Daily digest

Fastjson 1.x RCE Vulnerability Actively Exploited With No Patch Available

A critical unauthenticated RCE vulnerability (CVE-2026-16723, CVSS 9.0) in Alibaba's Fastjson 1.x Java library is being actively exploited in the wild. Attackers can execute arbitrary code by sending a malicious JSON request to affected Spring Boot applications, inheriting the privileges of the Java process. No patch is currently available for the 1.x branch.

Why it matters: If any Java-based applications in your environment — including self-hosted tools or containerized workloads on AWS GovCloud — depend on Fastjson 1.x, they are exposed with no patch option; audit dependencies now and consider migrating to Fastjson 2.x or an alternative library as an interim control. An actively exploited unpatched RCE in a widely-used library is a material risk under CMMC L2's incident response and configuration management domains.

GitLab RCE PoC Published — Authenticated Users Can Run Commands as Git on Unpatched Servers

Security researchers published working exploit code on July 24 for a GitLab vulnerability patched on June 10 (version 18.11.3). Any authenticated user with push access can exploit the flaw by committing a crafted Jupyter notebook and triggering a heap leak via the commit diff view, ultimately achieving remote code execution as the git system user. Self-managed GitLab instances that have not applied the June 10 update are at risk.

Why it matters: If your environment runs a self-managed GitLab instance — common for Ansible playbook or infrastructure-as-code repositories — verify immediately that you are on a version newer than 18.11.3. A public PoC dramatically lowers the bar for exploitation; any authenticated user, including a compromised insider account, can pivot to the git OS user and potentially access all hosted repositories and CI/CD secrets.

Cl0p Affiliates Exploiting Unauthenticated RCE in PTC Windchill and FlexPLM

Threat actors affiliated with the Cl0p ransomware group are chaining a pre-authentication information disclosure flaw in FlexPLM's WSDL endpoint with a server-side vulnerability in the Windchill login servlet to achieve unauthenticated RCE on internet-exposed deployments. The campaign is focused on data extortion against organizations running PTC's product lifecycle management software. Both flaws are being actively exploited in the wild.

Why it matters: Organizations in defense manufacturing or engineering sectors subject to CMMC L2 frequently run PLM platforms like Windchill to manage CUI-adjacent technical data; if your environment or a key supplier uses internet-exposed PTC Windchill or FlexPLM, treat this as an emergency — verify exposure, apply patches, and review network segmentation immediately.

Malvertising Campaign Assembles Windows Malware Entirely in Browser Memory

A malvertising operation tracked as SourTrade, active since late 2024, delivers a Windows executable by splitting the payload into fragments and using JavaScript to reassemble it in browser memory — bypassing file-based detection. The campaign impersonates TradingView, Solana, and Luno to lure retail traders and uses a legitimate Bun JavaScript runtime as its base component. Confiant detailed the campaign on July 23, 2026.

Why it matters: This technique is specifically designed to evade endpoint detection that relies on scanning files written to disk; ensure your Intune-managed Windows 11 fleet has memory-protection features (e.g., Microsoft Defender's behavior-based detection and Attack Surface Reduction rules) enabled, and review whether users have access to non-work financial or crypto-trading sites from managed devices.

DevMan RaaS Portal Offers Affiliates Full-Service Payload Building and Victim Management

Cybersecurity firm PRODAFT has detailed DevMan, a ransomware-as-a-service platform tracked internally as Funky Mantis, which provides affiliates with a centralized web portal for building custom payloads, managing victim communications, and tracking affiliate earnings and payouts. The platform lowers the operational bar for ransomware campaigns by consolidating previously fragmented capabilities into a single interface.

ClickFix Attacks on Steam Forums Deploy XMRig Cryptominers

Threat actors are posting fake technical support messages in Steam game discussion forums, instructing users to run PowerShell or terminal commands that ultimately install the XMRig Monero cryptominer. The ClickFix social engineering technique abuses users' trust in community-sourced troubleshooting advice. Affected systems show performance degradation as compute resources are hijacked for mining.

Why it matters: ClickFix attacks depend on users willingly executing commands — a risk on any managed Windows endpoint where users have local admin rights or unrestricted PowerShell access. Confirm that Intune policies restrict PowerShell execution to signed scripts and that application control (WDAC or AppLocker) is enforced, particularly on endpoints that may see personal-use browsing.

Real-Time Phishing Operations Now Hijack Insurance Accounts Instantly Instead of Harvesting Credentials

CTM360 research documents a shift in phishing campaigns targeting insurance and financial accounts: rather than harvesting credentials for later use, attacker infrastructure now acts as a real-time proxy, replaying stolen session tokens immediately to bypass MFA and take over accounts before the victim finishes the phishing flow. The technique renders time-delayed credential invalidation ineffective as a defense.

Why it matters: This adversary-in-the-middle technique defeats standard TOTP-based MFA; for M365 GCC High, confirm that Conditional Access policies enforce phishing-resistant MFA (FIDO2 or Windows Hello for Business) rather than relying on authenticator app push notifications, which remain vulnerable to real-time relay.

ShinyHunters Breach Data Recycled Into Targeted $2,000 Sextortion Campaign

Attackers are leveraging email addresses from datasets previously leaked by the ShinyHunters extortion group to send personalized sextortion emails demanding $2,000 in Bitcoin. The emails use victims' real email addresses and, in some cases, partial personal details sourced from the breaches to add credibility. The campaign is ongoing and broad in scale.