A clearer view of today.

Researchers and vendor guidance point to CVE-2026-63077 as a critical unsafe deserialization issue in JetBrains TeamCity that can lead to operating system command execution. While JetBrains reported no known active exploitation at first, CISA later added the flaw to its Known Exploited Vulnerabilities (KEV) catalog—signaling real-world use. Teams running TeamCity should prioritize upgrading to the patched release (notably 2026.1.3) and validate exposure of the agent polling endpoints (e.g., /app/agents/v1/commands/error).

Source: Rapid7 Analysis

Switzerland’s BIT reported that attackers exploited SharePoint vulnerabilities to compromise the login credentials of around 200 accounts. The incident was identified after unusual activity was observed on July 28; BIT then blocked internet access to the platform and moved to close the exploited vulnerabilities. The key takeaway for defenders: even credential-only compromise should trigger a full account security review (password resets, session/token revocation, and logging review) plus a rapid SharePoint patch/mitigation cycle.

Source: Help Net Security

CISA is cautioning policymakers that overly rigid legislative or procedural constraints could hinder the agency’s ability to adapt vulnerability tracking and handling to evolving attacker techniques. While Congress-backed authority could improve consistency and coverage for global vulnerability coordination, the risk is reducing flexibility where quick operational adjustments are needed. Organizations should watch for policy shifts that could affect how quickly and how broadly vulnerabilities must be reported, tracked, and remediated—especially for KEV-style workflows.

Source: NextGov

A vishing/extortion group tracked as UNC6671 has expanded its campaign to specifically target mergers and acquisitions organizations—an audience that often experiences compressed timelines, high-stakes communications, and elevated stress during deal cycles. Security guidance emphasized “managed-device logins” and enhanced audit log monitoring to detect the kinds of identity and workflow manipulation that vishing campaigns depend on. For defenders, the practical lesson is to treat phone-based credential theft as a direct precursor to cloud account compromise and downstream data theft.

Source: SCMagazine

New research suggests AI-generated security patches are frequently incorrect—failing more often than they truly remediate vulnerabilities. Even when an AI response appears plausible, it can introduce new weaknesses or leave the original flaw exploitable. The security implication is clear: AI assistance should be paired with mandatory verification (tests, static/dynamic analysis, and human review), especially for patching and configuration changes that affect authentication, input validation, or dependency behavior.

Source: CyberScoop

A new “Water Watch Center” initiative pairs a utilities group with a DEF CON offshoot to help cash-strapped water operators detect and respond to cyber incidents. The launch comes as states continue grappling with intrusions into water systems, with officials publicly noting suspected foreign interest in some cases. This is a meaningful policy-to-practice bridge: smaller operators often lack 24/7 monitoring and incident response capacity, so shared detection guidance and response playbooks can reduce time-to-containment.

Source: NextGov

A new report claims ICE is purchasing access to credit card records via data broker channels, effectively expanding visibility into sensitive personal and financial activity. For cybersecurity and privacy teams, this underscores how “security” often overlaps with data governance: breach risk and misuse risk can come not only from cyberattacks, but also from centralized aggregation and downstream access. Organizations handling consumer financial or identity data should re-check data minimization, retention, and vendor access controls.

Source: Schneier Blog