Thursday, July 23, 2026
Daily digest
Nine-Year-Old RefluXFS Linux Flaw Gives Local Users Root on Default RHEL Installs
CVE-2026-64600 is a race condition in the Linux kernel's XFS filesystem that allows an unprivileged local user to overwrite root-owned files and achieve persistent root access. Qualys confirmed default installations of RHEL and its derivatives, Fedora Server, and Amazon Linux are exploitable. The flaw has existed for nine years and was publicly disclosed July 22.
Why it matters: Amazon Linux runs on AWS GovCloud EC2 instances, and RHEL derivatives are common in defense contractor environments — any Linux hosts using XFS (the default filesystem on RHEL 8+) should be patched immediately or mitigated by restricting local user access until kernel updates are applied.
Check Point Patches Exploited SmartConsole Flaw Allowing Full Admin Access
CVE-2026-16232 (CVSS 9.3) is an authentication bypass in Check Point's SmartConsole login process affecting Security Management and Multi-Domain Management products. The flaw is actively being exploited in the wild and allows a remote unauthenticated attacker to gain full administrative access. Check Point has released patches and urges immediate update.
Why it matters: If Check Point firewalls are part of your network perimeter or are used to segment CUI enclaves, an unauthenticated admin bypass is a critical exposure — patch or restrict SmartConsole access to management-only VLANs immediately.
New msaRAT Malware Uses Chrome, Edge Browsers to Route C2 Traffic
The Chaos ransomware gang has deployed a new backdoor called msaRAT that tunnels command-and-control communications through the Chrome or Edge browser processes, making C2 traffic appear as normal browser activity. This technique is designed to evade network-based detection tools that inspect traffic by process or port. The malware targets Windows endpoints.
Why it matters: Your Intune-managed Windows 11 fleet running Edge is a direct target surface — this technique bypasses traditional C2 detection by blending into sanctioned browser traffic, so DNS-layer filtering and endpoint behavioral analytics (not just signature-based AV) are essential to catch it.
Flaws in Passkey Implementation Show Old Attacks Still Work
Researchers presenting ahead of Black Hat USA discovered exploitable flaws in Microsoft's passkey implementation that could allow attackers to impersonate privileged users. The vulnerabilities show that despite the stronger cryptographic foundation of passkeys, implementation weaknesses can reintroduce credential-based attack paths. Specific technical details are expected to be disclosed at Black Hat.
Why it matters: If you are deploying or planning to deploy passkeys in your M365 GCC High or Entra ID environment as a phishing-resistant MFA option for CMMC compliance, this research warrants close attention — watch for Microsoft's response and any patches before broad rollout.
Microsoft Working to Fix Exchange Online Mailbox Quarantine Issue
Since Sunday, Exchange Online has been incorrectly quarantining customer mailboxes due to a bug Microsoft is actively working to resolve. Affected users are unable to send or receive mail during the incident. Microsoft has acknowledged the issue and is investigating the root cause.
Why it matters: Exchange Online is the mail backend for M365 GCC High — if your tenant is affected, this could impact operational email for CUI-handling staff. Monitor the Microsoft 365 Service Health Dashboard and prepare to escalate with Microsoft's GCC High support track if mailboxes are quarantined.
Redmond's Reaper: October 2026 End-of-Life for Windows Server 2022, Office LTSC 2021, and Entra ID Risk Policies
Microsoft has confirmed that Windows Server 2022, Office LTSC 2021, Publisher, and Entra ID risk-based Conditional Access policies will all reach end of support or end of life in October 2026. After these dates, affected products will no longer receive security updates. Organizations have roughly 90 days to plan migrations or upgrades.
Why it matters: Running unpatched Windows Server 2022 after October would create a gap against NIST 800-171 control 3.14.1 (identify and remediate vulnerabilities) — now is the time to confirm upgrade paths to Server 2025 and assess whether Entra ID Conditional Access policies dependent on risk signals need to be rebuilt.
Attackers Weaponize GitHub Actions Runners to Target cPanel and WHM Servers
Threat actors compromised GitHub repositories and injected malicious development versions into 10 Packagist PHP packages associated with a legitimate developer, turning GitHub Actions runners into distributed attack infrastructure targeting cPanel and WHM servers. The campaign ran July 12–13 and used supply-chain poisoning to reach downstream hosting environments. Researchers have shed light on the scale and coordination of the operation.
Why it matters: If your Ansible playbooks or CI/CD pipelines pull Packagist/PHP dependencies or use GitHub Actions runners, this supply-chain attack vector applies directly — audit your dependency pinning and GitHub Actions runner trust configurations.
Linux Kernel Team Publishes 432 CVEs in Two Days
The Linux kernel security team published 432 CVEs over a Sunday-to-Monday period, fueling speculation that AI-assisted tooling was used to generate the bulk bug reports. The volume is highly unusual and is straining the capacity of downstream distributors to triage and respond. Many of the CVEs affect subsystems present in common enterprise and cloud Linux distributions.
Why it matters: With Amazon Linux and potentially RHEL-derived guests running on your Nutanix AHV and AWS GovCloud infrastructure, a sudden flood of kernel CVEs makes automated patching prioritization critical — lean on vendor advisories from Amazon and Red Hat to filter signal from noise rather than chasing all 432 raw entries.
Hackers Exploit Windmill Flaw to Read Arbitrary Server Files Without Authentication
CVE-2026-29059 (CVSS 7.5) is an unauthenticated path traversal vulnerability in the Windmill open-source developer platform that is actively being exploited in the wild. Attackers can read arbitrary server-side files without authentication by manipulating the filename parameter in the job log retrieval API endpoint. VulnCheck confirmed active exploitation.
Why it matters: If Windmill is part of your automation or self-hosted workflow stack — it's a popular open-source Ansible/script orchestration alternative — patch or take the instance offline immediately, as unauthenticated file reads on a CUI-adjacent host would be a direct 800-171 incident.
Attackers Are Learning to Live Off the AI Toolchain
Researchers have identified malware dubbed Sandworm_Mode that abuses trusted AI developer tools and workflows to conduct malicious activity indistinguishable from normal AI toolchain operations. The technique is a living-off-the-land evolution targeting AI-integrated environments. It represents an early but significant example of adversaries weaponizing AI infrastructure rather than traditional OS binaries.
Why it matters: If you run a self-hosted AI stack or integrate AI tooling into development pipelines in your environment, this class of attack has no existing signature — behavioral monitoring of AI tool process activity and network egress from those hosts should be added to your detection strategy.
FedRAMP and Identity Security: Federal Organizations Consolidating Identity Security Platforms
Federal agencies are increasingly consolidating identity security platforms to reduce risk, cut costs, and align with Zero Trust mandates, according to a Federal News Network report. The consolidation trend emphasizes unified governance across identity, access management, and AI controls under FedRAMP-authorized tooling. The piece highlights how fragmented identity systems create compliance gaps and increase attack surface.
Why it matters: CMMC Level 2 maps heavily to NIST 800-171 access control and identification/authentication controls — if your identity stack spans multiple non-integrated tools, this consolidation trend reflects the direction assessors and auditors are increasingly expecting.
New InfraTrust Report Reveals Infrastructure Flaws Admins Should Patch First
Eclypsium has launched InfraTrust, a new infrastructure-focused cybersecurity knowledge base paired with a monthly InfraTrust Pulse report, designed to help organizations prioritize vulnerabilities in infrastructure firmware, networking gear, and edge devices. The resource is aimed at practitioners who need to triage below-the-OS-layer vulnerabilities that traditional vulnerability scanners often miss. The first report is now available.
Why it matters: Firmware and network infrastructure vulnerabilities are frequently the hardest to track under NIST 800-171's vulnerability management controls — InfraTrust could serve as a useful supplemental resource for prioritizing patching on Nutanix AHV hosts, network switches, and other infrastructure that sits below your standard patch management tooling.