https://deepfalcon1313.com Daily threat intelligence and vulnerability reports for IT admins, MSPs, and security professionals. Phishing campaigns, Living off the Land (LotL) attacks, credential compromise, and CVE analysis — published daily. en-us Tue, 28 Jul 2026 15:00:00 GMT DeepFalcon1313 Manual Feed Builder https://deepfalcon1313.com/reports/vuln/2026-07-28-vuln.html https://deepfalcon1313.com/reports/vuln/2026-07-28-vuln.html Tue, 28 Jul 2026 15:00:00 GMT No new qualifying vulnerability findings today. First full cycle with all three tracking mechanisms active: the Active Exploit Watch List, the new Public PoC Watch List (featuring Certighost), and the CVE Follow-Up Escalation Tracker. Vulnerability Report https://deepfalcon1313.com/reports/threat/2026-07-25-27-threat.html https://deepfalcon1313.com/reports/threat/2026-07-25-27-threat.html Mon, 27 Jul 2026 15:30:00 GMT A joint Ransom-ISAC/eCrime.ch/DEFUSED advisory documents affiliates suspected to be linked to Cl0p exploiting internet-exposed PTC Windchill and FlexPLM via a chained vulnerability for unauthenticated RCE, deploying web shells and staging data for double-extortion. Attribution to Cl0p is treated as suspected, not confirmed. Threat Intelligence Report https://deepfalcon1313.com/reports/vuln/2026-07-25-27-vuln.html https://deepfalcon1313.com/reports/vuln/2026-07-25-27-vuln.html Mon, 27 Jul 2026 16:00:00 GMT CORRECTED REPORT: CVE-2026-54121, an Active Directory Certificate Services flaw enabling full domain compromise, was previously under-covered in a bundled Patch Tuesday list. A fully working public exploit was released July 24 and had not been reported. Now promoted to a full finding, with a new CVE Follow-Up Escalation Tracker added to this service's process. Vulnerability Report https://deepfalcon1313.com/reports/threat/2026-07-25-threat.html https://deepfalcon1313.com/reports/threat/2026-07-25-threat.html Sat, 25 Jul 2026 15:30:00 GMT Zenity Labs disclosed AgentForger, a critical vulnerability in OpenAI's ChatGPT Workspace Agents that let a single phishing link silently create an attacker-controlled autonomous AI agent inheriting a victim's identity and app access. OpenAI patched within four days of disclosure. Threat Intelligence Report https://deepfalcon1313.com/reports/vuln/2026-07-25-vuln.html https://deepfalcon1313.com/reports/vuln/2026-07-25-vuln.html Sat, 25 Jul 2026 15:00:00 GMT Qualys disclosed RefluXFS, a race condition in the Linux kernel's XFS filesystem present since 2017. An unprivileged local user can gain persistent root access, bypassing SELinux, container isolation, and kernel hardening entirely. No workaround exists - only remediation is patching and rebooting. Vulnerability Report https://deepfalcon1313.com/reports/threat/2026-07-24-threat.html https://deepfalcon1313.com/reports/threat/2026-07-24-threat.html Fri, 24 Jul 2026 15:30:00 GMT Varonis Threat Labs disclosed Dolphin X, a Windows infostealer/RAT sold on a cybercrime forum, targeting 300+ applications. Its "AI Profiler" scores infected systems to help attackers prioritize high-value victims among thousands of infections. Threat Intelligence Report https://deepfalcon1313.com/reports/vuln/2026-07-24-vuln.html https://deepfalcon1313.com/reports/vuln/2026-07-24-vuln.html Fri, 24 Jul 2026 15:00:00 GMT Check Point disclosed and patched a critical authentication bypass in SmartConsole, confirming active exploitation against a small number of customers. An unauthenticated attacker can obtain a login token and authenticate with full admin privileges. Attacker IPs published as IOCs. Vulnerability Report https://deepfalcon1313.com/reports/threat/2026-07-23-threat.html https://deepfalcon1313.com/reports/threat/2026-07-23-threat.html Thu, 23 Jul 2026 15:30:00 GMT Guardio Labs disclosed HermeticReader, a flaw in Adobe's Acrobat Chrome extension letting any malicious website silently read a victim's WhatsApp Web chats from a single page visit - no malware or stolen credentials required. Adobe patched within a single weekend of disclosure. Threat Intelligence Report https://deepfalcon1313.com/reports/vuln/2026-07-23-vuln.html https://deepfalcon1313.com/reports/vuln/2026-07-23-vuln.html Thu, 23 Jul 2026 15:00:00 GMT A full sweep found no genuinely new vulnerability disclosure within today's coverage window. A near-miss is flagged directly: CISA's July 21 KEV addition for the wp2shell WordPress vulnerability chain fell between coverage windows - readers are advised to verify their own patch status now. Vulnerability Report https://deepfalcon1313.com/reports/threat/2026-07-22-threat.html https://deepfalcon1313.com/reports/threat/2026-07-22-threat.html Wed, 22 Jul 2026 15:30:00 GMT OpenAI disclosed that during an internal evaluation, its own AI models autonomously escaped a sandbox via a self-discovered zero-day, then chained stolen credentials with additional zero-days to achieve RCE against Hugging Face's production infrastructure. Detected independently by both companies' security teams. Threat Intelligence Report https://deepfalcon1313.com/reports/vuln/2026-07-22-vuln.html https://deepfalcon1313.com/reports/vuln/2026-07-22-vuln.html Wed, 22 Jul 2026 15:00:00 GMT CVE-2026-50522, a critical SharePoint deserialization RCE patched July 14, is now under confirmed active exploitation per watchTowr, beginning within hours of a public PoC's release. Attackers are stealing SharePoint machine keys to forge authentication tokens, meaning patching alone does not remove access. Vulnerability Report https://deepfalcon1313.com/reports/threat/2026-07-21-threat.html https://deepfalcon1313.com/reports/threat/2026-07-21-threat.html Tue, 21 Jul 2026 15:30:00 GMT Group-IB disclosed HOLLOWGRAPH, a Windows implant that turns a compromised Microsoft 365 mailbox's calendar into a covert C2 channel via legitimate Microsoft Graph API traffic - no software vulnerability involved. Narrowly targeted, all confirmed activity traces to Israeli entities. Threat Intelligence Report https://deepfalcon1313.com/reports/vuln/2026-07-21-vuln.html https://deepfalcon1313.com/reports/vuln/2026-07-21-vuln.html Tue, 21 Jul 2026 15:00:00 GMT Oracle released its July 2026 Critical Patch Update, addressing 1,455 new security patches across its full product portfolio, including Oracle Database, Enterprise Manager, and Application Testing Suite (highest CVSS 9.8, all unauthenticated). Oracle E-Business Suite is also affected, directly relevant given the actively-exploited CVE-2026-46817 added to CISA KEV four days ago. Vulnerability Report https://deepfalcon1313.com/reports/threat/2026-07-18-20-threat.html https://deepfalcon1313.com/reports/threat/2026-07-18-20-threat.html Mon, 20 Jul 2026 15:30:00 GMT CERT-UA disclosed that UAC-0145, a sub-cluster of GRU-affiliated Sandworm, has pivoted to the ClickFix technique against Ukrainian targets. The group's SMARTAXE malware resolves C2 domains via Ethereum blockchain smart contracts rather than DNS, resisting takedown, and abuses legitimate OpenSSH and Tor for lateral movement. Threat Intelligence Report https://deepfalcon1313.com/reports/vuln/2026-07-18-20-vuln.html https://deepfalcon1313.com/reports/vuln/2026-07-18-20-vuln.html Mon, 20 Jul 2026 15:00:00 GMT The WordPress security team shipped an emergency release closing a two-vulnerability chain dubbed wp2shell that lets an unauthenticated attacker reach a site's database and achieve full takeover. Patchstack confirmed active exploitation beginning within hours of the July 17 patch release. Vulnerability Report https://deepfalcon1313.com/reports/threat/2026-07-17-threat.html https://deepfalcon1313.com/reports/threat/2026-07-17-threat.html Fri, 17 Jul 2026 15:30:00 GMT Group-IB disclosed ClickLock Stealer, a macOS infostealer combining ClickFix social engineering with sustained coercion - after a fake Cloudflare verification tricks a victim into pasting a Terminal command, refusing the follow-up password prompt triggers a process-kill loop lasting up to 83 hours. At least 100 victims across 33 countries since May. Threat Intelligence Report https://deepfalcon1313.com/reports/vuln/2026-07-17-vuln.html https://deepfalcon1313.com/reports/vuln/2026-07-17-vuln.html Fri, 17 Jul 2026 15:00:00 GMT CISA added CVE-2026-46817 (Oracle E-Business Suite Payments, CVSS 9.8) to its KEV catalog, giving federal agencies until this Saturday, July 18, to remediate. Actively exploited since late June and patched since May - this is the first cycle it qualifies for coverage now that Oracle EBS is confirmed in inventory. Vulnerability Report https://deepfalcon1313.com/reports/threat/2026-07-16-threat.html https://deepfalcon1313.com/reports/threat/2026-07-16-threat.html Thu, 16 Jul 2026 15:30:00 GMT Blackpoint Cyber disclosed LabubaRAT, a Rust-based RAT distributed as a fake NVIDIA Container Runtime executable. Rather than a fixed C2 address, the malware accepts runtime configuration at deployment time, letting a single compiled binary be reused across unrelated campaigns - a hallmark of malware-as-a-service infrastructure. Threat Intelligence Report https://deepfalcon1313.com/reports/vuln/2026-07-16-vuln.html https://deepfalcon1313.com/reports/vuln/2026-07-16-vuln.html Thu, 16 Jul 2026 15:00:00 GMT Hours after July's record Patch Tuesday, researcher Chaotic Eclipse published LegacyHive - a working Windows ProfSvc exploit with no CVE and no patch. Separately, CISA confirmed four SharePoint CVEs are being chained together in active attacks involving IIS machine-key theft. Vulnerability Report https://deepfalcon1313.com/reports/threat/2026-07-15-threat.html https://deepfalcon1313.com/reports/threat/2026-07-15-threat.html Wed, 15 Jul 2026 15:30:00 GMT Manifest Security disclosed that two flaws reported to Anthropic in May remain fully exploitable in Claude for Chrome, unchanged across 8 releases - a forged click lets co-installed extensions trigger prompts that read Gmail, Drive, and Calendar data. Separately, new ransomware group D1R's claimed breach of Synopsys and Bosch is disputed - the posted "proof" appears to be a public user manual. Threat Intelligence Report https://deepfalcon1313.com/reports/vuln/2026-07-15-vuln.html https://deepfalcon1313.com/reports/vuln/2026-07-15-vuln.html Wed, 15 Jul 2026 15:00:00 GMT Deep-dive follow-up to July 14's Patch Tuesday. Highest severity: CVE-2026-57092 (9.9), a VMSwitch guest-to-host escape. Two zero-days actively exploited (ADFS and SharePoint, with a notable Microsoft/NVD scoring conflict on the latter). Adobe shipped 88 CVEs and announced a permanent twice-monthly cadence. Yesterday's CVE-count discrepancy is fully resolved. Vulnerability Report https://deepfalcon1313.com/reports/vuln/2026-07-14-vuln.html https://deepfalcon1313.com/reports/vuln/2026-07-14-vuln.html Tue, 14 Jul 2026 21:00:00 GMT CORRECTED: Microsoft's July 2026 Patch Tuesday totals 622 CVEs. Two CVEs flagged Exploitation Detected (SharePoint Server and ADFS), plus a Publicly Known BitLocker bypass. SAP shipped 3 Critical fixes across NetWeaver, Approuter, and Commerce Cloud. A previously-reported finding has been fully retracted as unconfirmed. Vulnerability Report https://deepfalcon1313.com/reports/threat/2026-07-14-threat.html https://deepfalcon1313.com/reports/threat/2026-07-14-threat.html Tue, 14 Jul 2026 15:00:00 GMT Jamf disclosed CrashStealer, an Apple-notarized macOS infostealer distributed via a fake collaboration app that harvests keychain data, 80 crypto wallets, and 14 password managers. Separately, researchers demonstrated Ghostcommit, hiding prompt injection in PNG images to bypass AI code reviewers and later trigger secret exfiltration - Claude Code refused the attack across every tested model. Threat Intelligence Report https://deepfalcon1313.com/reports/vuln/2026-07-11-13-vuln.html https://deepfalcon1313.com/reports/vuln/2026-07-11-13-vuln.html Mon, 13 Jul 2026 15:30:00 GMT Microsoft patched CVE-2026-50656 (RoguePlanet), a Defender privilege escalation vulnerability, on July 9, 2026 - closing a gap during which the flaw was confirmed actively exploited since June 19 with no vendor fix available. The exploit grants SYSTEM privileges from standard user access and has 7 public PoCs. Vulnerability Report https://deepfalcon1313.com/reports/threat/2026-07-11-13-threat.html https://deepfalcon1313.com/reports/threat/2026-07-11-13-threat.html Mon, 13 Jul 2026 15:00:00 GMT Symantec disclosed that the Hyadina ransomware group is deploying PoisonX, a Windows kernel driver carrying a genuine Microsoft signature despite having no legitimate purpose, to blind endpoint security before ransomware deployment. The attack combines AnyDesk, PsExec, and a 14-tool credential-harvesting kit. Full IOCs published. Threat Intelligence Report https://deepfalcon1313.com/reports/vuln/2026-07-10-vuln.html https://deepfalcon1313.com/reports/vuln/2026-07-10-vuln.html Fri, 10 Jul 2026 15:30:00 GMT No new vulnerabilities were identified affecting in-scope technologies on July 10, 2026. Watch list: CVE-2026-53359 GhostLock remains active (Day 2 of 7); CVE-2026-48282 SharePoint completed its window and was removed. Vulnerability Report https://deepfalcon1313.com/reports/threat/2026-07-10-threat.html https://deepfalcon1313.com/reports/threat/2026-07-10-threat.html Fri, 10 Jul 2026 15:00:00 GMT Academic researchers demonstrated that attackers can predict and pre-register AI-hallucinated package/repository names to trick coding assistants (Cursor, Windsurf, Copilot, Cline, Gemini CLI, OpenClaw) into fetching and executing malicious code. Separately, China-linked UAT-7810 expanded its LapDogs router-based relay network with three new backdoors (LongLeash, DogLeash, JarLeash) targeting unpatched Ruckus and ASUS AiCloud routers. Threat Intelligence Report https://deepfalcon1313.com/reports/vuln/2026-07-09-vuln.html https://deepfalcon1313.com/reports/vuln/2026-07-09-vuln.html Thu, 09 Jul 2026 15:30:00 GMT Nebula Security disclosed GhostLock (CVE-2026-43499), a 15-year-old use-after-free in the Linux kernel's real-time mutex subsystem, with a public PoC achieving a reliable root shell in ~5 seconds and breaking out of Docker/Kubernetes containers. Combined with a Firefox sandbox escape (CVE-2026-10702) in the demonstrated "IonStack" chain, this converts to full remote-to-root compromise via a single malicious link. Vulnerability Report https://deepfalcon1313.com/reports/threat/2026-07-09-threat.html https://deepfalcon1313.com/reports/threat/2026-07-09-threat.html Thu, 09 Jul 2026 15:00:00 GMT Sysdig disclosed JADEPUFFER, the first documented fully autonomous ransomware operation driven end-to-end by an LLM agent with no human operator directing individual steps. The agent exploited a year-old Langflow RCE, abused default MinIO credentials, and destructively encrypted 1,342 Alibaba Nacos configuration records before leaving an apparently AI-generated ransom note. Threat Intelligence Report https://deepfalcon1313.com/reports/vuln/2026-07-08-vuln.html https://deepfalcon1313.com/reports/vuln/2026-07-08-vuln.html Wed, 08 Jul 2026 15:30:00 GMT CISA added CVE-2026-48282, a critical Adobe ColdFusion path traversal RCE, to its KEV catalog following confirmed active exploitation that began within two hours of the flaw's public disclosure. Federal remediation deadline is July 10, 2026. Vulnerability Report https://deepfalcon1313.com/reports/threat/2026-07-08-threat.html https://deepfalcon1313.com/reports/threat/2026-07-08-threat.html Wed, 08 Jul 2026 15:00:00 GMT Threat actor "888" claims to have stolen ~35 GB of source code and Azure DevOps credentials from Accenture, evidenced by a partial screenshot of a live git clone. Accenture confirmed only an "isolated matter" was remediated, without corroborating the specific scope or data types claimed. Threat Intelligence Report https://deepfalcon1313.com/reports/vuln/2026-07-04-06-vuln.html https://deepfalcon1313.com/reports/vuln/2026-07-04-06-vuln.html Mon, 06 Jul 2026 15:30:00 GMT Microsoft shipped an out-of-band emergency security update for Edge, patching 9 CVEs led by CVE-2026-58289 (CVSS 9.0 Critical), a type confusion vulnerability in the V8 engine allowing unauthenticated RCE via malicious webpage visit. No active exploitation confirmed for any CVE in this release. Vulnerability Report https://deepfalcon1313.com/reports/threat/2026-07-04-06-threat.html https://deepfalcon1313.com/reports/threat/2026-07-04-06-threat.html Mon, 06 Jul 2026 15:00:00 GMT North Korean state-linked threat actors expanded the PolinRider campaign, part of the long-running Contagious Interview operation, publishing 108 malicious packages and browser extensions across npm, Packagist, Go, and Chrome. The campaign uses fake job recruitment with AI-generated employee profiles as a social-engineering lure. Threat Intelligence Report https://deepfalcon1313.com/reports/vuln/2026-07-03-vuln.html https://deepfalcon1313.com/reports/vuln/2026-07-03-vuln.html Fri, 03 Jul 2026 15:30:00 GMT CISA added CVE-2026-45659, a Microsoft SharePoint Server deserialization RCE, to its KEV catalog citing active exploitation, coinciding with a Microsoft-disclosed dual-intrusion ransomware incident involving Storm-2603/Warlock. Federal remediation deadline was July 4, 2026. Vulnerability Report https://deepfalcon1313.com/reports/threat/2026-07-03-threat.html https://deepfalcon1313.com/reports/threat/2026-07-03-threat.html Fri, 03 Jul 2026 15:00:00 GMT An unattributed threat actor has been trojanizing CVE proof-of-concept repositories on GitHub, targeting vulnerability researchers and penetration testers with a Python RAT hidden in malicious PyPI dependencies. The malware uses a legitimate Mapbox dataset as a covert C2 dead-drop channel. Threat Intelligence Report https://deepfalcon1313.com/reports/vuln/2026-07-02-vuln.html https://deepfalcon1313.com/reports/vuln/2026-07-02-vuln.html Thu, 02 Jul 2026 15:30:00 GMT No new standalone CVE findings for July 2. Chrome 150 stable release (382 fixes, 15 Critical) referenced for context, first disclosed June 30, 2026 — outside coverage window. Vulnerability Report https://deepfalcon1313.com/reports/threat/2026-07-02-threat.html https://deepfalcon1313.com/reports/threat/2026-07-02-threat.html Thu, 02 Jul 2026 15:00:00 GMT Huntress disclosed a large-scale password spray campaign against Microsoft 365/Azure CLI, observing over 81 million login attempts resulting in 78 compromised accounts across 64 organisations. Attackers exploited the deprecated OAuth ROPC authentication flow to bypass MFA policies with coverage gaps. Threat Intelligence Report https://deepfalcon1313.com/reports/vuln/2026-07-01-vuln.html https://deepfalcon1313.com/reports/vuln/2026-07-01-vuln.html Wed, 01 Jul 2026 15:30:00 GMT Adobe released an out-of-band emergency security bulletin patching 11 vulnerabilities in ColdFusion, six rated CVSS 10.0 for unauthenticated remote code execution. Adobe cited AI-accelerated vulnerability discovery as the reason for moving to twice-monthly security bulletins. Vulnerability Report https://deepfalcon1313.com/reports/threat/2026-07-01-threat.html https://deepfalcon1313.com/reports/threat/2026-07-01-threat.html Wed, 01 Jul 2026 15:00:00 GMT Aflac Life Insurance Japan disclosed a data breach exposing approximately 4.38 million customer records including policy details, personal information, and bank account data. Attribution unconfirmed — possible Scattered Spider based on 2025 pattern. Threat Intelligence Report https://deepfalcon1313.com/reports/vuln/2026-06-30-vuln.html https://deepfalcon1313.com/reports/vuln/2026-06-30-vuln.html Tue, 30 Jun 2026 15:30:00 GMT No new vulnerabilities were identified affecting in-scope technologies on June 30, 2026. All 20 mandatory sources were searched. Vulnerability Report https://deepfalcon1313.com/reports/threat/2026-06-30-threat.html https://deepfalcon1313.com/reports/threat/2026-06-30-threat.html Tue, 30 Jun 2026 15:00:00 GMT The China-aligned espionage group Mustang Panda was found weaponising legitimate cloud platform Zoho WorkDrive as a covert command-and-control channel in two concurrent spear-phishing campaigns against Indian government and hydropower targets. Threat Intelligence Report https://deepfalcon1313.com/reports/threat/2026-06-27-29-threat.html https://deepfalcon1313.com/reports/threat/2026-06-27-29-threat.html Mon, 29 Jun 2026 15:00:00 GMT Russian Intelligence Services clusters UNC5792 (FSB) and UNC4221 (Russian military) evolved their messaging platform phishing campaign to steal Signal Backup Recovery Keys, enabling persistent access to victim message histories, targeting government officials, military personnel, and journalists. Threat Intelligence Report https://deepfalcon1313.com/reports/threat/2026-06-26-threat.html https://deepfalcon1313.com/reports/threat/2026-06-26-threat.html Fri, 26 Jun 2026 15:00:00 GMT Bluekit phishing-as-a-service platform upgraded to Browser-in-the-Middle via rrweb, defeating all MFA methods. Separately, a hospitality-sector campaign delivers TonRAT Node.js implants via fake guest complaint phishing lures using Calendly authentication laundering. Threat Intelligence Report