Jul 20's Top Cyber News NOW! - Ep 1177

At a glance

Seven critical vulnerabilities across Fortinet, WordPress, and Microsoft products are actively exploited or actively being weaponized. Threat actors are pivoting to email-based social engineering (ClickFix, vishing) to steal credentials when traditional entry points tighten. Organizations must patch immediately and hunt for prior compromise.

Stories covered

What's driving the surge in ACR stealer malware attacks?

What happened: Microsoft observed a spike in ACR stealer (a rebrand of Amitera Stealer malware-as-a-service) attacks using ClickFix social engineering to trick users into running malicious PowerShell and DLLs. Attackers are abusing WebDAV shares and HTML application hosts to deliver payloads and exfiltrate credentials, cookies, and authentication tokens.

Why it matters: ClickFix remains a high-success vector for initial access. Threat actors aren't innovating—they're exploiting human behavior at scale. If your users can be socially engineered into running PowerShell, your perimeter controls don't matter.

What to do: Block low-reputation and newly registered domains at the firewall level. Implement application allowlisting (deny-by-default) to restrict PowerShell execution. Hunt for anomalous sign-ins (off-hours, unusual geographies, new resource access patterns). Enforce MFA everywhere. Monitor for WebDAV abuse in network logs.

How are threat actors gaining access to Abbott Laboratories systems?

What happened: Abbott Laboratories disclosed two separate breaches. Shiny Hunters extortion gang compromised legacy systems in its cancer diagnostics business and separately breached a lab central portal. Shiny Hunters used vishing (voice phishing) to manipulate help desk staff into resetting credentials or adding themselves to MFA, then compromised the Microsoft Entra single sign-on account for lateral movement.

Why it matters: Vishing is outpacing email phishing because help desk staff are trained to be helpful, not skeptical. Once attackers compromise SSO, they own the tenant. This is a credential-harvesting attack, not a zero-day exploit.

What to do: Implement zero-trust identity controls. Require help desk to use out-of-band verification (callback to known number) before credential resets or MFA changes. Monitor Entra sign-in logs for impossible travel, new device registrations, and atypical resource access. Alert on MFA changes initiated outside normal business hours.

Why is FairLife's ransomware attack a manufacturing industry wake-up call?

What happened: FairLife (a Coca-Cola subsidiary dairy company) suffered a ransomware attack on Thursday. Coca-Cola stated product quality and safety were unaffected, suggesting operational technology systems remained isolated. No ransomware group has claimed responsibility yet.

Why it matters: Manufacturing is a top ransomware target because operators understand the cost of downtime (often quantified per minute). Lean margins and 24/7 operations make ransom demands defensible to bean counters. Many manufacturing facilities employ shift workers without email accounts or formal user credentials, creating blind spots in security awareness programs.

What to do: Segment operational technology networks from IT business infrastructure. Assume email-based initial access (phishing to business staff, not floor operators). Enforce credential-based access controls for all systems, including temporary shift workers. Monitor for lateral movement from IT to OT boundaries.

How many critical Fortinet sandbox flaws are actively under attack right now?

What happened: Two critical OS command injection vulnerabilities (CVE-2024-21893, CVE-2024-21894) in Fortinet Sandbox, Sandbox Cloud, and Sandbox as-a-service are now confirmed actively exploited. Both carry CVSS 9.1 and allow unauthenticated remote code execution via malformed HTTP requests. CISA added both to the Known Exploited Vulnerabilities catalog. EPSS score: 84%.

Why it matters: 84% EPSS means exploitation risk in the next 30 days is extremely high if you run this tech. Patches have been available since June. If your team didn't patch then, you must assume you were compromised and audit logs immediately. Unpatched = open door for 30+ days.

What to do: Confirm with your network/security team that Fortinet sandbox was patched in June. If not patched, do it now and then review all logs and NetFlow data from March 28 onward for signs of exploitation (command injection patterns, unexpected process execution). Check for lateral movement post-compromise.

Is WordPress core now a critical unauthenticated RCE vector?

What happened: Two unauthenticated remote code execution vulnerabilities in WordPress 6.9 and 7.0 (named WP2 Shell) allow anonymous attackers to execute arbitrary code with no preconditions. WordPress shipped emergency patches (6.9.5, 7.0.2) and forced auto-updates. All versions pre-6.8 are unaffected due to being too old to contain the vulnerable code path.

Why it matters: Unauthenticated RCE is the worst severity class. Exploit proof-of-concept exists. Forced auto-updates means most sites are now patched, but legacy installations running 6.8 or 6.9 may still be vulnerable. No active wild exploitation reported yet—only PoC.

What to do: Verify you're running 6.9.5, 7.0.2, or newer. Enable WordPress auto-updates if not already on. If running pre-6.8, you're not vulnerable to this flaw. Hunt logs for suspicious POST requests to vulnerable endpoints and unexpected PHP execution as `www-data` or equivalent. Consider WAF rules to block malformed requests until patched.

What's the exploit impact of the Microsoft SharePoint Server deserialization flaw?

What happened: Microsoft SharePoint Server (2016, 2019, subscription versions) has a critical untrusted deserialization vulnerability (CVSS 9.8) allowing authenticated attackers to execute arbitrary code remotely. CISA added it to KEV catalog; federal agencies had until July 21 to patch. Actively exploited in the wild.

Why it matters: Unlike the Fortinet and WordPress flaws, this requires authentication (site owner privilege). Barrier to entry is higher, but impact is severe. Affects on-premises deployments, not SharePoint Online. If you're still running SharePoint 2016, you're running a 10-year-old platform with known gaps.

What to do: Patch to latest supported versions immediately. If you cannot patch SharePoint 2016 by end-of-life (October 2026), plan migration. Review Entra/AD logs for unusual SharePoint site owner account activity (privilege escalation, lateral movement). Monitor for serialized object injection attempts in request logs.

How is FairLife's dairy company ransomware attack affecting operations?

What happened: EY (Ernst & Young), a Big Four professional services firm with 46,000 employees, disclosed a data breach stemming from compromise of a third-party support ticket system used by IT personnel. Attackers accessed the system March 28–April 12, downloading multiple documents containing personal and financial data used for tax filings. No ransomware group has claimed responsibility; no indication of active extortion.

Why it matters: Third-party SaaS risk. IT personnel often have over-privileged access to support systems without realizing those systems themselves can be attack surface. Tax data + personal financial info = high-value target. EY hasn't disclosed customer count or affected countries, suggesting ongoing investigation or regulatory hold.

What to do: Audit your third-party SaaS inventory. For any system where your IT staff submit tickets or documents, verify: (1) encryption in transit and at rest, (2) access controls limiting document retrieval, (3) audit logging. Cross-reference with your TAR (Third-party Risk) program. If you use EY services, monitor credit reports and tax filing accounts for fraud.

Why are AI email filters now being bypassed with text salting?

What happened: Barracuda reports threat actors using text salting (injecting random benign text) and CSS cropping / zero-font techniques to evade AI-powered email gateways. Hidden text is invisible to humans but visible to AI scanners, fooling them into marking malicious emails as benign. No new vulnerability—old evasion technique repurposed.

Why it matters: AI email security is not a silver bullet. Attackers are adapting. Text salting is low-effort, high-success evasion. Layered defenses still work; single-layer (keyword-only) AI detection does not.

What to do: Deploy multi-layered email security: sender reputation checks, DMARC/SPF/DKIM validation, embedded URL reputation, HTML rendering analysis, and manual content comparison (visible vs. hidden text via CSS inspection). Train users to distrust emails with suspicious formatting, hidden divs, or zero-font text. Monitor for emails with unusual CSS or font-size:0 attributes.

Key takeaways

• Patch urgently: Fortinet sandbox (EPSS 84%), WordPress (active PoC), and SharePoint (active wild exploitation) require immediate patching. Assume compromise if unpatched for >30 days and hunt logs.
• Credentials are the new perimeter: Vishing, ClickFix, and SSO compromise (Abbott, EY) show attackers are logging in, not breaking in. Enforce MFA, monitor impossible travel, and require out-of-band verification for credential resets.
• AI is not a substitute for defense-in-depth: Text salting bypasses single-layer email filters. Combine sender reputation, authentication, URL analysis, and user training.
• Third-party risk is real: EY's support ticket system breach reminds us that SaaS tools used by IT staff are attack surface. Audit and segment third-party integrations.
• Manufacturing and healthcare remain top targets: Lean margins, 24/7 operations, and quantifiable downtime make ransomware ROI predictable. Segment OT from IT and assume phishing will succeed.

Topics covered

Show notes generated from the live transcript using AI on Mon, 20 Jul 2026 19:11:44 GMT. Errors? Open the YouTube replay for the source of truth.