Latest / Daily DefSec Brief / Daily DefSec Brief - Cyber Security News for July 21 2026
Transcript
- Jerry: Patch Palo Alto VPN bug is now feeding QLIn ransomware intrusions, and there's a Windows Privilege Escalation Zero Day with no official fix. So today's a patch and hunt day. This is the daily DefSec Brief. I'm Jerry Bell, the day's security news in five minutes for July 21st, 2026. Twelve items on the board today. One, there's an authentication bypass in PanOS Global Protect that lets attackers set up an unauthorized VPN connection for initial access. And the QLIN ransomware crew is using it right now. Palo Alto patched it back in May. So patch now and if you can't, apply the vendor mitigations and hunt for unauthorized VPN sessions. 2. A Windows user service flaw lets a non-admin write to the classes registry hive and get code execution the next time an admin logs in on fully patched systems with a proof of concept and no official fix yet. Look at the vetted unofficial micro patch and watch for pending Microsoft updates and alert on non-admin rights to the classes hive. Three. Sandworm is running fake capture pages that tell visitors to paste and run a PowerShell command so the victim runs the attacker's code themselves. Block that clipboard to run behavior. Alert on PowerShell spawn from a browser or the run dialog, and remind people no capture ever asks you to run a command. 4. Zimbra patched a critical unauthenticated command injection bug in its SNMP monitoring component. plus some XSS flaws in the classic UI. Update to 10.1.20 and if you can't yet disable SNMP notifications and the swatchdog service as a stopgap. Five. There's an authorization bypass in Gidea where a public scope token can push into a private pull request branch and trigger private action workflows. Update the version 1.27.0 and audit your public scope tokens along with recent private PR and actions activities. 6. An espionage implant called Holograph hides its tasking stolen files. In Microsoft 365 calendar events dated to 2050, moving everything over legitimate graph content. Hunt for odd graph calendar activity and out of range event dates because network controls keyed to attacker infrastructure won't catch this. Seven, an espionage campaign is planting Telegram bot backdoors in Middle Eastern government networks using an ISO with a legitimate ACES binary that sideloads a malicious DLL. Alert on ISO-delivered executables sideloading DLLs and on servers reaching out to Telegram's bot API when they've got no business doing that. Eight, a campaign called Fake Git is using nearly 7,600 malicious GitHub repos, Many posing as AI skills or MCP servers to push Smart Loader and then steal IC InfoStealer. Vet repos before you run their zips, distrust lookalike dev profiles, and hunt for those indicators on developer machines. 9. Rapid 7 found an exposed server holding over a thousand artifacts, basically a QA lab where attackers used LLMs to generate lures and automated tests for web dev execution. Close any internet exposed web dev, restrict web dev execution, and review reference CVEs against your own stack. 10. Researchers escape sandboxes of four AI coding agents. Cursor, Codex, Gemini CLI, and Anti-Gravity. Without touching the sandbox directly, the agent writes a workspace file that a trusted tool outside the sandbox later runs. Update the affected agents per each vendor and treat anything an agent writes as untrusted input to tools running outside the sandbox. eleven. OpenSSL quietly fixed a pre handshake memory exhaustion denial service where an eleven byte payload forces large allocations that never get freed. Exhausting server memory before any handshake. Update OpenSSL to the fixed version and prioritize your internet facing services. 12. The Linux kernel project shipped fixes for over 400 vulnerabilities in about a day. A lot of them memory safety issues across XFS, BTRFS, Netfilter, Bluetooth, KVM, and more, driven by AI assisted discovery. Track your distro's backported updates and prioritize by subsystems you actually expose rather than chasing all 400. That's the board for today. Thanks for watching. All the sources are linked in the show notes below. If the show's useful to you, a like and subscribe would help and pass it along to someone who'd use it. Be back again tomorrow.