Coverage: Last 24 hours

Today’s Highlights

Today’s intelligence highlights real-world exploitation of critical vulnerabilities, adversary adaptation in cloud and AI environments, and highly targeted espionage and ransomware campaigns. Defenders face an evolving attack surface where isolation boundaries, automation, and traditional controls are being actively circumvented.

Defensive Actions

• Apply Apple macOS patch for CVE-2026-65400 and update SharePoint, Microsoft IKE, and VMware vCenter to remediate critical active exploits.
• Audit Dahua camera deployments, enforce credential resets, and disable unnecessary peer-to-peer features immediately.
• Review Cloudflare Workers’ workload placement and isolation policies to reduce risk and rotate JWT secrets in light of speculative execution threats.
• Block and monitor for MacSync Stealer domains as released by Microsoft Defender, and deploy updated EDR/network rules on macOS endpoints.
• Proactively enrich web proxy and gateway blocklists with new IOCs from StopAndProtect infrastructure used for malware delivery.
• Hunt for SilkParasite RAT indicators and update detection rules, especially in Central Asian government environments.
• Mandate strong authentication and ongoing credential audits for researchers and privileged users in higher education or high-value environments.
• Review integration logs and access by third parties to prepare for ransomware supply chain targeting (e.g., PTC Windchill exposure).
• Tune email SOC analytics for user-centric and intent-based phishing, as static payload detection is increasingly bypassed.

Table of Contents

1. Virtual Event Today: CodeSecCon – Secure Your Code and Applications
2. US Charges 17 Iranian Hackers, Offers $10 Million Rewards for 5 of Them
3. Cloudflare Workers Spectre Attack Leaks JWT From Co-Located Worker at 12 Bits/Second
4. Hackers Compromised 14,500+ Dahua Devices Using Credential Attacks, Auth Bypasses, and P2P
5. Critical macOS, SharePoint, vCenter, and Microsoft IKE Flaws Under Active Exploitation

Top Stories

Virtual Event Today: CodeSecCon – Secure Your Code and Applications

Source: SecurityWeek | Risk: LOW | Impacted: Application security teams, DevSecOps programs

Summary: CodeSecCon is the premier virtual event bringing together developers and cybersecurity professionals to revolutionize the way applications are built, secured, and maintained. The post Virtual Event Today: CodeSecCon – Secure Your Code and Applications appeared first on SecurityWeek.

Why it matters: Effective code security practices reduce the exploitability of business applications, directly lowering risk from supply chain and first-party software attacks.

Practitioner Perspective

Bringing together development and security teams at events like CodeSecCon is crucial for bridging gaps in real-world secure SDLC implementations. While attackers race to exploit weaknesses in code and build pipelines, proactive organizations use these forums to update tactics and vet new tooling. However, value only comes from operationalizing best practices post-event, not just attending. Defenders should look to prioritize takeaways that can be plugged into their own CI/CD and build hygiene controls.

Recommended Actions

• Review and integrate code security guidance or frameworks highlighted at CodeSecCon into your SDLC process
• Benchmark build and release pipeline controls against recommendations shared at the event

US Charges 17 Iranian Hackers, Offers $10 Million Rewards for 5 of Them

Source: SecurityWeek | Risk: HIGH | Impacted: Academic institutions, Research-intensive organizations, Global commercial companies

Summary: The 17 members of the Mabna Institute targeted hundreds of universities and organizations in the US and abroad. The post US Charges 17 Iranian Hackers, Offers $10 Million Rewards for 5 of Them appeared first on SecurityWeek.

Why it matters: Targeting by government-backed threat actors underscores the ongoing risk to academic and commercial IP, making it clear that compliance or perimeter controls alone are insufficient to block credential or supply chain attacks.

Practitioner Perspective

Universities and enterprises who have faced targeting by the Mabna Institute or analogous groups should treat these latest indictments as confirmation, not deterrence, of ongoing high-threat campaigns. Credential reuse and software supply chain exploitation remain central to their tactics. Security leaders must accept that legal recourse will not diminish operational risk: only robust credential hygiene and active monitoring for lateral movement can blunt the effect of further state-aligned targeting. Proactive communication with users and IT on evolving threats should be part of ongoing risk management.

Recommended Actions

• Mandate strong authentication and regular credential resets for all privileged and research staff
• Audit recent access logs for indicators of targeted account compromise linked to patterns in Mabna Institute campaigns

Emerging Signals

Cloudflare Workers Spectre Attack Leaks JWT From Co-Located Worker at 12 Bits/Second

Source: The Hacker News | Risk: HIGH | Impacted: Cloudflare Workers tenants, Multi-tenant SaaS providers, Teams relying on JWT-based authentication

Summary: Cybersecurity researchers have disclosed details of a remote Spectre attack against Cloudflare Workers that leaked a JSON Web Token (JWT) from a co-located Worker in the production environment at up to 12 bits per second, 360 times the rate of an earlier attack demonstrated in 2021. The end-to-end experiment used an attacker Worker and a victim Worker controlled by the researchers.

Why it matters: Spectre-type attacks in serverless multi-tenant environments can enable unauthorized data exfiltration across isolated workloads, undermining trust in cloud-native boundaries and leading to high-value token leakage at exploitable rates.

Practitioner Perspective

Organizations relying on Cloudflare Workers or similar serverless edge platforms must recognize the persistence of speculative execution risks even post-mitigation efforts. The demonstrated JWT exfiltration underscores the inadequacy of isolation provided solely at the logical workload layer, physical co-tenancy remains exploitable. Most defenses assume clean separation, but attackers can repeatedly steal sensitive tokens if an untrusted workload lands on shared hardware. The primary concern is that simply following best practices for token storage or logic does not prevent leakage via microarchitectural side channels in hostile cloud environments.

Recommended Actions

• Review Cloudflare’s documentation and advisories for speculative execution mitigations, apply platform updates or isolation policies as released
• Isolate workloads with sensitive secrets (e.g., JWTs) to dedicated environments or hardware where possible in Cloudflare Workers

Hackers Compromised 14,500+ Dahua Devices Using Credential Attacks, Auth Bypasses, and P2P

Source: The Hacker News | Risk: HIGH | Impacted: Organizations with Dahua network cameras, Managed service providers with IoT fleets, Physical security operators

Summary: Cybersecurity researchers at Hunt.io have disclosed details of a campaign that they say compromised more than 14,530 Dahua devices between June 17 and July 22, 2026, using credential attacks, two authentication-bypass flaws, and a peer-to-peer (P2P) relay technique. The activity, codenamed Operation CameraSwarm, was reconstructed from a 407 MB exposed working directory containing 2,616 files.

Why it matters: Credential stuffing, authentication bypass, and P2P relay exploitation in Dahua cameras demonstrate real-world ease of mass compromise for unmanaged IoT if organizations fail to address upstream device flaws and credential hygiene.

Practitioner Perspective

Any deployment of Dahua video surveillance or IoT gear worldwide should be considered highly exposed if not actively managed and patched. Operation CameraSwarm shows attackers rapidly scaling exploitation of both credential reuse and vendor-specific authentication logic bugs, as well as leveraging peer-to-peer relays to avoid straightforward network controls. This validates how weak device security can create ongoing surveillance and lateral movement risk for any Internet-facing environment. Treat vendor advisories as urgent, and do not assume that air-gapping or segmentation alone will block these attacks given abuse of native device features.

Recommended Actions

• Apply all password and firmware updates for Dahua devices addressing recent authentication bypass vulnerabilities
• Inventory Dahua devices with P2P relay enabled and disable exposed peer-to-peer features wherever not strictly required

Exploits & CVEs

Critical macOS, SharePoint, vCenter, and Microsoft IKE Flaws Under Active Exploitation

Source: The Hacker News | Risk: CRITICAL | Impacted: macOS device fleets, Enterprises running Microsoft SharePoint, VMware vCenter deployments, Organizations using Microsoft IKE VPN

Summary: The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added four critical vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, stating they are being exploited in the wild. The shortcomings added to the KEV catalog are listed below – CVE-2026-65400 (CVSS score: 9.8) – An improper authentication vulnerability impacting Apple macOS that could allow an attacker access, plus active threats to SharePoint, vCenter, and Microsoft IKE.

Why it matters: Confirmed in-the-wild exploitation of critical macOS, SharePoint, vCenter, and Microsoft IKE vulnerabilities raises immediate risk of privilege escalation and network compromise across both client and infrastructure layers.

Practitioner Perspective

CISA’s inclusion of CVE-2026-65400 (improper authentication in macOS) and actively exploited flaws in SharePoint, vCenter, and Microsoft IKE signals that attackers are prioritizing these entry points for both opportunistic and targeted attacks. Organizations who fail to patch quickly face heightened risk of initial access, lateral movement, and even RCE in critical environments. Asset owners and IT leads should treat this as a stop-the-bleed scenario, delayed action compounds exposure. The most crucial defensive move is prioritization of patch efforts for assets exposed to the Internet or commonly targeted internal systems.

Recommended Actions

• Apply Apple macOS patch for CVE-2026-65400 to all supported devices without delay
• Update Microsoft SharePoint and Microsoft IKE services to the latest patched versions addressing KEV-listed flaws

What We’re Watching

• Monitoring for follow-on exploitation waves targeting CVE-2026-65400 (macOS, CVSS 9.8) and related cloud infrastructure vulnerabilities.
• Emergent threats from the SilkParasite espionage campaign in Central Asia: watch for new RAT variants targeting public sector endpoints.
• Continued rotation and expansion of MacSync Stealer infrastructure: high alert for new C2 domains targeting macOS fleets.
• Ransomware actor Cl0p’s targeting and data leak extortion against PTC Windchill customers across multiple critical industry sectors.
• Further credential stuffing and authentication bypass campaigns focusing on Dahua and other mass-managed IoT/OT device fleets.

Categories: Cybersecurity Blog, Cybersecurity News

Tags: Cloud Security, cybersecurity, daily briefing, Incident Response, IoT, Malware, Ransomware, Vulnerabilities