Wednesday, July 8, 2026
Daily digest
Two critical Linux kernel vulnerabilities disclosed today — GhostLock and Januscape — affect privilege escalation and VM escape respectively, and both have direct implications for Nutanix AHV hypervisor hosts. Patch tracking should begin immediately.
15-Year-Old GhostLock Flaw Enables Root and Container Escape on Most Linux Distros
Researchers disclosed CVE-2026-43499 ('GhostLock'), a Linux kernel privilege-escalation vulnerability present in essentially all mainstream distributions since 2011. Any locally authenticated user can gain full root access with no special permissions or unusual configuration required. A patch is available but must be applied manually across affected systems.
Why it matters: Nutanix AHV runs on a hardened Linux kernel — this flaw affects the host OS layer directly. Any compromised guest or local account on an AHV host could escalate to root, making this a hypervisor-level risk. Confirm AHV host kernel version and check Nutanix's advisory queue for a patched release immediately; this also triggers NIST 800-171 control SI-2 (flaw remediation) tracking obligations.
New Januscape Linux Flaw Allows VM Escape on Intel, AMD Devices
A 16-year-old Linux kernel vulnerability dubbed 'Januscape' allows an attacker inside a virtual machine to escape the VM boundary and execute arbitrary code on the underlying host, affecting both Intel and AMD hardware. The flaw has been present in the kernel for over a decade and affects a wide range of Linux-based hypervisor environments. Details and a CVE have been published alongside a coordinated disclosure.
Why it matters: This is a direct threat to Nutanix AHV: a VM escape means a compromised guest workload — including any CUI-handling VM — could reach the host and laterally move to other guests. Combined with GhostLock, a two-step exploit chain (Januscape escape + GhostLock root escalation) is plausible. Treat this as critical priority patching and review AHV host isolation controls.
DEBULL Tooling Abuses Microsoft Device-Code Flow to Target M365 Accounts
A device-code phishing campaign tracked as DEBULL was observed actively targeting Microsoft 365 accounts in late June through early July 2026, using collaboration-themed lures rather than fake login pages. The attack pushes victims through the legitimate Microsoft device login flow at login.microsoftonline.com, making it visually indistinguishable from a real authentication event. No stolen credentials or fake sites are required — only the victim completing a device-code entry.
Why it matters: GCC High tenants are not immune to device-code phishing since the attack abuses legitimate Microsoft infrastructure. Review Conditional Access policies in Intune/Entra to restrict or block device-code authentication flows for standard users, and confirm that risky sign-in alerts are enabled and monitored. This is a live, in-the-wild campaign with high success rates against MFA-protected accounts.
CISA Orders Feds to Patch Max-Severity ColdFusion Flaw by Friday
CISA added CVE-2026-48282, a CVSS 10.0 path-traversal vulnerability in Adobe ColdFusion enabling arbitrary code execution, to its KEV catalog and ordered federal agencies to patch by Friday. The flaw is being actively exploited in the wild. CISA simultaneously added three other flaws affecting Adobe, Joomla, and Langflow to the KEV list.
Why it matters: If ColdFusion is running anywhere in your environment or on any internet-facing system, this is a drop-everything patch situation. KEV additions carry FISMA/CMMC compliance implications — document remediation status now for audit trail purposes under SI-2.
CISA Orders Feds to Prioritize Patching Langflow Auth Bypass Flaw
CISA issued a KEV directive requiring federal agencies to patch an actively exploited authentication bypass vulnerability in Langflow, the visual AI agent-building framework, by end of week. The flaw allows unauthenticated remote access to Langflow instances. Langflow is widely self-hosted by organizations experimenting with AI agent pipelines.
Why it matters: If you are running a self-hosted AI stack that includes Langflow for agent orchestration, this is an unauthenticated RCE-class risk requiring immediate patching or takedown. Even non-federal organizations should treat KEV entries as high-priority given the confirmed active exploitation.
Ubiquiti Warns of New Max-Severity UniFi OS Vulnerability
Ubiquiti released security updates addressing seven critical vulnerabilities in UniFi OS, including one maximum-severity flaw exploitable via command injection. The vulnerabilities affect UniFi network appliances and controllers. Ubiquiti is urging all users to apply updates immediately.
Why it matters: If UniFi gear is part of your network infrastructure, these are command-injection flaws at max severity — update the UniFi OS controller and all affected APs and switches before these are added to KEV. Network device compromise is a common first pivot in defense contractor targeting campaigns.
China-Linked UAT-7810 Expands ORB Network With New LONGLEASH Malware
Cisco Talos reports that Chinese APT UAT-7810 is actively refining new malware called LONGLEASH to expand its 'LapDogs' Operational Relay Box network by compromising internet-facing network devices, primarily unpatched Ruckus routers. The ORB network is used to proxy APT traffic and obscure attribution. The campaign has been active since at least mid-2025.
Why it matters: ORB networks specifically target perimeter networking devices to blend APT traffic with legitimate ISP infrastructure, making detection harder. If you manage internet-facing routers or firewalls — particularly Ruckus gear — confirm firmware patch levels and review for indicators of compromise from the Talos report.
Fake IT Help Desk Actors on Microsoft Teams Coax Workers Into Installing Malware
Palo Alto Unit 42 documented a social engineering campaign in which attackers pose as internal IT helpdesk staff on Microsoft Teams, persuade employees to grant remote access, and then drop the EtherRAT trojan. The technique bypasses email-based phishing defenses by operating entirely within Teams chat. Victims are targeted via both external Teams messages and compromised internal accounts.
Why it matters: M365 GCC High tenants use Teams as a primary communication channel. Verify that your tenant restricts or logs external Teams communications, and confirm that Intune-managed endpoints have policies preventing remote-control software installation by non-admin users. This attack pattern is specifically designed to exploit helpdesk trust relationships.
GitHub 'Verified' Commits Can Be Rewritten Into New Hashes Without Breaking Signatures
New research demonstrates that a signed Git commit's cryptographic signature can be preserved on a second commit with a different hash — meaning an attacker without the signing key can create a duplicate commit with identical author, date, and files that GitHub still marks as 'Verified.' The commit hash, which most tooling uses for integrity checks, does not match the original. This undermines assumptions about the tamper-evidence of signed commits in CI/CD pipelines.
Why it matters: If your Ansible playbooks, infrastructure-as-code, or deployment pipelines rely on Git commit signature verification (e.g., via GitHub Actions or Gitops workflows), the 'Verified' badge no longer provides the integrity guarantee you may assume. Review your supply chain controls and consider hash pinning at the pipeline level rather than relying solely on GitHub's signature UI.
CIRCIA and Other Major Cyber Rules Expected to Be Finalized This Fall
CISA's cyber incident reporting rules under CIRCIA are among several major cybersecurity regulations expected to be finalized in fall 2026, according to Federal News Network. The rules will impose mandatory incident reporting timelines on critical infrastructure and federal contractors. Other regulations moving in parallel include updates touching FedRAMP and supply chain security requirements.
Why it matters: CIRCIA finalization will create mandatory incident reporting obligations that overlap with and extend beyond current CMMC/DFARS 252.204-7012 requirements. Now is the time to review your IR plan and ensure your logging and notification workflows can meet sub-72-hour reporting windows.
Enforce Zero Data Retention on Amazon Bedrock With Bedrock Projects and Service Control Policies
AWS published guidance on using Bedrock Projects combined with Service Control Policies (SCPs) to enforce zero data retention across Amazon Bedrock AI inference calls, preventing prompts and outputs from being stored after a request completes. The approach is designed to address compliance requirements for organizations using third-party models such as Claude that involve data sharing with external providers. The controls can be applied organization-wide via AWS Organizations.
Why it matters: If you are running AI workloads on AWS GovCloud using Bedrock, CUI handling through third-party model APIs requires explicit data retention controls to satisfy CMMC/NIST 800-171 requirements around data protection (MP-6, SC-28). This SCP pattern gives you an enforceable, auditable mechanism — review against your current Bedrock configuration.
Microsoft to Enable Windows Backup by Default for Entra-Joined Enterprise Systems
Microsoft announced that Windows settings backup and restore will be enabled by default for Microsoft Entra-joined and Entra hybrid-joined enterprise devices after upgrading to Windows 11 26H2. The feature syncs settings data off-device to Microsoft cloud services. Organizations in the EU are excluded by default; all others must actively opt out if they do not want settings shipped to Microsoft.
Why it matters: For an Intune-managed Windows 11 fleet in a CMMC L2 environment, automatic settings sync to Microsoft cloud services may conflict with data handling requirements depending on what settings are captured. Verify whether GCC High tenants are scoped to sovereign storage for this feature, and consider proactively setting an Intune policy to control or disable the backup before 26H2 rolls out.