Daily Threat Briefing
← All briefings

Microsoft Defender / Malware Protection Engine · Junos OS on MX Series · Metabase open-source and Enterprise —

DAILY THREAT INTELLIGENCE BRIEFING Date: 2026-07-10 Prepared for: SOC Analysts | Incident Responders | Vulnerability Management | Security Leadership

EXECUTIVE SUMMARY

Today’s most notable new developments are the GigaWiper destructive Windows backdoor (combining disk wiping, fake ransomware, and spyware), the GodDamn ransomware family using a kernel driver to disable endpoint defenses, and a new Helix vishing group targeting SharePoint environments. On the vulnerability side, Microsoft has released a full patch for the RoguePlanet Defender zero-day (CVE-2026-50656) previously disclosed after June Patch Tuesday. BSI published a large batch of new advisories covering GitLab, Palo Alto PAN-OS, Juniper JunOS, MOVEit, n8n, and FreeRDP, among others.

CRITICAL VULNERABILITIES

NEW

CVE-2026-50656 (Microsoft Defender — RoguePlanet)

  • Affected products: Microsoft Defender / Malware Protection Engine (mpengine.dll), all Windows versions receiving Defender updates
  • Severity: High (CVSS 7.8)
  • EPSS: Not yet scored
  • Technical detail: A local privilege escalation flaw in the Microsoft Malware Protection Engine allows a standard user to gain SYSTEM-level privileges. The vulnerability was originally disclosed after June 2026 Patch Tuesday as part of the “Nightmare Eclipse” exploit set and received only a partial fix at that time. Microsoft has now released a complete remediation. Because Defender updates are delivered automatically, most managed endpoints will receive the fix without manual intervention, but unmanaged or air-gapped systems require verification.
  • Exploitation status: Previously disclosed as a zero-day; exploitation in the wild cannot be excluded given prior public disclosure. Treat as actively exploited until confirmed otherwise.
  • Remediation: Verify Defender engine and signature updates have been applied. Confirm mpengine.dll version reflects the July 2026 update. Prioritize unmanaged and air-gapped Windows endpoints.

CVE-2026-57026 and CVE-2026-57023 (Juniper Networks Junos OS)

  • Affected products: Junos OS on MX Series (SPC3) and SRX Series — multiple version branches prior to 23.2R2-S7, 23.4R2-S8, 24.2R2-S5, 24.4R2-S4, 25.2R2, 25.4R1-S2
  • Severity: High (CVSS 8.7 each)
  • EPSS: Not yet scored
  • Technical detail: CVE-2026-57026 is an improper input validation flaw in the SIP plugin that allows an unauthenticated, network-based attacker to crash the Packet Forwarding Engine (PFE), causing a denial of service. CVE-2026-57023 is a similar flaw in the TCP proxy plugin. Both are remotely exploitable without authentication against devices with SIP or TCP proxy inspection enabled — common configurations in enterprise and carrier environments. Juniper MX and SRX series are widely deployed as edge and core routers and firewalls across European telecommunications and enterprise networks.
  • Exploitation status: No active exploitation confirmed.
  • Remediation: Apply Junos OS updates per the BSI advisory (WID-SEC-2026-2257). Disable SIP and TCP proxy inspection on devices where these features are not operationally required as an interim measure.

CVE-2026-59827 and CVE-2026-59826 (Metabase)

  • Affected products: Metabase open-source and Enterprise — versions 1.55.0 through 1.58.14, 1.59.0 through 1.59.11, 1.60.0 through 1.60.6.2, 1.61.0 through 1.61.1.3 (CVE-2026-59827); similar ranges for CVE-2026-59826
  • Severity: Critical — CVE-2026-59827 CVSS 9.9; CVE-2026-59826 CVSS 9.1
  • EPSS: Not yet scored
  • Technical detail: CVE-2026-59827 allows remote code execution via a malicious H2 database connection string on instances using the default H2 embedded database, including fresh installations. CVE-2026-59826 is a related flaw where unsafe H2 connection properties are not validated on existing connections, enabling a similar attack path. Metabase is a widely deployed open-source business intelligence tool used across European organizations for data analytics and dashboarding. Default installations are vulnerable without any configuration change.
  • Exploitation status: No active exploitation confirmed; the default-vulnerable nature of fresh installs significantly elevates risk.
  • Remediation: Upgrade to Metabase 1.58.15, 1.59.12, 1.60.6.3, or 1.61.1.4 as appropriate. Audit all Metabase instances for internet exposure. Migrate away from the default H2 database to a production database (PostgreSQL, MySQL) for any non-development deployment.

CVE-2026-52778 (YesWiki)

  • Affected products: YesWiki prior to 4.6.6
  • Severity: Critical (CVSS 9.8)
  • EPSS: 0.56 — high exploitation probability
  • Technical detail: An unsafe eval() call in YesWiki’s Formula Calculator feature allows remote code execution and denial of service. The EPSS score of 0.56 indicates a statistically elevated probability of exploitation in the wild. YesWiki is a collaborative wiki platform with notable deployment in French-speaking European organizations, NGOs, and educational institutions.
  • Exploitation status: No confirmed exploitation; EPSS score warrants elevated urgency.
  • Remediation: Upgrade to YesWiki 4.6.6 immediately. If immediate patching is not possible, disable the Formula Calculator feature and restrict access to trusted users.

CVE-2026-15308 (CPython / Python html.parser)

  • Affected products: CPython (Python) all versions prior to 3.15.0 and 3.16.0
  • Severity: High (CVSS 8.7)
  • EPSS: Not yet scored
  • Technical detail: The incremental HTML parser (html.parser.HTMLParser) is vulnerable to CPU denial of service through repeated unterminated markup declarations when processing attacker-controlled input. Any Python application that parses untrusted HTML using the standard library HTMLParser — including web frameworks, scrapers, and data pipelines — is potentially affected. The breadth of Python deployment across enterprise environments makes this a high-priority patch.
  • Exploitation status: No active exploitation confirmed.
  • Remediation: Upgrade to Python 3.15.0 or 3.16.0. Where immediate upgrade is not feasible, sanitize or limit HTML input before passing to HTMLParser, or use an alternative parsing library.

ONGOING

  • CVE-2026-54782 (CoreWCF, CVSS 10.0): unauthenticated SAML bypass; upgrade to 1.8.1 or 1.9.1.
  • CVE-2026-43499 “GhostLock” (Linux Kernel): local root and container escape; apply distribution vendor kernel patches.
  • CVE-2026-50746 (Ubiquiti UniFi, CVSS 10.0): unauthenticated command execution; apply all UniFi firmware updates.
  • CVE-2026-9074 / CVE-2026-3144 (IBM API Connect): unauthenticated SQLi and default credentials; patch and rotate credentials.
  • CVE-2026-48282 / CVE-2026-48316 (Adobe ColdFusion): actively exploited, CISA deadline 2026-07-10 — patch or isolate immediately.
  • CVE-2026-55255 (Langflow): actively exploited, CISA deadline 2026-07-10 — patch immediately.
  • CVE-2026-48908 / CVE-2026-56290 (Joomla extensions): actively exploited, CISA deadline 2026-07-10 — update and audit web root.
  • CVE-2026-53359 (Linux KVM “Januscape”): public PoC available; apply kernel patches.
  • CVE-2026-8037 (Progress Kemp LoadMaster): actively exploited; patch or isolate.
  • CVE-2026-46817 (Oracle E-Business Suite): actively exploited; patch immediately.

EUROPEAN ADVISORIES

BSI published a large batch of new (NEU) advisories on 2026-07-09. New advisories of note:

WID-SEC-2026-2257 (Juniper JUNOS and JUNOS Evolved, NEU, hoch): Multiple vulnerabilities across Juniper EX, MX, QFX, and SRX series enabling denial of service, information disclosure, code execution, and undefined behavior. Critical items CVE-2026-57026 and CVE-2026-57023 are detailed in Critical Vulnerabilities above.

WID-SEC-2026-2265 (GitLab, NEU, hoch): Multiple vulnerabilities allowing a remote authenticated attacker to execute arbitrary code, conduct cross-site scripting, manipulate data, or disclose confidential information. GitLab is widely deployed in European DevOps environments. Apply the latest GitLab security release.

WID-SEC-2026-2261 (Palo Alto Networks PAN-OS, NEU, hoch): Multiple vulnerabilities enabling XSS, code execution, security bypass, data manipulation, information disclosure, and denial of service. Organizations running PAN-OS firewalls should apply the latest PAN-OS updates promptly.

WID-SEC-2026-2262 (Progress Software MOVEit, NEU, hoch): Multiple vulnerabilities enabling security bypass, denial of service, and XSS. Given MOVEit’s history as a high-value target, apply available patches without delay. CVE-2026-11903 was detailed in yesterday’s report.

WID-SEC-2026-2267 (n8n, NEU, hoch): Multiple vulnerabilities enabling privilege escalation, information disclosure, data manipulation, XSS, security bypass, and code execution. n8n is a popular workflow automation tool in European organizations. Apply the latest n8n update.

WID-SEC-2026-2264 (FreeRDP, NEU, hoch): Remote code execution vulnerability in FreeRDP, exploitable by an unauthenticated remote attacker. Apply the latest FreeRDP release.

WID-SEC-2026-2266 (rclone, NEU, hoch): Multiple vulnerabilities allowing a remote authenticated attacker to read and write arbitrary files, disclose information, and bypass security mechanisms. Relevant for organizations using rclone for cloud storage synchronization.

WID-SEC-2026-2263 (LiteLLM, NEU, hoch): Multiple vulnerabilities enabling information disclosure, data manipulation, code execution, and security bypass in this LLM proxy framework.

WID-SEC-2026-2260 / WID-SEC-2026-2253 (IBM Operational Decision Manager and IBM Security Verify Access, NEU, hoch): Multiple vulnerabilities across both IBM enterprise products enabling code execution, privilege escalation, and security bypass. Apply IBM-supplied patches.

WID-SEC-2026-2251 (Drupal Modules, NEU, hoch): SQL injection, security bypass, information disclosure, and XSS in multiple Drupal modules. Audit installed modules and apply available updates.

WID-SEC-2026-2249 (Bitwarden, NEU, hoch): Security bypass vulnerability in Bitwarden for authenticated remote attackers. Apply the latest Bitwarden update.

WID-SEC-2026-1489 (Microsoft Windows, UPDATE, kritisch): Updated advisory for multiple Windows vulnerabilities. Apply all outstanding July 2026 Windows patches; RoguePlanet (CVE-2026-50656) is detailed in Critical Vulnerabilities above.

WID-SEC-2026-1829 (Wazuh Manager, UPDATE, kritisch): Privilege escalation vulnerability; patch still required if not yet applied.

ACTIVE THREATS AND CAMPAIGNS

NEW — GigaWiper Destructive Windows Backdoor Microsoft has analyzed GigaWiper, a modular Windows backdoor combining three destructive capabilities: full disk wiping, Windows drive overwriting, and fake ransomware that encrypts files with a discarded key (making recovery impossible). Operators select capabilities on demand. Attribution has not been publicly confirmed. The fake ransomware component may be used to obscure destructive intent or complicate incident response. SOC teams should review endpoint telemetry for unusual disk I/O patterns, kernel driver loads, and processes consistent with wiper behavior.

NEW — GodDamn Ransomware with PoisonX Kernel Driver A new ransomware family called GodDamn, assessed by Symantec as a rebrand of Beast ransomware, uses the PoisonX kernel driver to disable endpoint security software before encryption. First observed in the wild on 2026-05-21. The use of a kernel driver for defense evasion is a significant escalation. Review EDR telemetry for unsigned or anomalous kernel driver loads and ensure Secure Boot and Driver Signature Enforcement are enabled.

NEW — Helix Vishing Group Targeting SharePoint A new data-extortion group called Helix is conducting voice phishing (vishing), device code phishing, and MFA abuse to steal data from SharePoint environments. Tactics overlap with previously reported DEBULL device-code flow abuse. Brief helpdesk staff and end users; enforce Conditional Access policies blocking device code flow where not required; monitor SharePoint audit logs for bulk downloads.

NEW — Forg365 AI-Assisted Phishing-as-a-Service Targeting Microsoft 365 A new PhaaS platform called Forg365 combines adversary-in-the-middle (AiTM) and device code phishing with AI-generated lures to steal Microsoft 365 credentials. Enforce phishing-resistant MFA (FIDO2/passkeys) and review AiTM-aware Conditional Access policies.

NEW — Injective Labs npm Supply Chain Compromise Attackers compromised the Injective Labs SDK GitHub repository and published a malicious npm package that steals cryptocurrency wallet private keys and mnemonic seed phrases. Organizations with development teams working on blockchain or Web3 integrations should audit npm dependencies and review developer workstations for stealer indicators.

ONGOING — Dormant GitHub accounts used to enumerate corporate GitHub organizations via API: review GitHub org membership and audit OAuth token grants. ONGOING — Lurking Lizard fake 7-Zip installers enrolling devices as residential proxy nodes: block lookalike domains at DNS/proxy layer. ONGOING — Roundcube exploitation against academic and research institutions: verify Roundcube is fully patched; review webmail access logs. ONGOING — Entra passkey enrollment vishing targeting Microsoft 365: enforce out-of-band verification for all identity enrollment requests. ONGOING — DEBULL device-code flow abuse against M365: disable device-code flow in Conditional Access where not required.

SECURITY NEWS AND CONTEXT

Microsoft has released a complete patch for the RoguePlanet Defender zero-day (CVE-2026-50656), which was only partially addressed in June Patch Tuesday; Heise Security notes this is the final fix from the Nightmare Eclipse exploit set.

npm version 12 disables install scripts by default and deprecates granular access tokens that could bypass 2FA, a meaningful supply chain risk reduction for JavaScript ecosystems.

Operation First Light 2026, a global law enforcement action spanning 97 countries, resulted in 5,811 arrests and seizure of $293 million in assets linked to social engineering fraud.

AI coding agent security: researchers demonstrated “GhostApproval” symlink attacks against six AI coding assistants (Amazon Q, Claude Code, Augment, Cursor, Google Antigravity, Windsurf) enabling arbitrary file writes; a separate “Friendly Fire” proof-of-concept shows AI security scanning agents can be tricked into executing attacker code.

RECOMMENDED ACTIONS

  1. Verify Microsoft Defender engine update for RoguePlanet (CVE-2026-50656) has been applied on all Windows endpoints, prioritizing unmanaged and air-gapped systems.
  2. Apply Junos OS updates for CVE-2026-57026 and CVE-2026-57023 on all MX and SRX series devices; disable SIP and TCP proxy inspection where not required as an interim measure.
  3. Upgrade Metabase to 1.58.15, 1.59.12, 1.60.6.3, or 1.61.1.4; migrate default H2 database instances to a production database and restrict internet exposure.
  4. Upgrade YesWiki to 4.6.6 immediately (EPSS 0.56); disable Formula Calculator if patching is delayed.
  5. Upgrade Python to 3.15.0 or 3.16.0 to address CVE-2026-15308 HTML parser DoS; sanitize untrusted HTML input in the interim.
  6. Apply GitLab, PAN-OS, n8n, FreeRDP, rclone, and Bitwarden updates per BSI advisories published 2026-07-09.
  7. Review EDR telemetry for GodDamn/PoisonX kernel driver loads and GigaWiper disk I/O patterns; ensure Secure Boot and Driver Signature Enforcement are enabled.
  8. Brief helpdesk and end users on Helix vishing and Forg365 AiTM phishing targeting Microsoft 365; enforce Conditional Access blocking device code flow; audit SharePoint for bulk downloads.
  9. Audit npm dependencies for the malicious Injective Labs SDK package; review developer workstations for credential stealer indicators.
  10. Continue remediation of previously reported items: ColdFusion CVE-2026-48282/48316 (CISA deadline 2026-07-10), Langflow CVE-2026-55255 (deadline 2026-07-10), Joomla CVE-2026-48908/56290 (deadline 2026-07-10), CoreWCF CVE-2026-54782, GhostLock CVE-2026-43499, UniFi CVE-2026-50746, Kemp LoadMaster CVE-2026-8037, Oracle EBS CVE-2026-46817.