Cyber security developments for Sunday the 26th of July 2026 covering articles added to the BlueTeamSec community on infosec.pub. Today we have 22 articles to cover. All attribution is by the article authors. All article analysis is automated.
Tencent has published an analysis of tactical and technical upgrades to Ocean Lotus, though unfortunately the article sits behind WeChat's authentication wall at present. Worth flagging for those with platform access who follow Vietnamese-nexus threat activity.
Hunt.io and Bob Diachenko report that Thailand's Ministry of Finance was targeted between the 9th and 13th of July by an autonomous AI agent called Hermes running in unattended mode. The attack deployed a custom implant called Hades across Windows and Linux systems, exploited misconfigured Hadoop services, and staged several older privilege escalation exploits. The operation originated from Hong Kong infrastructure and demonstrates how AI-driven attacks can compress the time between initial access and full compromise quite dramatically.
Google Threat Intelligence Group has published their zero-day review for 2025. Ninety vulnerabilities were exploited in the wild last year, with a notable shift toward enterprise and edge devices accounting for nearly half of all exploits. For the first time, commercial surveillance vendors surpassed traditional state groups in zero-day usage, though PRC-nexus actors remained the most prolific state players.
An analysis has surfaced covering a zero-day in Fastjson version 1.2.83, described as gadget-free, which suggests exploitation without the usual deserialization gadget chains. The article appears to provide technical depth and defensive guidance for users of this widely deployed Java JSON library.
Researchers from Shanna Kahn and John Hastings conducted a cross-model study of Python scripts generated by ChatGPT, Microsoft Copilot, and Google Gemini for automation tasks. All three models produced code containing exploitable vulnerabilities across seventeen distinct classes, including server-side request forgery, path traversal, and template injection. The implication is that non-expert users deploying AI-generated code without security review are creating shadow automation with systemic flaws.
Dark Elevator is a Windows InstallService privilege escalation flaw affecting Windows 11, designated CVE-2026-50343. The vulnerability enables unprivileged users to escalate to SYSTEM level by exploiting registry manipulation and COM-based DLL hijacking. Microsoft patched it on the 14th of July.
Researchers from the Chinese Academy of Sciences and Tsinghua University have introduced STAR, a website fingerprinting attack using zero-shot cross-modal retrieval to identify encrypted HTTPS websites without prior labeled training data. The technique exploits structural correlations between how websites are built and the traffic patterns they produce, bypassing modern privacy protections including encrypted client hello and encrypted DNS—which is a rather unwelcome advancement in traffic analysis capabilities.
Bitdefender Labs has detailed a defense-evasion technique abusing Windows bind links, specifically the bindflt.sys minifilter driver, to perform in-memory file redirection. Attackers with local administrator privileges can bypass EDR, antivirus, AppLocker, and other security tools by mapping malicious files to trusted paths without creating disk artifacts. The technique affects all Windows 10 RS4 onwards and Windows 11 systems. Alloy Secure Group have released BlinkLinkSentiennel, a user-mode detection sensor prototype to identify this abuse.
A researcher has demonstrated how attackers can exploit Windows WebDAV functionality to bypass Mark-of-the-Web and SmartScreen protections. By mapping WebDAV shares as local drives over HTTP or HTTPS, malicious payloads avoid traditional download-based security controls, abusing the native WebClient service to deliver files without triggering browser-based defenses.
CVE-2026-54121, known as Certighost, is a critical vulnerability in Active Directory Certificate Services allowing low-privileged domain users to impersonate Domain Controllers. The attacker exploits the CA's failure to validate directory object resolution by providing malicious attributes, causing the CA to issue valid certificates for the target DC and enabling full domain compromise. A proof of concept has been published.
Shellph is an open-source command-line utility written in Go that automates encryption and obfuscation of shellcode for red teaming and malware development. It supports multiple encryption methods and transformations to evade static signature-based detection, and outputs obfuscated shellcode in various programming languages including C, Go, Rust, C# and PowerShell. Named after the author's cat, apparently.
USENIX researchers have developed Mohabi, a modified Firefox browser that sandboxes the SpiderMonkey JavaScript engine using software-based fault isolation. The system disaggregates the engine from the browser process to contain exploits within the sandbox, preventing attackers from escalating privileges or executing arbitrary code more broadly. Performance overhead sits at around twenty-four percent on standard benchmarks.
ENISA has published procurement guidelines designed to help hospitals and healthcare providers integrate cybersecurity requirements into their acquisition processes. The guidelines include technical security criteria, checklists in Annex B, and cross-cutting considerations for AI-enabled medical products.
NIST has released draft Special Publication 800-209r1 providing updated security guidelines for storage infrastructure. The document addresses modern storage architectures including software-defined storage, identifies emerging threats from increased abstraction complexity, and offers actionable security controls for organisations managing enterprise storage systems. Public comment is open.
OOMOL Lab's open-connector is an open-source authentication gateway connecting AI agents to over a thousand SaaS providers through multiple interfaces. No security incident or vulnerability has been identified with this project—it includes standard security reporting procedures typical of open-source repositories.
Pwno.io has developed Diff Rolling, an automated vulnerability research methodology that uses large language models to analyze version control commit histories for security flaws. The technique targets major open-source projects including FFmpeg, the Linux kernel, and V8, treating commit diffs as an enumerable search space to discover memory corruption and other vulnerabilities at scale. The researchers argue that the bottleneck in LLM vulnerability discovery is not model capability but codebase decomposition, and they've found that diffs are more interesting than initially presumed.
SentinelLABS benchmarked frontier AI models, including GPT-5.6 Sol, for autonomous long-horizon malware analysis using an eight-stage sabotage implant scenario in IDA Pro. The study found AI models can function as supervised investigative agents for multi-stage reverse engineering tasks but require human oversight due to semantic errors and hallucinated completions.
A researcher has released llm-observer-proxy-go, a Go-based observability proxy for developers to intercept and log OpenAI and Anthropic API traffic during LLM development. The tool records request and response payloads, streaming outputs, and token usage to local files, but lacks authentication on its control API and stores sensitive data in plain text. Defenders should restrict network access to control ports and apply filesystem permissions to prevent unauthorised access to recorded LLM conversations.
Rhys Downing has dissected a sophisticated four-stage .NET malware delivery chain that uses bitmap steganography to embed and deliver AsyncRAT version 0.5.8. The campaign employs Armenian-language decoys, multiple obfuscation techniques, process hollowing into legitimate .NET utilities, and actively disables Microsoft Defender to evade detection and maintain persistence on Windows systems.
A reverse engineering analysis of Remus Stealer reveals a sophisticated information-stealing malware that uses fileless, memory-resident execution techniques to evade detection. The malware performs system reconnaissance, clipboard theft, and screen capture before exfiltrating data to command-and-control infrastructure, briefly dropping a .bin file before deleting it and operating entirely in memory.
And Cisco Talos reports on msaRAT, a remote access trojan associated with Chaos ransomware that uses living off the browser techniques by hijacking legitimate browser processes—Chrome or Edge—to establish covert command-and-control channels. The malware leverages WebRTC and TURN protocols through trusted services like Twilio and Cloudflare to mask malicious traffic as legitimate browser activity, which significantly complicates network detection.
That concludes today's briefing.