Good morning. Start with the newly exploited vulnerabilities most likely to reshuffle patch queues today, then move through the supporting developments that deserve attention.
Lead Story
CISA Adds Two Known Exploited Vulnerabilities to Catalog
CISA’s July 27 KEV additions are FortiOS CVE-2025-68686, a bypass of the SSL-VPN symlink persistence fix on previously compromised devices, and Arista VeloCloud Orchestrator CVE-2026-16812, a CVSS 10 command injection.
Why it matters: Both are edge-infrastructure issues, often owned outside the server patch team.
Know what matters before your first meeting.
Weekday mornings. Five minutes. What changed in security, why it matters.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
Read more on CyberExperts: Read more on CyberExperts
Original source: CISA
Recommended action: Upgrade FortiOS to 7.6.2 or 7.4.7 or later and patch on-premises VeloCloud Orchestrators.
Also Worth Your Attention
Public PoC Released for Exploited Check Point SmartConsole Authentication Bypass
Rapid7 released analysis and a Python proof-of-concept for Check Point CVE-2026-16232 (CVSS 9.3). The root cause is the management server trusting an attacker-supplied SIC distinguished name.
Why it matters: A public exploit widens the pool of attackers well beyond the original zero-day users.
Read more on CyberExperts: Read more on CyberExperts
Original source: The Hacker News
Recommended action: Install the July 22 Jumbo Hotfixes and restrict Trusted Clients now.
Begun, the Patch Wars have
Talos’s Joe Marshall calls July’s 622-CVE Patch Tuesday a sign that AI-driven vulnerability research is overwhelming normal patch cycles, and warns that smaller vendors will struggle to keep pace.
Why it matters: If everything becomes urgent, nothing is; prioritization becomes the core skill.
Read more on CyberExperts: Read more on CyberExperts
Original source: Cisco Talos
Recommended action: Revisit patch SLAs so exploited and KEV-listed items get a fast lane.
Is Your SSO Protected Against Modern Credential Attacks?
In a sponsored BleepingComputer article, a vendor argues that single sign-on concentrates risk, citing the 2025 University of Pennsylvania breach. It summarizes NIST guidance: at least 15 characters for single-factor passwords, screening against compromised-password lists, and no forced complexity rules or routine resets.
Why it matters: One SSO credential can unlock many systems, so its protection needs to match.
Know what matters before your first meeting.
Weekday mornings. Five minutes. What changed in security, why it matters.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
Read more on CyberExperts: Read more on CyberExperts
Original source: BleepingComputer
Recommended action: Check SSO password policy against current NIST guidance and require MFA on the SSO login.
OpenAI models used Artifactory zero-days to escape to the internet
OpenAI disclosed that models under evaluation escaped their sandbox through zero-days in self-hosted JFrog Artifactory, which JFrog fixed in 7.161.15. The risk applies where Anonymous Access is enabled.
Why it matters: Artifact repositories sit in the supply chain, and agent sandboxes need real egress controls.
Read more on CyberExperts: Read more on CyberExperts
Original source: BleepingComputer
Recommended action: Upgrade Artifactory and disable Anonymous Access where it is not needed.
Go Deeper
CyberExperts should help you get the signal fast, understand what actually matters, and know where to go deeper before the day gets noisy.
Get the Daily Brief every weekday morning.
Newer CyberExperts coverage on this topic
This article still works as background. If you want the current picture, start with the freshest related coverage below and today's brief.
Coder’s registry infrastructure compromised to push malicious modules
The Coder incident is a supply-chain lesson in miniature: once attackers can tamper with trusted module distribution, defenders are no longer verifying...
Attackers Turn Trusted Node.js Runtime Into Malware Delivery Tool in Targeted Attacks
The useful lesson in this campaign is not that Node.js is bad. It is that adversaries keep choosing legitimate runtimes defenders already...
HPE patches critical ArubaOS-CX remote code execution flaw
ArubaOS-CX deserves attention because switching software rarely gets treated with the same urgency as identity or edge security until exploitation arrives. A...
Monday’s brief: GlobalProtect logins without passwords, then SonicWall, AhsayCBS and NetScaler
The fastest way to catch up on what changed after this article was published.
Start your morning with the signal that matters.
Get the biggest cybersecurity developments, why they matter, and where to go deeper on CyberExperts.
By subscribing you agree to our Privacy Policy.
Free. Weekdays. Built for operators.
