📰 DAILY THREAT BRIEFING
Wednesday, July 29, 2026
12 News Items
HN · BleepingComputer · Krebs · Dark Reading · SANS · THN Intel · Unit 42 · Security.com

📰 Cybersecurity News Headlines

Top stories from leading cybersecurity publications as of July 29, 2026.

  1. Ghost Credentials Expose Cloud Systems to Hidden Identity Risks
    — Dark Reading

    Dormant nonhuman identities can create security blind spots, says security researcher Aleksandr Krasnov, who has released an open source too…
  2. CubePilot drone software dev hit by DNS hijacking to intercept traffic
    — Bleeping Computer

    CubePilot, an Australian firm that designs flight controllers for drones (UAVs), announced a severe operational disruption caused by a DNS h…
  3. Thousands of Data Center Controllers Open to Takeover
    — Dark Reading

    A host of Internet-exposed remote hardware management processors are subject to offline password-cracking attacks — and adversaries have t…
  4. OpenAI models used Artifactory zero-days to escape to the internet
    — Bleeping Computer

    JFrog has confirmed that OpenAI models exploited zero-day vulnerabilities in self-hosted Artifactory servers to help escape an isolated test…
  5. When AI Agents Escape Sandboxes, Old Security Rules Apply
    — Dark Reading

    OpenAI's recent AI agent sandbox escape proves traditional security principles matter more than ever: limit access, isolate execution, log e…
  6. Claude AI Just Cracked a Post-Quantum Test Scheme and Found a Faster 7-Round AES Attack
    — The Hacker News

    Anthropic says Claude Mythos Preview helped derive an end-to-end key-recovery attack against HAWK-256 and a 200- to 800-fold speedup for an …
  7. CISA shares advice on isolating vital systems during cyberattacks
    — Bleeping Computer

    The U.S. and Australian governments have released new guidance urging critical infrastructure organizations to prepare to isolate vital oper…
  8. Tengu Botnet Reboots Compromised Linux Devices When Defenders Kill Its Process
    — The Hacker News

    A new Mirai-derived botnet called Tengu can use a compromised Linux device's hardware watchdog to trigger a reboot when defenders kill its m…
  9. 24,650 Internet-Exposed BMCs Disclose IPMI Password Hashes Before Login
    — The Hacker News

    Cybersecurity researchers have sounded an alert after finding more than 36,000 Baseboard Management Controller (BMC) management interfaces e…
  10. AutoIT Payload Injector , (Tue, Jul 28th)
    — SANS ISC

    For a long time, AutoIT[1] has been pretty common in the malware ecosystem. Threat actors still use it because it&#x27s easy to write and po…
  11. ISC Stormcast For Tuesday, July 28th, 2026 https://isc.sans.edu/podcastdetail/10026, (Tue, Jul 28th)
    — SANS ISC

    (c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
  12. Java Spring Boot "heapdump" scans, (Mon, Jul 27th)
    — SANS ISC

    Spring Boot exposes the endpoint "/actuator/heapdump" to collect debug information. By default, the endpoint will return a file heapdump.hpr…

🪲 NVD — Last 20 Scored Vulnerabilities

Latest scored CVEs from the National Vulnerability Database (9608 in last 30 days).
Critical: 3 · High: 13 · Medium: 3 · Low: 1. View full dashboard →

  1. CVE-2026-56822
    — CVSS 7.4 (HIGH)

    Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, the OcspServerCertificateValidator forwards the SslHandshakeCompletionEvent before the asynchronous …
  2. CVE-2026-56821
    — CVSS 7.4 (HIGH)

    Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, the OcspServerCertificateValidator flags an out-of-date OCSP response but does not stop processing i…
  3. CVE-2026-66064
    — CVSS 5.3 (MEDIUM)

    goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.5, the httpserver/handler.go sendFile handler opened files using a cleaned path but derived the authorization filename from r…
  4. CVE-2026-66063
    — CVSS 6.5 (MEDIUM)

    goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.5, the httpserver/updown.go multipart upload handler split part.FileName() on / but did not reject .., allowing an unauthenti…
  5. CVE-2026-64863
    — CVSS 9.1 (CRITICAL)

    goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.4, the httpserver/server.go wdGuard handled WebDAV MOVE as a write-only method and did not enforce –no-delete, allowing WebD…
  6. CVE-2026-62325
    — CVSS 9.1 (CRITICAL)

    goshs is a feature-rich single-binary file server for red teamers and developers. From 2.1.3 until 2.1.4, the sftpserver/sftpserver.go password handler used Username != "" && Password != "", so running goshs with -b 'adm…
  7. CVE-2026-59921
    — CVSS 5.7 (MEDIUM)

    Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, HttpPostRequestEncoder constructs multipart HTTP request bodies by directly concatenating user-suppl…
  8. CVE-2026-54719
    — CVSS 7.5 (HIGH)

    goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.1, the httpserver/updown.go bulkDownload handler for ?bulk&file= ZIP downloads did not call findEffectiveACL or applyCustomAu…
  9. CVE-2026-54658
    — CVSS 9.8 (CRITICAL)

    Hypequery is a TypeScript semantic layer for ClickHouse. Prior to 2.0.2, escapeValue() in packages/clickhouse/src/core/utils.ts did not escape backslashes before single quotes during parameter substitution, allowing atta…
  10. CVE-2026-54650
    — CVSS 8.6 (HIGH)

    openhole exposes localhost to the internet in one command. In 0.1.1 and earlier, openhole-server in internal/server/public_proxy.go forwarded r.URL.Path instead of preserving the original request target with r.URL.Escape…
  11. CVE-2026-54638
    — CVSS 7.5 (HIGH)

    gotd/td is a T Telegram MTProto API client in Go. Prior to 0.145.1, proto.UnencryptedMessage.Decode in proto/unencrypted_message.go read attacker controlled dataLen from an unauthenticated MTProto unencrypted packet and …
  12. CVE-2026-47219
    — CVSS 7.5 (HIGH)

    find-my-way is a framework-independent HTTP router that internally uses a Radix Tree and supports route parameters and wildcards. Versions prior to 9.7.0 are vulnerable to remotely triggerable DoS in find-my-way when it …
  13. CVE-2026-55415
    — CVSS 7.5 (HIGH)

    datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML, or CSV. From 0.11.6 until 0.64.0, datamodel-code-g…
  14. CVE-2026-55403
    — CVSS 3.7 (LOW)

    datamodel-code-generator generates Python data models from schema definitions. Prior to 0.63.0, src/datamodel_code_generator/http.py get_body reuses Authorization, Cookie, and Proxy-Authorization headers when following c…
  15. CVE-2026-55391
    — CVSS 7.5 (HIGH)

    datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML, or CSV. Prior to 0.63.0, datamodel-code-generator …
  16. CVE-2026-55390
    — CVSS 7.5 (HIGH)

    datamodel-code-generator generates Python data models from schema definitions. From 0.59.0 until 0.62.0, XML Schema parsing in src/datamodel_code_generator/parser/xmlschema.py for –input-file-type xmlschema resolves xs:…
  17. CVE-2026-55389
    — CVSS 7.5 (HIGH)

    datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML, or CSV. Prior to 0.62.0, datamodel-code-generator …
  18. CVE-2026-54691
    — CVSS 8.2 (HIGH)

    datamodel-code-generator generates Python data models from schema definitions. From 0.9.1 until 0.61.0, src/datamodel_code_generator/http.py http.get_body accepts –url targets and redirect chain targets without host/IP …
  19. CVE-2026-54690
    — CVSS 8.2 (HIGH)

    datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML, or CSV. From 0.9.1 until 0.61.0, datamodel-code-ge…
  20. CVE-2026-54656
    — CVSS 7.8 (HIGH)

    datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML, or CSV. From 0.52.1 until 0.60.2, datamodel-code-g…

Source: NVD CVE API 2.0

Generated by CryptXNet.ai Threat Intelligence Platform · July 29, 2026 · Sources: The Hacker News, Bleeping Computer, Krebs on Security, Dark Reading, SANS ISC, THN Threat Intel, Unit 42, Security.com