2026-07-02: SharePoint RCE hits CISA's known exploited list with a Friday deadline

Show Notes - 2026-07-02

Stories Covered

• July 2, 2026
• Today:
• SharePoint RCE CVE-2026-45659 Added to CISA KEV After Active Exploitation [Critical Alerts]
• Microsoft Uncovers Parallel Threat Activity from 2 Clusters [Critical Alerts]
• FortiBleed Credential Theft Linked to INC and Lynx Ransomware Operations [Ransomware & Extortion]
• AI Agent Exploits Langflow RCE to Automate Database Ransomware Attack [Ransomware & Extortion]
• AI-Generated Browser Ransomware Abuses Chromium API on Windows, Linux, macOS, Android [Ransomware & Extortion]
• Missed Incidents and Persistent Threats: Insights from Compromise Assessment Projects [Ransomware & Extortion]
• New ChocoPoC RAT Targets Vulnerability Researchers via Fake PoC Exploit Repos [Business & Infrastructure Threats]
• Progress Kemp LoadMaster Pre-Auth RCE Flaw Faces Active Exploitation Attempts [Business & Infrastructure Threats]
• Unpatched Argo CD Repo-Server Flaw Could Let Attackers Take Over Kubernetes Clusters [Business & Infrastructure Threats]
• Crafty Phishing Campaigns Auto-Adapt to Victim's Device, OS [Business & Infrastructure Threats]
• This phishing kit looks more like BEC-as-a-service [Business & Infrastructure Threats]
• Microsoft Adds New Teams Controls to Block Unauthorized AI Bots From Meetings [Business & Infrastructure Threats]
• Adobe Patches 7 CVSS 10.0 Flaws in ColdFusion and Campaign Classic [Vulnerability Disclosures]
• Critical Cursor Flaws Could Let Prompt Injection Escape Sandbox and Run Commands [Vulnerability Disclosures]
• And the Winner in Dominant Malware Delivery? ClickFix [General Security News]
• 19-Year-Old Scattered Spider Suspect Extradited to Face U.S. Hacking Charges [General Security News]
• Microsoft Accelerates Post-Quantum Cryptography Shift to 2029 [General Security News]

CVEs Referenced

CVE-2021-29441, CVE-2024-1212, CVE-2024-31989, CVE-2025-11371, CVE-2025-14847, CVE-2025-3248, CVE-2025-55182, CVE-2025-64446, CVE-2026-0257, CVE-2026-10520, CVE-2026-35616, CVE-2026-45659, CVE-2026-48276, CVE-2026-48277, CVE-2026-48281, CVE-2026-48282, CVE-2026-48283, CVE-2026-48286, CVE-2026-48313, CVE-2026-48315, CVE-2026-48316, CVE-2026-48908, CVE-2026-50548, CVE-2026-50549, CVE-2026-50751, CVE-2026-8037

Indicators of Compromise

IP Addresses: 91.132.163.78, 192.42.116.58, 192.42.116.105, 146.70.139.154

Read the full brief