6 verified findings from 3 runs · 1 update to prior coverage · the settled record for this UTC day, in the classic brief order.
Criticality
Kind
Topic
Region
TL;DR · the day in one read
01ServiceNow patches an unauthenticated code-execution sandbox escape in its AI Platform; self-hosted and partner-managed instances are the residual exposure. ServiceNow disclosed CVE-2026-6875 (CVSS 9.5), a sandbox escape in the ServiceNow AI Platform that, in certain circumstances, lets an unauthenticated user execute code within the platform. ServiceNow has already fixed its own hosted instances and reports no known exploitation; self-hosted and partner-managed customers running ITSM/case-management on-prem must apply the listed family-release patches. →
02Progress tells all on-prem ShareFile Storage Zone Controller customers to power off their servers over an undisclosed 'credible external security threat'. Progress Software has ordered every customer running an on-premises ShareFile Storage Zone Controller (SZC) — the internet-facing IIS component bridging ShareFile's cloud to customer-managed storage — to physically shut the hosting server down over "a credible external security threat," first notified 2026-07-10 and still unresolved on the vendor status page as of 2026-07-13. No CVE, root cause, patch or restart timeline has been published; the shutdown-not-patch instruction signals no fix yet exists. Exposure of the component concentrates in the US and Germany, giving Swiss/European on-prem file-exchange operators direct reason to act. →
0319-agency advisory details FSB Centre 16 router hijacking via SNMP and Cisco Smart Install as the UK and EU attribute Poland's Dec-2025 grid sabotage. A joint Cybersecurity Advisory from 19 agencies across 13 countries (2026-07-13) details how Russian FSB Centre 16 (Static Tundra / Berserk Bear) opportunistically compromises internet-facing routers across energy, government, telecom, finance and healthcare — chiefly by abusing default/weak SNMP community strings and the seven-year-old Cisco Smart Install flaw CVE-2018-0171 (CISA KEV) to exfiltrate device configurations. On the same day the UK and EU formally attributed the destructive 29 Dec 2025 attack on Poland's energy grid to this FSB unit and imposed their first joint cyber-sanctions package. Swiss and European critical-infrastructure operators running Cisco IOS/IOS XE or legacy SNMP on exposed network devices should treat router hygiene as an active-exploitation priority. →
Progress Software has told every customer running an on-premises ShareFile Storage Zone Controller (SZC) — the self-hosted IIS component that lets ShareFile's SaaS front end store files on customer-controlled storage (local filesystem, SMB, SharePoint, S3/Azure) rather than in Progress's cloud — to manually power off the Windows server hosting it, citing "a credible external security threat" first notified to customers on 2026-07-10 (BleepingComputer, 2026-07-10). Three days on, the vendor status page still lists the Storage Zone Controller service as not operational and under investigation (Progress ShareFile status, 2026-07-13), and Progress has disclosed neither a CVE, a root cause, nor a patch or safe-restart timeline; the mitigation on offer is a full shutdown rather than an update, with no fix published as of this run (heise online, 2026-07-13; SecurityWeek, 2026-07-13). heise characterises the shutdown as a precautionary measure during an ongoing investigation. Progress states it has no indication of unauthorized access to any ShareFile account or data so far. Only on-premises SZC deployments are affected; cloud-only ShareFile tenants are not.
This sits on top of a chainable pre-auth RCE that watchTowr Labs disclosed in the same component in April 2026: CVE-2026-2699 (CVSS 9.8) is a CWE-698 execution-after-redirect authentication bypass in /ConfigService/Admin.aspx, where Response.Redirect() is called with the terminate flag set to false, so the admin page body still renders and executes after the browser is told to redirect to login; CVE-2026-2701 (CVSS 9.1) chains from that access, because the storage-location validation only checks writability, letting an attacker repoint the storage repository at the IIS web root and land an ASPX web shell (watchTowr Labs, 2026-04-02). Both were fixed in Storage Zone Controller 5.12.4 (the 6.x .NET-Core branch was unaffected); watchTowr counted roughly 30,000 internet-facing SZC instances at disclosure. Progress has not said whether the current threat relates to this chain or to a separate issue.
Defender takeaway. This is the same on-prem, internet-facing, managed-file-transfer-adjacent architecture class (ShareFile, MOVEit, GoAnywhere, Cleo) that has repeatedly produced mass pre-auth exploitation, and a vendor ordering customers to pull the plug rather than patch is a strong signal to treat any exposed SZC as untrusted until Progress publishes scope. Regardless of whether the July threat proves related to CVE-2026-2699/2701, any instance still on SZC 5.x below 5.12.4 carries a known, PoC-backed pre-auth RCE and should be upgraded or taken offline now. Since Progress has confirmed no mechanism, treat the CWE-698 chain as the working hunt hypothesis.
Triage: an authenticated administrator legitimately hits /ConfigService/Admin.aspx and receives a normal authenticated session; the anomaly for the known chain is a request to that path that returns a 302 whose response body nonetheless carries the full admin-panel HTML (the execution-after-redirect behaviour) rather than the redirect being honoured, followed by configuration changes to Zone/Primary-Zone-Controller/storage-repository fields outside a change window — and, downstream, an .aspx file appearing under a StorageCenter webroot subdirectory that is not part of the vendor's shipped file set.
We have reason to believe there is a credible external security threat targeting Progress Software's ShareFile Storage Zone Controllers.
Currently, we have no indication of unauthorized access to any Progress ShareFile accounts or data.
Progress Software (via BleepingComputer)
ShareFile customers with Storage Zone Controllers are not operational at this time.
The alert arrived the same day that independent honeypots began detecting active, in-the-wild attempts to exploit a critical authentication bypass vulnerability the vendor patched earlier this year in its ShareFile Storage Zone Controller software.
Honeypots run by nonprofit cybersecurity organization Shadowserver Foundation first recorded active, in-the-wild attacks attempting to exploit CVE-2026-2699 on Friday.
This smells like CL0P ransomware group activity. If you use ShareFile, be like C-3PO and 'shut them all down.'
Two developments harden the picture around Progress's emergency ShareFile Storage Zone Controller (SZC) shutdown order. First, the shutdown was not precautionary in the abstract: the alert "arrived the same day that independent honeypots began detecting active, in-the-wild attempts to exploit" the pre-auth authentication-bypass flaw CVE-2026-2699, with Shadowserver Foundation honeypots first recording those attempts on Friday 2026-07-10 (BankInfoSecurity, 2026-07-13). This moves the flaw's status from PoC-public to actively exploited. Second, defenders responded at scale — the number of internet-exposed Storage Zone Controllers fell from watchTowr's April count of about 30,000 to roughly 1,000 by 2026-07-13, evidence of widespread emergency power-downs (BankInfoSecurity, 2026-07-13). Progress restored ShareFile cloud-service access for SZC customers but continues to require the on-prem controllers themselves stay powered off pending its investigation, and still reports no evidence of unauthorized access to customer data (The Register, 2026-07-13; Progress ShareFile status, 2026-07-13).
Recorded Future analyst Allan Liska publicly assessed that the pattern "smells like CL0P ransomware group activity," pointing to Clop's long record of mass-exploiting secure file-transfer software (Accellion FTA, GoAnywhere, MOVEit, Cleo Harmony, and Oracle E-Business Suite) (BankInfoSecurity, 2026-07-13). This is a named researcher's hypothesis, not an attribution: Progress has identified no actor and disclosed no root cause.
Defender takeaway. The one-day earlier guidance — treat any exposed SZC as untrusted and keep it powered off rather than patched — is now backed by confirmed in-the-wild exploitation, so it should carry more weight, not less, for any organisation that has not yet acted. Exposure concentrates in the US and Germany, keeping this directly relevant to European on-prem file-exchange operators. The recommended state remains a full power-off of on-prem Storage Zone Controllers until Progress publishes scope; the original entry's shutdown and bounded-compromise-check actions still stand unchanged.
Progress Software has confirmed the root cause behind its emergency ShareFile Storage Zone Controller (SZC) shutdown order: a high-severity path-traversal vulnerability affecting SZC versions 5.x and 6.x that lets an authenticated administrative user read arbitrary files accessible to the application's service account, write malicious content to server directories, and enumerate the filesystem layout (BleepingComputer, 2026-07-14) — a CWE-22-class flaw reachable through the SZC's internet-facing IIS component. Progress has shipped patched versions 5.12.5 and 6.0.2, and a CVE identifier is reserved but will not be published for two weeks. The vendor states it has "no indication of unauthorized access to any ShareFile customer account or data," a claim that sits alongside this run's earlier finding that Shadowserver honeypots recorded in-the-wild exploitation attempts against the same component from 2026-07-10. Progress's status page confirms Storage Zone Controller customer access "is currently being restored," with recovery instructions issued directly to account owners (Progress — ShareFile Status Page, 2026-07-14), closing out the multi-day outage that began with the 2026-07-10 shutdown order.
Dutch intelligence services AIVD (General Intelligence and Security Service) and MIVD (Military Intelligence and Security Service) disclosed on 2026-07-11 that Russia-linked actors compromised "a small number" of internet-connected cameras positioned along routes used to move military supplies to Ukraine through the Netherlands — including cameras operated by businesses located on those routes — giving the operators remote viewing access to the shipments and equipment being moved (NL Times/ANP, 2026-07-11). The agencies state the cameras were reachable chiefly because they "still us[e] default passwords or outdated firmware" — weak/default-credential abuse and unpatched embedded firmware on internet-exposed devices, not a bespoke exploit chain. On 2026-07-13, after EU ministerial consultations in Brussels, the Netherlands summoned the Russian ambassador; France, Germany and Finland took the same step over related espionage and sabotage concerns, and NATO issued a joint statement condemning "the persistent malicious cyber activities of Russia" (NL Times/ANP, 2026-07-13). AIVD/MIVD separately warned businesses located along military-logistics routes to harden their camera and IoT security. This is a distinct technical story from the same-day FSB Centre 16 router-hijacking advisory and the Turla espionage attribution covered separately today — here the compromised asset class is consumer/commercial IP cameras used for physical-logistics surveillance.
Dutch intelligence services disclosed Friday that Russian actors had compromised “a small number of cameras” on routes for military shipments to Ukraine. The breaches allowed the hackers remote viewing access, according to statements from the General Intelligence and Security Service (AIVD) and the Military Intelligence and Security Service (MIVD).
We strongly condemn the persistent malicious cyber activities of Russia. The country uses its cyber ecosystem to attack allies and NATO partners.
CERT@VDE — Germany's OT/ICS coordinating CERT, acting as CVE Numbering Authority for the vendor — published advisory VDE-2026-031 / CVE-2026-4769 on 2026-07-13 for WAGO I/O System Field series coupler devices (models 0765-110x, 0765-120x, 0765-150x, 0765-2101, 0765-2102, 0765-410x, 0765-420x, 0765-450x, all variant /0100-0000) (CERT@VDE, 2026-07-13). Certain devices activate an undocumented internal diagnostic capability during the initial boot sequence — functionality outside the publicly documented feature set — which is reachable without authentication for a brief window before the main operating environment and its security controls become fully active (CWE-912 Hidden Functionality). If an attacker has network access to the device during that early-boot window, they can interact with internal system processes normally protected during regular operation, which CERT@VDE describes as resulting in full system compromise. The advisory carries a CVSS 3.1 vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (9.8), and the ENISA EU Vulnerability Database entry EUVD-2026-43297 lists a CVSS 4.0 base score of 9.3 (ENISA EUVD, 2026-07-13). No exploitation has been reported and EPSS is 0.0. WAGO has released fixed firmware for each affected model.
WAGO I/O System Field devices are modular fieldbus I/O couplers used in industrial automation and building-management deployments, including energy and water-utility OT environments in the constituency's additional sectors. The practical exploitability is bounded — an attacker must have network reachability to the device precisely during its early-boot window — but the impact if that condition is met is unauthenticated, full compromise of an operational field device, and OT patch cycles are slow, so the exposure can persist. Detection is best framed as OT network monitoring: correlate device power-cycle/reboot events (from maintenance logs or the device's own uptime telemetry) with any new inbound session to the device's management/diagnostic ports in the same time window — a connection arriving during a reboot, rather than steady-state operation, is the anomaly this vulnerability creates. Hardening: apply the per-model fixed firmware listed above and, until then, keep these couplers behind VLAN/ACL segmentation from any untrusted network segment, tightening reachability during planned maintenance reboots when the early-boot window is opened deliberately.
This functionality is not formally documented and becomes accessible without authentication for a brief period in the early boot phase. During this window, an unauthenticated remote attacker can gain access to the internal system processes, resulting in full system compromise.
ServiceNow disclosed CVE-2026-6875, a "Sandbox Escape in ServiceNow AI Platform" rated CVSS 4.0 9.5, in security bulletin KB3137947 published 2026-07-13 (ServiceNow, 2026-07-13; ENISA EUVD, 2026-07-13). Per ServiceNow, the flaw "could enable an unauthenticated user, in certain circumstances, to execute code within the ServiceNow platform" — an isolation failure in the AI Platform's code-execution environment. ServiceNow states it "addressed this vulnerability by deploying a security update to hosted instances," provided updates to self-hosted customers and partners, and is "not currently aware of exploitation against ServiceNow instances" (ServiceNow, 2026-07-13). Fixed releases are Zurich Patch 7b/9, Yokohama Patch 12 Hot Fix 1b/13, Australia Patch 2 and Brazil EA/GA. Because hosted instances were remediated server-side by the vendor, the live exposure is narrowed to self-hosted and partner-managed deployments that have not yet applied the update — a population that still includes public-sector and critical-infrastructure operators running ServiceNow ITSM, HR-service-delivery and case-management on-prem or through partners.
This vulnerability, tracked as CVE-2026-6875, could enable an unauthenticated user, in certain circumstances, to execute code within the ServiceNow platform.
We are not currently aware of exploitation against ServiceNow instances.
The unauthenticated ServiceNow AI Platform sandbox escape has moved from "no known exploitation" to confirmed active exploitation. NCSC-CH's 2026-07-20 advisory revision set the item's status to "Actively exploited" (NCSC-CH, 2026-07-20), and BleepingComputer reports attackers "begun exploiting a critical vulnerability (CVE-2026-6875) in the ServiceNow AI Platform," attributing the in-the-wild observation to threat-intelligence firm Defused from around 2026-07-18 (BleepingComputer, 2026-07-20). The mechanism is unchanged from the original entry — an unauthenticated caller reaches unrestricted server-side script execution through the GlideRecord query path, a chain Searchlight Cyber demonstrated where "running any code via eval or new Function will run free from the constraints of the additional sandbox" (Searchlight Cyber, 2026-07-14).
The operational change is entirely one of urgency: exploitation is live, so any self-hosted or partner-managed AI Platform instance still missing the vendor hotfix has crossed from "patch on the normal cycle" to "patch out of band."
VulnCheck disclosed a six-CVE chain in Rejetto HFS (HTTP File Server) 3.0.0 through 3.2.0, all fixed in 3.2.1 on 2026-07-13 (VulnCheck, 2026-07-13). The headline flaw, CVE-2026-61500 (CVSS 4.0 9.3, CWE-338 weak PRNG), derives the session-cookie signing key from JavaScript's non-cryptographic Math.random() and leaks outputs of that same generator to unauthenticated clients on the login endpoint; an attacker who collects a small number of login responses can reconstruct the generator's internal state, recover the signing key and forge a valid administrator session cookie — reaching full admin access and code execution through HFS's built-in server_code configuration feature (arbitrary server-side script), with no authentication or user interaction (VulnCheck, 2026-07-13). Five companion bugs, all verified on NVD and fixed in the same 3.2.1 release, lower the bar further: unauthenticated username enumeration including the default admin account (CVE-2026-61503), state-changing admin actions accepted over GET with no anti-CSRF check (CVE-2026-61502), stored XSS rendered when an admin views the log via a crafted failed-login username (CVE-2026-61501) and via unescaped filenames in the fallback "basic" listing reachable by anonymous uploaders (CVE-2026-61504), and a lang-parameter path traversal limited to reading specific JSON files outside shared folders (CVE-2026-61505). No in-the-wild exploitation of this 3.x chain has been reported yet; the risk is the standard one for a pre-auth, unauthenticated-RCE flaw in internet-facing file-sharing software whose patch is already public — once the forge-the-cookie technique is understood, an exposed instance is a low-effort opportunistic target.
Rejetto HFS 3.0.0 through 3.2.0 derives its session-cookie signing key from the non-cryptographic Math.random() generator and discloses outputs of the same generator to unauthenticated clients during login.
A remote attacker can collect a small number of login responses, reconstruct the generator's state, recover the signing key, and forge a valid administrator session cookie, leading to full administrative access and remote code execution via the server_code configuration feature.
On 2026-07-13 France (ANSSI/C4) and the EU High Representative formally attributed the Turla intrusion set to Russia's FSB 16th Centre, publishing CERT-FR report CERTFR-2026-CTI-005 with French victimology (defence, diplomatic, justice and technology entities since 2017) and its spearphishing/watering-hole TTPs; the EU sanctioned 9 individuals and 4 organisations (incl. AO AST, NPP Gamma) and the UK sanctioned 24. Companion to the morning's Static Tundra router-hijacking advisory — the sibling FSB Centre 16 espionage cluster.
The morning entry covered the 19-agency Static Tundra/Berserk Bear advisory (SNMP and Cisco Smart Install router hijacking) and the UK/EU attribution of the December 2025 Polish grid sabotage. This delta covers the sibling FSB Centre 16 cluster — Turla — which France and the EU formally attributed the same day. France's Cyber Crisis Coordination Centre (C4 — ANSSI, COMCYBER, DGA, DGSE, DGSI and the Ministry for Europe and Foreign Affairs) and the EU High Representative jointly attributed the Turla intrusion set to the FSB's 16th Centre on 2026-07-13, publishing CERT-FR's technical report CERTFR-2026-CTI-005 alongside formal French and EU attribution statements (CERT-FR, 2026-07-13; ANSSI, 2026-07-13). France's COMCYBER describes Turla as an FSB 16th Centre attack mode (mode opératoire) used for intelligence-gathering since at least 2004 (COMCYBER, 2026-07-13). The 16th Centre is the parent unit behind both this Turla/Secret Blizzard espionage set and the Static Tundra/Berserk Bear router-hijacking cluster covered this morning — the EU-sanctions reporting describes the 16th Centre as controlling groups including Turla (heise online, 2026-07-13).
ANSSI documents French Turla victims including Ministry of Armed Forces webmail accounts compromised since 2017, the network of the French Embassy in Moscow (2018), a justice-sector personnel-training host (2019) and an advanced-technology company (2025), plus opportunistic intermediary compromises across varied sectors between 2019 and 2025 used as relay infrastructure (CERT-FR, 2026-07-13). The initial-access tradecraft combines spearphishing and watering-hole attacks that lure targets into downloading malicious files masquerading as legitimate software, plus exploitation of vulnerabilities in webmail/messaging services, browsers, business applications and web servers; the operators favour rented or previously-compromised infrastructure for camouflage (ANSSI, 2026-07-13). In coordination, the EU sanctioned 9 individuals and 4 organisations (entry bans and asset freezes), including the enabler firms Advanced System Technology (AST) and NPP Gamma, and the UK sanctioned 24 individuals and organisations; the EU Council statement names Germany, Poland, Cyprus, the Netherlands, Austria, Slovakia, Romania and Finland among affected states (heise online, 2026-07-13).
Background. The FSB Centre 16 network-device cluster is not new — it has a decade-plus public record under the vendor labels Berserk Bear, Energetic Bear, Crouching Yeti, Dragonfly and Ghost Blizzard, and Cisco Talos profiled it in August 2025 as "Static Tundra," documenting long-term compromise of unpatched and end-of-life network gear for configuration theft and persistent collection (Cisco Talos, 2025-08-20). What is new is a same-day trio of actions on 2026-07-13: a much fuller TTP disclosure, a formal government attribution of a destructive attack, and the first coordinated EU/UK cyber-sanctions package.
A joint Cybersecurity Advisory carrying 19 authoring and co-sealing agencies across 13 countries — NSA, CISA, FBI and DC3 (US) alongside the cyber and intelligence authorities of Australia, Canada, New Zealand, the UK, Czech Republic, Denmark, Estonia, Finland, France, Italy, Poland and Sweden — describes FSB Centre 16 opportunistically compromising poorly configured routers across communications, defense industrial base, energy, financial services, government (especially state/local), and healthcare sectors (NSA/CISA/FBI joint advisory, 2026-07-13; NCSC-UK, 2026-07-13). The advisory notes these TTPs overlap with Salt Typhoon activity, so the hardening below counters more than one actor.
The primary access vector is not a novel exploit but weak SNMP hygiene. The actors scan internet IP ranges for SNMP agents that accept common or default community strings, then issue spoofed-source SNMP Set-Requests carrying object identifiers that instruct the device to copy its running configuration to a file (commonly config.bkp or output.txt) and transfer it, usually over TFTP, to a leased VPS or a compromised FTP server (joint advisory, 2026-07-13). The advisory names the exact OIDs abused — 1.3.6.1.4.1.9.9.96.1.1 (Cisco Config Copy) and 1.3.6.1.4.1.9.9.96.1.1.1.1.5 (the destination address for the copied config). A stolen configuration frequently discloses further credentials and additional community strings, feeding lateral movement. Talos's profile records the actor guessing or reusing insecure read-write community strings such as public and anonymous (Cisco Talos, 2025-08-20). Secondarily — "occasionally," per the advisory — the actors exploit known Cisco bugs and the Smart Install (SMI) feature, naming CVE-2018-0171 (the Smart Install pre-auth RCE, in CISA KEV since 2021) and CVE-2008-4128 (end-of-life devices only, no patch). Persistence has historically included the SYNful Knock IOS firmware implant.
The Poland grid attribution. On the same day, the UK together with EU member states formally attributed the destructive 29 December 2025 attack on Poland's energy grid to FSB Centre 16 (NCSC-UK, 2026-07-13). CERT Polska's own incident report describes coordinated destructive activity against 30-plus wind and photovoltaic grid-connection substations — RTU, HMI and protection-relay firmware damaged or system files deleted — and a combined heat-and-power plant serving roughly half a million people, where wiper malware was blocked by the operator's EDR before detonation; CERT Polska tied the activity to the Static Tundra / Berserk Bear / Ghost Blizzard / Dragonfly cluster via VPS, router and anonymizing-infrastructure overlap and called it "the first publicly described destructive activity attributed to this activity cluster" (CERT Polska, 2026-01-30). Note the attribution is contested at the cluster-label level: earlier ESET reporting attributed the same DynoWiper attack to the GRU's Sandworm (BleepingComputer, 2026-01-24), and the EU Council statement names FSB Centre 16 as the parent controlling several groups including Turla — so treat "FSB Centre 16" as an umbrella unit rather than a single team.
The sanctions package is the policy layer: the EU designated 9 individuals and 4 entities and the UK designated 24, covering senior GRU figures, the front company IMPULS accused of recruiting hackers for GRU Unit 29155, Lumma Stealer operators, and the disinformation outlet Rybar LLC (UK Government, 2026-07-13; BleepingComputer, 2026-07-13).
Detection. The telemetry classes to prioritise on network gear: network-flow and firewall logs for inbound SNMP Set-Requests (especially with spoofed or unfamiliar source addresses) and for outbound TFTP sessions initiated from a router/switch management interface to non-management destinations; device syslog and AAA/TACACS+ logs for unexpected "config copy" events, new local-account creation, and unexplained drops in logging volume — Talos documents the actor tampering with TACACS+ configuration to blind logging and standing up GRE tunnels to redirect victim traffic (Cisco Talos, 2025-08-20); and IDS rules keyed to inbound SNMP Set-Requests carrying the config-copy OIDs above, as the advisory recommends (joint advisory, 2026-07-13). Baseline NetFlow for the new GRE tunnel endpoints Talos describes.
Defender takeaway. For a Swiss or European CI operator this is a router-hygiene mandate with a live destructive precedent next door. Disable Smart Install where it is not in active use, confirm CVE-2018-0171 is patched, migrate management SNMP to v3 with authPriv and disable SNMPv1/v2c (or, where legacy SNMP is unavoidable, replace every default/weak community string and enforce read-only), restrict all management protocols to known stations via out-of-band ACLs, use Cisco password hashing type 8 (never 0/4/7), and treat the device configuration held in your management system — not the device itself — as the source of truth so a tampered config is detectable.
Triage: legitimate network-management stations poll SNMP on a predictable cadence from a known IP set, almost always read-only GET/GET-NEXT. The signal is a write (SNMP Set-Request) — particularly one carrying the config-copy OIDs — from a source outside the management range or with an inconsistent/spoofed source address, followed by an outbound TFTP transfer from the device; either alone is weak, the sequence config-write-then-TFTP-egress is the discriminator.
The actors scan for Internet IP ranges with active Simple Network Management Protocol (SNMP) agents that accept common or default community strings for authentication
Members of the Cyber Crisis Coordination Centre (C4) have observed the targeting and compromise of French entities using the Turla intrusion set operated by the 16th Centre of the Federal Security Service of the Russian Federation (FSB).
Russian technology companies supporting the intelligence service are also affected. For example, Advanced System Technology (AST) and NPP Gamma will no longer be allowed to do business in the EU in the future.
The morning entry covered the 19-agency Static Tundra/Berserk Bear advisory (SNMP and Cisco Smart Install router hijacking) and the UK/EU attribution of the December 2025 Polish grid sabotage. This delta covers the sibling FSB Centre 16 cluster — Turla — which France and the EU formally attributed the same day. France's Cyber Crisis Coordination Centre (C4 — ANSSI, COMCYBER, DGA, DGSE, DGSI and the Ministry for Europe and Foreign Affairs) and the EU High Representative jointly attributed the Turla intrusion set to the FSB's 16th Centre on 2026-07-13, publishing CERT-FR's technical report CERTFR-2026-CTI-005 alongside formal French and EU attribution statements (CERT-FR, 2026-07-13; ANSSI, 2026-07-13). France's COMCYBER describes Turla as an FSB 16th Centre attack mode (mode opératoire) used for intelligence-gathering since at least 2004 (COMCYBER, 2026-07-13). The 16th Centre is the parent unit behind both this Turla/Secret Blizzard espionage set and the Static Tundra/Berserk Bear router-hijacking cluster covered this morning — the EU-sanctions reporting describes the 16th Centre as controlling groups including Turla (heise online, 2026-07-13).
ANSSI documents French Turla victims including Ministry of Armed Forces webmail accounts compromised since 2017, the network of the French Embassy in Moscow (2018), a justice-sector personnel-training host (2019) and an advanced-technology company (2025), plus opportunistic intermediary compromises across varied sectors between 2019 and 2025 used as relay infrastructure (CERT-FR, 2026-07-13). The initial-access tradecraft combines spearphishing and watering-hole attacks that lure targets into downloading malicious files masquerading as legitimate software, plus exploitation of vulnerabilities in webmail/messaging services, browsers, business applications and web servers; the operators favour rented or previously-compromised infrastructure for camouflage (ANSSI, 2026-07-13). In coordination, the EU sanctioned 9 individuals and 4 organisations (entry bans and asset freezes), including the enabler firms Advanced System Technology (AST) and NPP Gamma, and the UK sanctioned 24 individuals and organisations; the EU Council statement names Germany, Poland, Cyprus, the Netherlands, Austria, Slovakia, Romania and Finland among affected states (heise online, 2026-07-13).
Shut down internet-facing on-prem ShareFile Storage Zone Controller servers per Progress's active directive and do not restart until Progress confirms scope; separately confirm any SZC 5.x instance is on ≥ 5.12.4 (or migrate to the unaffected 6.x .NET-Core branch) to close the known CVE-2026-2699/2701 pre-auth RCE chain.
On any on-prem SZC host, run a bounded compromise check for the known chain: unexpected .aspx files under the StorageCenter webroot subdirectories (documentum/cifs/sp) and the IIS worker process w3wp.exe spawning cmd.exe or powershell.exe.
Apply ShareFile Storage Zone Controller 5.12.5 or 6.0.2 to every on-prem SZC now and follow Progress's account-owner recovery instructions before returning the component to service — this is the fix for the flaw behind the 2026-07-10 emergency shutdown, against which in-the-wild exploitation attempts were already observed.
Disable Cisco Smart Install (no vstack) and confirm CVE-2018-0171 is remediated on every internet-facing IOS/IOS XE device, and alert on inbound SNMP Set-Requests carrying the config-copy OIDs named in the advisory (1.3.6.1.4.1.9.9.96.1.1 Cisco Config Copy; 1.3.6.1.4.1.9.9.96.1.1.1.1.5 Config Copy Server Address) — both are in-use FSB Centre 16 access and config-exfiltration vectors.
Apply ServiceNow hotfix KB3137947 to every self-hosted or partner-managed ServiceNow AI Platform instance immediately — the flaw is now exploited in the wild and ServiceNow's own hosted tenants are already fixed, so on-prem/partner-managed deployments are the exposure that remains.
Upgrade any internet-exposed Rejetto HFS to 3.2.1; where an immediate upgrade is not possible, take the admin interface off the public internet and disable the server_code feature — it is the code-execution sink the forged-session chain reaches.
2026-07-13T2009Z-intel· Claude Opus 4.8 · window 24 h · 4 entries published
Run 2026-07-13T2009Z-intel
Intraday fire. Previous run 2026-07-13T1212Z-intel (started 12:12:27Z, publish ok); gap ≈ 8 h → window_hours 24 (hard floor). No intel/ drops in-window → no S5. No watchlists configured (product/supplier sweeps no-op). All four research sub-agents (S1–S4) returned within cap; models self-reported Sonnet 5 (research pin). Main agent: Claude Opus 4.8.
Verification & coverage notes
Published (4 files — 3 new + 1 update):
rejetto-hfs-...-cve-2026-61500 (vulnerability, notable) — VulnCheck six-CVE chain in Rejetto HFS < 3.2.1; CVE-2026-61500 pre-auth session forgery → RCE. Companion CVE ids (61501–61505) verified against NVD (per-CVE authority, not the THREATINT aggregator S1 first cited). No ITW exploitation; included because it is a pre-auth unauthenticated RCE in internet-facing file-sharing software with the patch just public — an out-of-band-patch decision for any exposed instance (the earlier uncited "2.x weaponisation history" rationale was removed at verification).
servicenow-ai-platform-...-cve-2026-6875 (vulnerability, notable) — unauth code-execution sandbox escape, CVSS 9.5, patched 2026-07-13; hosted instances fixed server-side by vendor, self-hosted/partner-managed = residual exposure. single-source (ServiceNow PSIRT first-party for its own product; EUVD mirrors). Calibrated to notable not high: no exploitation, no PoC, vendor already remediated the majority (hosted) population.
russia-ip-camera-hijacking-nato-military-supply-routes (incident, notable) — AIVD/MIVD disclosure of default-credential/outdated-firmware IP-camera hijacking along NATO logistics routes; NL/FR/DE/FI ambassador summons + NATO condemnation on 2026-07-13. single-source (AIVD/MIVD is the national-authority discloser but the substance was relayed via the ANP wire, not fetched from the agencies' own bulletin — see below; the formal national-CERT carve-out value is not claimed).
france-eu-turla-fsb-centre-16-attribution-french-victimology (threat, notable, update_of: 2026-07-13/fsb-centre-16-static-tundra-router-hijacking-advisory) — sibling FSB Centre 16 cluster (Turla/Secret Blizzard); France/EU attribution, French victimology, EU/UK sanctions on AO AST + NPP Gamma. Published as an update-delta rather than a full companion (PD-8) and framed around Turla's access tradecraft, deliberately distinct from the morning router-hijacking entry and today's IP-camera entry — three separate technical stories on one coordinated diplomatic day, kept from becoming near-duplicates.
Single-source / carve-outs:
russia-ip-camera-hijacking-... — Single-source (verification: single-source): the substance is a first-party AIVD/MIVD disclosure for their own jurisdiction, but it was reported via the ANP wire (NL Times) and the agencies' own bulletin was not directly reachable this run, so both cited URLs are ANP-sourced (not independent) and the formal single-source-national-cert carve-out value is deliberately NOT used. Independently carried by Ukrainska Pravda / UNITED24 / APA per search but those could not be fetched cleanly → credibility held at 2, confidence medium. No named Russian APT cluster stated (an earlier allied APT28/GRU-26165 camera-targeting attribution is background only, not carried).
servicenow-... — Single-source: ServiceNow's own security KB is the first-party authority for its product; EUVD mirrors the disclosure. No independent technical analysis yet.
Borderline drops:
borderline-drop: @zereight/mcp-gitlab path traversal (CVE-2026-61462) — niche third-party MCP connector, no novel technique (S1: "a further instance of the broader agentic-tooling exposure pattern"), no exploitation; the AI-agent-tooling supply-chain pattern is already well covered (GhostApproval 07-09, PraisonAI 07-11, friendly-fire 07-11). Marginal relevance to this constituency.
borderline-drop: Swiss Armed Forces Cyber Command OpenDesk / M365 exit — directly relevant to the constituency's core (Swiss federal/military sovereign-cloud posture) but a strategic/governance story with no operational defender action (no patch/hunt/block/detect; techniques[] empty). Belongs to the weekly strategic run, not an operational intel run. FLAG FOR WEEKLY: Republik 2026-07-09 + heise 2026-07-10, in-window republication via inside-it.ch 12:13Z; the Federal Chancellery's own fleet-wide M365 feasibility study is due mid-August 2026 (a watch item).
borderline-drop: Lidl online-shop service-provider breach (DE/BE/NL) — retail is off-sector for this org (sectors: public-sector/energy/water/transport/healthcare/finance/telco); no actor, no TTP (vector undisclosed), no CVE. Fails the stricter breach/incident inclusion gate — European geography alone with no CI/gov nexus and no transferable operational lesson.
(S4 fake-news-guard drops, logged in findings.S4.yaml: D1R vs Synopsys/Bosch, Qilin vs Retelit SpA — unconfirmed leak-site claims; ZEGO/AssuranceAmerica/Centers-Lab — out-of-nexus/stale.)
Verification loop (5 iterations — reached the cap, final CLEAN, confirmation waived): iter 1 (Opus) NEEDS_FIXES — F3 Turla COMCYBER over-attribution, F4 IP-camera doorbell/consumer embellishment; both remediated. iter 2 (Sonnet) first spawn died on an infrastructure session-limit error (no verdict); re-spawned after the 21:30 UTC reset and returned NEEDS_FIXES — confirmed iter-1 fixes held, found F4 Turla "Iranian servers" (not in ANSSI/CERT-FR primary), F4 Rejetto unsupported poc-public, F5 Rejetto uncited 2.x-weaponisation history; all remediated. iter 3 (Opus) CLEAN — all fixes confirmed. iter 4 (Sonnet, confirmation pass) did NOT confirm — cross-checked the Turla entry's own sources against each other and surfaced F9 date-range (CERT-FR says 2019–2025, entry had 2021), F9 heise/CERT-FR Iran contradiction, F5 ServiceNow uncited Jan-2026 comparison, F12 run-record single-source-national-cert mischaracterisation; all remediated. iter 5 (Opus) CLEAN — all iter-4 fixes confirmed, independent pass clean. Single CLEAN at the 5-iteration cap → publish under the double-CLEAN fail-open (confirmation_waived). No entry dropped by verification. Total run duration (~2.5 h) is dominated by the session-limit wait and the five sequential verifier iterations, not by research/composition — under the runaway threshold but longer than a normal quiet fire.
Deep-dive: none. The morning 12:12Z run already published today's deep dive (FSB Centre 16). No candidate this run independently earns deep-dive treatment with materially higher urgency (no active ITW exploitation of the vulns; Turla is an update; IP-camera is notable).
Completeness sweep: re-read all four findings sets including borderline items. The three drops above are gate-failures (off-scope, marginal, or strategic-not-operational), not space-driven omissions. S1's Apache Gravitino and S3's chased-and-dropped leads (JadePuffer, Dialogflow CX, coding-agent RCE) all traced to already-covered or out-of-window primaries. No genuinely-relevant operational item left behind.
Priority calibration: zero critical, zero high this run — appropriate for a quiet intraday window. Two notable vulns (both patched, neither exploited), one notable update (attribution/sanctions), one notable incident (nation-state, broad hardening lesson). No priority inflated to drive notifications.
Coverage gaps: ncsc-uk (RSS/feed path unresolved — 404s; listing still reachable via bridge); trendmicro-research (feed stale since 2026-06-29); cert-eu (advisories RSS stale since 2026-06-10); cert-at (English blog stale since 2026-06-01); industrialcyber-co (Cloudflare 403, unreachable via direct + jina — 3rd consecutive run); cisa-advisories (JS-rendered listing, no article links via bridge — cross-checked via WebSearch); shadowserver, snyk-research, cisa-directives, cert-pl (S1 slice) — not fetched, time allocation, no exclusive lead surfaced.
Essential-coverage: all 15 essential sources attempted across S1/S2; cisa-advisories listing returned no parseable article links (JS-rendered) and was cross-checked via WebSearch (no in-window item beyond already-covered AA26-194A / Joomla KEV). No essential source produced an unpublished in-window item.
2026-07-13T1212Z-intel· Claude Opus 4.8 · window 24 h · 3 entries published
Verification & coverage notes
Intraday fire, 8.03 h after the previous run (2026-07-13T0410Z-intel, a zero-entry quiet window); window held at the 24 h floor, developing window 72 h. Three entries published, all genuinely new signal absent from the 14-day prior-coverage index and the store-wide CVE index; no updates. Four cti-research sub-agents (S1–S4, all Sonnet 5) returned; no S5 (no in-window intel/ drops).
Published:
FSB Centre 16 / Static Tundra router-hijacking campaign (threat, high, deep dive — category apt-campaign, well-rotated: no apt-campaign deep dive in the prior 30 days, none earlier today). Corroborated across S1, S2 and S4 (19-agency joint advisory + NCSC-UK + UK gov + CERT Polska). Active exploitation of the CISA-KEV Smart Install flaw CVE-2018-0171 plus SNMP default-credential abuse against energy/government/telecom CI, with the same-day formal UK/EU attribution of the destructive Dec-2025 Poland grid attack and the first joint EU/UK cyber-sanctions package. Direct Swiss/EU critical-infrastructure relevance.
Progress ShareFile Storage Zone Controller emergency shutdown (incident, high). Corroborated across S2 and S4. Vendor-ordered full shutdown of an internet-facing on-prem component over an undisclosed "credible external threat," unresolved on day three, no patch or CVE published; exposure of the component concentrates in the US and Germany. No prior coverage in the store.
WAGO I/O System Field CVE-2026-4769 (vulnerability, notable). S1. Same-day CERT@VDE advisory: an undocumented, unauthenticated early-boot diagnostic interface allowing full compromise of OT field couplers used in energy/water estates. single-source-national-cert (CERT@VDE as CNA; ENISA EUVD republishes the same data). actions: [] — no exploitation (EPSS 0.0), narrow early-boot window; the patch/segmentation guidance is body content, folded into the constituency's OT patch cycle rather than a do-now task.
Attribution contradiction (recorded, not silently resolved). The cluster label for the 29 Dec 2025 Poland energy-grid attack is contested: CERT Polska (infrastructure overlap) and the 2026-07-13 UK/EU government attribution assign it to the Static Tundra / Berserk Bear cluster under FSB Centre 16, while earlier ESET reporting (via BleepingComputer, 2026-01-24) attributed the same DynoWiper attack to the GRU-linked Sandworm cluster, and the EU Council statement names FSB Centre 16 as a parent unit also controlling Turla/Secret Blizzard. The deep-dive entry holds all three framings, attributes each to its source, and treats "FSB Centre 16" as an umbrella unit rather than a single group; sourcing_note carries the caveat. Registry: actor:static-tundra created distinct from the existing actor:secretblizzard (which already carries "FSB Centre 16" as an alias) precisely because the two are separate clusters under a shared parent — no alias collision introduced.
Completeness sweep (Phase 2) re-read all four findings sets including borderline items; two genuinely-surfaced items were dropped, both recorded here for recoverability:
borderline-drop: Swiss Cyber Command migrates off Microsoft 365 to OpenDesk (S2) — a public-sector sovereignty/vendor-dependency policy story with no near-term SOC operational action; the underlying decision was first reported 2026-07-09/10 (outside the 24 h window) and today's Inside IT piece is trade-press repackaging with no new fact. Strategic lens belongs to the weekly run, not an operational intel fire. Highly relevant to the constituency's posture but not an operational-actionable item.
borderline-drop: Lexfo — three M365 AiTM/device-code phishing operations exposed (S4) — genuinely fresh primary research (2026-07-13), but M365 device-code/AiTM tradecraft is saturated in-window: ARToken (07-02), Railway/LSHIY (07-10), Helix (07-10), Forg365 (07-10, a commercial PhaaS bundling device-code + AiTM) and the W27/W28 weekly syntheses all cover the same mechanism and the same defences (block the device-code grant via Conditional Access, FIDO2/passkeys, Entra sign-in-log anomaly on device-code grant_type). No new defender decision; the novel nuggets ("The Quarry" PhaaS ecosystem, AI-assisted kit development) do not clear the standalone actionability bar and would add volume to a topic synthesised one day ago. Dropping it leaves no defender blind spot.
Coverage notes:
Watchlist: not reported — no product/supplier watchlist configured in this deployment (both sweeps no-ops).
Coverage gaps: industrialcyber-co (S3 — Cloudflare anti-bot challenge on both direct fetch and jina reader, 3rd consecutive run; no in-window OT/ICS content confirmed via WebSearch, so no coverage lost); consilium.europa.eu (S4 — EU Council press release 403 on both transports; the UK gov.uk / NCSC-UK national-authority primaries and BleepingComputer/SecurityWeek corroboration fully substitute, so covered anyway); cert-eu, cert-at, cert-pl news, anssi-fr, ccb-belgium, ncsc-ch-* (reached, no in-window items — freshest CERT-EU advisory 2026-06-10, freshest ANSSI 2026-07-10); github-advisory (S1 — client-rendered listing, no structured recipe surfaced today); us-treasury-ofac (S2 — JS shell, no structured OFAC subcommand; UK/EU sanctions corroborated via gov.uk/BleepingComputer instead). fetch_failures: [] — no transport block cost any coverage.
Essential-coverage: none missed — all essential-tier sources in the S1/S2 slices were attempted.
Source-health: 158/158 probed, 0 UNSOLVED (96 ok, 62 bridge-ok); no source demoted. One new candidate added (certvde); no other source drift.
2026-07-13T0410Z-intel· Claude Opus 4.8 · window 24 h · 0 entries published
Verification & coverage notes
Zero-entry intraday fire. Gap to the previous run (2026-07-12T2309Z-weekly, the W28 strategic run) is 5.03 h; window held at the 24 h floor. All four research sub-agents (S1–S4) swept their full essential slices plus standard-tier rotation and returned 0 qualifying items. This is a genuinely quiet window, not a coverage failure: the vulnerability/exploit ecosystem clustered on Friday 2026-07-10, the weekend produced no fresh in-window publications, and the W28 weekly (which ran ~5 h earlier, publishing through 2026-07-12T23:56Z) had already absorbed the week's home-region / sector / research signal. Every candidate lead traced to either already-covered ground in the 14-day prior-coverage index or a primary source published outside the window.
Completeness sweep (Phase 2) re-read all four findings sets including every dropped candidate; nothing genuinely relevant was left behind. Documented drops:
borderline-drop: Comfast CF-WR631AX router command injection (CVE-2026-15511 / EUVD-2026-43252, pub 2026-07-12T23:00Z) — single VulDB source, no vendor/CERT corroboration, EPSS 0.0, no Swiss/EU critical-infrastructure nexus (S1).
borderline-drop: Retelit SpA (IT telco, Qilin leak-site claim) and STEP Oiltools (RO, DragonForce leak-site claim) — leak-site-only, no victim or Admiralty A/B corroboration despite native-language search (S4, PD-6).
borderline-drop: Nayax extortion claim — already covered 2026-07-09; leak deadline set for 2026-07-21, no material in-window delta yet (S4).
out-of-window: recycled French Education Ministry "Compas" breach (actual incident March 2026), French Ministry of Culture forum claim (single low-reliability aggregator, dated 2026-07-05), River Financial 8-K/A + AssuranceAmerica (US-domestic, no nexus, outside window) (S4).
out-of-window / duplicate (S3): SentinelLabs "One Target, Two Flags" (= 2026-07-10 e-government-portal watering-hole entry); Talos wolfSSL/GeoVision/VTK-DICOM (= 2026-07-09 disclosure entry); Nozomi Apex2/c2c botnets (= 2026-07-09 entry); ESET H1 2026 / Check Point Cavern Manticore / Sygnia AI-cloud (all covered by the W28 weekly); Silver Fox MODBEACON (QiAnXin primary 2026-07-06), Group-IB Millenium RAT (2026-06-25), Calif "My Cousin Vinyl" CVE-2026-50052 (2026-07-01) — all outside the 24/72 h window; CYFIRMA and Comparitech H1 healthcare-ransomware roundups (2026-07-10) — vanity-metric/strategic narrative, no technique-level substance.
Operational — jina reader key balance exhausted (HTTP 402), pipeline-wide. All four sub-agents independently reported that tools/fetch_source.py jina … returns HTTP 402 "JINA_API_KEY balance exhausted" on every call this run (jina-usage confirms total_balance = -1,951,663). This removes the rung-3 reader fallback for hosts that 403 the direct/bridge transports (industrialcyber.co article pages, CISA/CERT-PL under WAF, JS-rendered SPAs such as PRODAFT and NCC Group). It cost no content this run — the affected leads were all out-of-window or dropped on merits, and CISA/CERT feeds were reached via their structured recipes — but it degrades fetch resilience for future runs until the operator generates a new key at <a href="https://jina.ai/api-dashboard/" rel="noopener noreferrer">https://jina.ai/api-dashboard/</a> and updates the environment. Operator action required.
Tooling fix shipped this run:tools/source_health.py previously flagged every jina-fetch_method source as needs-demote when the reader 402s, creating false "standing repair orders" (3 sources this run: ccn-cert-es, reliaquest, mysites-guru — all healthy, two contributed primary content within the last week). Added a dedicated reader-quota probe class: a jina HTTP 402 is now recognised as an account-level transport block (402 never demotes, same hard rule as 403/429), classed handled (action none) and surfaced visibly in the class breakdown, while genuine per-source recipe deaths (404/5xx/non-402 errors) still fall through to needs-demote. Re-ran the probe: 157/157 sources, 0 UNSOLVED, 5× reader-quota.
Source-health: 157/157 probed, 0 UNSOLVED (0 needs-demote after the reader-quota fix). No source demoted. No sources_changed[] this run — the RSS-path mismatches S3/S1 flagged for sophos-xops, calif-codex and recordedfuture-insikt are already documented correctly in each record's rss_url/notes; the sub-agents guessed alternate paths because the run's slimmed source slice omitted the rss_url field, an execution detail, not source drift.
Coverage gaps: cisa-advisories, cisa-directives, ncsc-uk (S1 — reached via bridge recipe; no in-window advisories); claroty-team82 (S1 rotation, no in-window post); ico-uk (S4 — JS-rendered listing, jina reader unavailable this run, WebSearch fallback found no in-window enforcement action); industrialcyber-co (S3 — /feed/ RSS reachable 200, per-article pages 403 + jina 402).
Essential-coverage: none missed — all 15 essential sources attempted across S1/S2.