2026-07-03: Anubis ransomware exploits Citrix Bleed 2 with CISA-mandated July 11 deadline

Show Notes - 2026-07-03

Stories Covered

• Today:
• Citrix Bleed 2 Exploited in Anubis Ransomware Campaigns (CVE-2025-5777) [Critical Alerts]
• FortiBleed Feeds Ransomware Operations (Inc, Lynx) [Critical Alerts]
• SharePoint On-Premises RCE Added to CISA KEV [Critical Alerts]
• Interpol Impersonation Campaign Targets Small Business [Ransomware & Extortion]
• AI Agent Conducts End-to-End Ransomware Attack [Business & Infrastructure Threats]
• Google Disrupts NetNut Residential Proxy Network [Business & Infrastructure Threats]
• SIEM Data Volume Becomes Liability [Business & Infrastructure Threats]
• Cursor AI IDE Sandbox Escape (CVE-2026-50548, CVE-2026-50549) [Vulnerability Disclosures]
• macOS PamStealer Uses PAM Validation [Vulnerability Disclosures]
• FatFs Filesystem Vulnerabilities (Seven CVEs) [Vulnerability Disclosures]
• ST Engineering iDirect iQ-Series Terminals (CVE-2026-38059, CVE-2026-38057) [Vulnerability Disclosures]
• Gardyn IoT Hub (CVE-2026-13768, CVE-2026-55726, CVE-2026-54477) [Vulnerability Disclosures]
• Additional Microsoft CVE Publications [Vulnerability Disclosures]
• Claude Cowork Sandbox Root Escape [General Security News]
• Apple Hide My Email Vulnerability [General Security News]
• BeepRAT Distributed via Chinese Utility [General Security News]

CVEs Referenced

CVE-2025-5777, CVE-2026-13768, CVE-2026-14164, CVE-2026-14258, CVE-2026-38057, CVE-2026-38059, CVE-2026-50521, CVE-2026-50548, CVE-2026-50549, CVE-2026-52911, CVE-2026-52944, CVE-2026-53046, CVE-2026-54477, CVE-2026-55726

Indicators of Compromise

Domains: maccyapp[.]com, avenger-sync[.]live, maccy[.]app

IP Addresses: 4.5.2.2, 4.5.2.1

Read the full brief