Latest / Daily DefSec Brief / Daily DefSec Brief - Cyber Security News for July 28 2026
Transcript
- Jerry: If you run Arista's VeloCloud Orchestrator on-prem, today's list opens with a maximum severity zero day that's already being exploited. This is the daily DefSec Brief. I'm Jerry Bell, the day's security news in five minutes for Tuesday, July 28th, 2026. 12 items on the board today. 1. There's an unauthenticated command injection in on-prem VeloCloud Orchestrator that lets a remote attacker take over the host. And it's a CVSS 10. Patches are out, it's listed in the Kev, you know what to do. Two, JetBrains fixed a critical auth bypass in Team City on premises that lets an unauthenticated attacker run OS commands as the Team City process. And there's a public proof of concept. Update to twenty five dot eleven dot seven or twenty s twenty six dot one dot three and restrict internet exposure of the server in the meantime. 3. CISA added a Forta OS info explosure flaw to the Kev that lets an attacker rebuild Simlink Persistence, but only after the device is already compromised. Apply Fortinets fix and go hunt for Simlink Persistence artifacts on any Forta OS box that's been exposed. 4. Imperva now confirms that Fastjson RCE0 Day is being actively exploited across financial services, healthcare, and retail, mostly US organizations, on stock default configs. Those 1.x versions are end of life, some migrate off a 1.x line and monitor for the patterns Imperva provides. This is feeling more and more like log4 show every day, but without the hype machine. Five. Level Blue published a proof of concept called Legacy Hive that abuses how Windows loads registry hives at logon and it runs on fully patched July systems. Don't lean on patch date here. Build detections around abnormal login time API sequence they documented. 6. Progress disclosed five flaws in Kemp Loadmaster. Three of them command ejection to root. Exploitable by authenticated users. Apply the july twenty seventh bulletin and tighten who can reach the management interface. 7. Operation Blue Dash uses a fake Teams update lure to silently deploy level RMM and drop screen connect in parallel. Block teamvem.com, alert on the level enrollment string, and take a minute to inventory your approved RMM tooling. Eight, the APT known as Mirage Kitten is using fake recruitment portals to drop a new backdoor called Night Ledger plus custom tunnelers against aerospace, defense, and telecom orgs. Hunt for the indicators on secureless report and scrutinize recruitment theme lures if you're in those sectors. nine. Four high severity flaws in lib SSH two let a malicious SSH server corrupt client memory after authentication. Including a double free in the SFTP open path. Update lip SSH2 and check which of your backup and automation tools quietly bundle it. 10. A public exploit is out for a V Bolton pre-auth RCE that reaches PHP's eval Upgrade self-hosted installs to 6.2.2 now that the details are public. 11. Security Joe's found in N8M Sandbox Escape that lets an authenticated workflow editor run OS commands and it bypasses the February 5th. Update to the latest version rather than relying on the interim access guidance, which the Advisory says is incomplete. 12. SANS is tracking fake bank emails that ship a RAR archive with a VBS script. decode a payload through PowerShell and use auto IT to inject it into a remote process. Block the published hashes, alert on VBS to PowerShell decode chains, and treat RAR attachments from bank senders with suspicion. that's the board for today. All the sources are in the show notes below. If the show is useful to you, please give us a like and subscribe and also pass it on to someone who you think will be able to use it. Back again tomorrow.