Latest / Daily DefSec Brief / Daily DefSec Brief - Cyber Security News for July 16 2026
Transcript
- Jerry: If you run Oracle eBusiness Suite, especially the payments module, there's a patch to go check today because CISA just told federal agencies they have until Saturday to get it done and it's under active attack. This is the daily DefSec brief. I'm Jerry Bell. Your few minutes on what defenders need to know for today, July 16th, 2026. The first one comes from CISA and it's an update to one I've covered previously. They've added the Oracle eBusiness Suite flaw. To the known exploited vulnerabilities catalog, and the federal deadline to patch is Saturday, July 18th. It's an improper privilege management bug in the file transmission component of Oracle payments. And the problem is it lets an unauthenticated attacker with HTTP access take over the whole system. Oracle actually patched this back in May 2026. So the fix has been out for a while. What's new is that CISA now says it's being exploited in the wild. Bleeping Computer corroborates that. make sure that you've applied that May 2026 Oracle CPU. the federal deadline is Saturday, but if your EBS instance is internet facing, I treat that as your own deadline too. moving on. Zoom has patched a critical account takeover flaw in its Windows client. It's an improper input validation bug, and an unauthenticated attacker can use it to take over a Zoom account outright. It's rated a 9.8. Zoom found this one internally and patched it along with three related lower severity flaws at the same time. By the way, there are no reports of anyone exploding in this in the wild, so this isn't a fire drill yet. It's a straightforward one to close. Go update your Zoom workplace, the VDI client, the meeting SDK, all the Zoom things. The affected versions are kinda complicated, so check the advisory for the exact versions you need. Next up is F5, which shipped an out of band patch for a critical flaw in Nginx. If you run Nginx Plus or Nginx open source, there's an unscheduled patch waiting for you. It's a heap buffer overflow in the way Nginx handles regex in the map directive. And a crafted HTTP request can crash the worker process. F5 patched it along with seven other Nginx and big IP bugs in the same out of band release. It's important to note that F five says exploitation depends on conditions the attacker doesn't control. And there's no in the wild reports yet. So it's rated as critical, but the practical exposure is narrower than the scope alone suggests. Apply F5's out of band patch. if you can't do it right away, F5 says ASLR is the mitigating factor. So confirm that it's enabled in the meantime. Alright, this last story comes from Cisco Talos. They're tracking a financially motivated group, and the group is distributing trojanized installers for a bunch of common tools like WebEx, Zoom, MOBAXTerm, Dbeaver, and FaceIT. The way it works, the installer runs an HTA file, drops a Python-based RET that Talos calls Starland and stands up a PowerShell-based memory resident command and control they call WLDR. the group also carries Castle Stealer and Remcos in its kit and what it's after is credentials and crypto wallets. Most of the victims are Windows users in the US, with some also seen in Germany, Romania and Venezuela. There are two things to do here. First, tell your users to only install Zoom WebEx and other tools from your approved sources, like the official vendor web pages. Second, go hunt for HTA launched NSys installers and unexpected PowerShell beaconing. That combination is the tell here. Before we wrap, a few quick ones. New ransomware called Spirals went from an IIS web shell to encrypting the whole network in under 24 hours. So harden your internet-facing IIS servers and watch for fast UAC bypasses, RDP being enabled and WMI lateral movement. JetBrains patch six bugs across Team City, U-Trek, and IntelliJ Idea. including a critical path traversal that can lead to code execution. So update to the latest builds. Cisco fixed an authenticated privilege escalation chain in Catalyst SD WAN that lets a net admin account become root. So apply the fixed releases. And both Firefox and Chrome shipped critical patches this week, including two Firefox bugs that already have public exploit code out. So go update your browsers. That's the brief. Thank you for watching. The sources are in the show notes. If this was useful, like and subscribe and pass it along to a friend who can use it. I'm Jerry Bell and I'll see you again tomorrow.