Coverage: Last 24 hours

Today’s Highlights

Attackers are exploiting a range of software and supply chain vulnerabilities, from critical flaws in SharePoint and PAN-OS to weaponized open-source libraries and emergent risk from AI-enabled toolchains. Defenders face real-world risk not only from direct exploitation but also from gaps in asset inventory, third-party dependencies, and the security of AI-powered developer platforms.

Table of Contents

1. LG to Ban Residential Proxies from Smart TV Apps
2. Police Dismantle Kratos Phishing Kit Built to Steal Microsoft 365 Sessions and Bypass MFA
3. Trojanized Newtonsoft.Json Fork Hides Game-Rigging Code in a Working Library
4. AWS Kiro Flaw Let a Poisoned Web Page Rewrite Its Config and Run Code
5. Zimbra Patches Critical SNMP Command Injection and Four XSS Vulnerabilities
6. Critical SharePoint RCE CVE-2026-50522 Under Active Exploitation After Public PoC
7. Qilin Ransomware Attackers Exploit PAN-OS Authentication Bypass for Initial Access

Top Stories

LG to Ban Residential Proxies from Smart TV Apps

Source: Krebs on Security | Risk: Medium | Impacted: Enterprise networks with unmanaged smart TVs, Shared corporate/residential spaces, Organizations with bring-your-own-device policies

Summary: The home appliance giant LG Electronics USA said this week it plans to suspend any apps built for its smart TVs that turn one’s television into an always-on residential proxy node. The move comes less than a month after researchers found that more than 42 percent of games and other apps available for download on LG’s webOS store allow unknown

Why it matters: Turning smart TVs into proxy nodes can convert any corporate or home device into unwitting infrastructure for cybercrime, increasing risk of reputational damage, blacklisting, or even criminal liability for organizations with unmanaged smart devices on their network.

Practitioner Perspective

Smart TVs running unvetted or fraudulent applications effectively become compromised assets, often piggybacking on trusted enterprise and home networks. Attackers commonly leverage these residential proxies for malicious traffic, bypassing IP-based controls and obscuring attribution for fraud or intrusion. For defenders, TVs and similar devices often escape asset management and segmentation policies, leaving gaps in monitoring and response. The volume of potentially affected apps demonstrates how easily IoT devices slide into unwitting complicity with organized cybercrime. Inventory and network segregation for unmanaged smart devices is critical, especially in mixed-use spaces.

Recommended Actions

• Audit LG smart TVs for side-loaded or non-vetted webOS apps enabling proxy/residential network functionality
• Deploy segmentation controls to restrict outbound connectivity for all smart TVs and IoT appliances

Emerging Signals

Police Dismantle Kratos Phishing Kit Built to Steal Microsoft 365 Sessions and Bypass MFA

Source: The Hacker News | Risk: High | Impacted: Microsoft 365 tenants, Organizations with high-value mailbox users, Security teams focused on email or identity compromise

Summary: German and US law enforcement have taken down the core infrastructure of Kratos, described by German investigators as one of the world’s most widely used criminal phishing kits, and Indonesian authorities arrested the man they say developed and ran it. In a joint announcement on Monday, the Frankfurt public prosecutor’s cybercrime unit (ZIT) and Germany’s Federal Criminal Police Office (BKA)

Why it matters: The takedown of Kratos infrastructure temporarily reduces risk of phishing campaigns that bypass MFA and hijack M365 sessions, but copycats and alternate kits will rapidly fill the void, keeping identity compromise a persistent threat.

Practitioner Perspective

Kratos enabled attackers to automate session theft and bypass relatively robust MFA protections in Microsoft 365 environments, eroding confidence in primary email and productivity system security. While its dismantling is a positive disruption, similar phishing kits spread widely and often re-emerge quickly from new infrastructure or forks. Defenders relying solely on MFA as a silver bullet against phishing should view this event as a temporary reprieve at best. It is now standard for phishing campaigns to target session hijacking, persistent tokens, and OAuth consents. Ongoing vigilance and layered technical controls are a must.

Recommended Actions

• Review controls for detection of stolen M365 session tokens and anomalous device logins
• Tighten conditional access policies in Azure AD to limit token lifespan and restrict risky sign-ins

Trojanized Newtonsoft.Json Fork Hides Game-Rigging Code in a Working Library

Source: The Hacker News | Risk: High | Impacted: .NET developers using NuGet, Software vendors with game or transactional logic, CICD environments with unchecked package dependencies

Summary: Cybersecurity researchers have discovered a NuGet typosquat that’s unlike the typical information-stealing malware distributed via package registries: usual info-stealers: it’s designed to rig live game results on Digitain. The package, named “Newtonsoftt.Json.Net,” masquerades as the Newtonsoft.Json library and is a trojanized fork. Seven versions of the package have been published to the

Why it matters: Malicious forks of popular .NET libraries in public repositories can introduce covert logic into business applications, leading to fraud or compromise through seemingly innocuous dependencies.

Practitioner Perspective

Any team using NuGet or other package managers for .NET is at risk if typosquatting or lookalike libraries are not excluded, as evidenced by a trojanized Newtonsoft.Json fork built for targeted fraud. This highlights increased sophistication in software supply chain threats: attackers may not just steal data, but secretly modify application logic with business impact. Traditional code review often misses such risk unless dependency provenance is enforced. Security teams must move beyond CVE-based approaches and focus on supply chain hygiene and runtime monitoring.

Recommended Actions

• Audit all .NET project dependencies for noncanonical package sources, especially any Newtonsoft.Json variants
• Implement allowlisting for approved NuGet repositories and packages

AWS Kiro Flaw Let a Poisoned Web Page Rewrite Its Config and Run Code

Source: The Hacker News | Risk: High | Impacted: Development teams using AWS Kiro IDE, Organizations with remote/contractor coders, SaaS providers integrating AI-enabled dev tools

Summary: Hidden text on a web page was enough to make Kiro, AWS’s agentic coding IDE, rewrite its own configuration file and run an attacker’s code on a developer’s machine, with no approval step able to stop it. Intezer, in research with Kodem Security, found that a request as ordinary as asking Kiro to summarize a page could end in remote

Why it matters: Developers relying on AWS Kiro IDE could inadvertently execute attacker-controlled code from a simple drive-by web interaction, converting trusted developer endpoints into initial points of compromise.

Practitioner Perspective

The risk exposed here is unique to the growing adoption of AI-powered developer tools, where untrusted content can trigger code execution without user intent, bypassing traditional approval or workflow gating. Enterprises leveraging AWS Kiro should carefully consider trust boundaries for all websites or docs integrated into dev pipelines. The use of generative AI for code review and automation introduces new lateral movement vectors, as traditional endpoint protections are often not tailored to developer contexts. Treat developer workstations as high-value targets with advanced threat modeling for toolchain risk.

Recommended Actions

• Force-install Kiro IDE security updates that specifically patch config-file rewriting exposure
• Harden developer policies around web browsing and content preview in Kiro workspaces

Zimbra Patches Critical SNMP Command Injection and Four XSS Vulnerabilities

Source: The Hacker News | Risk: High | Impacted: Enterprises using Zimbra for mail, Managed service providers hosting Zimbra, IT teams supporting multi-tenant Zimbra environments

Summary: Zimbra has rolled out fixes to address multiple critical security issues, including a command injection flaw in the Simple Network Management Protocol (SNMP) monitoring component. As many as nine security vulnerabilities have been patched in Zimbra 10.1.20. Topping the list is a command injection vulnerability in the SNMP monitoring component when SNMP notifications are enabled. Also patched

Why it matters: Exploitable SNMP command injection in Zimbra could yield shell access on mail servers, potentially allowing threat actors to escalate from monitoring access to total service takeover and lateral movement.

Practitioner Perspective

Organizations running Zimbra with SNMP notifications enabled represent a significant attack surface, particularly in multi-tenant or hosted environments where mail infrastructure is exposed. As mail servers hold both sensitive content and credentials, any command injection flaw must be treated as urgent. The breadth of vulnerabilities patched (including XSS) increases risk of chained or multi-stage attacks, raising the stakes for timely patching. If your Zimbra deployment predates the 10.1.20 patch, prioritize validation corrective action immediately.

Recommended Actions

• Patch Zimbra to version 10.1.20 or later to address SNMP command injection and XSS issues
• Review SNMP access policies, disabling notifications unless strictly required

Exploits & CVEs

Critical SharePoint RCE CVE-2026-50522 Under Active Exploitation After Public PoC

Source: The Hacker News | Risk: Critical | Impacted: Enterprises running on-premises SharePoint, Hybrid Microsoft organizations, Public sector and education networks

Summary: A third SharePoint Server flaw patched by Microsoft as part of its Patch Tuesday update for July 2026 has come under active exploitation, per watchTowr. The vulnerability in question is CVE-2026-50522 (CVSS score: 9.8), a critical deserialization of untrusted data in Microsoft Office SharePoint that could allow an unauthorized attacker to execute code over a network. Microsoft credited DEVCORE

Why it matters: Unauthenticated attackers can remotely execute code on unpatched SharePoint instances, providing a foothold for lateral movement and exposure of sensitive internal documents as exploit code circulates widely.

Practitioner Perspective

Any exposed or internet-accessible SharePoint server running a vulnerable version is at high risk given active exploitation and public proof-of-concept code for CVE-2026-50522. SharePoint remains a prime target for initial access due to its document-centric access and integration with authentication systems. Organizations with incomplete or lagging patch cycles are likely candidates for compromise, especially where legacy intra-network trust persists. Rapid, comprehensive patch management is non-negotiable for these platforms. Treat unpatched SharePoint as already compromised until verified.

Recommended Actions

• Immediately deploy July 2026 Patch Tuesday updates for SharePoint to close CVE-2026-50522
• Hunt for exploitation indicators linked to DEVCORE and watchTowr public PoCs

Qilin Ransomware Attackers Exploit PAN-OS Authentication Bypass for Initial Access

Source: The Hacker News | Risk: High | Impacted: Palo Alto Networks PAN-OS administrators, VPN/remote access users, Organizations with exposed gateways

Summary: Threat actors have been observed exploiting a now-patched high-severity Palo Alto Networks PAN-OS vulnerability as an entry point to deploy Qilin (aka Agenda) ransomware on victim environments. Arctic Wolf Labs said it investigated multiple intrusions in June 2026 that began with the exploitation of CVE-2026-0257 (CVSS score: 7.8), an authentication bypass flaw affecting the portal and gateway

Why it matters: Attackers are using a high-severity authentication bypass in PAN-OS (CVE-2026-0257) to gain privileged access to enterprise networks, which can quickly escalate into ransomware deployment and operational disruption before defenders recognize the breach.

Practitioner Perspective

Organizations relying on Palo Alto Networks gateways are directly exposed if patches for CVE-2026-0257 have not been applied. Qilin (Agenda) ransomware operators are known for quickly weaponizing new entry points and pivoting to critical infrastructure after initial access. Given how VPN and portal vulnerabilities bypass normal authentication, legacy multifactor controls may be insufficient as compensating controls. This is a classic example of a periphery device flaw turning into deep internal threat, latency in patching increases impact. If you use PAN-OS, assume targeting is imminent.

Recommended Actions

• Patch PAN-OS to remediate CVE-2026-0257 on all external and internal portals and gateways
• Review and harden access policies for all perimeter PAN-OS devices

Defensive Actions

• Audit LG smart TVs for side-loaded or non-vetted webOS apps enabling proxy/residential network functionality
• Deploy segmentation controls to restrict outbound connectivity for all smart TVs and IoT appliances
• Review controls for detection of stolen M365 session tokens and anomalous device logins
• Tighten conditional access policies in Azure AD to limit token lifespan and restrict risky sign-ins
• Audit all .NET project dependencies for noncanonical package sources, especially any Newtonsoft.Json variants
• Implement allowlisting for approved NuGet repositories and packages
• Force-install Kiro IDE security updates that specifically patch config-file rewriting exposure
• Harden developer policies around web browsing and content preview in Kiro workspaces
• Patch Zimbra to version 10.1.20 or later to address SNMP command injection and XSS issues
• Review SNMP access policies, disabling notifications unless strictly required
• Immediately deploy July 2026 Patch Tuesday updates for SharePoint to close CVE-2026-50522
• Hunt for exploitation indicators linked to DEVCORE and watchTowr public PoCs
• Patch PAN-OS to remediate CVE-2026-0257 on all external and internal portals and gateways
• Review and harden access policies for all perimeter PAN-OS devices

What We’re Watching

• The ongoing evolution of phishing kits and MFA bypass tools and how quickly replacement toolchains emerge after major takedowns
• Trends in the abuse of open-source and package management ecosystems for targeted attacks on business logic and financial systems
• The effectiveness of rapid and proactive patching practices for critical CVEs in high-profile platforms such as SharePoint and PAN-OS
• The security implications of increased AI automation in developer environments and the new class of vulnerabilities associated with toolchain integration
• The real-world impacts and implementation progress of mandated supply chain transparency for defense contractors and software vendors

Categories: Cybersecurity Blog, Cybersecurity News

Tags: cybersecurity, daily briefing, Phishing, Supply Chain, Vulnerabilities