Latest / Daily DefSec Brief / Daily DefSec Brief - Cyber Security News for July 27 2026
Transcript
- Jerry: If you run Java apps, today opens with a fast JSON RCE that went from disclosure to in the wild exploitation in about a day. This is the daily DefSec Brief. I'm Jerry Bell, the day's security news in five minutes for Monday, July 27, 2026. 1. There's a JSON parsing remote code execution bug in Alibaba's Fast JSON. One of the most used JSON libraries, and it's being exploited in the wild already. This feels a little like log4 shell. Inventory your apps for fast JSON, get to the fixed version from the vendor advisory, watch for fixes from other software you use that might also be exposed to this. 2. There's an update on the ransomware campaign hitting Edge VPN and firewall gear, now spanning Fortinet, Palo Alto, Citrix, and Checkpoint. With a mass fortigate credential compromise in the mix. Patch the listed CVEs on your edge devices, rotate fortigate credentials, and get management interfaces off the public internet. Three, attackers are scanning for the Spring Boot Heap Dump endpoint, which hands back a memory image that often contains API keys and database passwords. Disable or restrict the actuator endpoints and if it was exposed, Rotate any secrets the system may have had access to. Four. The North Korean Blue NORAF group is taking over real telegram accounts of trusted contacts and sending fake meeting links that lead to clickfix malware hunting for crypto wallets. Treat unexpected meeting links from people you know with suspicion. Block paste to run lures and pull the published IOCs. Five, Spark Kitty malware on iOS and Android uses OCR to read wallet seed phrases straight out of your screenshots and photo gallery. And it's reached the official app stores. Stop storing seed phrases as screenshots, scrutinize photo access requests, and check for the Trojanized apps checkpoint named. 6. An East Asia-linked actor is hitting Middle East governments with a new malware that uses Telegram API for command and control to blend into normal traffic. Hunt for DLL side loading and for anomalous Telegram API traffic coming from your servers. Seven, attackers are building look-alike download sites for more than 70 popular Windows utilities, ranking them in search engines and swapping in malicious downloads once the traffic builds. Source your downloads from official vendor links, block the bad domains as they surface, and remind users about search ranked download pages. Eight, there's a proof of concept for a cloud code flaw where a malicious repo uses a link to pull a file from outside the project into the model's first opbound request. Skipping the approval dialogue. Treat cloned repos as untrusted. Update to the fixed version per anthropics advisory. And don't run the tool over repos you haven't vetted. 9. GitHub's Dependabot now waits at least three days before opening version update pull requests. So poisoned release gets caught and yanked before it lands in your pipeline. Security updates will still ship immediately. 10. Attackers are hitting eSafeNet document management systems using the product's well-known default passwords. Change all default credentials on any install and keep the admin interfaces off the internet. 11. Anthropic's new Opus V now matches its best model at finding software bugs, though it lags on turning those findings into working exploits. We've been living with increased patch volumes in recent months, and I expect this will put the afterburners on. I wouldn't take too much comfort in Opus V not being able to develop exploits. Once the vulnerability is known, there are plenty of options to help with that. 12. Researchers jailbroke iOS 27 beta on an iPhone 11 Pro using a boot RAM level exploit, which needs physical access in DFU mode and is unpatchable. For managed A12 and A13 fleets, enforce physical access controls and treat lost or solen devices as compromised. That's the board for today. Thank you for watching. All of the sources are linked in the show notes below. If the show is useful to you, please give us a like and subscribe and pass it on to someone you think who can use it. Back again tomorrow.