cybr.cx Daily Digest — July 28, 2026

Critical Vulnerabilities

⚠️ Actively exploited — CVE-2026-16812 | Arista VeloCloud Orchestrator | CVSS: N/A
An OS command injection vulnerability in Arista's VeloCloud SD-WAN Orchestrator allows a remote, unauthenticated attacker to execute privileged commands on the host system, with the potential to compromise the entire orchestration platform and all managed downstream devices. CISA's remediation deadline was July 30 — if you run on-prem VCO deployments, this is a drop-everything patch. The blast radius here extends to every edge device the orchestrator manages.

⚠️ Actively exploited — CVE-2025-68686 | Fortinet FortiOS | CVSS: N/A
Attackers are actively bypassing Fortinet's previously issued patch for the symbolic link persistence mechanism — a technique observed in post-exploitation scenarios on compromised FortiOS devices. Crafted HTTP requests allow unauthenticated remote actors to re-expose sensitive information even on patched systems. This is a patch bypass, which makes it particularly nasty — don't assume your earlier remediation holds. CISA deadline is August 10.

⚠️ Actively exploited — CVE-2026-16232 | Check Point SmartConsole | CVSS: N/A
An improper authentication flaw in Check Point SmartConsole lets an unauthenticated remote attacker harvest a valid application login token and leverage it for full administrative access. CISA's due date has already passed (July 25), meaning federal agencies were required to patch days ago — if you haven't, assume you're exposed. Full admin on SmartConsole means complete firewall policy control.

⚠️ Actively exploited — CVE-2026-50522 | Microsoft SharePoint | CVSS: N/A
A deserialization of untrusted data vulnerability in SharePoint enables remote, unauthenticated code execution over the network. SharePoint's broad enterprise deployment and internet-facing configurations in many organisations make this a high-priority target for initial access. CISA deadline has passed (July 25).

⚠️ Actively exploited — CVE-2026-60137 + CVE-2026-63030 | WordPress Core | CVSS: N/A
These two vulnerabilities are being chained in active attacks to deliver unauthenticated remote code execution on default WordPress installations. CVE-2026-60137 is a SQL injection flaw triggered when plugins pass untrusted input to a core parameter; CVE-2026-63030 is an interpretation conflict that escalates the SQL injection to full RCE. The combination is particularly dangerous because it requires no authentication and works out-of-the-box — any unpatched WordPress install is at risk. Update WordPress Core immediately.

⚠️ Actively exploited — CVE-2026-0770 | Langflow | CVSS: N/A
Langflow, the popular open-source visual AI workflow builder, has an untrusted code execution vulnerability allowing remote attackers to run arbitrary code on affected installations. Given Langflow's frequent deployment in AI development pipelines — often with broad internal network access — exploitation could serve as a beachhead into sensitive ML infrastructure.

⚠️ Actively exploited — CVE-2021-27137 | DD-WRT | CVSS: N/A
A five-year-old stack-based buffer overflow in DD-WRT's UPnP handling is seeing fresh exploitation in 2026. Unauthenticated attackers can overflow an internal buffer to achieve code execution on affected routers. Consumer and prosumer routers running DD-WRT firmware are the target — UPnP should be disabled immediately if patching is not possible.

CVE-2026-66758 | GIMP file-fits plugin | CVSS: 7.8 (HIGH)
A heap-based buffer overflow in GIMP's FITS image plugin arises from signed 32-bit integer multiplication overflow when processing crafted image dimensions. The resulting undersized allocation can be exploited via a malicious FITS file — relevant anywhere GIMP is used in automated image pipelines or where untrusted files are processed.

CVE-2026-41608 / CVE-2026-48586 / CVE-2026-55968 / CVE-2026-55969 / CVE-2026-43871 / CVE-2026-45112 / CVE-2026-48145 | Apache Thrift (multiple bindings) | CVSS: 7.5 (HIGH)
Apache Thrift before 0.24.0 carries a cluster of serious flaws across its language bindings: data amplification via highly compressed payloads (Python, C++, Java, Go), infinite loop DoS (Python, Go, PHP, Java), resource exhaustion without throttling (Java, Node.js), integer overflow/wraparound (C++, Go, Delphi, Haxe), and — critically — TLS certificate hostname validation failure in C++ bindings. Any service using Thrift for RPC should upgrade to 0.24.0. The certificate mismatch flaw (CVE-2026-48145) deserves particular attention as it can silently expose communications to MitM attacks.

Headline News

Developer Supply Chain Attack: Fake Corepack Site Delivers Infostealer and Proxy Hijacker

A malicious website impersonating the legitimate Corepack Node.js tool was caught distributing a dual-payload malware package — an infostealer harvesting credentials and local secrets, combined with proxy-hijacking software that silently reroutes traffic through attacker-controlled infrastructure. The site has since gone quiet, suggesting the operators may be lying low or have achieved their initial targeting objectives. The attack is a textbook developer supply chain lure: Corepack is a Node.js built-in tool for managing package managers, making it a plausible search result for developers troubleshooting environment setup. Practitioners should audit developer workstations for unexpected proxy configurations and review any npm or Node.js tooling downloaded outside official channels in recent weeks.

Fleet Platform Vulnerabilities Expose Volvo/Eicher Vehicles and All User Accounts

A researcher disclosed a critical chain of vulnerabilities in the fleet management platform used by Volvo's Eicher commercial vehicle brand, ultimately enabling full account takeover for every registered user on the platform — and with it, control over telemetry and connected functions for the associated vehicles. The attack surface included broken access controls and insufficient server-side validation, allowing lateral movement across all customer accounts from a single entry point. This is a notable real-world example of the expanding automotive API attack surface: fleet management platforms aggregate enormous control and data across thousands of commercial vehicles, yet often receive less security scrutiny than the vehicles themselves. Security teams responsible for connected vehicle or IoT fleet deployments should audit whether their platforms enforce per-account isolation at the API layer.

$450K Drained from Garden Finance in Cross-Chain DeFi Exploit

Garden Finance suffered an active exploit draining approximately $450,000 in assets across four separate blockchain networks, detected in real-time by on-chain security tooling. This is not Garden Finance's first security incident — the repeated breaches point to systemic architectural weaknesses rather than one-off oversights, and erode confidence in the platform's ability to secure cross-chain bridge logic. Cross-chain protocols remain among the highest-value targets in the DeFi space because exploiting a bridge vulnerability can be replicated simultaneously across all connected chains, multiplying the attacker's return. The incident is a continued reminder that cross-chain interoperability code warrants the most rigorous audit scrutiny of any component in a DeFi stack.

Schrödinger's Feed

The Pittsburgh Supercomputing Center is moving forward with a new hybrid quantum-classical supercomputer, partnering with D-Wave to integrate both annealing and gate-model quantum hardware alongside conventional HPC infrastructure. This hybrid architecture is significant because it positions quantum acceleration as a practical complement to classical compute for specific problem classes — optimisation and simulation workloads in particular — rather than a wholesale replacement. For the security community, hybrid HPC systems of this scale are exactly the kind of infrastructure that will eventually be used to benchmark post-quantum cryptographic algorithms under realistic load conditions. Practitioners should watch this space: as hybrid systems mature, the timeline for "quantum-relevant" cryptanalytic capability becomes less theoretical and more engineering-tractable.

/dev/random

The humble Python interpreter is getting a portability makeover — the python-build-standalone project produces self-contained, highly portable Python distributions that carry all their dependencies bundled, with no reliance on system libraries or a pre-existing Python installation. Think of it as a statically linked Python binary that you can drop on almost any Linux, macOS, or Windows host and just run. The security angle is surprisingly interesting: bundled distributions eliminate a whole class of system library confusion attacks and supply-chain interference at the OS package manager layer, but they also mean you're carrying your own libc-equivalent around and need to track updates independently. It's turtles all the way down — except the turtles are hermetically sealed.