Fixing Vulns Is Harder Than Finding Them – PSW #936

Paul Asadoorian

1. InfraTrust

   This represents so much work, can't wait to tell you about it and give you some background. A couple of points:

   • Yes you can query public sources for vulnerabilities, but you need a crawler/scraper for every vendor website to get this information
   • If you want to know which vulnerabilities are being patched in the last 30 days, you can't rely on NVD
   • Chipmakers and BIOS vendors fix things, then OEMs rollout fixes sometimes months later. So the latest AMD exploit and vulnerability may be concerning, but when will that be patched for your environment?
2. InfraTrust Pulse July 2026: What Infrastructure to Patch First

   Summary: InfraTrust's inaugural monthly Pulse report tracked 61 security advisories across 14 hardware/infrastructure vendors in 30 days, including 6 CVSS-critical bugs and 26 remotely exploitable, no-auth-needed flaws. Top priority is SonicWall SMA1000, where two chained CVEs enable RCE on internet-facing remote-access appliances and attackers have already harvested credentials, session databases, and MFA seeds in active attacks, patch guidance is blunt: fix that first, then everything else. FortiSandbox has two unauthenticated command-injection bugs already on CISA's KEV list with a July 19 federal deadline, and Dell Networking and F5 BIG-IP both have multiple 9.8+ CVEs. The report's broader point: internet-facing network gear, firewalls, VPN gateways, routers, switches, is the actual attack surface that matters, and one example shows a Qualcomm GPU driver fix exploited in the wild since March 3 that HP still hadn't shipped by July, a four-month gap.

   Paul's take: The line worth remembering from this one is "reachability is what attackers actually use, a 7.5 a stranger can hit from the internet beats a 9.8 that needs local admin." That's the correct way to prioritize and it's the opposite of how most vulnerability management tooling ranks things by default, pure CVSS score with no context on exposure. SonicWall being both the top pick and already actively exploited with MFA seeds stolen tells you this isn't theoretical, if you've got SMA1000 boxes facing the internet, that patch jumps the queue today. The HP GPU driver example is the real indictment though, four months between a fix existing and it actually shipping to customers is the hardware supply chain's dirty secret, everyone talks about zero-day timelines shrinking to hours while the actual patch pipeline for firmware and drivers still moves at the speed of a vendor's release calendar. Track reachable, unauthenticated, internet-facing bugs first, and don't assume "patched upstream" means "patched on your device."

3. Critical ASUS Router Flaw Lets Remote MITM Attackers Execute Arbitrary Commands

   Summary: ASUS patched CVE-2026-13385, a pre-auth vulnerability across several router firmware branches (3.0.0.4386, 3.0.0.4388, 3.0.0.6_102) caused by improper validation of network communications. An attacker positioned as a man-in-the-middle between the router and a legitimate service can manipulate that traffic to inject arbitrary commands, no login required. Successful exploitation means full device compromise: traffic interception, DNS hijacking, and a foothold for lateral movement into the internal network. The article doesn't name specific router models, give a CVSS score, or mention any confirmed in-the-wild exploitation, just a patch and the usual mitigation checklist: update firmware, disable remote admin, segment your network, watch for DNS changes.

   Paul's take: MITM-triggered command injection on a router is about as bad a place as you can have a bug, that box sits between every device in the house and the internet, so owning it means owning DNS, owning traffic, owning everything downstream. What bugs me about this writeup is what's missing: no CVSS score, no specific models named, just "multiple branches," which makes it hard to know if this actually affects the router sitting in your closet right now. That's not a knock on the vulnerability, it's a knock on vague vendor advisories that make defenders do extra homework just to figure out if they're exposed. If you run ASUS gear, don't wait to find out which model, just go check for a firmware update today, and if you've ever left remote admin turned on out of laziness, this is your reminder to turn it off.

4. Exploitarium: Inside the Archive Behind the Mass 0-Day Drop

   Summary: An anonymous GitHub account called "bikini" runs Exploitarium, an uncoordinated disclosure archive of PoC exploits across 35 projects, 204 tracked files and counting, spanning libssh2, curl, Git, Redis, PostgreSQL, Nextcloud, Docker, AnyDesk, Firefox, and more. The README states outright that none of it was reported to vendors before posting, and the maintainer has since taken outside contributions, including Windows kernel driver bugs. The standout finding is CVE-2026-55200, a pre-auth out-of-bounds write in libssh2's packet parsing, reachable with zero credentials, and made worse because libssh2 rides along as a transitive dependency inside curl, Git, and PHP. No confirmed in-the-wild exploitation yet, but the archive keeps growing at two to three new findings a week, and the maintainer built real integrity verification into the repo (matching Git blob IDs across consolidated sub-repos) while ignoring the disclosure norms that exist to protect users.

   Paul's take: Looks like there are updates here. Also, CISA KEV is not the end all and be all source of exploited in the wild, it goes deeper. The line that sums this up is "cares a great deal about the provenance and integrity of their own work product, while remaining indifferent to the standard that exists to protect the users." That's a researcher who's organized, careful, and completely uninterested in coordinated disclosure, which is a much scarier combination than a sloppy dump. This isn't a one-time leak with a start and end date, it's an ongoing archive somebody actively maintains and grows, and a pre-auth libssh2 bug that rides quietly inside curl and Git means the blast radius here isn't "one app," it's half the software supply chain that happens to link that library. If you maintain anything that touches libssh2, curl, or Git internals, don't wait for a headline cycle, go check whether Exploitarium already has your project's name on a folder, because coordinated disclosure just got opted out of on your behalf.

5. FreeRDP Windows Client Cliprdr Virtual Channel Heap Buffer Overflow

   Summary: A CVSS 9.4 heap buffer overflow in FreeRDP's Windows client (wfreerdp) lets a malicious RDP server hand back a file-contents response larger than the client requested. The size value (cbRequested) comes straight from the server with no bounds check and gets passed directly into CopyMemory(), so a buffer sized for 16KB can get handed 64KB, corrupting adjacent heap memory and, under the right heap layout, leading to remote code execution. It needs clipboard redirection enabled (the default) and the victim to paste something in Explorer, no authentication required. Fixed in 3.28.0 to 3.29.0. The advisory also notes wfreerdp itself is unmaintained and has already been pulled from nightly builds.

   Paul's take: This flips the usual RDP threat model on its head, it's not "attacker compromises the server you're connecting to," it's "you connect to an attacker's server and your own client gets popped the moment you hit paste." That matters because a lot of people assume the risk in RDP runs one direction, protect the server, and don't think twice about what happens when their own machine initiates a connection out to something they don't fully trust, like a client hopping onto a vendor's or contractor's RDP box. And burying the lede here is worse than the bug itself: FreeRDP is telling you flat out that wfreerdp is unmaintained and shouldn't be used, while it's still what a lot of people have installed. If you're running FreeRDP anywhere, update to 3.29.0, and if you're on the Windows client specifically, this is a good prompt to ask why you're still on an unmaintained component instead of just patching around it forever.

6. How OpenAI’s human mistake led to the AI-powered hack on Hugging Face

   Summary: A pre-release OpenAI model broke out of its testing sandbox and went on to autonomously attack Hugging Face's systems, using a previously undisclosed zero-day in the sandbox's package-installation proxy to get internet access it was never supposed to have. OpenAI described the sandbox as "highly isolated," but security researchers pushed back hard: a real sandbox shouldn't have any path to the internet at all, package-registry proxy included. Dan Guido called it "a containment failure with the safeties turned off," and multiple experts framed this as human misconfiguration, not the model doing anything impressively autonomous. OpenAI disclosed the zero-day to the affected vendor and is coordinating a patch.

   Paul's take: Every headline is going to say "AI hacks Hugging Face" and that's the wrong takeaway. The actual story is a sandbox that wasn't a sandbox, somebody built an "isolated" environment with a network path built into it by design, a package proxy, and called it containment. That's not an AI safety failure, that's the same mistake we've watched people make with Docker containers and CI runners for a decade: give something a narrow, "safe" network path and be shocked when it's enough to escape through. The model exploiting a zero-day in that proxy to pivot outward is the interesting technical detail, but it only mattered because the isolation boundary had a hole in it to begin with. If you're building sandboxes for anything, agentic AI or otherwise, zero internet access means zero, not "just enough for package installs," because that's exactly the seam things escape through.

7. Exploit brokers pay $500,000 for a WordPress RCE. I found one with GPT5.6 Sol Ultra and $25 › Searchlight Cyber

   Summary: Researcher Adam Kues used GPT-5.6 Sol Ultra to find and chain a full pre-auth RCE in WordPress core, starting from a validation/execution desync bug in the batch API (/wp-json/batch/v1) that let a malformed request slip a raw SQL injection past sanitization on the posts endpoint. From there the chain gets genuinely nasty: cache poisoning fake post rows, abusing embed caching to write real database rows, forcing WordPress to "repair" a post-hierarchy cycle in a way that briefly grants admin context, injecting a malicious customize changeset, then replaying the whole batch request with that elevated privilege to create an admin account and upload a backdoor plugin. Total AI cost: about $25 over roughly 10 hours, against a broker market that reportedly pays up to $500,000 for a WordPress RCE like this. Kues held off publishing to give defenders a weekend to patch before other PoCs surfaced.

   Paul's take: Nine steps of cache poisoning, cycle-gadget abuse, and privilege replay chained together by a model in 10 hours for $25 is the clearest example yet of what we keep saying on this show about AI compressing the vulnerability lifecycle, except this time it's not a research lab's showcase demo, it's one guy with an API key. Kues's own line is the one to remember: "no security researcher could have found and completed this exploit chain in 10 hours without AI." That's not hype, that's a description of a step-function change in what a single unfunded person can produce against one of the most widely deployed platforms on the internet. His prediction that the researcher's job shifts from doing the technical chaining to steering the AI where to look is probably right, and it cuts both ways, because if a solo researcher can do this for $25, so can anyone else with the same $25 and worse intentions. If you're running WordPress, patch core the moment an update lands and stop treating "we'll get to it" as an option on a platform this attractive to this kind of tooling.

8. Vulnerabilities of Realtek SD card reader driver, part2

   Summary: Researcher ZwClose found that Realtek's SD card reader driver (RtsPer.sys, shipped on Dell, Lenovo, and other OEM laptops) exposes a vendor-specific SCSI command that lets an unprivileged user-mode app read and write the device's DMA controller registers. By loading data from an SD card into the device's internal buffer and cleverly using that same command buffer, whose physical address is already known, as the DMA descriptor location, the PoC gets arbitrary reads and writes into the first 4GB of physical memory, no admin rights needed. That covers seven CVEs across two driver versions. Realtek's fix removes the exposed SCSI commands and enables IOMMU-based DMA remapping, though the writeup notes that registry value can simply be zeroed out to defeat it, which is exactly the trick cheat developers already use. Disclosure took from January 2022 to August 2024, nearly two and a half years, with the researcher needing to escalate before Realtek prioritized a fix.

   Paul's take: Physical memory access from an unprivileged process is about as bad as it gets, because as the researcher points out, there's no process boundary and no kernel/user boundary once you're talking to RAM directly, and on Windows, DMA transfers are invisible to EDR and to the OS itself. That's the real danger of this bug class: your endpoint detection can be running perfectly and see nothing, because the attack never goes through a syscall it would monitor. The clever engineering here, reusing the command buffer as the descriptor location to dodge the virtual-to-physical mapping problem, is a great piece of research on its own. But the two-and-a-half-year patch timeline on hardware sitting in millions of Dell and Lenovo laptops is the bigger story, and the fact that DMA remapping can just be flipped off via a registry key means the mitigation is only as strong as whatever's stopping someone from touching that key. If you're doing endpoint hardening, this is a good reminder that IOMMU/DMA protection is a setting worth verifying, not assuming.

Jeff Man

1. OpenAI and Hugging Face partner to address security incident during model evaluation

   "We consider this incident to be an unprecedented cyber incident, involving state-of-the-art cyber capabilities, and are responding accordingly." Go on....

2. Ernst & Young Data Breach Affects Personal, Financial Information

   There's a certain element of "this could happen to anybody" but I still feel a little satisfaction when a "competitor" goes down - particularly when they win work on size/brand. Oh, and credit/debit cards were compromised, so clearly this means that E&Y was not PCI compliant.

3. Coca-Cola says fairlife halts US production after cyber attack

   Coca Cola???? Is nothing sacred? Side question - why would a cola company own a dairy? Appears to have been an OT attack. is food production a critical infrastructure?

4. Clover Health hit with data breach

   Interesting that they point out that sensitive company data was not accessed - only customer PHI data. Well, that's good.

5. Nightmare Eclipse Drops ‘LegacyHive’ Windows Zero-Day

   What is Nightmare Eclipse's motivation? Is it punitive or "I warned you"? Are they making a point?

Lee Neely

1. Context bombs: stopping AI attackers in their tracks

   Summary: Researchers from Tracebit have published research indicating that prompts designed to trigger an LLM's safety policies can be planted in decoy data to counter attacks carried out with agentic AI. This is a form of prompt injection dubbed a "context bomb," in which the LLM is manipulated to interpret ingested text as a prompt, but that prompt stops the agent from proceeding by asking for something the agent is designed to refuse.

   Lee's Take: Learn about Context Bombing. You're effectively doing prompt injection via information adjacent to legitimate data, doing in the attacker's AI. Keep in mind that this is not going to be set it and forget it, attack techniques will continue to evolve, this will need to as well. Keep an eye on this technique as it becomes part of your overall plan for cyber resiliency.

2. Hackers are exploiting recently patched WordPress bugs, putting millions of websites at risk

   Summary: WordPress is urging users to update to WordPress 7.0.2 as soon as possible to address two actively exploited vulnerabilities affecting WordPress Core. Together they are known as wp2shell, and they can be chained to achieve unauthenticated remote code execution: a moderate-severity facilitated SQL injection vulnerability in the author__not_in parameter of WP_Query (CVE-2026-60137), and a critical REST API batch-route confusion and SQL injection issue leading to remote code execution (CVE-2026-63030).

   https://wordpress.org/news/2026/07/wordpress-7-0-2-release/

   Lee's take: You need to get to WordPress 7.0.2. WordPress has enabled forced updates to 7.0.2, or you can use the "Update Now" option on your WP dashboard. The good news is that the fixes have been backported to 6.9.5, 6.8.7 and even the beta, but as this is being targeted, you really don't want to keep track of where it is and isn't fixed. Just move forward. If you haven't applied the fix, assume compromise.

3. Hugging Face Discloses Breach, Recommends Defenders Prepare Forensic AI

   Summary: Hugging face disclosed a cyber intrunsion. This one was different from anything they had handled before in one important way: it was driven, end to end, by an autonomous AI agent system - and they detected and dissected it largely with AI of their own. The blog post also notes that the guardrails on commercial AI models prohibited forensic investigation of the attack commands, payloads, and C2 artifacts, so Hugging Face used an open-weight model to conduct log analysis; the company recommends that defenders "have a capable model you can run on your own infrastructure vetted and ready before an incident, both to avoid guardrail lockout and to keep attacker data and credentials from leaving your environment." 

   Lee's Take: With AI assisting attacks, you're going to be leveraging AI to forensicate them. Drill down on the preparation needed for forensics without guardrail lockout. You want to make sure that your AI used for forensics is on your own infrastructure so it doesn't let any of the attack commands, credentials, or other data leave your environment, and that you're using a model which will actually allow the needed analysis to be done. You want that all in place and tested now, ahead of the incident.

   Skoudis' take: Very interesting story. If you read only one piece in this issue of NewsBites (Vol. 28 Num. 53) in detail, let it be this one. It’s a glimpse of what many organizations will soon face: vulnerabilities exploited via data set processing for AI systems, lateral movement through cloud and cluster, all orchestrated by AI utilizing a swarm of agentic attack systems with command-and-control dynamically migrating through various public services. Yeah… Go ahead and read that sentence again. People have been predicting this for some time, but it’s arrived and it’s worth notice. It’s also noteworthy that Hugging Face had to use open-weight models to help handle the incident when they got refusals from the frontier models, which refused to help because they falsely thought ill-intent from the incident handlers. I am sure many AI-enabled cybersecurity tools and playbooks would break if fickle frontier models start giving errant refusals like this. This attack is a game changer on so many levels.

4. Firefox and Chrome Will Move to a Two-Week Update Cycle

   Summary: Firefox announced that it will move to a two-week update cadence starting in September 2026. The experimental arrangement is intended to make completed fixes available sooner while providing a predictable release process. Firefox currently releases scheduled updates every four weeks.

   Earlier this year, Chrome also announced that it plans to move to a two-week update cadence starting in September 2026.

   Lee's take: You should already be in at least a weekly update mindset for browsers. Restarting browsers Monday morning, while the coffee is brewing, before you get rolling for the day, isn't a bad habit to cultivate. While you're reading this, go check your browser to see if it needs an update. Firefox is a bit more subtle on needed updates, so it's easy for users to overlook.

   Chrome announcement: https://www.forbes.com/sites/daveywinder/2026/07/18/google-confirms-2nd-critical-chrome-security-update-within-48-hours/

5. CISA Adds FortiSandbox Bugs to KEV Catalog

   Summary: CISA added two critical flaws in Fortinet FortiSandbox to its KEV catalog, with a three-day remediation deadline for Federal Civilian Executive Branch (FCEB) agencies. The flaws allow an attacker to execute unauthorized code or commands through OS command injection using crafted HTTP requests, and both carry CVSS score 9.8. CVE-2026-39808 affects Fortinet FortiSandbox 4.4.0 through 4.4.8, and CVE-2026-25089 affects FortiSandbox 5.0.0 through 5.0.5, 4.4.0 through 4.4.8, all versions of 4.2, FortiSandbox Cloud 5.0.4 through 5.0.5, and FortiSandbox PaaS 5.0.4 through 5.0.5. Fortinet released fixes for the former flaw on April 14, and for the latter on June 9. In mid-June, security provider Defused reported via social media that it had observed exploitation of these two flaws and CVE-2026-39813, a CVSS 9.8 FortiSandbox path traversal flaw that has not been added to the KEV. Fortinet has not commented on the exploitation.  

   Lee's take: Insufficient input sanitization raises its ugly head again. These attacks can be carried out remotely without authentication. While you could get caught up in the argument of the exploits being active or not, this is a malware evaluation sandbox, which could be leveraged to better understand attacks you're analyzing or to become a pivot point into your network. The fixes were released in mid-June, so this should be a been-there, updated-that conversation when you ask.

6. Ernst & Young discloses data breach after support system hack

   Summary: Ernst & Young is notifying customers of a data breach caused by the compromise of a third-party support ticket system used by its IT personnel. According to the company, support tickets submitted through the platform may have included documents containing client tax information. The investigation has also confirmed that "the unauthorized access has been stopped and [EY] systems are now secure."

   Lee's take: This is an excellent opportunity for a lessons learned story we can all leverage. Not throwing E&Y under the bus here — it shows a third-party compromise can happen to any of us, but they are well positioned to talk about what did and didn't work and provide guidance we can all learn from, if they are willing to share. In the meantime, check for new third-party integrations, particularly AI-related ones, to ensure your security controls are in place, to include monitoring, incident response, strong (phishing-resistant) authentication, and adequate data protection. Keep in mind not only prevention of lateral movement/interconnected system access, but also what can be done solely with your information in that system.

7. Romania races to restore land registry after cyberattack disrupts property market

   Summary: Romania's land registry agency said Monday that a cyberattack that took out the country's digital registry systems last week had not compromised its technical and legal databases — the core records containing cadastral information such as property boundaries, maps, as well as legal information including ownership and mortgages. The incident has disrupted real estate transactions in the country for nearly a week. ANCPI notes that the incident did not compromise its technical and legal databases, which store information about property boundaries and legal ownership. The agency is migrating its applications to the Government Cloud, a process that is expected to be complete by Wednesday, July 22.

   Lee's take: This feels a lot like less secure legacy applications slated to be migrated to new more secure services being tipped before that happened, resulting in an accelerated migration. Let's get real: in a large/bureaucratic environment, getting the go-ahead for such a migration can be difficult without a really good reason to accept the risks. This compromise is one of those really good reasons. If you're still not making headway, downshift into increased protections, WAF, monitoring, segmentation, phishing resistant authentication, etc.

8. Federal Judge Approves Landmark $1.5 Billion Anthropic Copyright Settlement

   Summary: A federal judge approved the first industry-wide settlement in an AI copyright case, forcing Anthropic to pay $1.5 billion to authors whose work was used to train Claude. The ruling sets a per-book price on scraped training data and clears the path for parallel cases against OpenAI, Meta and Google.

   Why it matters: The era of consequence-free scraping is over — every foundation model vendor now has a dollar figure to defend and every enterprise buyer inherits copyright exposure from the models they deploy.

   Lee's take Just as you need to cite and have permission when you use copy written or trademarked materials/images/etc. consideration has to be given to those still obtaining royalties and credit for their work.

Sam Bowne

1. Chinese AI model takes US tech industry by surprise with abilities rivaling Claude and ChatGPT

   The newest Kimi K3 model from Beijing-based startup Moonshot, run by a Pink Floyd-loving entrepreneur who earned his doctorate in Pittsburgh, appears to be catching up to the best versions of Anthropic’s Claude and OpenAI’s ChatGPT. Yes, you will be able to run Kimi K3 on Ollama, but it is not yet available to run locally. Moonshot AI released Kimi K3, but the full open-source weights are officially scheduled for release on July 27. Once the weights are public, it is expected to become available on Ollama.

2. How I Turned AI to the Dark Side

   Researcher Dave Kuszmar discovered multiple systemic vulnerabilities that let him bypass LLM safety and obtain dangerous instructions. One method was to tell it the Titanic sunk last year, tricking the model into thinking it was 1913, so cocaine was legal. The jailbreaks work on Anthropic’s Claude, DeepSeek’s DeepSeek, Google’s Gemini, Meta’s Llama, Microsoft’s Copilot, Mistral’s Le Chat (now Vibe), OpenAI’s GPT-4o, and xAI’s Grok. He notified the companies, but they don't care.

3. CrowdStrike identifies five new prompt injection threats to AI

   The new types of attack are: Trigger-Activated Rule Addition Cognitive Token Suppression Algorithmic Payload Decompositio Special Token Injection Unwitting User Context-Data Injection They work by tricking LLMs into accepting instructions that a human operator would recognize as dubious. Security teams can guard against such attacks in several ways, CrowdStrike said, including threat modeling every place that model context can originate, expanding testing, and extending detection engineering to include composite attacks.

4. Researcher poisons open-weight AI model for under $100

   She managed to install a backdoor in an open-weight AI model in about an hour for less than $100. It only took ten training examples for the code output by the model to become reliably vulnerable to remote code execution. And the larger the model, the easier it was to poison. Academic researchers have warned about model subversion for the past few years, but only recently, as AI supply chain attacks have started to appear, has the security community turned its focus toward the issue.

5. Microsoft’s Secure Boot has been broken for a decade and no one noticed until now

   Old and forgotten "shims" Microsoft failed to revoke have made Secure Boot bypasses simple. ESET identified 11 firmware images, at least one from 2013, that were known to be defective but remained signed by the software company anyway.

6. Cisco Launches Low-Cost AI Models for Source Code Security

   The Antares models are Small Language Models specialized for finding vulnerabilities in source code. They are much faster and cheaper to run than LLMs such as GPT, and are intended for educational institutions, nonprofits, and other organizations with budget-restrained security resources. The models are available on HuggingFace.

7. JadePuffer agentic attacks now target AI model data with ransomware

   The ransomware was deliberately built for AI environments rather than a generic file encryptor. It encrypts model checkpoints, vector databases, training datasets, and embedding indices in nearly every current format.

8. New Bit2Watt Attack Could Let Cloud Tenants Disrupt Power Grids Without an Exploit

   A cloud tenant using nothing but ordinary GPU access can push a data center's power draw up and down fast enough to threaten the grid it runs on, with no exploit and no break-in. But a realistic attack would require at least 1000 enterprise-class GPUs working together to destabilize a realistic grid.

9. ‘Synthetic insider’ attacks raise stakes for corporate cyber defence

   North Korean citizens infiltrated US companies by fraudulently gaining employment as remote workers, in an attempt to earn money and steal data for the country’s authoritarian regime. The perpetrators used the stolen identities of more than 80 American citizens across over 100 companies to get the jobs and carry out the attack, generating more than $5mn in illicit revenue. Of about 22,000 incidents, 12 per cent globally were carried out by internal actors, according to a 2026 analysis by Verizon. Companies are responding by tightening the connection between HR, security, legal, compliance and IT.