Coverage: Last 24 hours
Today’s Highlights
Zero-days continue to be exploited before patches are available and attackers are leveraging advanced evasion techniques across AI infrastructure and everyday business applications. Malicious campaigns are hijacking trusted public code repositories, abusing SaaS APIs, and targeting critical infrastructure, raising the bar for both detection and rapid response. This cycle puts exposure window management and accelerated patch deployment front and center, especially as threat actors innovate in cloud, supply chain, and physical surveillance tactics.
Table of Contents
- OpenSSL Silently Fixes ‘HollowByte’ DoS Vulnerability
- HollowGraph Malware Hides C2 and Stolen Files in Microsoft 365 Events Dated 2050
- Mythos Didn’t Break Your Security Program. Your Exposure Window Could.
- New 7-Zip Vulnerability Could Let Crafted XZ Archives Run Code During Extraction
- ⚡ Weekly Recap: WordPress RCE, SonicWall 0-Days, AI Service Attacks, SharePoint 0-Day and More
- SonicWall Zero-Days Exploited to Deliver Custom Malware for Weeks Before Patch
Top Stories
OpenSSL Silently Fixes ‘HollowByte’ DoS Vulnerability
Source: SecurityWeek | Risk: High | Impacted: Web application providers, Cloud infrastructure teams, Developers using OpenSSL in custom apps
Summary: Attackers could send waves of malicious payloads to trigger buffer pre-allocations that are not freed, exhausting server memory. The post OpenSSL Silently Fixes ‘HollowByte’ DoS Vulnerability appeared first on SecurityWeek.
Why it matters: Denial-of-service attacks exploiting resource management flaws in common cryptography libraries like OpenSSL threaten application availability across a large segment of internet-facing services.
Practitioner Perspective
OpenSSL remains a foundational component for secure communications on countless platforms, making any DOS capability highly disruptive across both cloud and hosted environments. Attackers crafting malicious payloads to exhaust buffer allocations can render servers unresponsive, impacting SLAs and critical business operations. The lack of prominent notification accompanying the fix leaves many applications exposed if relying on version drift. Security teams must inventory all dependent applications, prioritize upgrades, and ensure vendors are tracking upstream changes. Fast remediation is essential to minimize operational risk as automated DOS attempts escalate.
Recommended Actions
- Enumerate all services and applications statically or dynamically linked against vulnerable OpenSSL versions
- Apply the latest OpenSSL patch addressing HollowByte DOS vulnerability
Emerging Signals
HollowGraph Malware Hides C2 and Stolen Files in Microsoft 365 Events Dated 2050
Source: The Hacker News | Risk: High | Impacted: M365 tenants, Organizations with heavy Microsoft Graph API usage, Teams storing sensitive data in calendar attachments
Summary: A newly discovered espionage implant has been using a hijacked Microsoft 365 calendar as its command channel, planting operator instructions and smuggling out stolen files as attachments on calendar events dated to the year 2050. Group-IB, which named the malware HollowGraph, says the approach moves tasking and stolen data through legitimate Microsoft Graph API traffic, so the activity looks legitimate to standard monitoring tools.
Why it matters: Malware leveraging Microsoft 365 APIs to blend C2 and exfiltration traffic into legitimate SaaS application flows can evade standard monitoring, enabling long-term espionage and loss of sensitive data.
Practitioner Perspective
Organizations relying on Microsoft 365 must assume threat actors are actively probing for API misuse vectors to avoid detection. Abuse of calendar event objects dated far in the future to transport commands and exfiltrated payloads undermines traditional log and event monitoring, especially if API traffic to Microsoft Graph is whitelisted. Standard DLP and SOC alerting are unlikely to catch this TTP without outlier analytics tuned to calendar usage. Review and baseline calendar event patterns, particularly for suspicious attachments and events in distant years, to surface signals that traditional controls miss. Assume this evasion technique may escalate among both APT and criminal actors targeting SaaS-centric organizations.
Recommended Actions
- Establish detection for creation of Microsoft 365 calendar events with date ranges outside normal usage (e.g., year 2050 or beyond)
- Alert on attachments to M365 calendar events, especially for unexpected file types
Mythos Didn’t Break Your Security Program. Your Exposure Window Could.
Source: The Hacker News | Risk: Medium | Impacted: Enterprises with diverse software stacks, Organizations with slow patch processes
Summary: The industry spent the initial months after Anthropic’s April 7 Mythos reveal focused on volume. How many new CVEs would Mythos add to an already overloaded pipeline? How quickly would the flood of AI-driven discovery overwhelm triage capabilities? How long would it take adversaries to weaponize Mythos findings at scale? Those questions were and remain valid. Yet they all stop at the question of exposure window.
Why it matters: The time gap between vulnerability disclosure and patch deployment, not vulnerability volume, is now the primary determinant of breach likelihood in organizations with mature vulnerability management processes.
Practitioner Perspective
The proliferation of new CVEs from automated AI-powered discovery tools like Mythos is less impactful than the average length of exposure per disclosed issue. Even organizations with strong vulnerability detection and prioritization can be undermined if change control or patch deployment is slow. Adversaries are timing exploits to known exposure windows, targeting systems that lag behind the mean patching curve. Teams must revisit their patch velocity metrics, identify bottlenecks, and simulate fast-moving patch scenarios. Speed of mitigation is emerging as the core metric for measuring and improving organizational security posture.
Recommended Actions
- Analyze vulnerability exposure windows across all major asset classes post-Mythos disclosure
- Establish real-time SLAs for high and critical vulnerability patch deployment
New 7-Zip Vulnerability Could Let Crafted XZ Archives Run Code During Extraction
Source: The Hacker News | Risk: High | Impacted: Windows endpoints with 7-Zip, Software development pipelines processing user archives
Summary: Opening a crafted XZ archive in 7-Zip could let an attacker run code on the machine. The flaw, CVE-2026-14266, is a heap-based buffer overflow in how the archiver processes XZ chunked data, and Trend Micro’s Zero Day Initiative (ZDI) detailed it on July 15. A fix shipped on June 25 in 7-Zip 26.02. The overflow lets an attacker execute code during file extraction.
Why it matters: Exploitation of file extraction tools like 7-Zip can provide a low-friction pathway for code execution during routine use, presenting a high risk where untrusted archives are prevalent.
Practitioner Perspective
Any environment where users handle or process XZ-format archives with 7-Zip is at risk for exploitation via CVE-2026-14266. Mass adoption and integration of 7-Zip into automation chains increases the blast radius for a well-crafted exploit. This vulnerability is especially relevant for CI/CD, help desk, and shared research infrastructure that often process files from external sources. Attackers may target these workflows with spear-phished archives. Prompt deployment of 7-Zip 26.02 across all endpoints and strict file provenance checks are essential to close this gap.
Recommended Actions
- Deploy 7-Zip version 26.02 or later to all systems to mitigate CVE-2026-14266
- Review endpoint and server logs for extraction of XZ archives before patch deployment
Exploits & CVEs
⚡ Weekly Recap: WordPress RCE, SonicWall 0-Days, AI Service Attacks, SharePoint 0-Day and More
Source: The Hacker News | Risk: High | Impacted: WordPress sites, SonicWall appliance owners, Organizations using unpatched AI services
Summary: A single request should not be able to do this much. But this week, small inputs led to code execution, memory loss, stolen keys, and disabled security tools. The paths were often simple: exposed systems, weak checks, old drivers, fake prompts, and public code used for malware delivery. Some bugs were new. Others were already being used before defenders had a realistic chance to respond.
Why it matters: Rapid exploitation of new vulnerabilities in core business platforms allows attackers to achieve code execution, data theft, or security tool bypass before defenders have a realistic chance to respond.
Practitioner Perspective
This week’s attacks demonstrate that adversaries are targeting internet-facing systems and common business software with simple exploit chains shortly after disclosure. Many organizations are still relying on lagging patch cycles and incomplete asset discovery, creating persistent exposure windows. Several bugs are actively exploited and tied to malware deployment or service disruption. The most pressing challenge is to narrow the time between CVE publication and complete mitigation, especially for externally accessible assets. The bottom line is that effective vulnerability management requires real-time asset inventories and an emergency communication plan for critical patches.
Recommended Actions
- Identify and patch all WordPress Core instances impacted by CVE‑2026‑63030 and CVE‑2026‑60137 as exploitation is ongoing
- Locate and upgrade SonicWall appliances to the latest firmware addressing recent zero-days
SonicWall Zero-Days Exploited to Deliver Custom Malware for Weeks Before Patch
Source: SecurityWeek | Risk: Critical | Impacted: SonicWall VPN and firewall deployments, Organizations relying on perimeter appliances for segmentation
Summary: The zero-days CVE-2026-15409 and CVE-2026-15410 were exploited by a threat actor tracked by Volexity as UTA0533. The post SonicWall Zero-Days Exploited to Deliver Custom Malware for Weeks Before Patch appeared first on SecurityWeek.
Why it matters: Attackers exploiting SonicWall zero-days achieve persistent, privileged access before defenders can respond, giving them time to deploy custom payloads and pivot internally.
Practitioner Perspective
SonicWall appliances running unpatched versions vulnerable to CVE-2026-15409 and CVE-2026-15410 have been actively targeted and compromised in the wild by well-resourced threat actors. These zero-days enable initial access followed by tailored malware installation, allowing weeks of undetected activity and lateral movement. Many organizations treat appliance firmware upgrades as lower urgency, creating a dangerous patching lag. Defenders must immediately assess appliance exposure and forensically review recent device activity, as compromise may have occurred prior to public disclosure.
Recommended Actions
- Patch all SonicWall appliances affected by CVE-2026-15409 and CVE-2026-15410 immediately
- Assess device logs for evidence of compromise by Volexity’s UTA0533 actor TTPs
Defensive Actions
- Patch all WordPress sites for CVE‑2026‑63030 and CVE‑2026‑60137 as exploitation is confirmed in the wild
- Deploy 7-Zip version 26.02 or later to all systems to mitigate CVE-2026-14266
- Establish detection for creation of Microsoft 365 calendar events with date ranges outside normal usage (e.g., year 2050 or beyond)
- Enumerate all services and applications statically or dynamically linked against vulnerable OpenSSL versions
- Locate and upgrade SonicWall appliances to the latest firmware addressing recent zero-days
- Apply the latest OpenSSL patch addressing HollowByte DOS vulnerability
- Identify and patch all WordPress Core instances impacted by current RCE vulnerabilities
- Patch all SonicWall appliances affected by CVE-2026-15409 and CVE-2026-15410 immediately
- Review endpoint and server logs for extraction of XZ archives before patch deployment
- Analyze vulnerability exposure windows across major asset classes and set real-time SLAs for patch deployment
What We’re Watching
Security teams are urged to double down on monitoring SaaS API misuse, especially in Microsoft 365, track rapid exploit deployment in common business software, and remain vigilant against open-source and supply chain threats targeting developer environments. Vendors’ silent fixes and the lag between disclosure and patching continue to drive risk. Accelerating patch cycles, prioritizing asset visibility, and hardening controls for both cloud and on-premises platforms remain critical priorities.
Categories: Cybersecurity Blog, Cybersecurity News
Leave a Reply