Daily digest

Progress Tells ShareFile Customers to Shut Down Storage Zone Controllers Over 'Credible' Security Threat

Progress Software has issued an emergency directive telling ShareFile customers to immediately shut down any Windows servers running Storage Zone Controllers, citing a 'credible external security threat.' The company has proactively disabled access to affected accounts while investigating. No CVE has been published yet, and technical details are being withheld pending the investigation.

Why it matters: ShareFile is commonly used by DoD contractors for secure file transfer — if any system in your CUI data flow or supply chain runs an on-premises Storage Zone Controller, it should be shut down now pending Progress guidance. This also warrants a review of your third-party file-sharing inventory for CMMC boundary documentation.

Hackers Use Fake Microsoft Entra Passkey Enrollment to Gain Microsoft 365 Access

A threat actor tracked as O-UNC-066 is conducting vishing (voice phishing) campaigns that trick Microsoft 365 users into enrolling attacker-controlled passkeys in Microsoft Entra, bypassing MFA. The group uses a phishing kit with a panel that intercepts the passkey enrollment flow, then leverages the enrolled credential for data extortion. Multiple sectors have been targeted.

Why it matters: This attack directly targets the Entra ID / M365 authentication stack you run in GCC High. Even phishing-resistant MFA via passkeys can be subverted at enrollment time — review your Entra passkey enrollment policies, ensure enrollment requires a Compliant Device (Intune) or Temporary Access Pass issued through a verified channel, and validate that Conditional Access blocks enrollment from unmanaged devices.

Hackers Exploit Critical Auth Bypass in Gitea Docker Image

Attackers are actively exploiting a critical authentication bypass vulnerability in the official Docker image for Gitea, the self-hosted Git service, allowing unauthenticated users to impersonate any account including administrators. The flaw is being exploited in the wild and affects organizations running the containerized version of Gitea. A patched image has been released.

Why it matters: If your environment runs a self-hosted Gitea instance in containers — plausible given your Ansible and automation footprint — patch the Docker image immediately. An admin-level auth bypass on your internal code repository is a direct path to source code exfiltration and supply-chain tampering, both of which carry CMMC incident reporting obligations.

DoD Class Deviation Leaves Contractors With More Questions Than Answers

A recent DoD class deviation to acquisition regulations is generating confusion among defense contractors and legal experts about its intended scope and practical requirements. Compliance attorney Tracye Howard noted the rulemakers' intent is not entirely clear, leaving contractors uncertain how to respond. The deviation could affect contract clause applicability across multiple programs.

Why it matters: Ambiguous class deviations can create compliance gaps or unexpected obligations in active contracts — flag this for your contracts and legal team to assess whether any current or pending awards are affected before the next contract review cycle.

Six New U-Boot Flaws Could Let Malicious Images Crash Devices or Run Code at Boot

Binarly researchers disclosed six vulnerabilities in the U-Boot bootloader, which is embedded in home routers, smart cameras, and data-center server management chips. Four bugs cause denial-of-service crashes; two allow arbitrary code execution by an attacker who can place a malicious boot image in the device's boot path, before any OS-level security takes effect. No patches are available for all affected hardware.

Why it matters: Nutanix AHV nodes and other data-center appliances in your environment may use U-Boot in their BMC or management firmware. Verify with Nutanix and any other hardware vendors whether affected firmware is present, and assess whether firmware integrity verification (NIST 800-171 req. 3.4.9) is enforced in your baseline.

'Ghostcommit' Hides Prompt Injection in Images to Fool AI Agents, Steal Secrets

Researchers demonstrated 'Ghostcommit,' a prompt injection attack that embeds malicious instructions inside PNG images in a code repository. AI code-review agents CodeRabbit and Bugbot were bypassed entirely because they don't inspect image files, while a coding agent was manipulated into reading the repo's .env file and encoding all secrets into committed code. The technique requires no special privileges beyond submitting a pull request.

Why it matters: If your environment uses AI coding agents or automated code reviewers in any CI/CD pipeline — including against repos that handle CUI-adjacent configuration or secrets — this attack can exfiltrate credentials without triggering conventional SAST or secret-scanning tools. Ensure .env and secrets files are excluded from agent-accessible scopes and review any AI agent permissions granted to repository contents.

New MODBEACON RAT Uses gRPC Streaming for Encrypted C2 Traffic

The China-linked threat group Silver Fox has been attributed to a new Rust-based remote access trojan called MODBEACON, which uses gRPC streaming to blend its command-and-control traffic with legitimate encrypted application traffic. The malware spreads via counterfeit software installers promoted through SEO poisoning. Despite appearing unsophisticated on the surface, the group shows significant organizational depth.

Why it matters: gRPC-based C2 is specifically designed to evade network inspection tools that flag unusual ports or protocols — standard perimeter controls and DLP rules may not detect it. If your AWS GovCloud or on-prem traffic inspection doesn't perform TLS/gRPC deep inspection, this class of malware could operate undetected; worth validating your network monitoring coverage against encrypted application-layer protocols.

Critical Zimbra Flaw Could Let Crafted Emails Run Malicious Code in User Sessions

Zimbra has disclosed a critical stored XSS vulnerability in its Classic Web Client that allows specially crafted emails to execute malicious JavaScript within an authenticated user's browser session. No CVE has been assigned yet. Zimbra is urging all customers to apply the available update immediately.

Unpatched XRING Flaw in XQUIC Lets Remote Clients Crash HTTP/3 Servers

Researcher Sébastien Féry disclosed a denial-of-service vulnerability dubbed XRING in XQUIC, Alibaba's open-source QUIC and HTTP/3 library. Approximately 260 bytes of valid QPACK traffic — requiring no authentication or malformed packets — is sufficient to crash an affected server. No patch exists as of disclosure on July 8.

Securing Our Future: July 2026 Progress Report on Microsoft's Secure Future Initiative

Microsoft published its latest Secure Future Initiative (SFI) progress report covering advances in secure-by-default engineering, AI-powered threat defense, and identity hardening across its cloud platforms. The report includes updates on token protection, tenant security defaults, and reductions in legacy authentication surface area. It also outlines forward-looking commitments on quantum-readiness and supply chain transparency.

Why it matters: SFI changes roll into M365 GCC High on a delayed schedule relative to commercial — review the specific identity and tenant default changes to anticipate when they'll affect your Conditional Access policies and authentication configurations, and use the report's secure-by-default milestones to close any NIST 800-171 control gaps tied to Microsoft's shared responsibility model.

Ryuk Ransomware Member Pleads Guilty in the US, Faces 15 Years in Prison

A 34-year-old Armenian national pleaded guilty in a US court to hacking American companies and deploying Ryuk ransomware to encrypt their systems. He faces up to 15 years in federal prison. Ryuk was one of the most damaging ransomware operations of its era, targeting hospitals, government agencies, and enterprises.