Good morning. Start with the newly exploited vulnerabilities most likely to reshuffle patch queues today, then move through the supporting developments that deserve attention.
Lead Story
CISA Adds Two Known Exploited Vulnerabilities to Catalog
The July 22 KEV entries are still the federal priority: Check Point SmartConsole CVE-2026-16232 (deadline July 25) and SharePoint CVE-2026-50522.
Why it matters: Deadlines under BOD 26-04 are measured in days, not weeks.
Know what matters before your first meeting.
Weekday mornings. Five minutes. What changed in security, why it matters.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
Read more on CyberExperts: Read more on CyberExperts
Original source: CISA
Recommended action: If either fix is still outstanding, escalate it today.
Also Worth Your Attention
Three Steps to the Terminal: A Siemens ROX II Zero-Day Trilogy
Unit 42 and Siemens disclosed three chained flaws in Ruggedcom ROX II OT switches: xz-based file disclosure (CVE-2025-40948), feature-key command injection (CVE-2025-40947) and scheduler cron injection (CVE-2025-40949). Siemens recommends firmware V2.17.1.
Why it matters: Chained, they give persistent root on switches that segment industrial networks.
Read more on CyberExperts: Read more on CyberExperts
Original source: Palo Alto Unit 42
Recommended action: Inventory ROX II devices, plan the V2.17.1 update, and restrict access to switch management interfaces.
July 2026 Patch Tuesday: Microsoft Patches 622 Vulnerabilities Including Two Exploited Zero-Days
CrowdStrike’s July analysis counts 622 Microsoft CVEs, about triple June’s volume, with two exploited zero-days, one publicly disclosed zero-day and 62 critical issues. Elevation of privilege makes up 41% of the total.
Why it matters: Volumes like this break manual triage; rank by exploitation and exposure.
Read more on CyberExperts: Read more on CyberExperts
Original source: CrowdStrike
Recommended action: Prioritize AD FS CVE-2026-56155 and SharePoint CVE-2026-56164, both exploited.
New Dolphin X malware uses AI to rank high-value targets
Varonis analyzed the operator panel of Dolphin X, a new RAT sold on a cybercrime forum, which advertises an “AI Profiler” that scores and ranks infected victims, plus credential theft from more than 300 applications. Varonis confirmed the profiler exists in the panel but not which AI engine powers it.
Why it matters: Automated triage helps criminals find the few high-value machines, such as developer or cloud-admin workstations, among thousands of infections.
Read more on CyberExperts: Read more on CyberExperts
Know what matters before your first meeting.
Weekday mornings. Five minutes. What changed in security, why it matters.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
Original source: BleepingComputer
Recommended action: Protect developer secrets such as .env files, SSH keys and cloud CLI tokens, which this family targets.
Russian Espionage Group Exploited Zimbra Zero-Day to Steal Mail and 2FA Codes
A joint NSA and CISA advisory, backed by Unit 42 and Proofpoint, details Russian espionage using Zimbra XSS flaw CVE-2025-66376 and persistent app-specific passwords named “ZimbraWeb” to keep reading mail.
Why it matters: App passwords and IMAP access survive patching.
Read more on CyberExperts: Read more on CyberExperts
Original source: The Hacker News
Recommended action: Search Zimbra audit.log for CreateAppSpecificPassword and revoke unexpected app passwords.
Go Deeper
CyberExperts should help you get the signal fast, understand what actually matters, and know where to go deeper before the day gets noisy.
Get the Daily Brief every weekday morning.
Newer CyberExperts coverage on this topic
This article still works as background. If you want the current picture, start with the freshest related coverage below and today's brief.
Coder’s registry infrastructure compromised to push malicious modules
The Coder incident is a supply-chain lesson in miniature: once attackers can tamper with trusted module distribution, defenders are no longer verifying...
Attackers Turn Trusted Node.js Runtime Into Malware Delivery Tool in Targeted Attacks
The useful lesson in this campaign is not that Node.js is bad. It is that adversaries keep choosing legitimate runtimes defenders already...
HPE patches critical ArubaOS-CX remote code execution flaw
ArubaOS-CX deserves attention because switching software rarely gets treated with the same urgency as identity or edge security until exploitation arrives. A...
Thursday’s brief: Fortinet’s firewall fixes land today, then Cisco Expressway, eMudhra certificates and PHP2Shell
The fastest way to catch up on what changed after this article was published.
Start your morning with the signal that matters.
Get the biggest cybersecurity developments, why they matter, and where to go deeper on CyberExperts.
By subscribing you agree to our Privacy Policy.
Free. Weekdays. Built for operators.
