The 5-Minute Cyber Brief
Good morning. Start with the newly exploited vulnerabilities most likely to reshuffle patch queues today, then move through the supporting developments that deserve attention.
Lead Story
CISA Adds One Known Exploited Vulnerability to Catalog
The July 29 KEV addition is CVE-2026-20316, a hard-coded password in Cisco Secure Firewall Management Center, added on evidence of active exploitation.
Know what matters before your first meeting.
Weekday mornings. Five minutes. What changed in security, why it matters.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
Why it matters: Under BOD 26-04, federal agencies must prioritize KEV flaws that give total control of exposed assets, and this one sits on the firewall control plane.
Recommended action: Confirm FMC versions and exposure, and check FMC audit logs for logins you cannot explain.
Read more on CyberExperts: Read more on CyberExperts
Original source: CISA
Also Worth Your Attention
Three Steps to the Terminal: A Siemens ROX II Zero-Day Trilogy
In the ROX II chain, an xz-based file read (CVE-2025-40948) exposes hashes and keys, a feature-key signature check allows command injection as root (CVE-2025-40947), and the task scheduler adds root cron persistence (CVE-2025-40949).
Why it matters: Each step looks modest alone; together they survive reboots on a network device few teams monitor.
Recommended action: Limit switch web management to engineering networks and watch for unexpected scheduled tasks.
Read more on CyberExperts: Read more on CyberExperts
The Xcode Assassin Returns: A Deep Dive Into the Latest XCSSET Version
Unit 42 describes XCSSET v40, macOS malware that spreads through Xcode projects and has hidden in the projects of dozens of legitimate apps since early April. The new version adds in-memory execution, polymorphic payloads and fileless persistence.
Why it matters: Developer Macs and build projects are the target, so infections travel with shared code.
Recommended action: Review Xcode projects pulled from GitHub for unexpected build phases and monitor developer Macs.
Read more on CyberExperts: Read more on CyberExperts
Rails patches critical Active Storage flaw with RCE potential
The Rails Active Storage flaw, CVE-2026-66066 (CVSS 9.5), affects apps that use libvips and accept image uploads from untrusted users; Rails says MiniMagick apps are not exposed through this path. Rails 7.1 and earlier are end of life and get no backport.
Know what matters before your first meeting.
Weekday mornings. Five minutes. What changed in security, why it matters.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
Why it matters: Apps on unsupported Rails versions have no patch to wait for and must upgrade.
Recommended action: Upgrade to a fixed release, require libvips 8.13 or later, and rotate application secrets.
Read more on CyberExperts: Read more on CyberExperts
Amgen says cloud data breach exposed patient health, proprietary info
Amgen told the SEC that attackers exfiltrated proprietary data and patient protected health information from cloud environments run by third-party providers. It deemed the incident material on July 29 and has not found impact on products or manufacturing.
Why it matters: The data sat with providers, but the disclosure duty and the patient impact stay with Amgen.
Recommended action: Check which third-party cloud services hold regulated data and how quickly they must tell you about an incident.
Read more on CyberExperts: Read more on CyberExperts
Go Deeper
Editorial Promise
CyberExperts should help you get the signal fast, understand what actually matters, and know where to go deeper before the day gets noisy.
Newer CyberExperts coverage on this topic
This article still works as background. If you want the current picture, start with the freshest related coverage below and today's brief.
Coder’s registry infrastructure compromised to push malicious modules
The Coder incident is a supply-chain lesson in miniature: once attackers can tamper with trusted module distribution, defenders are no longer verifying...
Attackers Turn Trusted Node.js Runtime Into Malware Delivery Tool in Targeted Attacks
The useful lesson in this campaign is not that Node.js is bad. It is that adversaries keep choosing legitimate runtimes defenders already...
HPE patches critical ArubaOS-CX remote code execution flaw
ArubaOS-CX deserves attention because switching software rarely gets treated with the same urgency as identity or edge security until exploitation arrives. A...
Monday’s brief: GlobalProtect logins without passwords, then SonicWall, AhsayCBS and NetScaler
The fastest way to catch up on what changed after this article was published.
Start your morning with the signal that matters.
Get the biggest cybersecurity developments, why they matter, and where to go deeper on CyberExperts.
By subscribing you agree to our Privacy Policy.
Free. Weekdays. Built for operators.
