#ParsedReport #CompletenessMedium 29-07-2026

Cleaning Out Inboxes: TA488 Comes for Outlook with Another Half-Click Exploit

Report completeness: Medium

Actors/Campaigns: Void_blizzard

Threats: Owareaper Supply_chain_technique Zimreaper

Victims: Government, Telecommunications, Finance, Hospitality, Aerospace

Industry: Government, Entertainment, Semiconductor_industry, Aerospace, Financial, Telco, Healthcare, Petroleum, Energy

Geo: Russia

CVEs: CVE-2026-42897 [Vulners] CVSS V3.1: 8.1, Vulners: Exploitation: True X-Force: Risk: Unknown X-Force: Patch: Unknown Soft: - microsoft exchange_server (2016, 2019) - microsoft exchange_server_subscription_edition (<15.02.2562.043)

TTPs: Tactics: 3 Technics: 0

ChatGPT TTPs: do not use without manual check T1001.003, T1027, T1041, T1059.007, T1070.008, T1071.001, T1071.003, T1071.004, T1090, T1098.002, have more...

IOCs: File: 4 Domain: 4 Hash: 1

Soft: Outlook, Zimbra, Microsoft Exchange, IndexedDB, WordPress

Algorithms: aes-ctr, base32, aes, sha256, base64

Functions: Proofpoint, ReadWriteMailbox, GetClientAccessToken, eval, send, _buildPackets

Languages: javascript

#ParsedReport #CompletenessMedium 29-07-2026

Cleaning Out Inboxes: TA488 Comes for Outlook with Another Half-Click Exploit

Report completeness: Medium

Actors/Campaigns: Void_blizzard

Threats: Owareaper Supply_chain_technique Zimreaper

Victims: Government, Telecommunications, Finance, Hospitality, Aerospace

Industry: Government, Entertainment, Semiconductor_industry, Aerospace, Financial, Telco, Healthcare, Petroleum, Energy

Geo: Russia

CVEs: CVE-2026-42897 [Vulners] CVSS V3.1: 8.1, Vulners: Exploitation: True X-Force: Risk: Unknown X-Force: Patch: Unknown Soft: - microsoft exchange_server (2016, 2019) - microsoft exchange_server_subscription_edition (<15.02.2562.043)

TTPs: Tactics: 3 Technics: 0

ChatGPT TTPs: do not use without manual check T1001.003, T1027, T1041, T1059.007, T1070.008, T1071.001, T1071.003, T1071.004, T1090, T1098.002, have more...

IOCs: File: 4 Domain: 4 Hash: 1

Soft: Outlook, Zimbra, Microsoft Exchange, IndexedDB, WordPress

Algorithms: aes-ctr, base32, aes, sha256, base64

Functions: Proofpoint, ReadWriteMailbox, GetClientAccessToken, eval, send, _buildPackets

Languages: javascript

I'm about to install the July 2026 Exchange Server security update (referenced here: https://techcommunity.microsoft.com/blog/exchange/released-july-2026-exchange-server-security-updates/4534146) on our Exchange SE hybrid environment. We have a DAG (Database Availability Group) setup.

A few questions before I proceed:

DAG-related issues: Has anyone run into problems installing this SU on a DAG member server (failover issues, database mount problems, or anything unexpected during the rolling update)?

Send Connector issues: In the comments on that TechCommunity post, someone mentioned running into a Send Connector issue after applying the update. Has anyone else experienced Send Connector problems (mail flow breaking, connector settings reverting, etc.) after this SU?

IIS rewrite rule removal: For rolling back the CVE-2026-42897 EEMS M2.1 mitigation, I'm planning to use these commands:

powershell

Copy-Item -Path "$env:ExchangeInstallPath\FrontEnd\HttpProxy\owa\web.config" -Destination "$env:ExchangeInstallPath\FrontEnd\HttpProxy\owa\web.config.$((Get-Date).ToString('yyyyMMdd-HHmmss')).bak"

Remove-WebConfigurationProperty -PSPath "IIS:\Sites\Default Web Site\owa" -Filter "system.webServer/rewrite/outboundRules" -Name "." -AtElement @{name="EEMS M2.1 OWA CSP - outbound"}

Remove-WebConfigurationProperty -PSPath "IIS:\Sites\Default Web Site\owa" -Filter "system.webServer/rewrite/outboundRules/preConditions" -Name "." -AtElement @{name="EEMS M2.1 OWA SPA HTML shell - precondition"}

Has anyone hit issues running these — e.g., the elements not being found, IIS reset required afterward, or the mitigation reapplying itself before EM Service marks the July SU as "mitigation not required"?

Any input appreciated before I roll this out.

Исследователи Solar 4RAYS представили обзор сетевых уязвимостей по результатам мониторинга во втором квартале 2026 года.

Во отчетном квартале исследователи проанализировали 681 сообщение о новых уязвимостях и PoC. Количество сетевых уязвимостей составило 571. Анализировались не только уязвимости 2026 года, но и обнаруженные в 2025, но опубликованные в этом году.

В статистике отражены 89 «прошлогодних» уязвимостей. В Solar 4RAYS отметили, что все описанные ниже уязвимости имеют подтверждение, а значит, могут представлять реальную опасность.

Среди ключевых выводов:

Как отмечают в Solar 4RAYS, ситуация на ландшафте эксплойтов в популярном софте от квартала к кварталу меняется мало. Стартовавший в конце года тренд на рост числа уязвимостей в ИИ-сервисах продолжается, их стало почти вдвое больше, чем кварталом ранее.

Wordpress, в связи с популярностью и развитостью экосистемы, остается наиболее «многочисленным» по числу эксплойтов ПО.

Впрочем, во втором квартале стало ясно, что «вовремя» совсем не обязательно означает, что обновления нужно ставить максимально быстро.

Часто главной рекомендацией по защите является оперативное обновление. Действительно, своевременное обновление является ключевым аспектом защиты в 99% случаев. Но бывает тот самый один процент, который вечно все портит.

В этой части исследователи отметили supply-chain-атаку, которая произошла с библиотекой Axios минувшей весной. Примерно на рубеже первого и второго квартала стали появляться репозитории и статьи, говорящие об Axios Supply Chain Attack.

Атака условно делилась на шесть стадий. При этом быстрое обновление и автоматическая установка новых версий (совет, который часто можно встретить в ИБ-сфере, когда речь заходит о защите от атак через уязвимости) стали основным драйвером массового заражения.

Однако из этого не следует, что обновляться не нужно, - старые версии ПО накапливают известные CVE и представляют собой предсказуемую угрозу.

Ключевой вывод: автоматические обновления допустимы только для критических компонентов (браузеры, антивирусы), но не для библиотек и зависимостей в production-среде.

Для них следует применять отложенное обновление с ручным контролем: изучать changelog, проверять появление новых зависимостей и тестировать в staging-окружении перед выкаткой в прод.

CVE-2026-48907.

0day Intel: Unauthenticated RCE in the Joomla Content Editor

Vendor v10.0. 0day Intel: Unauthenticated RCE in the Joomla Content Editor

[Critical 10.0 CVE-2026-48907] Unauthenticated RCE in the Joomla Content Editor extension 🤯🔥

🔗 https://t.co/9VcnF0HadC 🔗 https://t.co/hw9ye6otgu 🔗 https://t.co/QS5VUVS8xr 🔗…

July Linux Patch Wednesday. A total of 2,017 vulnerabilities were addressed (539 in the Linux kernel and 504 in Chromium). For comparison, there were 1,888 vulnerabilities in June. Once again, a new record. Moreover, next month will most likely set another record, as 1,704 vulnerabilities have already been addressed 2.5 weeks before the August LPW. 🤷‍♂️ But for now, let's take a closer look at the July report. Only one vulnerability shows signs of exploitation in the wild:

🔻 RCE - Gogs (CVE-2025-8110). Gogs is a self-hosted web service for managing Git repositories, similar in purpose to GitHub or GitLab. An attacker can achieve remote code execution by manipulating the .git/config file through symbolic link bypasses and injecting commands via sshCommand. Multiple public exploits are available on GitHub. The vulnerability has been added to the CISA KEV catalog.

There are also 178 vulnerabilities with public exploits available or indications that they exist, but there are currently no signs of exploitation in the wild. For comparison, last month there were 109 such vulnerabilities. Among them, the following stand out:

🔸 RCE - NGINX (CVE-2026-42533). NGINX is a web server and software for handling network requests, which is often used as a reverse proxy, load balancer, and gateway for web applications. An unauthenticated attacker can exploit this vulnerability for remote code execution by sending crafted HTTP requests.🔸 RCE - libssh2 (CVE-2026-55200). libssh2 is a C library that implements the SSH-2 protocol and allows applications to establish secure SSH connections, execute commands, and transfer files via SFTP/SCP. A remote attacker can send crafted SSH packets with excessively large packet_length values to corrupt heap memory and achieve remote code execution.

🔸 RCE - Linux Kernel "RefluXFS" (CVE-2026-64600). An attacker with an ordinary local account can exploit the vulnerability to overwrite protected files on disk and gain root privileges on affected systems, including installations running SELinux in Enforcing mode. In practice, the vulnerability allows an attacker to set an empty root password.

🔸 RCE - Gogs (CVE-2025-64111). Due to an insufficient patch for CVE-2024-56731, it is still possible to modify files in the .git directory and achieve remote command execution. Based on the exploit code, authentication is required for exploitation.

🔸 CodeInj - MediaWiki (CVE-2026-58025). MediaWiki is a free and open-source web platform for creating and managing wiki websites, powering Wikipedia and other collaborative content editing projects. An attacker with the importupload or import permission (default: sysop group) can craft a malicious XML import file containing serialized PHP objects in params fields, triggering arbitrary object instantiation and potentially leading to remote code execution through gadget chains.

🔸 RCE - FFmpeg (CVE-2026-8461). FFmpeg is a free and open-source collection of libraries and utilities for processing audio and video data. An out-of-bounds write vulnerability in FFmpeg's libavcodec library, specifically in the MagicYUV decoder, allows denial-of-service and, in some cases, can be exploited for remote code execution.

[ Read the full post on avleonov.com ]

🗒 Full Vulristics report

@avleonovcom #LinuxPatchWednesday #Vulristics #Linux #LinuxKernel #Chromium #CISAKEV #Gogs #NGINX #libssh2 #MediaWiki #FFmpeg #7Zip

An anonymous researcher just dropped 130+ working zero-day exploits for 22 software projects.

No vendor notification. No coordinated disclosure. Just raw PoC code, public, for anyone to use.

The repo — "Exploitarium" by GitHub user "bikini" — includes: → Linux kernel "DirtyClone" (CVE-2026-43503) → Samba RCE (CVSS 10.0) → Frappe Framework zero-day → 127 more across OSS and commercial software

Two are already being actively exploited in the wild: → CVE-2026-55200 → CVE-2026-20896

It hit #5 on Hacker News with 726 points before most vendors even knew it existed.

This is what AI-assisted vulnerability research looks like at scale. One researcher, 130+ bugs, zero coordination. The defensive side physically cannot patch at this speed.

We used to debate full disclosure vs responsible disclosure. This is neither. It's just disclosure — weaponized, indifferent, and probably the new normal.

If this becomes a pattern, the CVE pipeline breaks.

⚠️ NetApp Active IQ Unified Manager for VMware vSphere alert: CVE-2026-55200 (CVSS 9.2)

Attackers could disrupt service or cause a denial of service.

No workaround is available; follow the vendor advisory for updates.

#NetApp #CyberSecurity #CVE

July Linux Patch Wednesday. A total of 2,017 vulnerabilities were addressed (539 in the Linux kernel and 504 in Chromium). For comparison, there were 1,888 vulnerabilities in June. Once again, a new record. Moreover, next month will most likely set another record, as 1,704 vulnerabilities have already been addressed 2.5 weeks before the August LPW. 🤷‍♂️ But for now, let's take a closer look at the July report. Only one vulnerability shows signs of exploitation in the wild:

🔻 RCE - Gogs (CVE-2025-8110). Gogs is a self-hosted web service for managing Git repositories, similar in purpose to GitHub or GitLab. An attacker can achieve remote code execution by manipulating the .git/config file through symbolic link bypasses and injecting commands via sshCommand. Multiple public exploits are available on GitHub. The vulnerability has been added to the CISA KEV catalog.

There are also 178 vulnerabilities with public exploits available or indications that they exist, but there are currently no signs of exploitation in the wild. For comparison, last month there were 109 such vulnerabilities. Among them, the following stand out:

🔸 RCE - NGINX (CVE-2026-42533). NGINX is a web server and software for handling network requests, which is often used as a reverse proxy, load balancer, and gateway for web applications. An unauthenticated attacker can exploit this vulnerability for remote code execution by sending crafted HTTP requests.🔸 RCE - libssh2 (CVE-2026-55200). libssh2 is a C library that implements the SSH-2 protocol and allows applications to establish secure SSH connections, execute commands, and transfer files via SFTP/SCP. A remote attacker can send crafted SSH packets with excessively large packet_length values to corrupt heap memory and achieve remote code execution.

🔸 RCE - Linux Kernel "RefluXFS" (CVE-2026-64600). An attacker with an ordinary local account can exploit the vulnerability to overwrite protected files on disk and gain root privileges on affected systems, including installations running SELinux in Enforcing mode. In practice, the vulnerability allows an attacker to set an empty root password.

🔸 RCE - Gogs (CVE-2025-64111). Due to an insufficient patch for CVE-2024-56731, it is still possible to modify files in the .git directory and achieve remote command execution. Based on the exploit code, authentication is required for exploitation.

🔸 CodeInj - MediaWiki (CVE-2026-58025). MediaWiki is a free and open-source web platform for creating and managing wiki websites, powering Wikipedia and other collaborative content editing projects. An attacker with the importupload or import permission (default: sysop group) can craft a malicious XML import file containing serialized PHP objects in params fields, triggering arbitrary object instantiation and potentially leading to remote code execution through gadget chains.

🔸 RCE - FFmpeg (CVE-2026-8461). FFmpeg is a free and open-source collection of libraries and utilities for processing audio and video data. An out-of-bounds write vulnerability in FFmpeg's libavcodec library, specifically in the MagicYUV decoder, allows denial-of-service and, in some cases, can be exploited for remote code execution.

[ Read the full post on avleonov.com ]

🗒 Full Vulristics report

@avleonovcom #LinuxPatchWednesday #Vulristics #Linux #LinuxKernel #Chromium #CISAKEV #Gogs #NGINX #libssh2 #MediaWiki #FFmpeg #7Zip

solve #280

25 page walkthrough available on HTB

MQTT protocol abuse, NTLM relay/coercion, authenticated LFI/path traversal, credential hunting in hives/Keepass, Gogs CVE-2025-8110 RCE, and ADCS certificate attacks.

I just solved Ghostlink on Hack The Box! https://t.co/TuQQ2WWZuT #HackTheBox #HTB #CyberSecurity #EthicalHacking #InfoSec #PenTesting

CISA Adds One Known Exploited Vulnerability to Catalog

CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. 

CVE-2025-8110 Gogs Path Traversal Vulnerability 

This @CISACyber https://t.co/vuOg5ZDgUz

🚨 New from Ethiack: A crafted MATLAB/HDF5 upload can make Rails Active Storage read server secrets.

Attackers could then use a stolen secret_key_base to forge a variation key and reach RCE via CVE-2025-24293.

Rails also released a forensic toolkit to check exposure and hunt for exploitation.

Read the updated story: https://thehackernews.com/2026/07/critical-rails-flaw-could-let.html

CVE-2025-24293 # Active Storage allowed transformation methods potentially unsafe

Active Storage attempts to prevent the use of potentially unsafe image transformation methods a… https://t.co/WhWvx3pAok

🚨 CVE-2025-24293: Rails (CVSS: 9.2)...

Command injection lurks in Rails Active Storage when user input feeds transformation methods - three whitelisted method...

#netsec #vulnerability #CVE #sysadmin #zeroday