Credentials Meet CVE Data, FortiBleed & SocGholish Dismantled

LegacyHive Zero-Day, SonicWall CVSS 10.0 & Sandworm's Clickfix Pivot

(00:00:00) LegacyHive Zero-Day, SonicWall CVSS 10.0 & Sandworm's Clickfix Pivot (00:01:09) SonicWall CVSS Ten Zero-Days (00:02:06) Microsoft's 622-Patch Cycle (00:02:41) Romania Land Registry Breach (00:03:16) Sandworm Clickfix Ukraine Campaign (00:04:01) NuGet Abuse and Spirals Ransomware A Windows zero-day called LegacyHive dropped publicly hours after Microsoft's July 2026 Patch Tuesday cycle closed — not before, after. Researcher Chaotic Eclipse published a proof of concept targeting the Windows User Profile Service that works on every fully-patched Windows version. Three previous disclosures by the same researcher led to confirmed in-the-wild exploitation. The pattern is the story. Meanwhile, two CVSS 10.0 zero-days in SonicWall SMA 1000 appliances are already being actively chained in real intrusions. CVE-2026-15409 and CVE-2026-15410 let attackers extract credentials and MFA seeds from perimeter devices, then pivot into domain controllers. A security device becomes a persistent backdoor. Patch Tuesday itself brought 622 vulnerabilities this cycle — including a no-auth SharePoint RCE and an Active Directory Federation Services flaw both flagged by CISA for federal remediation by July 17–28. Then LegacyHive arrived the same day, unpatched. Elsewhere: Romania's national land registry ANCPI was hit on July 14 by threat actor ByteToBreach, stalling real estate transactions nationwide. Russia's Sandworm group is using Clickfix — fake CAPTCHA prompts running PowerShell — to deploy FreakyPoll and FluidLeech malware against Ukrainian targets. Eleven malicious NuGet packages were found dropping Starland RAT and WLDR implants disguised as game cheats. And a ransomware variant called Spirals is achieving full network encryption within 24 hours of initial access, outpacing most recovery assumptions. Three open questions heading into the next cycle: Will LegacyHive move from theoretical to confirmed exploitation? Will SonicWall intrusions spread to new sectors? Will Microsoft issue an out-of-band patch? This episode includes AI-generated content.

SonicWall CVSS 10.0, Record 570 Patches & LegacyHive Zero-Day

(00:00:00) SonicWall CVSS 10.0, Record 570 Patches & LegacyHive Zero-Day (00:00:58) Microsoft Record 570 Patches (00:02:08) SharePoint and AD FS Under Attack (00:03:05) LegacyHive Unpatched Windows PoC (00:03:57) BitLocker Bypass and Patch Risk (00:04:48) What to Watch Next This episode covers one of the most intense vulnerability weeks of the year, opening with two actively exploited zero-days in SonicWall Secure Mobile Access appliances. CVE-2026-15409, a server-side request forgery flaw rated CVSS 10.0, and CVE-2026-15410, a code injection vulnerability rated 7.2, together create a direct attack path into remote access infrastructure. Organizations running SMA 1000 series appliances should treat patching as an emergency, not a maintenance item. Microsoft's July Patch Tuesday set an industry record: more than 570 vulnerabilities fixed in a single release, with up to 63 rated critical. Microsoft attributes the spike to AI-powered vulnerability discovery — a double-edged development, since attackers are using the same acceleration to weaponize known flaws at machine speed. The patch window is now down to one to three days by Microsoft's own guidance. Two confirmed zero-days are actively exploited within the July release. CVE-2026-56164 is a missing authentication flaw in SharePoint Server enabling privilege escalation and remote code execution. CISA has mandated federal agencies patch by July 17. CVE-2026-56155 targets Active Directory Federation Services, with Microsoft's own incident responders confirming active exploitation. A third zero-day, CVE-2026-50661, bypasses BitLocker via physical access. Separately, a researcher named Chaotic Eclipse released a working privilege escalation proof-of-concept called LegacyHive — an unpatched flaw affecting every Windows version post-July patch cycle. No fix is currently available. The structural theme across every story: AI is compressing both vulnerability discovery and exploitation timelines simultaneously. That is the operating environment defenders are now in. A YesWee production. This episode includes AI-generated content.

Patch Tuesday Record: 570 Fixes, 2 Zero-Days, One July 17 Deadline

(00:00:00) Patch Tuesday Record: 570 Fixes, 2 Zero-Days, One July 17 Deadline (00:00:36) SharePoint Zero-Day — July 17 Deadline (00:01:50) Exchange RCE and BitLocker Bypass (00:02:39) AI Running Both Sides of the Fight (00:03:32) AI Reliability Gap in Defense (00:04:01) What to Watch Next Microsoft's July 2026 Patch Tuesday is a record-breaker: 570 security fixes, 57 rated critical, and two zero-days already under active exploitation. If you run SharePoint Server or Active Directory Federation Services, this episode tells you what to patch, in what order, and why the clock is running out. The most urgent flaw is CVE-2026-56164, a privilege escalation vulnerability in SharePoint Server that requires no credentials to exploit. CISA's remediation deadline is July 17. The second actively exploited vulnerability, CVE-2026-56155 in AD FS, requires an authenticated attacker but targets the identity backbone of most enterprise environments — CISA deadline July 28. Two other high-priority CVEs round out the picture: a heap-based buffer overflow in Exchange Server that turns any low-privilege credential into a potential remote code execution vector, and a BitLocker bypass requiring physical device access. Beyond patching, this episode covers the expanding role of AI on both sides of the security fight. Microsoft attributes much of the 570-fix volume to AI-assisted vulnerability discovery. On the attacker side, criminal groups are using AI across every phase of an intrusion — one actor reportedly generated 88,000 lines of ransomware toolkit code in a single week. When Western AI platforms block malicious requests, attackers pivot to DeepSeek, Qwen, and Trae, which carry weaker content guardrails. The defensive picture is mixed. A 2026 SANS survey found 63 percent of security practitioners report significant shortcomings in AI-driven detection, and two-thirds have been misdirected by an AI tool in the past year. Human review remains the essential control layer that current AI tooling cannot replace. Key watchpoints: the July 17 SharePoint deadline, incoming proof-of-concept code for Exchange and AD FS, and ESU licensing for Exchange 2016 and 2019 environments. This episode includes AI-generated content.

Joomla CVSS 10.0 Exploits, FSB Router Campaign & DHS Breach Missed Twice

(00:00:00) Joomla CVSS 10.0 Exploits, FSB Router Campaign & DHS Breach Missed Twice (00:01:19) CMS Ecosystem Under Coordinated Pressure (00:02:03) Russian FSB Router Campaign Escalates (00:02:54) DHS Breach Missed Twice (00:03:30) Treasury Targets Ransomware Enablers (00:03:59) Django and Fake VPN Threats (00:04:32) Watchpoints and Closing Two Joomla extensions—iCagenda and Balbooa Forms—are carrying CVSS 10.0 scores and are actively being exploited right now. Both CVE-2026-48939 and CVE-2026-56291 enable unauthenticated remote code execution or arbitrary file upload, and both have landed on CISA's Known Exploited Vulnerabilities catalog. Patches exist. The question is whether administrators have applied them. Zooming out, Australia's cyber agency has issued warnings about coordinated, AI-accelerated exploitation targeting file upload and remote code execution flaws across WordPress, Joomla, and other CMS platforms—compressing the window between disclosure and weaponization. On the nation-state front, an 18-nation advisory led by the NSA details sustained Russian FSB Center 16 exploitation of CVE-2018-0171, an eight-year-old Cisco Smart Install vulnerability. The targeted sectors—defense, energy, healthcare, and government—are being hit not by cutting-edge zero-days, but by basic hygiene failures: default credentials and legacy configurations left open for years. At the Department of Homeland Security, attackers breached the Homeland Security Information Network and remained undetected for weeks, with live attack activity misclassified as a false positive twice. Attribution is unconfirmed; a classified Congressional briefing is scheduled. Treasury's OFAC has sanctioned ransomware infrastructure providers 1VPNS and Silayev—targeting the obfuscation ecosystem rather than front-line operators, marking a strategic escalation in financial enforcement. Rounding out today's briefing: a Django SQL injection flaw showing organised reconnaissance, and a fake Chinese VPN distributing GoodPersonRAT via malicious MSI installer. A YesWee production, built using AI technology. This episode includes AI-generated content.

JadePuffer's Kubernetes Takeover, Accenture Breach & Chrome iOS Zero-Day

(00:00:00) JadePuffer's Kubernetes Takeover, Accenture Breach & Chrome iOS Zero-Day (00:00:52) Kubernetes Egress: The Exploited Gap (00:01:37) Accenture Breach and Supply Chain Risk (00:02:12) Chrome iOS and AssuranceAmerica Breach (00:03:01) ColdFusion, Langflow, and Shrinking Windows (00:03:29) Vishing, Passkeys, and ClamAV's Debt (00:03:58) What to Watch Next A landmark moment in ransomware history: JadePuffer is the first documented attack chain where a large language model runs the entire operation autonomously — automated phishing, lateral movement, and polymorphic encryption across Kubernetes clusters, all driven by stolen OpenAI API keys. This isn't AI-assisted malware. It's a closed loop. And every threat actor now has a blueprint. Kubernetes defenders take note: unrestricted egress to LLM API endpoints is the specific gap JadePuffer exploits. NetworkPolicy rules and admission controller hardening are no longer optional — they are baseline requirements. Attribution remains unclear, meaning similar campaigns may already be running undetected. Elsewhere in today's briefing: threat actor "888" claims a 35 GB source-code exfiltration from Accenture via stolen credentials, raising serious supply chain exposure for the firm's enterprise clients. Google has patched CVE-2026-14075, a critical policy-enforcement bypass in Chrome for iOS — update immediately, as a proof-of-concept is likely weeks away. Seven million AssuranceAmerica records were stolen through a single compromised credential, including Social Security numbers and driver's license data that enables identity theft credit freezes cannot stop. Two more CVEs closed fast: Adobe ColdFusion's CVE-2026-48282 was exploited within minutes of public technical analysis; Langflow's CVE-2026-55255 hit CISA's KEV catalog just two weeks after initial observation. Pink Crew is hijacking Microsoft 365 accounts through vishing calls that walk victims into fake Entra passkey enrollment. And Cisco Talos patched ClamAV — seven vulnerabilities, some more than twenty years old. The thread connecting every story today: a single stolen credential. This episode includes AI-generated content.