Good morning. Start with the issue most likely to reshuffle someone's priority list today, then move through the supporting developments that deserve attention.
Lead Story
Cisco warns of FMC static credential flaw exploited in zero-day attacks
Cisco warns that attackers exploited CVE-2026-20316, a static (hard-coded) credential flaw in Secure Firewall Management Center (FMC), as a zero-day. CISA added it to the KEV catalog on July 29.
Why it matters: FMC is the management plane for Cisco firewalls, so a working credential there reaches the policy for every managed device.
Know what matters before your first meeting.
Weekday mornings. Five minutes. What changed in security, why it matters.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
Read more on CyberExperts: Read more on CyberExperts
Original source: BleepingComputer
Recommended action: Find every FMC instance, apply Cisco’s fixed release, and keep the management interface off untrusted networks.
Also Worth Your Attention
Cisco FMC Zero-Day Actively Exploited, Static Credentials Could Expose Sensitive Data
The Hacker News covers the same FMC zero-day, noting that the static credentials could expose sensitive data on affected systems.
Why it matters: A built-in credential cannot be rotated away by an administrator, so only the vendor fix closes it.
Read more on CyberExperts: Read more on CyberExperts
Original source: The Hacker News
Recommended action: Treat this as the same ticket as the Cisco item above and confirm the fix on standby and lab FMC instances too.
Critical Rails Flaw Could Let Unauthenticated Attackers Read Server Files via Image Uploads
Rails fixed CVE-2026-66066 (CVSS 9.5), an Active Storage flaw that lets unauthenticated attackers read server files through crafted image uploads when libvips handles image processing. Exposed files can include secret_key_base, the master key and database or cloud credentials.
Why it matters: Leaked Rails secrets can lead to code execution and to access in connected systems.
Read more on CyberExperts: Read more on CyberExperts
Original source: The Hacker News
Recommended action: Upgrade to Rails 7.2.3.2, 8.0.5.1 or 8.1.3.1 and rotate every secret the application process can read.
Anthropic confirms Claude is down worldwide
Anthropic confirmed elevated errors across multiple Claude models on July 29, with requests failing with “529 Overloaded” in Claude and in tools built on its API. BleepingComputer reported service restored for everyone by 19:00 EDT.
Why it matters: Teams that wired AI assistants into daily workflows found out how dependent those workflows had become.
Know what matters before your first meeting.
Weekday mornings. Five minutes. What changed in security, why it matters.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
Read more on CyberExperts: Read more on CyberExperts
Original source: BleepingComputer
Recommended action: List the processes that rely on a single AI provider and decide what should happen when it is unavailable.
Three Steps to the Terminal: A Siemens ROX II Zero-Day Trilogy
Unit 42 and Siemens ProductCERT detailed three Ruggedcom ROX II flaws, CVE-2025-40948, CVE-2025-40947 and CVE-2025-40949, that chain from file disclosure to persistent root on Siemens OT switches. Siemens recommends firmware V2.17.1.
Why it matters: These switches segment industrial networks, so root access lets an attacker watch or disrupt plant traffic.
Read more on CyberExperts: Read more on CyberExperts
Original source: Palo Alto Unit 42
Recommended action: Inventory ROX II devices and schedule V2.17.1 in the next maintenance window.
Go Deeper
CyberExperts should help you get the signal fast, understand what actually matters, and know where to go deeper before the day gets noisy.
Get the Daily Brief every weekday morning.
Newer CyberExperts coverage on this topic
This article still works as background. If you want the current picture, start with the freshest related coverage below and today's brief.
Coder’s registry infrastructure compromised to push malicious modules
The Coder incident is a supply-chain lesson in miniature: once attackers can tamper with trusted module distribution, defenders are no longer verifying...
Attackers Turn Trusted Node.js Runtime Into Malware Delivery Tool in Targeted Attacks
The useful lesson in this campaign is not that Node.js is bad. It is that adversaries keep choosing legitimate runtimes defenders already...
HPE patches critical ArubaOS-CX remote code execution flaw
ArubaOS-CX deserves attention because switching software rarely gets treated with the same urgency as identity or edge security until exploitation arrives. A...
Monday’s brief: GlobalProtect logins without passwords, then SonicWall, AhsayCBS and NetScaler
The fastest way to catch up on what changed after this article was published.
Start your morning with the signal that matters.
Get the biggest cybersecurity developments, why they matter, and where to go deeper on CyberExperts.
By subscribing you agree to our Privacy Policy.
Free. Weekdays. Built for operators.
