Good morning. Start with the newly exploited vulnerabilities most likely to reshuffle patch queues today, then move through the supporting developments that deserve attention.
Lead Story
CISA Adds Two Known Exploited Vulnerabilities to Catalog
Weekend catch-up on KEV: the July 22 additions, Check Point CVE-2026-16232 and SharePoint CVE-2026-50522, remain the most urgent entries for anyone running those products.
Why it matters: Both are being exploited, and both leave persistence behind if not cleaned up.
Know what matters before your first meeting.
Weekday mornings. Five minutes. What changed in security, why it matters.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
Read more on CyberExperts: Read more on CyberExperts
Original source: CISA
Recommended action: Verify remediation and cleanup status rather than patch status alone.
Also Worth Your Attention
Three Steps to the Terminal: A Siemens ROX II Zero-Day Trilogy
The Siemens ROX II trilogy from Unit 42 shows how a low-severity file read on an OT switch can lead to root and cron-based persistence. Fixed firmware is V2.17.1.
Why it matters: OT patch windows are slow, so compensating controls matter in the meantime.
Read more on CyberExperts: Read more on CyberExperts
Original source: Palo Alto Unit 42
Recommended action: Watch for xz -f -c -d runs and unexpected scheduled tasks on ROX II devices.
July 2026 Patch Tuesday: Microsoft Patches 622 Vulnerabilities Including Two Exploited Zero-Days
CrowdStrike notes this month’s 622 Microsoft fixes are almost five times May’s volume. Its team was credited with finding four of the CVEs.
Why it matters: Patch fatigue is a risk in itself when monthly releases grow this fast.
Read more on CyberExperts: Read more on CyberExperts
Original source: CrowdStrike
Recommended action: Make sure exploited and critical items are not stuck behind the volume.
The Hunter's Paradox: Is it time to embrace automated threat hunting?
Talos’s “Hunter’s Paradox” essay argues that humans cannot keep up with security data volume, but AI tends to believe attacker deception in the data. Its answer: let AI execute narrowly scoped hunts while humans choose what to hunt.
Why it matters: Treat AI agents like service accounts: scoped access, audit trails and limited autonomous actions.
Know what matters before your first meeting.
Weekday mornings. Five minutes. What changed in security, why it matters.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
Read more on CyberExperts: Read more on CyberExperts
Original source: Cisco Talos
Recommended action: Write down which response actions an AI agent may take on its own before piloting one.
Fastjson 1.x RCE Vulnerability Targeted in Attacks With No Patched Available
ThreatBook and Imperva report attacks on Fastjson 1.x flaw CVE-2026-16723 (CVSS 9.0), which allows unauthenticated code execution in Spring Boot fat-JAR apps. As of July 25 there is no fixed 1.x release.
Why it matters: With no patch, configuration is the only defense for teams that cannot migrate.
Read more on CyberExperts: Read more on CyberExperts
Original source: The Hacker News
Recommended action: Enable SafeMode (-Dfastjson.parser.safeMode=true) or use the 1.2.83_noneautotype build, and plan migration to Fastjson2.
Go Deeper
CyberExperts should help you get the signal fast, understand what actually matters, and know where to go deeper before the day gets noisy.
Get the Daily Brief every weekday morning.
Newer CyberExperts coverage on this topic
This article still works as background. If you want the current picture, start with the freshest related coverage below and today's brief.
Coder’s registry infrastructure compromised to push malicious modules
The Coder incident is a supply-chain lesson in miniature: once attackers can tamper with trusted module distribution, defenders are no longer verifying...
Attackers Turn Trusted Node.js Runtime Into Malware Delivery Tool in Targeted Attacks
The useful lesson in this campaign is not that Node.js is bad. It is that adversaries keep choosing legitimate runtimes defenders already...
HPE patches critical ArubaOS-CX remote code execution flaw
ArubaOS-CX deserves attention because switching software rarely gets treated with the same urgency as identity or edge security until exploitation arrives. A...
Monday’s brief: GlobalProtect logins without passwords, then SonicWall, AhsayCBS and NetScaler
The fastest way to catch up on what changed after this article was published.
Start your morning with the signal that matters.
Get the biggest cybersecurity developments, why they matter, and where to go deeper on CyberExperts.
By subscribing you agree to our Privacy Policy.
Free. Weekdays. Built for operators.
