Thursday, August 6, 2026
Daily digest
Today is dominated by critical, actively-exploited vulnerabilities across core infrastructure tooling — TeamCity, Veeam, HashiCorp's Terraform MCP Server, and the Linux kernel's Open vSwitch datapath all received urgent patches or CISA warnings. Prioritize patching cycles this week if any of these are in your stack.
CISA Flags TeamCity CVE-2026-63077 RCE Flaw Under Active Exploitation
CISA confirmed active exploitation of CVE-2026-63077, a CVSS 9.8 deserialization flaw in on-premise JetBrains TeamCity that allows unauthenticated remote code execution against the server. The vulnerability has been patched but organizations running on-prem TeamCity remain at risk if unpatched.
Why it matters: If TeamCity is used anywhere in your CI/CD pipeline for Ansible playbooks or infrastructure code, this is unauthenticated RCE with a public exploit path — patch immediately and check for indicators of compromise, not just apply the fix.
Veeam, Terraform MCP, Django Patch Critical Flaws, Led by CVSS 10.0 Cross-Tenant Bug
HashiCorp, Veeam, and the Django Software Foundation patched 11 vulnerabilities across Terraform MCP Server, Veeam Service Provider Console, and Django. The most severe include a 9.5-rated unauthenticated flaw in Veeam's console exposing managed-agent credentials and a cross-tenant bug in HashiCorp's MCP server allowing Terraform token reuse across users.
Why it matters: Veeam and Terraform are core to most backup and IaC workflows in this environment — the Veeam flaw can expose agent credentials outright, and the Terraform MCP cross-tenant bug is a serious risk if you use shared Terraform Cloud/Enterprise workspaces with Ansible-driven automation.
New OVSwrap Linux Kernel Flaw Lets Local Users Gain Root via Open vSwitch
A memory corruption vulnerability in the Linux kernel's Open vSwitch datapath, tracked as CVE-2026-64531 (CVSS 7.8) and codenamed OVSwrap, allows local privilege escalation to root on default-configured distributions. A public exploit with pre-built records for roughly 800 kernel builds is already circulating.
Why it matters: Open vSwitch underpins networking on many KVM-based virtualization platforms; verify whether Nutanix AHV or associated Linux hosts use OVS and apply kernel patches promptly given the ready-made exploit availability.
Critical Gitea Flaw Let Unauthenticated Attackers Read Server Files via Org-Mode Markup
A critical flaw in self-hosted Git platform Gitea (versions 1.22.1–1.27.0), tracked as CVE-2026-59774 (CVSS 9.8), lets unauthenticated attackers read arbitrary files accessible to the service account using crafted Org-mode markup in a public repository. The issue is fixed in Gitea 1.27.1.
Why it matters: If Gitea is used for internal code or automation repos, this requires no authentication and no write access to exploit — patch immediately and audit for unusual file access.
Kali365 Weaponizes Microsoft Authentication Against US Companies
A phishing kit dubbed Kali365 targets US organizations by abusing Microsoft's legitimate device code authentication flow, tricking victims into approving attacker-controlled device codes on Microsoft's real login page. Once tokens are issued, attackers retain access to email, documents, and cloud resources without needing stolen passwords.
Why it matters: This bypasses password and even some MFA protections by abusing a legitimate OAuth device code flow — worth reviewing Conditional Access policies in M365 GCC High to restrict or monitor device code authentication, which is often overlooked.
Snowflake Hacker Pleads Guilty Over Breaches Affecting at Least 100 Million People
Connor Riley Moucka pleaded guilty in Seattle federal court to computer fraud, wire fraud, aggravated identity theft, and conspiracy charges tied to the 2024 Snowflake customer account breaches. The intrusions affected at least 165 organizations and exposed records for over 100 million people; Moucka personally profited at least $495,000.
Chinese-Made Zbtlink Routers Ship With Backdoor That Opens Unauthenticated Root Shells
VulnCheck disclosed a factory-shipped backdoor present in all 21 available firmware images across at least 20 Zbtlink router models, spanning more than two years of releases. The backdoors start automatically and beacon to Chinese infrastructure; Zbtlink denies the backdoor claim but has paused firmware downloads to address security issues.
Why it matters: Any Zbtlink hardware in the environment (or gray-market/OEM-rebranded variants) should be treated as compromised by design — this is a hard supply-chain fail relevant to any NIST 800-171 supply chain risk assessment.
Thousands of Servers Can Be Backdoored by Exploiting Buggy Motherboard Controllers
Researchers found that baseboard management controllers (BMCs) from major manufacturers contain exploitable flaws that could allow attackers to backdoor server hardware at a low level, beneath the OS and hypervisor. The issues affect a broad swath of enterprise server hardware currently in production.
Why it matters: BMC-level compromise sits below Nutanix AHV and any hypervisor security controls — worth confirming firmware update status and out-of-band management network isolation for hosts in the fleet.
DoD Pulls Independent Testing Office's Public Reports From Its Website
The Department of Defense removed publicly available reports from its Director of Operational Test and Evaluation (DOT&E) office, moving the materials behind a CAC-enabled (Common Access Card) environment. A DoD official described the move as a proactive step to strengthen operational security posture.
Senate Intel Chair Presses Treasury on Tax Incentives for OT Modernization
Senate Intelligence Committee Chair Tom Cotton sent a letter to Treasury Secretary Scott Bessent requesting tax code changes to encourage investment in modernizing aging operational technology (OT) systems to improve cyberattack resilience.
Windows 10 LTSC 2021 Has Five Months Before Security Updates Cost Extra
Microsoft's Windows 10 LTSC 2021 edition begins its Extended Security Updates (ESU) paid meter in January, ending free security patching for that release outside the IoT edition. Organizations still running LTSC 2021 have roughly five months to plan migration or budget for paid ESU coverage.
Why it matters: If any Intune-managed endpoints or specialized/legacy devices still run Windows 10 LTSC 2021, this is a budgeting and migration deadline to track for maintaining continuous patching required under NIST 800-171/CMMC L2.
AWS Partners With Anthropic and OpenAI to Bring AWS Continuum Into Developer Workflows
AWS announced AWS Continuum for code vulnerabilities (Preview), a new offering built with Anthropic and OpenAI models aimed at combining frontier LLMs with deep knowledge of a customer's specific environment for security tooling integrated into developer workflows.