cybr.cx | Daily Digest — July 27, 2026

Critical Vulnerabilities

⚠️ Actively exploited — CVE-2026-16232 | Check Point SmartConsole | CVSS: N/A
An improper authentication flaw in Check Point SmartConsole allows an unauthenticated remote attacker to obtain a valid application login token and use it to authenticate with full administrative privileges — no credentials required. CISA added this to the KEV catalogue on July 22 with a remediation deadline that has already passed. If you're running SmartConsole and haven't patched or restricted network access, assume you're a target.

⚠️ Actively exploited — CVE-2026-50522 | Microsoft SharePoint | CVSS: N/A
A deserialization of untrusted data vulnerability in Microsoft SharePoint is being actively exploited to achieve remote code execution over the network without authentication. SharePoint's attack surface makes this high-value for initial access brokers and ransomware groups alike. Patch immediately and review SharePoint exposure at your perimeter.

⚠️ Actively exploited — CVE-2026-60137 + CVE-2026-63030 | WordPress Core | CVSS: N/A
These two flaws are designed to be chained: CVE-2026-60137 is a SQL injection triggered when plugins or themes pass untrusted input to a vulnerable parameter, and CVE-2026-63030 is an interpretation conflict that escalates the SQL injection to full remote code execution. Together they enable unauthenticated RCE on default WordPress installations. With WordPress powering roughly 40% of the web, mass exploitation is a realistic near-term outcome — update WordPress Core now and audit any plugin passing external input to database queries.

⚠️ Actively exploited — CVE-2026-0770 | Langflow | CVSS: N/A
Langflow, the open-source visual framework for building LLM-powered applications, contains a vulnerability allowing remote attackers to execute arbitrary code by loading functionality from an untrusted control sphere. Given the rapid adoption of Langflow in AI development pipelines, this is a particularly dangerous vector for organisations experimenting with local LLM tooling — these environments are often lightly monitored. Isolate Langflow instances from production networks and apply available patches immediately.

⚠️ Actively exploited — CVE-2021-27137 | DD-WRT | CVSS: N/A
A five-year-old stack-based buffer overflow in DD-WRT's UPnP implementation has reappeared in active exploitation campaigns. An unauthenticated attacker can overflow an internal buffer to achieve code execution on affected routers. The age of this CVE suggests threat actors are sweeping for unpatched consumer and small-business routers — disable UPnP and update firmware if you haven't already.

CVE-2026-15962 | Fluent Forms Pro Add On Pack (WordPress) | CVSS: 8.8 — HIGH
A PHP Object Injection flaw in the Fluent Forms Pro plugin (versions up to 6.2.6) can be triggered by any authenticated user with Subscriber-level access or higher. A POP chain is present that allows password changes and likely full account takeover. Any WordPress site running this plugin should update to 6.2.7 or later and audit user role assignments.

CVE-2026-63720 | datamodel-code-generator (< 0.70.0) | CVSS: 7.5 — HIGH
Attackers who control input schemas passed to datamodel-code-generator can inject arbitrary Python code via a crafted customBasePath value containing embedded newlines. The malicious value is emitted directly into a generated from ... import ... statement without validation, resulting in RCE at code-generation time. This is a supply-chain-adjacent risk — any CI/CD pipeline consuming untrusted schemas with this library is exposed. Upgrade to 0.70.0.

CVE-2026-57989 / CVE-2026-57990 | Microsoft Edge (Chromium-based) | CVSS: 7.4 — HIGH
Two separate information disclosure vulnerabilities in Microsoft Edge — one an origin validation error, the other exposing files or directories to external parties — both allow network-based attackers to access data they shouldn't. No active exploitation reported yet, but Edge's enterprise footprint makes these worth patching promptly via the standard update channel.

Headline News

Iran-Linked Threat Actors Active Inside US Water and Energy Control Systems

Federal agencies have updated a joint cybersecurity advisory warning that Iran-linked threat actors have successfully breached internet-exposed operational technology systems across US water and energy sectors. The intrusions target internet-facing industrial control systems and SCADA interfaces, with actors observed probing and in some cases maintaining persistent access to systems that manage physical infrastructure. The advisory describes a pattern of opportunistic but deliberate targeting — actors are exploiting weak authentication and unpatched internet-exposed devices rather than sophisticated zero-days, which makes the threat accessible to lower-capability groups operating under state direction. For ICS/OT practitioners, the immediate priorities are asset discovery of internet-exposed control interfaces, enforcement of multi-factor authentication, and network segmentation between IT and OT environments. The fact that a federal advisory has been updated — rather than issued fresh — signals this activity is ongoing and escalating, not a historical incident.

Steam Workshop Maps Weaponised to Distribute Malware

Multiple maps distributed through Steam Workshop for the game Meccha Chameleon were found to contain embedded malware, with the infection apparently introduced through a compromised contributor account or toolchain. The game's official Discord server was simultaneously compromised, creating a two-vector attack where players seeking support or updates could be further targeted. Workshop-based distribution is a particularly effective delivery mechanism because users extend implicit trust to content distributed through the platform's official channels, and the files are often automatically synced to local machines. While the developers have pushed a fix for the malicious map files, the Discord server compromise remains unresolved, meaning the social engineering surface is still live. This incident is a useful reminder that gaming platforms represent a meaningful malware distribution channel — endpoint detection needs to cover content downloaded through game clients, not just browsers and email.

Schrödinger's Feed

Error suppression is quietly becoming one of the most consequential engineering challenges in quantum computing, and two notable integrations landed this week: Quantum Elements released Orbit, an automated error suppression tool available as a Qiskit Function through IBM's network, while Qedma's QESEM platform is now integrated directly with Quantinuum's trapped-ion hardware. Noise and decoherence remain the principal obstacles between today's NISQ-era machines and cryptographically relevant computation, and mature error suppression tooling is a prerequisite for reaching that threshold. Neither announcement moves the cryptopocalypse timeline dramatically on its own, but the pace of tooling maturity across multiple hardware platforms is accelerating. Security teams planning post-quantum migration timelines should treat the error suppression engineering curve as a leading indicator — when these tools stop being research projects and become commodity infrastructure, the urgency window compresses fast.

/dev/random

Someone on Hacker News has published CheapSecurity — a self-hosted CCTV system designed to run on Linux single-board computers like the Raspberry Pi, apparently on the grounds that consumer security cameras are either expensive, cloud-dependent, privacy-hostile, or all three simultaneously. The project handles motion detection and recording locally, with no mandatory cloud account required — which is arguably a more defensible security posture than sending your home footage to a vendor whose privacy policy runs to fourteen pages. It attracted a modest but appreciative audience, which suggests there is a non-trivial number of practitioners who have decided that the correct response to insecure IoT cameras is to write their own. The irony of a security camera system called CheapSecurity appearing in a digest that also covers DD-WRT buffer overflows from 2021 being actively exploited in 2026 is left as an exercise for the reader.