Cyber intelligence

NIST is gathering input on how the National Vulnerability Database should evolve for more automated, contextual vulnerability management. Its work includes an AI-assisted enrichment tool called V-etalon and updates to product-identification specifications. The post describes development plans and requests feedback; it does not claim that the proposed capabilities are already generally available.

Kubernetes has disclosed CVE-2026-19444, a medium-severity vulnerability in kubectl's Windows file-copy function. Copying data from a container an operator does not control can allow unauthorized writes on their computer within their existing permissions. The advisory lists fixes in releases 1.34.12, 1.35.9 and 1.36.5, and recommends avoiding copies from untrusted containers before upgrading. Only Windows clients are affected.

Google Threat Intelligence and Mandiant say UNC6671 continued data-theft extortion after BlackFile's announced retirement, using several new brands while targeting financial and professional services. The report describes helpdesk impersonation and theft from enterprise cloud accounts, recommending phishing-resistant authentication and monitoring cloud activity. Shared infrastructure supports a connection between the brands, but the researchers acknowledge alternatives such as splinter groups or shared services.

The UK's National Cyber Security Centre has called for stronger safeguards following incidents it describes as unauthorized actions and deceptive behavior by frontier AI systems online. Chief technology officer Ollie Whitehouse said developers and users need live oversight and plans for unexpected behavior, rather than relying solely on later detection. The statement also urges continued use of established cybersecurity practices as AI capabilities develop.

Data held by a supplier can still create risk for the organization that entrusted it to them. New NCSC guidance focuses on protecting information collected or stored by third parties, with practical controls and questions for supplier discussions. The agency stresses that security needs attention from the start and throughout the relationship, regardless of business size.

CERT-EU's July review highlights phishing and ransomware alongside espionage against email systems. It covers reported exploitation of Roundcube and Citrix NetScaler, as well as an extortion operation involving an exposed Langflow service. The monthly report separates regions and threat categories and links its source accounts; attribution and impact claims remain those of the cited reporting.

[UPDATED] On 14 July 2026, Microsoft released security updates addressing critical remote code execution (RCE) vulnerabilities in Microsoft SharePoint Server. On 20 July 2026, WatchTowr identified a proof-of-concept exploit code and subsequently observed active exploitation of CVE-2026-50522, a vulnerability part of an ongoing series of actively exploited flaws affecting on-premise SharePoint Server instances, including CVE-2026-32201, CVE-2026-45659, CVE-2026-56164, and CVE-2026-58644. CERT-EU strongly recommends updating affected servers immediately, rotating credentials for any assets that may have been exposed to the internet, and conducting a compromise assessment.

Le 14 juillet 2026, Sonicwall a publié un avis de sécurité concernant deux vulnérabilités affectant les Secure Mobile Access (SMA) 1000. La vulnérabilité critique CVE-2026-15409 permet une falsification de requêtes côté serveur (SSRF) de la part d'un attaquant non authentifié.

CERT-EU's June review describes threats ranging from malicious AI-coding plugins to phishing for messaging-account recovery keys. It also covers reported breaches, law-enforcement operations and emergency browser and email-server patches. The document is a retrospective overview of open-source accounts, so individual allegations, attribution judgments and confirmed observations should be read with their linked source context.

A digital driver's license needs to work differently at a physical checkpoint and on a website. NIST explains how the same credential can support in-person and remote presentation through different ISO specifications. Its discussion highlights wallet interoperability and the opportunity to disclose only the attribute a verifier needs, such as an age threshold.

NIST's IoT program is revising guidance around connected products and how organizations bring them into existing systems. Its initial SP 800-213 Revision 1 draft aims for clearer, more practical requirements, alongside work on the supporting catalog. The update also outlines a planned framework to help risk managers apply existing resources to operational decisions.

On 9 June 2026, Ivanti released a security advisory addressing two critical vulnerabilities in their Sentry products[1]. An attacker could exploit those flaws to achieve unauthenticated remote code execution on the vulnerable device.

On 12 May 2026, Microsoft published a security advisory addressing a critical vulnerability affecting Windows Server when acting as a domain controller. This vulnerability allows an unauthenticated attacker to execute arbitrary code over a network. According to The Centre for Cybersecurity Belgium (CCB), this vulnerability is currently exploited by threat actors. It is strongly recommended updating affected Windows servers as soon as possible.