Hello, stay ahead with CISO Brief 🚀

🔎 Researchers uncovered the FakeGit campaign using some 7,600 malicious GitHub repositories to distribute SmartLoader and StealC malware, amassing over 14 million download events. Many repos impersonated legitimate tools and AI skills, employing an AgentBaiting technique to attract AI agents and developers. The campaign reused tactics from a prior Lumma Stealer operation, and Island recommends isolating and vetting AI skills, rotating secrets, and validating publishers.

🔒 Microsoft SharePoint's critical CVE-2026-50522 vulnerability is being actively exploited in the wild to steal machine keys and preserve access post-patch. Researchers observed attackers leveraging a public proof-of-concept to trigger deserialization-based remote code execution against on-premises SharePoint, allowing creation of forged authentication tokens. Microsoft fixed the flaw in July, but security firms advise rotating exposed credentials and confirming patches.

🚀 Starting today, Amazon EC2 C6in instances are available in AWS Asia Pacific (Taipei). These sixth-generation network-optimized instances, powered by 3rd Gen Intel Xeon Scalable processors and the AWS Nitro System, deliver up to 200 Gbps network bandwidth and up to 100 Gbps Amazon EBS bandwidth with 400K IOPS. C6in instances support up to 128 vCPUs across 10 sizes (including bare metal) and offer EFA on 32xlarge and metal sizes for high-performance networking.

🚀 Amazon EC2 R6in and R6idn instances are now available in AWS Europe (Paris) and Canada (Central). These sixth-generation, network-optimized instances use 3rd Gen Intel Xeon processors and the AWS Nitro System to deliver up to 200 Gbps network bandwidth, 2x improved bandwidth and packet-processing versus prior generation. They support up to 128 vCPUs, 1024 GiB memory, up to 100 Gbps EBS bandwidth, and offer EFA on select sizes. R6idn adds up to 7.6 TB of high-speed instance storage.

🚀 Starting today, Amazon EC2 M6in and M6idn instances are available in AWS Asia Pacific (Hyderabad) and South America (Sao Paulo). These sixth-generation, network-optimized instances use 3rd Gen Intel Xeon Scalable processors and the AWS Nitro System to deliver up to 200 Gbps network bandwidth—roughly 2x the bandwidth of comparable fifth-generation instances. They support up to 128 vCPUs, 512 GiB memory, up to 100 Gbps EBS bandwidth, 400K IOPS, EFA on select sizes, and up to 7.6 TB of instance storage on M6idn variants.

🛡️ The Anubis ransomware gang has claimed responsibility for the cyberattack on Coca-Cola's Fairlife dairy subsidiary, alleging it stole approximately 1 TB of corporate data and encrypted Nutanix systems. Coca-Cola disclosed the incident on July 16 after production at U.S. facilities was suspended; the company said product safety was unaffected and declined to comment on Anubis' claims. Anubis, a RaaS group active since December 2024, has combined data theft, encryption, and destructive wiping in prior attacks.

🔒 Apple patched a vulnerability in its Hide My Email service that could reveal users' real email addresses when forwarded messages were rejected as spam. The fix was deployed on July 3, 2026, after the flaw was disclosed to Apple by Tyler Murphy of EasyOptOuts on June 13, 2025. The issue allowed real addresses to appear in mail transfer logs and affected addresses created before July 7, 2026. Apple now says the problem is resolved, even as a class action alleges misleading privacy claims.

🛡️ AWS WAF now supports dynamic label interpolation, allowing labels applied to requests (including managed Bot Control and ATP labels) to be referenced by namespace instead of enumerating individual values. Use the ${namespace:} syntax in custom request/response headers and response bodies to forward matched labels and synthetic values (client IP, request ID, JA3/JA4) to your origin or embed them in challenge and block pages. This reduces rule maintenance, supports hundreds of evolving bot categories, enables per-device signals, and lets applications make nuanced decisions—such as challenges, redirects, or routing—based on WAF classifications.

🟦 Amazon Elastic Container Service now includes built-in blue/green, linear, and canary deployment strategies in the AWS European Sovereign Cloud, enabling safer and faster containerized application updates. These features are native to Amazon ECS and remove the need for custom deployment tooling while offering production-ready controls like deployment lifecycle hooks, bake time, and quick rollback. Deployments run alongside existing versions for validation before traffic shifts, and you can use CloudWatch alarms, the deployment circuit breaker, or the StopServiceDeployment API to detect failures and rollback. Support includes ALB, NLB, and ECS Service Connect and configuration is available via the Console, CLI, SDKs, or IaC.

🔒 Hackers are actively exploiting the wp2shell vulnerability chain (CVE-2026-63030 and CVE-2026-60137) in WordPress Core to install persistent webshells and malicious plugins. The exploit abuses the REST API batch-processing feature to achieve unauthenticated remote code execution. WordPress released emergency patches (7.0.2, 6.9.5, 6.8.6) and forced automatic updates while researchers report mass scanning, plugin abuse, and backdoor deployments.

📣 Amazon Simple Email Service (SES) now offers three hierarchical pricing plans — Essentials, Pro, and Enterprise — that bundle commonly used deliverability and management capabilities. Each plan builds on the prior tier and provides progressively greater features at a discount versus à‑la‑carte purchases. Plans remove the need to evaluate and buy individual add-ons and are available in all AWS Regions where SES operates except the Middle East (UAE) and Bahrain.

🛡️ Hidden text on a web page allowed Kiro, AWS's agentic coding IDE, to rewrite its mcp.json configuration and execute attacker-controlled commands on a developer's machine without a usable approval step. Researchers at Intezer and Kodem Security showed that asking Kiro to summarize or fetch a page could inject setup instructions in one-pixel white text, causing Kiro to register and launch a malicious Model Context Protocol server. AWS patched the vulnerability by protecting sensitive paths and adding platform-enforced approval checks.

🔒 AlloyDB, a PostgreSQL-compatible managed service, now offers columnar engine accelerated HNSW to speed up pgvector vector search. This preview feature pins HNSW indexes in a compressed, in-memory columnar cache to reduce buffer-manager overhead and enable up to 4x higher QPS compared to standard PostgreSQL. The enhancement requires simple flag changes and uses the same pgvector SQL syntax, delivering higher throughput and improved AI recall without application changes.

📘 Amazon Elastic Container Service (Amazon ECS) now provides Action Logs, an observability feature that records detailed, timestamped actions ECS performs during service deployments and Managed Daemon updates. These logs surface previously invisible service-side operations to help monitor and troubleshoot workloads without contacting AWS Support. You can enable Action Logs at the cluster level via the console or CloudWatch vended logs APIs and deliver them to CloudWatch Logs, S3, or Kinesis Data Firehose. Amazon Q in the ECS console integrates with Action Logs to detect deployment issues and provide root cause analysis and remediation guidance; standard CloudWatch/S3/Firehose pricing applies.

🛡️Researchers uncovered a new ClickFix variant called ConsentFix that tricks users into granting OAuth tokens, enabling attackers to access Microsoft 365 accounts without stealing passwords. Attackers use deceptive pages and social engineering—often via phishing emails imitating file-sharing services—to induce victims to drag a tokenized URL onto an attacker-controlled page. Once obtained, the OAuth token can expose Outlook, Teams, OneDrive, SharePoint and other services depending on the organization’s license and privileges, enabling data exfiltration, BEC and lateral movement. The technique is widely shared on cybercrime forums with tutorials and turnkey tools, increasing its prevalence and lowering the barrier for novice threat actors.

🔒 DeepMind has released Gemini 3.5 Flash Cyber, a lightweight AI specialized in rapid vulnerability discovery, validation, and patching. The model is available only to governments and trusted partners via the CodeMender pilot program and is designed for high-speed, low-cost scanning of code paths. DeepMind reports it outperforms other Gemini variants and rival models in finding unique, confirmed issues across complex projects.

🛡️ CodeMender is a managed code security agent now available in preview, offering automated scanning and remediation using Google DeepMind–tuned models via the Gemini Enterprise Agent Platform or as part of AI Threat Defense. It prioritizes fixes by exploitability, runs proof-of-concept exploits in customer-managed sandboxes, and generates validated patches that integrate into developer workflows. The agent supports multiple languages, integrates with CI/CD and IDEs, and enforces enterprise-grade governance and data controls.

🛡️ Microsoft patched a critical SharePoint Server deserialization flaw, CVE-2026-50522 (CVSS 9.8), which is now being actively exploited. DEVCORE researcher splitline reported the issue; Microsoft warned authenticated attackers with Site Owner privileges could execute remote code. Security firms and CISA observed attackers stealing machine keys and urged credential rotation even after patching.