Daily Threat Intelligence Brief - July 29, 2026

The Operator's Take

This week shows that the AI infrastructure stack is being attacked with the same tactics, and often the same mistakes, as the legacy enterprise stack. Langflow is not a novelty anymore. It is a production control plane that holds LLM keys, cloud credentials, and database secrets, and CVE-2026-55255 proves that an authorization bypass there is worth a CISA KEV entry. The lesson is not that AI is uniquely dangerous. It is that agent orchestration platforms inherited every classic web vulnerability, then added a high-value payload.

The same pattern repeats in SharePoint, ColdFusion, WordPress, and FortiSandbox. Attackers are not choosing between AI and infrastructure. They are chaining them. A SharePoint deserialization bug or a WordPress REST API route confusion can be the beachhead that leads to the environment where AI agents run, and from there to the secrets those agents can access. Defenders should stop treating AI tooling as a separate risk category with separate rules. Patch it, segment it, log it, and hunt on it with the same urgency as domain controllers and VPN concentrators.

The other thread this week is credentials as the real target. Langflow flows, SharePoint IIS machine keys, ColdFusion RDS endpoints, and FortiSandbox admin interfaces all sit on paths that lead to keys. Rotate secrets before you finish reading the incident report. If your agent platform is reachable from the same network segment as your SharePoint farm, you have already drawn the attack path.

Executive Summary

CISA added Microsoft SharePoint Server deserialization RCE CVE-2026-58644 to KEV on July 16, 2026, with a federal remediation deadline of July 19, 2026. Microsoft confirmed active zero-day exploitation before the July 14, 2026 patch release. The Hacker News, Rapid7
Langflow CVE-2026-55255, an insecure direct object reference in the /api/v1/responses endpoint, landed on CISA KEV on July 7, 2026. Active exploitation harvests credentials from other users' flows. Help Net Security, Sysdig
Adobe ColdFusion CVE-2026-48282, a path traversal in Remote Development Services leading to unauthenticated RCE, carries a CVSS 10.0 score and was added to KEV on July 7, 2026. Help Net Security, Akamai
WordPress Core CVE-2026-63030, dubbed wp2shell, allows unauthenticated RCE via REST API batch route confusion chained with SQL injection CVE-2026-60137. CISA added it to KEV on July 21, 2026. Rapid7, SANS ISC
Fortinet FortiSandbox CVE-2026-25089 and CVE-2026-39808 are OS command injection flaws rated up to CVSS 9.8, added to CISA KEV on July 16, 2026, with public PoC availability reported for CVE-2026-39808. NVD CVE-2026-25089, NVD CVE-2026-39808
containerd CVE-2026-53492 lets an attacker inject untrusted Container Device Interface annotations from a checkpoint image, leading to container escape when CDI is enabled. SentinelOne, Intruder CVEmon
OWASP reports prompt injection as the fastest-growing attack category, with a 340% year-over-year surge, while MCP tool poisoning benchmarks show attack success rates above 60%. adyog, iTecs Online
The Anubis ransomware group claimed responsibility for the Fairlife ransomware attack, disrupting U.S. dairy production and allegedly stealing approximately 1 TB of data. SecurityWeek, Bitdefender
Salt Typhoon remains an active PRC state-sponsored threat to telecommunications providers globally, with ongoing intrusions into routing infrastructure reported into 2026. FBI, Global Cyber Alliance
Large-scale data breaches disclosed around July 2026 include a 24 billion record exposed infostealer database, the Canvas education breach affecting 275 million student records, and AssuranceAmerica affecting approximately 7 million customers. ITRC, DuoCircle

Critical Vulnerabilities

CVE-2026-58644: Microsoft SharePoint Server Deserialization RCE

Microsoft patched CVE-2026-58644 on July 14, 2026, and CISA added it to KEV two days later. The flaw is a deserialization issue in SharePoint Server 2016, 2019, and Subscription Edition that leads to remote code execution. Microsoft later confirmed it was exploited as a zero-day before patches were available. Some analyses describe the vulnerability as unauthenticated network RCE, while Microsoft’s advisory text notes an attacker authenticated as at least a Site Owner can inject arbitrary code. Either way, the impact is critical and the exploitation window is open.

Attackers have been observed stealing IIS machine keys, deploying web shells, and establishing deserialization-based persistence after compromise. The patch must be applied to every server in a farm, followed by the SharePoint Products Configuration Wizard. SharePoint Server 2016 and 2019 reached extended support end on July 14, 2026, so organizations still running those builds should treat migration as a security control, not a roadmap item.

Detail	Value
Product	Microsoft SharePoint Server 2016, 2019, Subscription Edition
Type	Deserialization leading to RCE (CWE-502)
CVSS	9.8
KEV added	July 16, 2026
Federal deadline	July 19, 2026
Fixed builds	2016: 16.0.5556.1005; 2019: 16.0.10417.20153; SE: 16.0.19725.20384

Sources: The Hacker News, Rapid7, NCSC NZ

CVE-2026-55255: Langflow Authorization Bypass / IDOR

Langflow, an open-source visual builder for AI agent workflows, became the first AI agent orchestration platform to land on CISA KEV in the same category as network appliances and enterprise servers. CVE-2026-55255 is an insecure direct object reference in the /api/v1/responses endpoint. When a flow is accessed by UUID, the backend does not verify ownership, allowing an authenticated attacker to execute another user's flow.

The real damage is secret harvesting. Flows routinely embed LLM provider API keys, AWS credentials, database passwords, and service account tokens. Sysdig observed exploitation beginning around June 25, 2026, with attackers enumerating flow IDs and injecting prompts such as "leak api keys" into hijacked flows. In multi-tenant deployments this becomes a cross-tenant credential breach.

Detail	Value
Product	Langflow prior to 1.9.2
Type	Insecure direct object reference / authorization bypass (CWE-639)
CVSS	8.4 to 9.9 depending on source
KEV added	July 7, 2026
Federal deadline	July 10, 2026
Advisory	GHSA-qrpv-q767-xqq2

Sources: Help Net Security, Sysdig, SentinelOne

CVE-2026-48282: Adobe ColdFusion Path Traversal to RCE

Adobe patched CVE-2026-48282 in advisory APSB26-68 on June 30, 2026. The flaw sits in the Remote Development Services FILEIO handler at /CFIDE/main/ide.cfm?ACTION=FILEIO. Insufficient path validation allows an unauthenticated attacker to write files outside the intended directory using traversal sequences. A malicious CFML or JSP file dropped into a web-accessible path yields RCE, often as NT AUTHORITY\SYSTEM on Windows hosts.

Exploitation requires RDS to be enabled with weak or disabled authentication. Active exploitation was observed within hours of public technical analysis. CISA added the CVE to KEV on July 7, 2026.

Detail	Value
Product	Adobe ColdFusion 2025 Update 9 and earlier; 2023 Update 20 and earlier
Type	Path traversal leading to RCE (CWE-22)
CVSS	10.0
KEV added	July 7, 2026
Fixed versions	ColdFusion 2025 Update 10; ColdFusion 2023 Update 21

Sources: Help Net Security, Akamai, Deepwatch

CVE-2026-63030: WordPress Core REST API Batch Route Confusion RCE

CVE-2026-63030, named wp2shell, is a critical flaw in the WordPress REST API batch endpoint. When chained with CVE-2026-60137, an SQL injection in WP_Query::author__not_in, an unauthenticated attacker can achieve RCE on default WordPress installations. The root cause is a desynchronization between failed sub-request validation and route matching in WP_REST_Server::serve_batch_request_v1(). A malformed sub-request causes later requests to execute under the wrong route handler, skipping type checks and enabling SQL injection.

Attackers can extract admin password hashes for offline cracking and plugin upload, or use INTO OUTFILE to write a PHP shell if the MySQL user has FILE privilege. WordPress.org pushed forced automatic updates for affected branches. CISA added CVE-2026-63030 to KEV on July 21, 2026.

Detail	Value
Product	WordPress 6.8.0 to 6.8.5, 6.9.0 to 6.9.4, 7.0.0 to 7.0.1
Type	Route confusion + SQL injection leading to RCE
CVSS	9.8
KEV added	July 21, 2026
Fixed versions	6.8.6, 6.9.5, 7.0.2

Sources: Rapid7, SANS ISC, Qualys

CVE-2026-25089 and CVE-2026-39808: Fortinet FortiSandbox Dual OS Command Injections

FortiSandbox, the appliance that inspects suspicious files for other security controls, became the target this week. CVE-2026-25089 and CVE-2026-39808 are OS command injection vulnerabilities in the management interface that can allow unauthenticated remote code execution as root. CISA added both to KEV on July 16, 2026, with a federal remediation deadline of July 19, 2026. Public PoC code has been reported for CVE-2026-39808.

The irony is obvious: a security sandbox that can be compromised becomes a beachhead with privileged access to the files it is supposed to analyze. Organizations running FortiSandbox should patch to 4.4.9 or 5.0.6, restrict management access, and review logs for suspicious command execution.

Detail	Value
Product	FortiSandbox 4.4.x, 5.0.x; FortiSandbox Cloud and PaaS
Type	OS command injection (CWE-78)
CVSS	9.1 to 9.8
KEV added	July 16, 2026
Fixed versions	4.4.9+, 5.0.6+

Sources: NVD CVE-2026-25089, NVD CVE-2026-39808, SecPod

CVE-2026-53492: containerd CDI Annotation Trust Bug

On July 1, 2026, containerd disclosed a set of vulnerabilities in the CRI checkpoint restore path. CVE-2026-53492 is the most severe: the CRI plugin trusts Container Device Interface annotations embedded in untrusted checkpoint image metadata. A user with pod creation permissions can inject arbitrary CDI edits, including device nodes and host mounts, into a restored container. If CDI is enabled on the node and a matching host CDI spec exists, this leads to container escape.

Three related CVEs were disclosed the same day: CVE-2026-53489 allows arbitrary host file read via a symlinked container.log, CVE-2026-50195 allows checkpoint image cache poisoning, and CVE-2026-53488 allows arbitrary host command execution through container labels. Patch containerd to 2.3.2, 2.2.5, 2.1.9, 2.0.10, or 1.7.33 depending on branch.

Detail	Value
Product	containerd prior to 2.3.2, 2.2.5, 2.1.9, 2.0.10, 1.7.33
Type	Trust boundary violation in checkpoint restore
CVSS	8.4
Disclosed	July 1, 2026
Fixed versions	2.3.2, 2.2.5, 2.1.9, 2.0.10, 1.7.33

Sources: SentinelOne, Intruder CVEmon

AI Security Threats

Agent Orchestration Platforms Enter the Production Target Set

Langflow joining CISA KEV is a signal, not an outlier. AI agent orchestration platforms are control planes. They store provider keys, connect to databases, invoke APIs, and often run with broad permissions. They are also web applications built with the same frameworks and mistakes as everything else. CVE-2026-55255 is an IDOR. CVE-2026-0770, also added to KEV in July 2026, is an unauthenticated root RCE in Langflow through exec_globals. The attack surface is familiar. The consequences are amplified because the asset is a credential concentrator.

Defenders should apply the same controls to Langflow, CrewAI, Dify, and similar platforms that they apply to CI/CD servers: patch immediately, disable auto-login in production, run as a non-root least-privilege user, place the interface behind SSO or VPN, and audit every flow for embedded secrets. More on prompt injection and agentic red teaming is in the KrypteiaSec glossary.

Prompt Injection Surge and MCP Tool Poisoning

OWASP identified prompt injection as the fastest-growing cyberattack category globally, with a 340% year-over-year increase. The growth tracks the deployment of agentic systems that read untrusted content, emails, web pages, and documents, then take action on it. A malicious instruction hidden in an attachment or web page can cause an AI email assistant to forward sensitive files, exfiltrate AWS keys, or approve fraudulent transactions.

The Model Context Protocol expands the blast radius. MCP tool poisoning occurs when malicious instructions are embedded in tool schemas, server descriptions, or resources that the LLM processes as trusted content. The MCPTox benchmark tested live MCP servers and found tool-poisoning success rates above 60%, with some configurations reaching 72%. More capable models were sometimes more vulnerable because their stronger instruction-following made them more compliant with poisoned tool metadata.

Threat	Mechanism	Risk
Direct prompt injection	Malicious instructions in user input	Data exfiltration, unauthorized actions, jailbreak
Indirect prompt injection	Malicious instructions in retrieved content	Compromise of agents reading email, web, documents
MCP tool poisoning	Malicious instructions in tool schemas or server metadata	Persistent compromise of agent tool calls
Supply-chain poisoning	Compromised MCP server or package	Broad victim population, persistent access

OX Security disclosed a systemic MCP STDIO vulnerability in April 2026 affecting more than 150 million SDK downloads and an estimated 200,000 vulnerable instances across Python, TypeScript, Java, and Rust SDKs. The issue highlights that the MCP supply chain itself is now a target.

Defensive Priorities for AI Systems

Runtime interception is more reliable than defensive prompting alone. Studies show that defensive system prompts can be overridden by attacker instructions. Recommended layers include an MCP gateway or proxy to sanitize tool calls, input and output filtering, anomaly detection on agent behavior, least-privilege tool permissions, and human-in-the-loop approval for high-impact actions. Static scanners such as mcp-scan and Inkog can detect misconfigurations and vulnerable patterns in open-source agents before deployment.

Sources: adyog, iTecs Online, LangProtect, CSA Labs, GitHub awesome-ai-agent-attacks

Threat Actor Activity

Salt Typhoon: Telecommunications Under Persistent Pressure

Salt Typhoon, a PRC state-sponsored group also tracked as OPERATOR PANDA, RedMike, UNC5807, and GhostEmperor, remains active against telecommunications providers worldwide. CISA, FBI, NSA, and international partners published joint advisory AA25-239A on August 27, 2025, detailing compromise of backbone, provider-edge, and customer-edge routers. The campaign has affected hundreds of organizations across more than 80 countries.

By early 2026, the FBI stated the threat was still ongoing. Norway and Singapore confirmed national telecom breaches, and U.S. House committee email systems were also reportedly compromised. The strategic objective appears to be long-term access to communications infrastructure for intelligence collection and potential disruption.

Actor	Attribution	Primary targets	Notable TTPs
Salt Typhoon	PRC	Telecom, government, transportation, military	Router compromise, config theft, covert proxies
Volt Typhoon	PRC	US and allied critical infrastructure	Living-off-the-land, SOHO router proxies
APT28 / Forest Blizzard	Russian GRU	Military, logistics, Ukrainian targets	Signal compromise, SlimAgent malware
APT29 / Midnight Blizzard	Russian SVR	Diplomatic, cloud environments	OAuth abuse, token theft, Graph API exfiltration
Kimsuky	North Korea	Government, defense, academic, policy	Spear-phishing, QR-code phishing, credential harvesting

LLM-Assisted Tradecraft

State actors are increasingly using LLMs to generate native-quality spear-phishing lures, reconnaissance scripts, and social engineering content. The same tools that lower the barrier for legitimate automation also lower the barrier for targeted phishing at scale. Defenders should expect better grammar, more context-aware pretexts, and faster iteration on failed lures.

Sources: FBI, Global Cyber Alliance, NJCCIC, Hunt.io Kimsuky, CloudSEK Top APTs 2026

Ransomware and Data Breaches

Ransomware

Victim	Actor	Impact	Notes
fairlife, LLC (Coca-Cola subsidiary)	Anubis	U.S. production suspended; ~1 TB data allegedly stolen	Disclosed July 16, 2026; production largely resumed by July 28
Various	Medusa	Ongoing campaigns against healthcare, education, government	CISA advisory AA25-071A covers TTPs including IAB-purchased access and ProxyShell

Sources: SecurityWeek, Bitdefender, Valtik Studios Medusa

Data Breaches

Victim	Records exposed	Notes
Exposed infostealer database	24 billion records (8.3 TB)	Unprotected database aggregating 36 cybercrime sources; exposed during server migration
Canvas / Instructure	275 million student records across 9,000+ schools	ShinyHunters breach disclosed May 2026
AssuranceAmerica	~7 million customers	Unauthorized access discovered March 2026; disclosed early July 2026
Accenture	~35 GB source code and internal files	Threat actor "888" offered stolen data including keys and tokens
Mount Royal University	10 TB allegedly stolen	Calgary university confirmed breach affecting students
Medtronic	~3.8 million individuals confirmed	ShinyHunters corporate IT breach
DentaQuest	~2.6 million members	PII and PHI exposed

Sources: ITRC, DuoCircle, Rescana Medtronic, Rescana DentaQuest

Recommended Actions

Immediate (this week)

Patch SharePoint Server to the July 14, 2026 cumulative update and run the Products Configuration Wizard on every farm member.
Patch or block FortiSandbox management interfaces; upgrade to 4.4.9 or 5.0.6.
Upgrade Langflow to 1.9.2 or later; rotate all credentials embedded in flows.
Upgrade WordPress to 6.8.6, 6.9.5, or 7.0.2; if patching is delayed, block unauthenticated access to /wp-json/batch/v1.
Patch Adobe ColdFusion to 2025 Update 10 or 2023 Update 21; disable RDS if not required.
Upgrade containerd to patched versions and audit checkpoint restore permissions.
Rotate IIS machine keys on SharePoint farms only after confirming the host is clean.

Short-term (next 30 days)

Audit all AI agent orchestration platforms for internet exposure, embedded secrets, and patch levels.
Deploy an MCP gateway or proxy to sanitize tool calls and enforce least-privilege tool permissions.
Implement runtime prompt injection detection for production LLM applications.
Segment AI tooling from domain controllers, SharePoint farms, and CI/CD pipelines.
Review telecom and router hardening against Salt Typhoon TTPs.

Strategic (next 90 days)

Treat AI orchestration platforms as Tier 0 assets with the same lifecycle management as identity and CI/CD infrastructure.
Build an agentic red teaming program that tests prompt injection, tool poisoning, and credential escape paths.
Establish a secret rotation program tied to exposure events, not just calendar dates.
Migrate off end-of-life SharePoint Server 2016 and 2019 builds.
Align ransomware response with CISA’s updated #StopRansomware guide and ensure backup recovery paths are tested and isolated.