opsecsafe — cyber intelligence

2d ago

2026-07-28 11:56Z

HIGH

Introducing Attack Path Management for Entra Agents in BloodHound Enterprise

SpecterOps·specterops.io

SpecterOps released Attack Path Management for Entra Agents in BloodHound Enterprise, extending the attack graph to model AI agent identities, execution contexts, and trust relationships across Microsoft's agent ecosystem (Entra Agent ID, Copilot Studio, Power Automate, Azure AI Foundry). The extension identifies attack paths where low-privileged users can invoke agents that act with higher-privileged identities, public agents bridge anonymous callers to authenticated resources, and agent identity blueprints expose multiple child identities.

TACTA0004TACTA0001SRFIdentityTACTA0003SRFCloudSWBloodhoundSWEntraSWAzure Ai Foundry

Edit Score

2d ago

2026-07-28 11:50Z

INFO

Designing an MCP Server for AI Agents: Why Wrapping Your API Is the Wrong Abstraction

SpecterOps·specterops.io

SpecterOps published a technical design essay on building Model Context Protocol (MCP) servers for AI agents, using BloodHound Hunter as a case study. The post argues that MCP servers should be designed around agent intent and workflow rather than wrapping existing REST APIs, emphasizing interface design principles like reducing cognitive load and hiding implementation complexity.

SRFApplicationTACTA0007SWBloodhoundVNDSpecteropsTYPResearchTECT1087

Edit Score

2d ago

2026-07-28 11:50Z

INFO

Attack Path Management Comes to AWS

SpecterOps·specterops.io

SpecterOps announced AWS IAM attack path management capabilities in BloodHound Enterprise, extending the platform's identity graph analysis to AWS environments. The release models IAM, Organizations, STS, S3, KMS, Lambda, EC2, CloudFormation, EKS, and SSM resources to visualize privilege escalation chains, cross-account trust relationships, and lateral movement paths across AWS organizations.

TACTA0006SRFIdentitySRFCloudTACTA0008SWBloodhoundSWAwsVNDAmazonTYPTool

Edit Score

2d ago

2026-07-28 11:50Z

HIGH

Expanding attack path management to the AI frontier

SpecterOps·specterops.io

SpecterOps announced new BloodHound Enterprise features for AWS attack path management and Entra Agent ID support, enabling defenders to visualize privilege escalation and lateral movement chains across hybrid cloud, SaaS, and AI agent identities. The update models 20+ AWS resource types and 150+ relationships (IAM, Lambda, S3, KMS, cross-account trust, PassRole abuse) and introduces BloodHound Hunter, an MCP interface that connects approved AI agents to attack path findings for automated remediation prioritization.

TACTA0006SRFIdentitySRFCloudTACTA0008SWBloodhoundSWEntraSWGithubSWAws

Edit Score

2d ago

2026-07-28 11:00Z

INFO

How we use /goal to find bugs in Patch the Planet

Trail of Bits·blog.trailofbits.com

Trail of Bits describes their methodology for using Codex's /goal feature (goal-based prompting) to systematically discover bugs in widely-audited open-source projects including Rust, curl, and zlib as part of the Patch the Planet initiative. The post details three core techniques: leveraging Codex to write its own goal prompts, defining outcomes rather than prescribing paths, and assigning one outcome per agent to avoid optimization conflicts. They report finding critical vulnerabilities including a Rust soundness hole, 11 variant CVE hits via Semgrep rules, and high-severity privilege-escalation bugs in Keycloak's SAML component.

SRFApplicationTACTA0043TYPResearchTYPToolSTGDiscoveryTECT1592

Edit Score

2d ago

2026-07-28 10:16Z

CRIT

CVE-2026-16462 — PROCON: This allows a remote unauthenticated attacker to execute arbitrary SQL commands.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-16462

In PROCON-WEB SCADA the endpoint 'GetGridData' is not properly sanitized. This allows a remote unauthenticated attacker to execute arbitrary SQL commands. CVSSv3.1 9.8 (CRITICAL)

CWECWE 89VNDProconTYPVulnerability

9.8

CVSS v3.1

Edit Score

2d ago

2026-07-28 10:16Z

HIGH

CVE-2026-14328 — Eazy: The Eazy Plugin Manager – Powerful Plugin Management Solution for WordPress plugin for WordPress

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-14328

The Eazy Plugin Manager – Powerful Plugin Management Solution for WordPress plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.4.1. This is due to insufficient authorization on the `wp_ajax_pos_get_option` AJAX handler, which verifies only a nonce that is localized to every logged-in admin-area user via `admin_enqueue_scripts` — without any capability check — before returning the value of any arbitrary WordPress option via `get_ CVSSv3.1 8.8 (HIGH)

CWECWE 269VNDEazyTYPVulnerability

8.8

CVSS v3.1

Edit Score

2d ago

2026-07-28 10:16Z

CRIT

CVE-2026-11841 — Additionally, exposure of the custom application directory may allow execution of arbitrary Lua code

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-11841

An attacker may perform unauthenticated read and write operations on sensitive filesystem areas via the AppEngine Fileaccess over HTTP due to improper access restrictions. A critical filesystem directory was unintentionally exposed through the HTTP-based file access feature, allowing access without authentication. This includes device parameter files, enabling an attacker to read and modify application settings, including customer-defined passwords. Additionally, exposure of CVSSv3.1 9.4 (CRITICAL)

CWECWE 552TYPVulnerability

9.4

CVSS v3.1

Edit Score

2d ago

2026-07-28 09:16Z

HIGH

CVE-2026-14169 — Due to incorrect behavior order a low privileged remote attacker could trigger account inconsistent

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-14169

Due to incorrect behavior order a low privileged remote attacker could trigger account inconsistent state via crafted input and overwrites existing user passwords which could result in complete administrative unavailability of the device. CVSSv3.1 8.1 (HIGH)

CWECWE 696TYPVulnerability

8.1

CVSS v3.1

Edit Score

2d ago

2026-07-28 09:16Z

HIGH

CVE-2026-14168 — A low privileged remote attacker can gain administrator privileges due to missing authorization at

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-14168

A low privileged remote attacker can gain administrator privileges due to missing authorization at the insert path of the configuration table resulting in gaining full system access. CVSSv3.1 8.8 (HIGH)

CWECWE 862TYPVulnerability

8.8

CVSS v3.1

Edit Score

2d ago

2026-07-28 09:16Z

HIGH

CVE-2026-14167 — A low privileged remote attacker can perform privileged configuration changes reserved for the administrator

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-14167

A low privileged remote attacker can perform privileged configuration changes reserved for the administrator level including permission management due to incorrect authorization. CVSSv3.1 8.8 (HIGH)

CWECWE 863TYPVulnerability

8.8

CVSS v3.1

Edit Score

2d ago

2026-07-28 08:17Z

CRIT

CVE-2026-15014 — SMS: The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-15014

The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnerable to Authentication Bypass leading to Account Takeover in all versions up to, and including, 3.9.7 via the `billing_phone` parameter. This is due to the `processRegistration()` function using a phone-unbound `$_SESSION['sa_mobile_verified']` boolean flag as the sole gate before issuing an authentication cookie — the flag is set to `true` after any successf CVSSv3.1 9.8 (CRITICAL)

CWECWE 288VNDSmsTYPVulnerability

9.8

CVSS v3.1

Edit Score

2d ago

2026-07-28 08:17Z

CRIT

CVE-2026-11756 — Deserialization: A Deserialization of Untrusted Data vulnerability affecting Station Launcher App in 3DEXPERIENCE platform from

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-11756

A Deserialization of Untrusted Data vulnerability affecting Station Launcher App in 3DEXPERIENCE platform from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2026x could lead to an unauthenticated remote code execution. CVSSv3.1 10.0 (CRITICAL)

CWECWE 502TYPVulnerability

10.0

CVSS v3.1

100

Edit Score

2d ago

2026-07-28 08:00Z

HIGH

Mirage Kitten targets Middle East and Africa region with new malware

Kaspersky Securelist·securelist.comin the wild

Kaspersky researchers documented a previously undisclosed malware toolkit attributed to Mirage Kitten (UNC1549/Smoke Sandstorm/Nimbus Manticore) targeting aerospace, aviation, defense, and telecom sectors across the Middle East and Africa. The toolkit comprises NightLedger (a Windows backdoor using DLL search-order hijacking), BridgeHead, and ArcBridge (two custom WebSocket-based SOCKS5 tunnelers with per-target username validation and enterprise proxy traversal logic). Victims span Egypt, Jordan, Tanzania, Pakistan, Ethiopia, and Burkina Faso, with initial access via spear-phishing using recruitment-themed lures and lookalike videoconferencing pages.

SRFOsTACTA0004TACTA0001TACTA0002SRFNetworkTACTA0003TACTA0008TACTA0011

Edit Score

2d ago

2026-07-28 07:16Z

CRIT

CVE-2026-14545 — TrueBooker: The TrueBooker WordPress plugin before 1.2.4 does not validate account ownership when resetting a

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-14545

The TrueBooker WordPress plugin before 1.2.4 does not validate account ownership when resetting a user's password through one of its front-end account handlers, allowing unauthenticated attackers to set an arbitrary password on any account, including an administrator, and take over the site. CVSSv3.1 9.8 (CRITICAL)

CWECWE 269VNDTruebookerTYPVulnerability

9.8

CVSS v3.1

Edit Score

2d ago

2026-07-28 00:00Z

HIGH

Chaos in Teams vishing

Sophos X-Ops·news.sophos.comin the wild

Sophos X-Ops tracked STAC4749, a financially motivated threat group conducting Microsoft Teams vishing campaigns (February–June 2026) targeting North American organizations across services, manufacturing, energy, and construction sectors. The group deployed a custom modular malware chain (Python backdoor, Golang implants, reverse SOCKS proxy) for persistence and lateral movement, ultimately facilitating Chaos ransomware deployment in at least three incidents with sub-17-hour dwell times. The campaign demonstrated rapid tactical iteration—switching from Quick Assist to RemSupp RMM, rotating malware filenames, and evolving registry persistence mechanisms—indicating operational maturity and financial motivation.

SRFApplicationTACTA0005TACTA0001TACTA0003SRFCloudTACTA0011SWChaosSWMicrosoft Teams

Edit Score

2d ago

2026-07-27 22:16Z

CRIT

CVE-2021-32088 — Quest: An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2021-32088

An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273. Certain API endpoints contain a rate-limiting feature to minimize a brute-force attack. This protection can be bypassed by removing the kboxid cookie. CVSSv3.1 9.8 (CRITICAL)

CWECWE 384VNDQuestTYPVulnerability

9.8

CVSS v3.1

Edit Score

2d ago

2026-07-27 22:16Z

HIGH

CVE-2021-32087 — Quest: This allows remote attackers to trivially gain privileged access to the FTP service interface

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2021-32087

An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273. It installs with default user credentials. The kbftp account has a password of getbxf, which is publicly known and documented. This allows remote attackers to trivially gain privileged access to the FTP service interface, which contains MySQL backups. Sensitive information is stored in the database, such as privileged credentials for other systems. CVSSv3.1 8.8 (HIGH)

CWECWE 798VNDQuestTYPVulnerability

8.8

CVSS v3.1

Edit Score

2d ago

2026-07-27 22:16Z

CRIT

CVE-2021-32086 — Quest: An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2021-32086

An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273. It uses a hardcoded symmetric encryption key to encrypt secrets in the MySQL databases. (This key is not unique for each installation.) An attacker that gains access to the MySQL server or a backup files can decrypt the secrets. Often, the decrypted secrets can be used to escalate privileges within KACE, or gain privileged access to unrelated systems or services. CVSSv3.1 9.8 (CRITICAL)

CWECWE 321VNDQuestTYPVulnerability

9.8

CVSS v3.1

Edit Score

2d ago

2026-07-27 22:16Z

HIGH

CVE-2021-32085 — Quest: This allows remote attackers to trivially gain privileged access to the MySQL databases.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2021-32085

An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273. It installs with default user credentials. The report and R1 MySQL accounts have a password of box747, which is publicly known and documented. This allows remote attackers to trivially gain privileged access to the MySQL databases. Sensitive information is stored in the database, such as privileged credentials for other systems. CVSSv3.1 8.8 (HIGH)

CWECWE 798VNDQuestTYPVulnerability

8.8

CVSS v3.1

Edit Score

2d ago

2026-07-27 22:16Z

CRIT

CVE-2021-32084 — Quest: An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2021-32084

An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273. If a customer restricts access to the web console by IP address or subnets, the API endpoints are not restricted. If credentials/API keys are known to an attacker, the appliance can still be accessed via the API, leading to a potential compromise of the entire environment that is configured for KACE. CVSSv3.1 9.8 (CRITICAL)

CWECWE 284VNDQuestTYPVulnerability

9.8

CVSS v3.1

Edit Score

3d ago

2026-07-27 21:17Z

HIGH

CVE-2026-64783 — A use-after-free issue was addressed with improved memory management.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-64783

A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.6, iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, visionOS 26.6, watchOS 26.6. Processing maliciously crafted web content may lead to an unexpected Safari crash. CVSSv3.1 8.8 (HIGH)

CWECWE 416TYPVulnerability

8.8

CVSS v3.1

Edit Score

3d ago

2026-07-27 21:17Z

CRIT

CVE-2026-64775 — A memory initialization issue was addressed with improved memory handling.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-64775

A memory initialization issue was addressed with improved memory handling. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. An app may be able to cause unexpected system termination. CVSSv3.1 9.8 (CRITICAL)

CWECWE 665TYPVulnerability

9.8

CVSS v3.1

Edit Score

3d ago

2026-07-27 21:17Z

CRIT

CVE-2026-64774 — An integer overflow was addressed with improved input validation.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-64774

An integer overflow was addressed with improved input validation. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6. A remote attacker may be able to cause unexpected application termination or heap corruption. CVSSv3.1 9.8 (CRITICAL)

CWECWE 190TYPVulnerability

9.8

CVSS v3.1

Edit Score

3d ago

2026-07-27 21:17Z

CRIT

CVE-2026-64772 — An out-of-bounds write issue was addressed with improved input validation.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-64772

An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6. A remote attacker may be able to cause unexpected application termination or heap corruption. CVSSv3.1 9.8 (CRITICAL)

CWECWE 787TYPVulnerability

9.8

CVSS v3.1

Edit Score

Latest intel// live feed

Introducing Attack Path Management for Entra Agents in BloodHound Enterprise

Designing an MCP Server for AI Agents: Why Wrapping Your API Is the Wrong Abstraction

Attack Path Management Comes to AWS

Expanding attack path management to the AI frontier

How we use /goal to find bugs in Patch the Planet

CVE-2026-16462 — PROCON: This allows a remote unauthenticated attacker to execute arbitrary SQL commands.

CVE-2026-14328 — Eazy: The Eazy Plugin Manager – Powerful Plugin Management Solution for WordPress plugin for WordPress

CVE-2026-11841 — Additionally, exposure of the custom application directory may allow execution of arbitrary Lua code

CVE-2026-14169 — Due to incorrect behavior order a low privileged remote attacker could trigger account inconsistent

CVE-2026-14168 — A low privileged remote attacker can gain administrator privileges due to missing authorization at

CVE-2026-14167 — A low privileged remote attacker can perform privileged configuration changes reserved for the administrator

CVE-2026-15014 — SMS: The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart

CVE-2026-11756 — Deserialization: A Deserialization of Untrusted Data vulnerability affecting Station Launcher App in 3DEXPERIENCE platform from

Mirage Kitten targets Middle East and Africa region with new malware

CVE-2026-14545 — TrueBooker: The TrueBooker WordPress plugin before 1.2.4 does not validate account ownership when resetting a

Chaos in Teams vishing

CVE-2021-32088 — Quest: An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273.

CVE-2021-32087 — Quest: This allows remote attackers to trivially gain privileged access to the FTP service interface

CVE-2021-32086 — Quest: An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273.

CVE-2021-32085 — Quest: This allows remote attackers to trivially gain privileged access to the MySQL databases.

CVE-2021-32084 — Quest: An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273.

CVE-2026-64783 — A use-after-free issue was addressed with improved memory management.

CVE-2026-64775 — A memory initialization issue was addressed with improved memory handling.

CVE-2026-64774 — An integer overflow was addressed with improved input validation.

CVE-2026-64772 — An out-of-bounds write issue was addressed with improved input validation.