Good morning. Start with the newly exploited vulnerabilities most likely to reshuffle patch queues today, then move through the supporting developments that deserve attention.
Lead Story
CISA Adds One Known Exploited Vulnerability to Catalog
CISA’s July 29 KEV addition is Cisco Secure Firewall Management Center CVE-2026-20316, a hard-coded credential flaw.
Why it matters: FMC manages Cisco firewalls, so access there reaches the security control plane.
Know what matters before your first meeting.
Weekday mornings. Five minutes. What changed in security, why it matters.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
Read more on CyberExperts: Read more on CyberExperts
Original source: CISA
Recommended action: Apply Cisco’s FMC fixes and review FMC access logs.
Also Worth Your Attention
Three Steps to the Terminal: A Siemens ROX II Zero-Day Trilogy
Unit 42’s ROX II research remains relevant for OT teams: three Siemens flaws chain to persistent root on industrial switches, fixed in firmware V2.17.1.
Why it matters: Industrial switches are often assumed safe on isolated networks.
Read more on CyberExperts: Read more on CyberExperts
Original source: Palo Alto Unit 42
Recommended action: Schedule the firmware update in the next OT maintenance window.
VMware fixes three critical flaws allowing auth bypass, VM escapes
Broadcom fixed five VMware flaws, including vCenter authentication bypass CVE-2026-59309 and vCenter Syslog directory traversal RCE CVE-2026-59310 (both CVSS 9.8) and VMXNET3 VM escape CVE-2026-47876 (9.3). Broadcom treats them as emergency changes and saw no exploitation so far.
Why it matters: vCenter and ESX compromises give access to large parts of an estate and are a favorite ransomware target.
Read more on CyberExperts: Read more on CyberExperts
Original source: BleepingComputer
Recommended action: Upgrade vCenter to 9.1.0.0300, 9.0.2.0100 or 8.0 U3k and ESX to the matching fixed builds.
The Xcode Assassin Returns: A Deep Dive Into the Latest XCSSET Version
Unit 42 describes XCSSET v40, a macOS malware family that spreads through Xcode projects and has hidden in the projects of dozens of legitimate apps since early April. The new version adds in-memory execution, polymorphic payloads and fileless persistence.
Why it matters: Developer machines are the target, and infected projects spread to anyone who builds them.
Know what matters before your first meeting.
Weekday mornings. Five minutes. What changed in security, why it matters.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
Read more on CyberExperts: Read more on CyberExperts
Original source: Palo Alto Unit 42
Recommended action: Review Xcode projects pulled from GitHub for unexpected build phases and monitor developer Macs.
Microsoft Teams vishing attacks lead to Chaos ransomware attacks
Sophos tracks STAC4749, a campaign that impersonated IT support in Microsoft Teams calls to get remote access via Quick Assist or RemSupp, leading to Chaos ransomware in at least three cases, once in under 17 hours.
Why it matters: Most targets were in Canada and the U.S., across services, manufacturing, energy and construction.
Read more on CyberExperts: Read more on CyberExperts
Original source: BleepingComputer
Recommended action: Restrict external Teams contact and block unapproved remote-support tools such as RemSupp.
Go Deeper
CyberExperts should help you get the signal fast, understand what actually matters, and know where to go deeper before the day gets noisy.
Get the Daily Brief every weekday morning.
Newer CyberExperts coverage on this topic
This article still works as background. If you want the current picture, start with the freshest related coverage below and today's brief.
Coder’s registry infrastructure compromised to push malicious modules
The Coder incident is a supply-chain lesson in miniature: once attackers can tamper with trusted module distribution, defenders are no longer verifying...
Attackers Turn Trusted Node.js Runtime Into Malware Delivery Tool in Targeted Attacks
The useful lesson in this campaign is not that Node.js is bad. It is that adversaries keep choosing legitimate runtimes defenders already...
HPE patches critical ArubaOS-CX remote code execution flaw
ArubaOS-CX deserves attention because switching software rarely gets treated with the same urgency as identity or edge security until exploitation arrives. A...
Monday’s brief: GlobalProtect logins without passwords, then SonicWall, AhsayCBS and NetScaler
The fastest way to catch up on what changed after this article was published.
Start your morning with the signal that matters.
Get the biggest cybersecurity developments, why they matter, and where to go deeper on CyberExperts.
By subscribing you agree to our Privacy Policy.
Free. Weekdays. Built for operators.
