Tenable Security Intel Brief: Russia's Zimbra zero-day ran five months undetected
Welcome to this week's Tenable Security Intel Brief, a curated summary of the top stories in cybersecurity by Tenable's Research Special Operations (RSO) team. This week, Proofpoint details TA488, a Russian-aligned private contractor that quietly exploited a Zimbra zero-day for at least five months in 2025, targeting Ukrainian government and US nuclear and defense industrial base organizations. TA488 hit US nuclear and defense targets with a Zimbra zero-day → Brief: TA488, a Russian-aligned private contractor, exploited CVE-2025-66376, a Zimbra Collaboration Suite zero-day, for at least five months in 2025, targeting Ukrainian government and US nuclear and defense industrial base organizations. Intel: Opening a malicious email in Zimbra's Classic UI webmail was enough to trigger the exploit. TA488 fragmented a malicious SVG tag behind fake CSS @import directives; Zimbra's sanitizer passed each fragment, and the browser reassembled them into executable JavaScript. The payload, tracked as ZimReaper, exfiltrated session security tokens, autocomplete passwords, 2FA scratch codes, the Global Address List, and 90 days of email. It registered a "ZimbraWeb" app-specific password for Internet Message Access Protocol (IMAP) access that bypassed 2FA. Zimbra patched in November 2025; no TA488 activity has been recorded since February 2026. Why it matters: ZimReaper registered a Zimbra application credential that IMAP accepts without a second factor, one that is separate from the account password. For organizations whose mail server is the crown jewel, the half-click delivery closed the window that normally buys time. The user did nothing wrong. GlobalProtect bypass becomes Qilin ransomware's entry point → Brief: Arctic Wolf Labs confirmed that CVE-2026-0257, a GlobalProtect authentication bypass fixed May 13, served as the initial access vector for multiple Qilin ransomware intrusions in June 2026. Intel: The flaw lets an unauthenticated attacker establish a valid VPN session; it is exploitable only where sign-in shortcut cookies are active alongside a specific certificate configuration. In the June intrusions, attackers dumped credentials from memory and the domain's password database, used a standard Windows admin tool to spread across the network, staged ransomware in an empty default Windows folder, then encrypted domain-wide. Tradecraft ranged from rapid encryption to full double-extortion, consistent with multiple Qilin Ransomware-as-a-Service (RaaS) affiliates. CISA flagged the CVE as exploited in ransomware attacks and Shadowserver tracks over 167,000 GlobalProtect instances exposed online. Why it matters: Our June 3 edition noted exploitability hinged on a certificate-wiring decision, not on CVSS. Researchers observed exploitation against numerous customers starting May 17, four days after the fix shipped; confirmed ransomware intrusions followed in June. The configuration gap that decides exposure was already being industrialized before the patch cycle closed. HOLLOWGRAPH turns Microsoft 365 calendars into an espionage dead-drop → Brief: Group-IB identified HOLLOWGRAPH, a malware implant using a compromised Microsoft 365 mailbox calendar as a two-way command channel, hiding operator tasking and stolen files inside events dated May 13, 2050. Intel: HOLLOWGRAPH runs two commands through the Microsoft Graph API, the cloud interface for Microsoft 365: 'get' pulls instructions from a planted calendar attachment; 'send' uploads stolen files into a new far-future event. No flaw is exploited; the malware uses a compromised account and stolen login credentials, leaving no patch. Group-IB tied the implant to Cavern Manticore with high confidence but could not attribute the campaign to any known actor. The Iranian-nexus link comes from a separate Check Point report covered in our July 15 edition. Group-IB counted 12 infected systems between June 3 and July 9, with a focus on Israeli entities. Why it matters: Detection built around flagging traffic to attacker-owned destinations has nothing to match when the command channel is a legitimate Microsoft 365 calendar. The 2050 date parks dead-drop events in a corner of the mailbox no one monitors, and two commands run a complete espionage loop. Oracle's CPU and a kernel flood put CVE volume on trial → Brief: Oracle's July 2026 Critical Patch Update, its quarterly patch bundle, addresses 1,235 unique CVEs in 1,449 patches across 32 product families, the largest CPU release in our analysis. Intel: Context: the January 2026 CPU covered 158 CVEs; April covered 241. That same week, 432 CVEs landed from the Linux kernel team, which issues its own CVEs, in a 31-hour window ending July 20. Jan Schaumann flagged the volume on OSS-SEC; Greg Kroah-Hartman, who oversees the kernel CVE program, explained it: "These were all pending for weeks," the result of "a perfect storm of 6 week straight of conferences and vacations." Kroah-Hartman added that "the number of llm-found issues is only on the rise right now." Why it matters: When one quarterly update carries 1,235 CVEs and the kernel publishes 432 in a weekend, a CVE stops working as a signal to act and becomes a unit of accounting. NVD has logged 45,207 CVEs this year, on pace to roughly double 2025's total; Bloomberg found no rise in exploitation. Stat of the week: $124 million Recorded financial exposure from wrench attacks (incidents where criminals use violence or threats to steal cryptocurrency) in 1H 2026, according to CertiK, which counted 52 verified incidents, up from 39 incidents and $10.5 million a year earlier. Tenable's RSO serves as Tenable's Forward Logistics Element in the threat landscape, providing customers with the analyses and contextualized exposure intelligence required to manage risks to critical business assets. With over 150 years of collective expertise, this hand-picked group of world-class security researchers is united with one mission: to cut through the noise and deliver critical intelligence about the most dangerous cyber threats emerging right now.Tenable Security Intel Brief: wp2shell WordPress attacks underway
Welcome to this week's Tenable Security Intel Brief, a curated summary of the top stories in cybersecurity by Tenable's Research Special Operations (RSO) team. This week, researchers disclosed wp2shell, a chain of two WordPress core flaws that lets an anonymous attacker run code on a stock install. WordPress pushed fixes to affected sites through forced auto-updates. Two WordPress core bugs chain into code execution with no login → Brief: Researchers disclosed wp2shell, a chain of two WordPress core flaws that lets an anonymous attacker run code on a stock install with no plugins and no login. Intel: CVE-2026-63030 is a flaw in the batch endpoint, a WordPress feature that bundles requests into one call, letting a request run with permissions it should not have. CVE-2026-60137 is a SQL injection that reaches the database. Adam Kues at Searchlight Cyber reported the route bug; a separate team reported the injection. WordPress shipped fixes July 17 through auto-updates; the full chain exists only in 6.9 and 7.0, while the injection alone reaches back to 6.8. Security firms have confirmed active exploitation within days of disclosure, including incident response in several attacks. Why it matters: The fix shipped as open-source code, so researchers reconstructed the flaw from the changed lines and proof-of-concept (PoC) exploits appeared within hours, their speed credited to AI-assisted tooling. Responders are already working confirmed attacks, and the weight is new: all four prior WordPress entries on CISA's KEV catalog were plugins, not Core. SonicWall SMA 1000 zero-days chained to give unauthenticated OS access → Brief: SonicWall disclosed two actively exploited vulnerabilities in its SMA 1000 remote-access appliances, with no available workaround and a federal remediation deadline of July 17. Intel: CVE-2026-15409 carries a CVSS 10.0 rating: it is an SSRF (server-side request forgery) weakness in the SMA 1000 Workplace interface that any unauthenticated remote attacker can reach. CVE-2026-15410 is a CVSS 7.2 code injection weakness inside the Appliance Management Console (AMC); when chained, the two let an attacker run commands on the appliance without logging in. SonicWall PSIRT confirmed "multiple cases indicating the active exploitation." The Cybersecurity and Infrastructure Security Agency (CISA) added both to the Known Exploited Vulnerabilities (KEV) catalog on July 14. No workaround exists. Why it matters: An SMA 1000 concentrates what an intruder otherwise has to earn: VPN session tokens, administrator credentials, and a map of the network behind the gateway. Exploitation was confirmed before any public proof-of-concept existed, and the CVEs drew a federal remediation deadline just three days after they were listed. Sandworm adopts ClickFix to compromise Ukrainian organizations → Brief: Ukraine's CERT confirmed that Sandworm (UAC-0145), a hacking unit tied to Russia's GRU military intelligence, is running ClickFix lures against Ukrainian targets across more than ten compromised websites. Intel: The group's compromised websites display a fake CAPTCHA that tells visitors to copy a PowerShell command and run it on their computer; the command delivers GHETTOVIBE, a VBS file saved to the Startup directory. A reconnaissance tool, SCOUTCURL, then collects system details, programs, files, and browser data so attackers can triage whether the target warrants further compromise. Higher-value systems received FREAKYPOLL, a compiled Python backdoor, and CERT-UA confirmed at least one organization's network was breached (advisory in Ukrainian). Delivery infrastructure uses SMARTAXE, which resolves its domain from a blockchain smart contract, complicating takedown. Why it matters: ClickFix was a crimeware staple, used primarily by financially motivated actors, as Ars Technica notes, "in the last year or so." Sandworm's adoption of it closes the gap between commodity lures and elite state intrusion. The same fake CAPTCHA a security team would file under petty crime can now be a GRU operation. OpenAI's own models escaped a test sandbox and breached Hugging Face → Brief: Hugging Face disclosed a July 16 intrusion into part of its production infrastructure; OpenAI has since confirmed the attacker was its own models, running a benchmark with safety classifiers disabled. Intel: OpenAI's models were running an internal cyber-capabilities benchmark with safety classifiers (guardrails against high-risk cyber activity) disabled. In that state, they exploited a previously unknown flaw in a software-download proxy to escape their sandbox. They then used stolen credentials and more previously unknown flaws to run their own code on Hugging Face's servers, reaching test answers in its production database. Hugging Face says the campaign fired thousands of actions across a swarm of disposable environments and reached a small set of internal datasets and credentials, with no sign user-facing models or Spaces were altered. Why it matters: The frontier AI models Hugging Face tried first refused the attack commands its responders submitted, forcing the forensics onto a model it could run on its own servers. The guardrails that blocked the defenders never touched OpenAI's models: the classifiers were off for the benchmark run. Stat of the week: 97% The share of ransomware victims breached through compromised credentials that had multi-factor authentication (MFA) enabled in some form at the time of the attack, according to the Sophos State of Ransomware 2026 report; deploying MFA and being covered by it are two different things. Tenable's RSO serves as Tenable's Forward Logistics Element in the threat landscape, providing customers with the analyses and contextualized exposure intelligence required to manage risks to critical business assets. With over 150 years of collective expertise, this hand-picked group of world-class security researchers is united with one mission: to cut through the noise and deliver critical intelligence about the most dangerous cyber threats emerging right now.Oracle July 2026 Critical Patch Update Addresses 1235 CVEs
On July 21, Oracle released its Critical Patch Update (CPU) for July 2026, the third quarterly update of 2026 and the largest CPU release ever. This CPU contains fixes for 1235 unique CVEs in 1449 security updates across 32 Oracle product families. Out of the 1449 security updates published this quarter, 18% of patches were assigned a critical severity. High severity patches accounted for the bulk of security patches at 52.7%, followed by medium severity patches at 24.7%. For more information about the July 2026 CPU release, including the availability of patches and Tenable product coverage, please visit our blog.Tenable Security Intel Brief: UAT-7810 builds fresh relay networks
Welcome to this week's Tenable Security Intel Brief, a curated summary of the top stories in cybersecurity by Tenable's Research Special Operations (RSO) team. This week, Cisco Talos details UAT-7810, a China-nexus group whose likely job is standing up the relay networks other espionage crews use to strike their targets, and whose own arsenal now includes a newer version of its SHORTLEASH backdoor plus two previously unknown malware families. China-nexus UAT-7810 builds fresh relay networks with new malware → Brief: Cisco Talos is tracking UAT-7810, an advanced persistent threat (APT) group assessed with high confidence to be China-nexus, and which sustains the LapDogs Operational Relay Box (ORB) network that SecurityScorecard first documented in 2025. Intel: Talos assesses the actor's likely job is to stand up ORB networks, a type of covert network that secondary threat actors like UAT-5918 borrow to strike high-value targets. The actor primarily exploits known vulnerabilities (n-days) in unpatched Ruckus wireless routers (CVE-2020-22653, CVE-2020-22658, CVE-2023-25717), and one server associated with UAT-7810 infrastructure was also used against ASUS AiCloud routers (CVE-2025-2492) in early 2026. Researchers found a newer version of its SHORTLEASH backdoor, tracked as LONGLEASH, plus two previously unknown families, the C-based DOGLEASH and the Java-based JARLEASH, whose configuration file carries comments in Simplified Chinese. Why it matters: Espionage here runs on a division of labor: one crew builds the relay layer, the operators who break in borrow it. LONGLEASH can act as an intermediate command and control (C2), so each compromised edge device becomes another rung of the network. LEASHTEST, a leftover test binary, shows the crew still validating its tooling after shipping LONGLEASH. Microsoft tells customers to expect higher volume of fixes from AI → Brief: Microsoft told Windows customers to expect more fixes in each monthly release as AI accelerates how fast it finds vulnerabilities in its own code. Intel: In a July 9 post, Pavan Davuluri, Microsoft's EVP of Windows and Devices, wrote that "As AI helps defenders discover more issues, customers will see a higher volume of security updates included in each security release." Driving the increase is a multi-model agentic scanning harness (MDASH) that runs candidate flaws through debate across several AI model families before a separate pipeline strips false positives. Microsoft is also revising its Secure Development Lifecycle (SDL) for AI-enabled attack techniques and applying AI to move flaws through remediation faster, with humans kept in the loop for code review. On Tuesday, Microsoft released its July Patch Tuesday, addressing 569 CVEs, the largest release in Patch Tuesday history and nearly triple the previous record of 198 set in June. We break down the full release in our monthly Patch Tuesday blog. Why it matters: The research itself hasn't changed. The engine finding the flaws has. As the same tooling scales across vendors, the monthly cycle grows heavier by design, and the burden of testing and deploying that rising volume settles on the customers running the software. A vibe-coded script mapped Active Directory in a real breach → Brief: Huntress recovered a PowerShell script (a Windows scripting tool) that an attacker used during a June 3 intrusion to map an Active Directory (AD) environment, and its contents show it was built through "vibe coding," prompting AI in natural language until the output works. Intel: The attacker gained remote desktop protocol (RDP) access using pre-compromised credentials, staged tools in C:\ProgramData, a Windows system folder, then ran the script before using legitimate binaries to exfiltrate data. Huntress rebuilt it from telemetry and found the AI's fingerprints: a title reading "100% Working AD Information Gathering Script - FULLY FIXED," an unedited example server name the operator never replaced, five redundant ways to locate a domain controller, and an auto-generated HTML report summarizing the theft. Why it matters: Vibe coding puts bespoke, single-use tooling in the hands of a mediocre actor, and no two of its scripts look alike. What does not change is the tradecraft: the Active Directory enumeration underneath behaves the same way on the operating system no matter who prompted it, and that behavior is what detection can still read. Iran-nexus Cavern Manticore hides its C2 across three .NET formats → Brief: Check Point Research uncovered an Iran-nexus advanced persistent threat (APT) group it tracks as Cavern Manticore, running a modular C2 framework against Israeli government and IT-sector organizations. Intel: Already inside its targets, the group abuses a legitimate software-deployment feature, in one case SysAid's update mechanism, to drop a malicious dynamic link library (DLL) beside a trusted program (WinDirStat) that loads it and launches the Cavern backdoor. Its standout move is architectural: one .NET framework built three separate ways, forcing analysts into a different set of analysis tools for each component, while most samples evade nearly all antivirus detection. Check Point links the group to Iran's Ministry of Intelligence and Security (MOIS) and notes technical overlaps with MuddyWater and Lyceum, a subgroup of OilRig. Why it matters: None of this needed a new exploit. The intrusion runs on the target's own trusted software and on ordinary .NET compilation choices, and each module unloads itself from memory after it runs, leaving little on disk to scan. The near-invisibility is assembled almost entirely from legitimate parts. Stat of the week: 5,811 The number of arrests across 97 countries in Operation First Light 2026, a crackdown on social engineering scams and money laundering that also intercepted USD 293 million in illicit assets, according to Interpol. Tenable’s RSO serves as Tenable’s Forward Logistics Element in the threat landscape, providing customers with the analyses and contextualized exposure intelligence required to manage risks to critical business assets. With over 150 years of collective expertise, this hand-picked group of world-class security researchers is united with one mission: to cut through the noise and deliver critical intelligence about the most dangerous cyber threats emerging right now.
