Latest / Daily DefSec Brief / Daily DefSec Brief - Cyber Security News for July 8 2026
Transcript
- Jerry: Four products just landed on CISA's Kev list with a Friday deadline, and that's the headline today. Cold Fusion, Langflow, and two Joomla plugins are all getting hit this week. This is the daily Def Sec Brief. I'm Jerry Bell, and this is your few minutes on what defenders need to know for today, July 8th. Four stories and then a quick round at the end. First up, CISA added four things to the known exploited vulnerabilities catalog, and two of them are new since we last talked about this. There's a patch traversal bug in Adobe Cold Fusion and Authorization Bypass and Langflow, and unrestricted file upload flaws and two separate Joomla page builder extensions. All four are confirmed under active exploitation. And yes, this is a new auth bypass and langflow, not the one I mentioned a few days ago that was used by a clanker to autonomously deploy ransomware. The Cold Fusion one is tracked as CVE 2026 48.282 and is a perfect 10. Langflow is a 9.9. Sysdig first saw the Langflow flaw being exploited back on June 26th. So this isn't theoretical. The affected versions of Cold Fusion are 2025.9, 2023.20 and earlier. and then lang flow before 1.9.1. ⁓ So here's what you need to do. Patch Cold Fusion and get Langflow up to 1.9.1 or later and do it now. Then go check any Joomla sites that you run for those two specific page builder extensions and patch them or pull them out. Federal agencies have until Friday, July 10th. Everybody else should treat that same date as your deadline too. Alright, moving on to Ubiquity. If you use Unify Connect to run building automation, EV chargers are lightning, you'll want to update today. There's an improper access control flaw that lets someone with network access trigger command ejection right on the host device. It's tracked as CVE 2026-5746. The good news, if there is any, is that there's no confirmed in the wild reports yet. This patch just came out, so you got a window here that the Cold Fusion folks don't have. Effected is Unify Connect application 3.4.16 and earlier. Update to 3.4.20 or later now. And by the way, Ubiquiti shipped six other Unify OS patches, so while you're in there, roll those out too. Next up is Gidea, and this one is under active exploitation. If you self-host Gidea and Docker with a reverse proxy authentication turned on, go check your config today. The official Docker image is shipped with a default that trusts reverse proxy auth headers from any source IP. So an attacker who just supplies a valid username with a single HTTP header can log in as that user. That's it, that's the whole attack. It's CVE 2026-2896. ⁓ It's a 9.8. Systig's threat research is reporting active use in the wild. It affects the official images before 1.26.3. So upgrade to 1.26.3 or later. And if you sit behind a proxy, confirm that you're actually restricting which proxy IPs you trust. Rather than accepting that header from any source. Our last story comes from the Hacker News and it's a Linux kernel flaw they're calling Ghost Lock. any logged in local user on an unpatched box can become root and it works from inside a container too. It's a use after freestyle bug and a kernel scheduling mechanism, and it's been shipping in mainstream distros since 2011. Ordinary threading calls from any local program are enough to trigger it. It's tracked to CVE 2026-43499. Now there's no confirmed in the wild use yet, but Nebula Security published a working exploit code and they measured it at 97% reliable in their testing. So the proof of concept is public and it's good. Patch your servers up to a fixed kernel today. while there's no exploitation in wild yet, with a reliable exploit code out there, ⁓ I treat this as urgent. ⁓ fifteen year old privilege escalation that reaches out of containers is not awesome. And before we wrap, a few quick ones. A China Link actor is expanding its relay network with new malware by breaking into unpatched ruckus routers. So patch your ruckus firmware and watch for unusual app on proxy traffic. Prompt injection flow out called GitLost lets attackers leak private GitHub repo data just by filing a public issue against an org using agentic workflows. So audit which repos those workflows can read and cut that access to the minimum. Unit 42 found a mail advertising campaign pushing fake cracked software downloads that dropped both the Vidar Stealer and the XMRig minor. So block the known mail advertising domains and remind your users that pirated software still isn't worth it. And there's a hard-coded backdoor password in Tenda router firmware that grants full admin access. The vendor hasn't responded to the disclosure yet, so pull affected tender routers off of any internet facing network until there's a fix. That's the brief. Thanks for watching. The sources are all in the show notes. If this was useful, like and subscribe and pass it along to a friend who'd use it. I'm Jerry Bell and I'll see you tomorrow.