It’s Already When. — Field Notes

Field Note — July 20, 2026

2026-07-20T00:00:00+00:00

Today’s Field Note

Three items cleared the bar today, and two of them are already being fired at live targets. Attackers are exploiting CVE-2026-6875 in the ServiceNow AI Platform for code execution (per Defused), so if you run ServiceNow, assume it is on someone’s list. The WP2Shell pair, CVE-2026-60137 and CVE-2026-63030, went from disclosure to in-the-wild exploitation with the usual WordPress speed. And F5’s NGINX flaw, CVE-2026-42533, is an unauthenticated heap overflow reachable with crafted HTTP requests: crash today, likely RCE tomorrow, and it sits on the exact boxes facing the internet. None of these wait for your change window.

Today’s Action

Patch ServiceNow AI Platform for CVE-2026-6875 now and review logs for unexpected code execution or new integration/script activity.
Update NGINX to 1.30.4 (stable) or 1.31.3 (mainline), and NGINX Plus to 37.0.3.1, prioritizing internet-facing instances.
Audit WordPress installs for the plugin/theme tied to WP2Shell (CVE-2026-60137, CVE-2026-63030), patch, and hunt for dropped web shells.
Pull WAF and access logs for anomalous POSTs and malformed HTTP requests against these three surfaces from the last two weeks.
Confirm your NGINX worker processes are not silently crash-looping, an early signal someone is testing the overflow.

Resources

Verified links for the CVEs mentioned above: official advisories, and a live search for public detection rules if any exist yet.

CVE-2026-42533: NVD advisory · Search Sigma for detection rules
CVE-2026-60137: NVD advisory · Search Sigma for detection rules
CVE-2026-63030: NVD advisory · Search Sigma for detection rules
CVE-2026-6875: NVD advisory · Search Sigma for detection rules

You do not get to schedule the exploit, so stop scheduling the patch.

More: Issues · Field Notes · RTFM

Daily field notes, weekly Issues. Follow @itsalreadywhen or subscribe via RSS.

Field Note — July 19, 2026

2026-07-19T00:00:00+00:00

Today’s Field Note

Two things worth your attention before lunch. First, public exploits for the WordPress Core “wp2shell” RCE chain are now circulating, which means the window between “critical advisory” and “mass scanning” has already closed. WordPress runs a nontrivial slice of the internet, so assume automated exploitation against unpatched Core installs is already in motion. Second, 7-Zip shipped 26.02 to fix an RCE triggered by opening a crafted archive, the kind of bug that pairs nicely with a phishing lure and a curious user. Neither is exotic, both are the sort of thing that turns into an incident because someone deferred a patch.

Today’s Action

Patch WordPress Core immediately to the fixed release across every site you run, including the forgotten staging and marketing installs.
Hunt for “wp2shell” indicators now: unexpected PHP files in web roots, new admin users, and outbound connections from web hosts.
Push 7-Zip 26.02 to all endpoints and build systems, and check for the older versions bundled inside other software.
Remind users not to open archives from untrusted senders, and detonate suspicious ones in a sandbox instead.
Review web-facing logs for the scanning uptick that follows any public PoC release.

Patch the WordPress boxes first. The scanners already found them.

More: Issues · Field Notes · RTFM

Daily field notes, weekly Issues. Follow @itsalreadywhen or subscribe via RSS.

Field Note — July 18, 2026

2026-07-18T00:00:00+00:00

Today’s Field Note

Two things are burning today, and neither waits for your change window. The wp2shell flaws in WordPress core (6.9 and 7.0) now have CVE IDs, a published mechanism, and a working PoC: an unauthenticated HTTP request runs code on a bare install, no plugins required. Separately, Inc ransomware is chaining two SonicWall SMA zero-days to reach root on mobile access appliances, which is the kind of edge box that fronts your whole environment. WordPress is the largest attack surface on the internet and SMA appliances are internet-facing by design, so both of these are being sprayed at scale right now. Patch state is your only real signal here.

Today’s Action

Patch WordPress core to the fixed release immediately on every 6.9/7.0 host; if you run a persistent object cache, confirm the fix covers that condition and flush after updating.
Hunt WordPress logs for anonymous POST requests to core endpoints and unexpected PHP writes to uploads or theme directories.
Apply SonicWall’s SMA fixes now; if you cannot patch today, pull the appliance’s management interface off the public internet and restrict access.
Check SMA appliances for Inc ransomware indicators: unexpected root shells, new admin accounts, and outbound connections you did not authorize.
Rotate credentials and certs that transited any recently exposed SonicWall SMA, and treat root compromise as full-appliance compromise.

The request was anonymous. So was the shell.

More: Issues · Field Notes · RTFM

Daily field notes, weekly Issues. Follow @itsalreadywhen or subscribe via RSS.

Field Note — July 17, 2026

2026-07-17T00:00:00+00:00

Today’s Field Note

Two edge-facing platforms are burning at once. Microsoft SharePoint Server has CVE-2026-58644, a critical deserialization RCE (CVSS 9.8) that CISA added to the KEV catalog with an FCEB patch deadline of July 19, and it was exploited soon after disclosure. On the network side, CISA ordered agencies to patch two actively exploited Fortinet FortiSandbox flaws by Sunday. SharePoint remains a favorite because it sits internet-facing, holds sensitive documents, and organizations are chronically slow to patch it (see the ToolShell mess). The clock CISA set for federal agencies is the clock you should be running against too, deadlines are not a suggestion when a public exploit is already in play.

Today’s Action

Patch SharePoint Server for CVE-2026-58644 now. If you cannot patch today, restrict external access and rotate machine keys.
Hunt SharePoint for post-exploitation: unexpected w3wp.exe child processes, new .aspx files in LAYOUTS, and outbound connections from the SharePoint host.
Apply Fortinet FortiSandbox updates for the two KEV-listed flaws before Sunday, then audit management interface exposure.
Pull FortiSandbox and SharePoint logs for signs of authenticated access from unfamiliar accounts or IPs predating the patch.
Confirm your SharePoint instances are actually in your asset inventory. The one you forgot about is the one that gets hit.

Resources

Verified links for the CVEs mentioned above: official advisories, and a live search for public detection rules if any exist yet.

CVE-2026-58644: NVD advisory · Search Sigma for detection rules

Patch by Sunday, or explain by Monday.

More: Issues · Field Notes · RTFM

Daily field notes, weekly Issues. Follow @itsalreadywhen or subscribe via RSS.

Field Note — July 16, 2026

2026-07-16T00:00:00+00:00

Today’s Field Note

CISA added an actively exploited Oracle E-Business Suite vulnerability to the KEV catalog with a rare short fuse: federal agencies have until Saturday to patch. This is the Financials module, which means the exposed systems are the ones holding your invoicing, payments, and vendor data, exactly what post-exploit operators want. Separately, Zoom disclosed CVE-2026-53412 (CVSS 9.8), an improper input validation flaw in the Windows Desktop Client, VDI Client, and Meeting SDK that an unauthenticated attacker can leverage for account takeover. Neither of these waits for your change window. If you run EBS on the internet, assume it was scanned before the advisory landed.

Today’s Action

Inventory every Oracle E-Business Suite instance (especially Financials) and apply Oracle’s fix now, not by Saturday. Do not assume internal-only means safe.
Hunt EBS hosts for post-exploit signs: unexpected web shells, new admin accounts, and outbound connections from the app tier.
Push the Zoom update for Windows Desktop Client, VDI Client, and Meeting SDK to all endpoints; force-close and relaunch to confirm the version bumped.
Pull external-facing EBS behind VPN or IP allowlisting if patching lags, and rotate any service credentials that touched those systems.
Flag both CVEs to your incident channel so on-call knows what to correlate against tonight.

Resources

Verified links for the CVEs mentioned above: official advisories, and a live search for public detection rules if any exist yet.

CVE-2026-53412: NVD advisory · Search Sigma for detection rules

File it under “already happening,” because it was.

Daily field notes, weekly Issues. Follow @itsalreadywhen or subscribe via RSS.

Field Note — July 15, 2026

2026-07-15T00:00:00+00:00

Today’s Field Note

The perimeter appliances are on fire again. SonicWall confirmed two SMA1000 zero-days under active exploitation: CVE-2026-15409, an unauthenticated SSRF rated 10.0, and CVE-2026-15410, which chains toward arbitrary command execution as admin. In parallel, CISA added three on-prem SharePoint Server flaws to KEV with attackers already hitting internet-exposed instances. All of this lands on the same day Microsoft dumped a record 570-plus fixes including two more zero-days under attack (Active Directory and SharePoint), so your triage queue is now a bidding war. Patch the things attackers can reach from the internet first, then everything else.

Today’s Action

Patch SonicWall SMA1000 appliances immediately for CVE-2026-15409 and CVE-2026-15410; if you cannot patch today, pull them off the public internet.
Apply the CISA-flagged SharePoint Server patches on all internet-exposed on-prem instances, then hunt for webshells and anomalous IIS worker process activity.
Prioritize the two actively exploited zero-days in Microsoft’s July release (AD and SharePoint) ahead of the other 500-plus CVEs.
Review SMA and SharePoint logs for SSRF probes, unexpected admin commands, and post-exploitation persistence going back several weeks, not just today.
Rotate credentials and tokens exposed to any appliance you suspect was reachable before patching.

Resources

Verified links for the CVEs mentioned above: official advisories, and a live search for public detection rules if any exist yet.

CVE-2026-15409: NVD advisory · Search Sigma for detection rules
CVE-2026-15410: NVD advisory · Search Sigma for detection rules

Patch what the internet can touch, then argue about the rest.

Daily field notes, weekly Issues. Follow @itsalreadywhen or subscribe via RSS.

Field Note — July 14, 2026

2026-07-14T00:00:00+00:00

Today’s Field Note

CISA added Joomla extension flaws in iCagenda and Balbooa Forms to KEV, with attackers using arbitrary file uploads to reach remote code execution on public-facing sites right now. Meanwhile the supply chain keeps eating its own: a threat actor poisoned several Jscrambler npm package versions to drop a cross-platform credential stealer, downloaded roughly 1,500 times before disclosure. And Microsoft’s writeup on a year of ShinyHunters activity confirms what the receipts already showed, that the group walks into Salesforce environments through OAuth trust rather than any platform bug. None of this requires a novel exploit. It requires you trusting something you installed, connected, or forgot to patch.

Today’s Action

Patch or pull the iCagenda and Balbooa Forms Joomla extensions immediately, and audit upload directories for planted webshells and unexpected PHP files.
Pin and audit your Jscrambler npm dependencies against the known-bad versions, then rotate any developer or CI credentials that touched an affected build.
Enumerate OAuth apps connected to your Salesforce org, revoke anything unrecognized or unused, and lock down connected-app permissions and IP ranges.
Hunt for infostealer indicators on developer workstations that ran npm installs recently, treating stored tokens and browser secrets as already exposed.
Treat third-party OAuth grants as standing access, and put them on the same review cadence as user accounts.

Nobody breaks the door when you keep handing out keys.

Daily field notes, weekly Issues. Follow @itsalreadywhen or subscribe via RSS.

Field Note — July 13, 2026

2026-07-13T00:00:00+00:00

Today’s Field Note

Two Joomla extension flaws, iCagenda and Balbooa Forms, are on CISA’s KEV as of today, both CVSS 10.0, both exploited as zero-days for remote code execution (CVE-2026-48939 among them). These are unauthenticated RCE bugs in third-party extensions, which means the vulnerable surface is exactly the sort of thing that never made it into your asset inventory. Separately, Progress is telling ShareFile customers to manually power off their Storage Zone Controllers over a “credible threat,” which is the kind of guidance vendors only issue when they already know something bad is in flight. Neither of these waits for your patch window.

Today’s Action

Inventory every Joomla install for the iCagenda and Balbooa Forms extensions, then patch or remove them immediately; treat unpatched instances as already-touched.
Pull web and application logs for those extensions and hunt for anomalous POSTs and unexpected file writes since exploitation predates the KEV listing.
Follow Progress guidance and shut down ShareFile Storage Zone Controllers now if you run them, pending their investigation; do not wait for a formal patch.
Review the Lexfo Evilginx findings and check M365 sign-in logs for adversary-in-the-middle session token theft against your tenant.
Confirm your externally facing routers are patched and hardened per the joint US-and-allies advisory on Russian state targeting of misconfigured edge devices.

Resources

Verified links for the CVEs mentioned above: official advisories, and a live search for public detection rules if any exist yet.

CVE-2026-48939: NVD advisory · Search Sigma for detection rules

Your inventory is a lie by omission; the attackers already read the appendix.

Field Note — July 12, 2026

2026-07-12T00:00:00+00:00

Today’s Field Note

The jscrambler npm package shipped a poisoned 8.14.0 release on July 11 with a preinstall hook that drops and executes a native Rust infostealer, one binary per platform. This is not a runtime problem you can lint your way around later. Running npm install was enough to detonate it, which means any developer machine or CI runner that touched that version during the window is already compromised, not potentially compromised. Socket caught it six minutes after publish, which is fast, but six minutes of a popular package is still a lot of pipelines. Treat every credential that lived on an affected host as burned.

Today’s Action

Pin and audit: grep lockfiles and CI configs for jscrambler 8.14.0, block that exact version, and force resolution back to a known-good release.
Hunt install-time execution: search build logs and endpoint telemetry for preinstall activity and unexpected native binary drops around July 11.
Rotate anything the infostealer could reach: npm tokens, cloud keys, SSH keys, and env secrets on any dev or CI host that ran the install.
Isolate and reimage confirmed-affected runners rather than cleaning in place. Native stealers do not deserve the benefit of the doubt.
Enforce install-time controls going forward: disable lifecycle scripts by default (npm config set ignore-scripts true) where your builds tolerate it.

The exploit runs before you finish typing the version number.

Field Note — July 11, 2026

2026-07-11T00:00:00+00:00

Today’s Field Note

Three things need your hands today, not your calendar. Progress Software is telling ShareFile customers to physically shut down Windows Storage Zone Controllers over a “credible external security threat,” which is the kind of language a vendor only uses when they have already seen it in the wild. Separately, attackers are actively exploiting a critical auth bypass in the official Gitea Docker image that lets anyone impersonate any account, admins included, so your self-hosted Git is a full-takeover target right now. And @injectivelabs/sdk-ts@1.20.21 shipped from a compromised GitHub repo with telemetry that quietly exfiltrates crypto wallet keys and seed phrases. Two of these are supply-chain and one is a vendor waving a red flag. All three are already downstream of “patch when convenient.”

Today’s Action

ShareFile: power off on-prem Storage Zone Controllers now per Progress guidance, then hunt for anomalous access before you bring anything back online.
Gitea: if you run the official Docker image, patch to the fixed release immediately and audit admin accounts and recent logins for impersonation.
npm: pin away from @injectivelabs/sdk-ts@1.20.21, purge it from lockfiles and CI caches, and rotate any wallet keys or seed phrases touched by affected builds.
Grep build logs and package manifests across repos for the malicious Injective version; a lockfile is not the same as your runtime.
Treat any dev machine that pulled that package as compromised for credential theft, not just crypto.

It was never “when.” It was already.

Field Note — July 10, 2026

2026-07-10T00:00:00+00:00

Today’s Field Note

The phone is the vulnerability again. Okta is tracking O-UNC-066 running a panel-driven phishing kit that calls Microsoft 365 users and walks them through enrolling a rogue Entra passkey, giving the attacker a durable, MFA-resistant credential for data extortion. A separate crew, Helix, is using the same vishing and device-code playbook against SharePoint tenants. Meanwhile the crypto side is bleeding: Coinspect’s “Ill Bloom” flaw (weak recovery-phrase randomness) has already funded at least one coordinated sweep, and a compromised Injective Labs GitHub repo pushed a malicious npm package that lifts private keys and seed phrases. None of this is clever. It is people trusting a voice and a package name.

Today’s Action

Hunt Entra ID sign-in and audit logs for unexpected passkey (FIDO2) registration events; alert on any new credential added outside your enrollment workflow.
Lock down passkey enrollment to managed devices or supervised sessions, and require help-desk callback verification before any MFA method reset.
Brief staff that no legitimate IT call will walk them through enrolling a security key or reading a device code aloud; make hanging up the default.
Audit dependencies for the compromised Injective Labs npm package, purge it, and rotate any wallet keys or seed phrases handled on affected build hosts.
Move to npm 12 where feasible and confirm install scripts default to off in CI.

Attackers no longer break the door down. They call and ask you to open it.

Field Note — July 09, 2026

2026-07-09T00:00:00+00:00

Today’s Field Note

Three things worth your attention, none of them theoretical. A China-linked cluster is exploiting vulnerable Roundcube webmail at US and Canadian universities to steal credentials and drop backdoors, so if you run Roundcube in academia you are already in scope. Tenda shipped a backdoor in its router firmware (CVE-2026-11405) that hands unauthenticated attackers the web management interface, and there is no patch, which means the fix is network isolation, not a download. And Microsoft finally patched RoguePlanet (CVE-2026-50656), a privilege escalation in the Malware Protection Engine that grants SYSTEM, roughly a month after details went public, delivered quietly via engine update rather than a reboot cycle you would notice.

Today’s Action

Patch Roundcube to the current release immediately and hunt for unexpected mail rules, new backdoor processes, and credential access on university mail servers.
Confirm the Microsoft Malware Protection Engine has pulled the CVE-2026-50656 fix (engine 1.1.x current build); do not assume it self-updated on isolated or air-gapped hosts.
Pull affected Tenda devices off any internet-facing or trusted segment now, and restrict management interfaces to a dedicated admin VLAN until Tenda ships firmware for CVE-2026-11405.
Cross-check inbound access logs on all three for exploitation you may have already absorbed, not just future attempts.
Flag your helpdesk on the Entra passkey enrollment vishing angle while you are at it, since credential theft is the common thread today.

Resources

Verified links for the CVEs mentioned above: official advisories, and a live search for public detection rules if any exist yet.

CVE-2026-11405: NVD advisory · Search Sigma for detection rules
CVE-2026-50656: NVD advisory · Search Sigma for detection rules

You did not get compromised today. You just found out about it today.

Field Note — July 08, 2026

2026-07-08T00:00:00+00:00

Today’s Field Note

CISA added four exploited flaws to KEV with a Friday deadline, and two of them earn the attention: Adobe ColdFusion CVE-2026-48282 (CVSS 10.0, path traversal to RCE) and the Langflow auth bypass, both under active exploitation. Separately, Gitea CVE-2026-20896 is being hit in the wild via a single HTTP header that bypasses auth and hands over repos and secrets, which is the same self-hosted-dev-infra blast radius we keep watching burn. And GhostLock (CVE-2026-43499) is a 15-year-old Linux kernel local privilege escalation shipped by default in essentially every mainstream distro since 2011: no special permissions, no network, straight to root. None of this is theoretical today. The internet-facing web apps and your own build infrastructure are the fastest paths in, and attackers already have the maps.

Today’s Action

Patch Adobe ColdFusion for CVE-2026-48282 immediately, or take exposed instances offline until you can. Do not wait for Friday.
Apply the Langflow update and pull any Langflow admin interfaces off the public internet behind auth.
Patch Gitea against CVE-2026-20896 now, then rotate every secret, token, and deploy key stored in those repos, because header-based auth bypass leaves no useful login trail.
Roll GhostLock (CVE-2026-43499) kernel updates across your Linux fleet, prioritizing multi-user and shared-access hosts where any local account equals root.
Grep ColdFusion, Gitea, and Langflow logs for anomalous requests and new admin activity going back at least two weeks; assume compromise on anything internet-exposed and unpatched.

Resources

Verified links for the CVEs mentioned above: official advisories, and a live search for public detection rules if any exist yet.

CVE-2026-20896: NVD advisory · Search Sigma for detection rules
CVE-2026-43499: NVD advisory · Search Sigma for detection rules
CVE-2026-48282: NVD advisory · Search Sigma for detection rules

Patch by Friday means someone already had since Tuesday.

Field Note — July 07, 2026

2026-07-07T00:00:00+00:00

Today’s Field Note

It’s a bad week to run edge appliances. Citrix NetScaler is bleeding again: attackers jumped on the latest memory disclosure flaw within hours of a public PoC landing, and if the last CitrixBleed taught us anything, session tokens are already walking out the door. Meanwhile BeyondTrust patched two critical pre-auth bypasses (CVE-2026-40138, CVSS 9.2) in Remote Support and Privileged Remote Access, the exact class of remote-access tooling attackers love because it hands them privileged footholds by design. Underneath all of it sits Januscape (CVE-2026-53359), a 16-year-old use-after-free in Linux KVM’s shadow MMU that lets a guest VM escape to the host on both Intel and AMD; the public PoC only panics the host for now, but the researcher claims a working code-execution exploit exists. Patch the edge first, then worry about the hypervisor.

Today’s Action

Patch NetScaler ADC/Gateway to the fixed build now, then rotate all session tokens and kill active sessions. A patch alone does not evict an attacker who already has valid tokens.
Apply BeyondTrust’s RS/PRA updates for CVE-2026-40138 immediately and audit recent admin sessions for unexpected authentications.
Inventory KVM hosts and schedule the Januscape (CVE-2026-53359) kernel fix, prioritizing multi-tenant and untrusted-guest environments.
Hunt NetScaler and BeyondTrust logs for post-exploitation signs (new accounts, unusual config changes, outbound connections) rather than assuming patching closed the window.
Restrict management interfaces on all three to trusted networks; none of this should be reachable from the open internet.

Resources

Verified links for the CVEs mentioned above: official advisories, and a live search for public detection rules if any exist yet.

CVE-2026-40138: NVD advisory · Search Sigma for detection rules
CVE-2026-53359: NVD advisory · Search Sigma for detection rules

Patch the door before you inspect the foundation.

Field Note — July 06, 2026

2026-07-06T00:00:00+00:00

Today’s Field Note

Opera GX shipped a fix for a flaw that let any malicious website silently install a browser add-on with zero clicks, then read specific data off the pages you visit. The researchers’ proof of concept reconstructed a signed-in user’s full Gmail address from a single visit, which tells you the primitive is real and not theoretical. Opera says it found no evidence of exploitation, but the PoC is public now and the gap between disclosure and adaptation is short. Separately, Google, the FBI, and partners took down NetNut, a residential proxy network riding on millions of hijacked consumer and IoT devices. Disruptions like this are temporary; the operators rebuild, and unpatched devices in your fleet are the raw material for whatever comes next.

Today’s Action

Push the Opera GX update to every managed endpoint today and confirm the build number, do not trust auto-update to have run.
Audit installed Opera GX mods and extensions across your fleet, flag anything installed without a recorded user action.
Treat any Gmail or session data accessed on Opera GX in recent weeks as potentially exposed, rotate where practical.
Pull outbound connections from IoT and consumer-grade devices on your network, hunt for residential proxy beaconing tied to NetNut infrastructure.
Restrict browser extension installation via policy so a website cannot trigger it silently on any browser you support.

The exploit was public before you finished reading the changelog.

Field Note — July 04, 2026

2026-07-04T00:00:00+00:00

Today’s Field Note

Two things earned attention today, and both are the kind that turn into someone else’s bad week. Bad Epoll (CVE-2026-46242) is a Linux kernel local privilege escalation that takes an unprivileged user to root across desktops, servers, and Android. A patch exists, which means the clock started the moment it dropped, and privilege escalation is the second half of nearly every intrusion chain you will investigate this quarter. Separately, JFrog flagged more North Korea-linked npm typosquats (“rollup-packages-polyfill-core” and “rollup-runtime-polyfill-core”) cloning “rollup-plugin-polyfill-node” down to the metadata, aimed squarely at developer credentials and CI secrets. The kernel bug is your infrastructure exposure; the npm packages are your supply chain exposure. Handle both before someone chains them.

Today’s Action

Inventory Linux and Android assets, then prioritize CVE-2026-46242 patching on multi-user hosts, build servers, and anything exposing shell access to untrusted users.
Where you cannot patch immediately, tighten local access and watch for unexpected privilege transitions and abnormal epoll-related activity.
Block and purge “rollup-packages-polyfill-core” and “rollup-runtime-polyfill-core” from registries, lockfiles, and developer machines; confirm you use “rollup-plugin-polyfill-node”.
Rotate any developer, npm token, and CI secrets on machines that touched the malicious packages, and review outbound connections from build agents.
Add both malicious package names to your dependency allowlist/denylist controls so they cannot reappear in a future install.

Resources

Verified links for the CVEs mentioned above: official advisories, and a live search for public detection rules if any exist yet.

CVE-2026-46242: NVD advisory · Search Sigma for detection rules

Root is just a bug someone else patched slower than you.

Field Note — July 03, 2026

2026-07-03T00:00:00+00:00

Today’s Field Note

Citrix is the story again, and it is the same story it always is. Anubis ransomware affiliates are exploiting Citrix Bleed 2 (CVE-2025-5777) for initial access, pairing memory disclosure with legitimate RMM tooling and hands-on-keyboard lateral movement. Separately, a fresh CitrixBleed variant on NetScaler is being exploited immediately after disclosure using public PoC code that pulls arbitrary memory from HTTP responses. On the perimeter’s other flank, the FortiBleed crew has parked in thousands of Fortinet firewalls and is now selling that access to Inc and Lynx, stacking on a Nextcloud zero-day for good measure. If your edge is Citrix or Fortinet, assume someone is already reading your memory.

Today’s Action

Patch NetScaler ADC/Gateway for CVE-2025-5777 and the newly disclosed variant now, then terminate all active sessions to kill tokens grabbed before you patched.
Hunt for FortiBleed indicators on Fortinet firewalls: unexpected admin sessions, config changes, and new local accounts. Rotate all firewall and VPN credentials.
Audit RMM tooling (AnyDesk, ScreenConnect, Atera, and similar) for unauthorized installs, a known Anubis pattern.
Patch your Nextcloud instances and review logs for anomalous access tied to the zero-day being chained by these actors.
Treat any Citrix or Fortinet box that was exposed pre-patch as compromised until proven otherwise, and check for staged exfil.

Resources

Verified links for the CVEs mentioned above: official advisories, and a live search for public detection rules if any exist yet.

CVE-2025-5777: NVD advisory · Search Sigma for detection rules

Your edge device is not a perimeter. It is a doorway with your name on the deed.

Field Note — July 02, 2026

2026-07-02T00:00:00+00:00

Today’s Field Note

Three things are burning at once, and two of them have patches you should have applied already. CISA added Microsoft SharePoint RCE CVE-2026-45659 (CVSS 8.8, deserialization of untrusted data) to KEV after confirmed exploitation, and Cisco finally admitted attackers are hitting the Unified CM flaw it patched back in early June, a bug with a public PoC out since disclosure. The new one has no fix: Synacktiv’s unpatched Argo CD repo-server RCE lets an unauthenticated attacker who can reach the internal port take over an entire Kubernetes cluster, no CVE assigned yet. If your SharePoint and Unified CM boxes are still on old builds, assume you are already in someone’s queue. Meanwhile ChocoPoC is trojanizing GitHub PoC repos to hit the researchers reading this, so watch what you clone.

Today’s Action

Patch Microsoft SharePoint Server for CVE-2026-45659 now, then hunt for w3wp.exe spawning cmd or PowerShell and unexpected ASPX writes.
Confirm Cisco Unified CM is on the June or later build; if it lagged, treat as potentially compromised and review admin and CLI access logs.
Restrict Argo CD repo-server network exposure: block the internal port at the network layer and isolate it from untrusted segments until a fix lands.
Detonate any GitHub PoC in a throwaway VM before running it; ChocoPoC steals browser creds, cookies, and drops a shell.
Cross-check FortiGate credential hygiene given FortiBleed feeding INC and Lynx: rotate exposed creds and enforce MFA on VPN.

Resources

Verified links for the CVEs mentioned above: official advisories, and a live search for public detection rules if any exist yet.

CVE-2026-45659: NVD advisory · Search Sigma for detection rules

It’s not if your SharePoint is exposed, it’s already when.

Field Note — July 01, 2026

2026-07-01T00:00:00+00:00

Today’s Field Note

Three things worth your attention today, and none of them are the Chrome 382-fix pile-on (patch it, move on). First, Langflow’s unauthenticated RCE (CVE-2026-33017, CVSS 9.3) is under active exploitation, with attackers scanning exposed AI app endpoints and dropping Monero miners. That is the entry-level payload, so assume the crypto miner is just the tenant who showed up first. Second, Huntress is tracking a live Azure CLI password spray out of LSHIY LLC infrastructure (2a0a:d683::/32, AS32167): 81 million-plus attempts, at least 78 accounts already compromised between June 12 and 26. Third, Adobe shipped seven max-severity (10/10) fixes for ColdFusion and Campaign Classic, all arbitrary code execution. ColdFusion is a perennial ransomware on-ramp, and the PoC gap on these never lasts long.

Today’s Action

Inventory internet-facing Langflow instances now and patch to a fixed release; if you cannot patch today, pull them behind auth or off the internet entirely.
Block the LSHIY range 2a0a:d683::/32 (AS32167) at the edge, then audit Azure sign-in logs for successful auth from that space and force resets on any hit.
Enforce MFA and conditional access on all Azure/Entra accounts, and disable legacy or CLI-based auth paths where you can.
Apply the Adobe ColdFusion and Campaign Classic patches for the seven CVSS 10 flaws; ColdFusion goes to the front of the queue.
Hunt Langflow hosts for XMRig and unexpected outbound Monero traffic before assuming the miner was the only guest.

Resources

Verified links for the CVEs mentioned above: official advisories, and a live search for public detection rules if any exist yet.

CVE-2026-33017: NVD advisory · Search Sigma for detection rules

Patch the front door before you argue about the drapes.

Field Note — June 30, 2026

2026-06-30T00:00:00+00:00

Today’s Field Note

Three maximum-pain flaws are live at once, and none of them are theoretical. CVE-2026-48558, a CVSS 10.0 OIDC auth bypass in SimpleHelp, is being used to drop two fresh stealers (Djinn and TaskWeaver) that hunt SSH keys, crypto wallets, cloud, and AI credentials. In parallel, Oracle E-Business Suite’s Payments module is under active attack via CVE-2026-46817 (CVSS 9.8), an unauthenticated takeover that Defused has already observed in the wild. And CISA confirmed ransomware crews are now exploiting the Windows Defender privilege-escalation bug dubbed BlueHammer, previously a zero-day. Remote management tooling, ERP financials, and your endpoint defense layer: pick your patch order, but pick fast.

Today’s Action

Patch SimpleHelp now for CVE-2026-48558, then rotate every SSH key, API token, and credential any SimpleHelp host could reach. Assume the OIDC bypass means existing sessions are burned.
Apply Oracle’s fix for CVE-2026-46817 on E-Business Suite, and if Payments was internet-facing, hunt for unauthorized transactions and new admin accounts.
Confirm the Windows Defender BlueHammer patch is deployed fleet-wide; CISA-confirmed ransomware use means privilege escalation is the post-foothold step, not the entry.
Hunt for Djinn and TaskWeaver indicators: outbound traffic to unknown C2, access to wallet files, .ssh directories, and cloud/AI credential stores.
Cross-check whether your SimpleHelp or EBS instances should be reachable from the internet at all. If yes, fix that too.

Resources

Verified links for the CVEs mentioned above: official advisories, and a live search for public detection rules if any exist yet.

CVE-2026-46817: NVD advisory · Search Sigma for detection rules
CVE-2026-48558: NVD advisory · Search Sigma for detection rules

Three tens and a ransomware crew before lunch. Patch in priority order, not in panic.

It’s Already When. — Field Notes

Field Note — July 20, 2026

Today’s Field Note

Today’s Action

Resources

Related

Field Note — July 19, 2026

Today’s Field Note

Today’s Action

Related

Field Note — July 18, 2026

Today’s Field Note

Today’s Action

Related

Field Note — July 17, 2026

Today’s Field Note

Today’s Action

Resources

Related

Field Note — July 16, 2026

Today’s Field Note

Today’s Action

Resources

Field Note — July 15, 2026

Today’s Field Note

Today’s Action

Resources

Field Note — July 14, 2026

Today’s Field Note

Today’s Action

Field Note — July 13, 2026

Today’s Field Note

Today’s Action

Resources

Field Note — July 12, 2026

Today’s Field Note

Today’s Action

Field Note — July 11, 2026

Today’s Field Note

Today’s Action

Field Note — July 10, 2026

Today’s Field Note

Today’s Action

Field Note — July 09, 2026

Today’s Field Note

Today’s Action

Resources

Field Note — July 08, 2026

Today’s Field Note

Today’s Action

Resources

Field Note — July 07, 2026

Today’s Field Note

Today’s Action

Resources

Field Note — July 06, 2026

Today’s Field Note

Today’s Action

Field Note — July 04, 2026

Today’s Field Note

Today’s Action

Resources

Field Note — July 03, 2026

Today’s Field Note

Today’s Action

Resources

Field Note — July 02, 2026

Today’s Field Note

Today’s Action

Resources

Field Note — July 01, 2026

Today’s Field Note

Today’s Action

Resources

Field Note — June 30, 2026

Today’s Field Note

Today’s Action

Resources