patched until August. On a broader point, Microsoft patched well over 1,000 vulnerabilities across its various products, many of them rated critical. ⁓ Get on it. Next up is SonicWall. CISA added two SonicWall SMA 1000 bugs to the Kev. One's an authenticated server-side request forgery flaw, and the other is an authenticated code injection bug That lets an admin level attacker run arbitrary OS commands right on the appliance. Now that might sound low risk, but we know that attackers are often compromising admin accounts, and this provides an avenue for persistence. So take it seriously. SSRF CVE 2026-15409, and the code injection is CVE 2026-15410. This affects SonicWall SMA 1000 series SSL VPN appliances. CISA has these as actively exploited, and we know from experience that SonicWalls are a favorite of ransomware operators. if you can't patch today, take that management interface off the internet and check Sonic Wall's advisory for compromise indicators. There's really no good reason for an SMA 1000 admin panel to be facing the open internet anyway. All right, moving on. There's an update to a story from last week. Progress confirmed the emergency shutdown of sharefile's storage zone controller was related to a high severity zero day vulnerability. I found it after a tip. the good news is patched versions are out and access has been restored. this affects the sharefile zone controllers version five and six on Windows servers. The patches are out now. If you had shut them down, you can get them patched and back in business. Our last story is one for the developers on your team. Windows, if a repos root folder contains the file name get.exe, Cursor's Windows client finds it and runs it automatically the moment the project loads. No click, no prompt, opening the folder is the whole attack. And it keeps rerunning that file as long as the project stays open. This affects cursor on Windows for anyone who opens an untrusted repo. MindGuard reported they've got a working proof of concept, and as of now it's still unpatched. Cursor hasn't published an advisory yet. So until Cursor fixes this, don't open untrusted repos and cursor on Windows. Check a repo's route for an unexpected get.exe before you open it. And if you want a detection, consider alerting an EDR when git.exe runs outside your standard Git install path. That'd catch this and a few other things while you're at it. Before we wrap, a few quick ones. RabbitMQ patched two access control flaws that could leak a broker's OWASP secret and expose cross-tenant queue data. So update to one of the fixed releases. ESET found eleven old Microsoft signed Linux UEFEI that let attackers bypass secure boot. And the fix is to push an updated UEFI revocation so the expired certificate gets blocked. Four compromised async API MPM packages were shipping a multi-stage botnet loader, so audit your builds for the affected versions and pin to a clean release. and Adobe patched eight critical cold fusion bugs that allow code execution and privilege So get on the latest cold fusion updates. That's the brief. Thanks for watching. All the sources are in the show notes. this was useful, like and subscribe and pass it along to a friend who'll use it. I'm Jerry Bell and I'll see you again tomorrow.