DarkInvader

JetBrains said there was no active exploitation. Nine days later, CISA disagreed.

CVE-2026-63077 is a CVSS 9.8 unauthenticated RCE in TeamCity On-Premises, exploitable through the agent polling protocol with nothing more than HTTP access. It landed on the CISA KEV catalogue on 5 August with a three day federal remediation deadline, and roughly 4,500 TeamCity instances are reachable from the internet right now.

A compromised CI/CD server is not just a server breach. It holds source code tokens, signing material, cloud credentials and deployment secrets, and it sits upstream of everything you ship. This is the third critical unauthenticated TeamCity flaw in two years, and the window between disclosure and exploitation keeps shrinking.

We break down the root cause, the timeline, and what to do this week.

Read full blog here:

TeamCity CVE-2026-63077 — CISA Confirms Active Exploitation of Critical CI/CD RCE Explore the critical TeamCity CVE-2026-63077 vulnerability, actively exploited as confirmed by CISA. Learn about its implications, mitigation strategies, and how organisations can protect themselves.

73% of organisations say they're not fully ready for a major cyberattack.

That's from a new survey of 600 security leaders by Vanson Bourne (January to February 2026). Most of these organizations have incident response plans. Most have security tools. Most have technical teams in place.

But plans and tools don't equal readiness.

The real gap: coordination, visibility, and executive alignment. When a breach happens, can you detect it quickly? Can you contain it? Can you communicate status to leadership and board? Can your teams coordinate under pressure?

The data: 76% of organizations experienced at least one cyberattack in the past 12 months. 32% experienced more than one. Yet they still report they're not fully prepared.

Here's the hard truth: Incident response readiness depends on visibility. If you don't know what's on your external attack surface, you won't detect a breach until the damage is visible. If you don't understand your infrastructure's exposure, you can't prioritize your defences or allocate resources effectively.

External attack surface management isn't just about preventing initial access. It's about enabling faster detection, better prioritization, and more coordinated response when incidents inevitably happen.

The 27% who say they are ready? They typically have strong external visibility, automated detection, and practiced response playbooks.

Read the full research and what incident response readiness actually requires:

Why 73% of Organizations Lack Incident Response Readiness: The Visibility and Coordination Gap 73% of organisations lack adequate incident response capabilities. This blog explores the gaps in visibility and coordination, offering solutions to enhance readiness and resilience.

Microsoft's Azure Cosmos DB just had a very quiet, very serious problem.

A vulnerability called CosmosEscape allowed attackers to escape the Gremlin query sandbox, access the multi-tenant Database Gateway, and retrieve a platform-wide key capable of unlocking any Cosmos DB customer's databases globally.

This is different from typical cloud vulnerabilities. Customers couldn't configure their way out of this risk. No firewall rule, no private endpoint, no RBAC setting would have stopped it. The flaw was in Microsoft's shared infrastructure.

The attack chain: Craft a malicious Gremlin query using .NET reflection capabilities, escape the sandbox, gain code ex*****on on the gateway, access the platform-wide signing secret, retrieve primary keys for any customer account, log in as that customer, full read and write access.

Scope: All Cosmos DB customers using Gremlin API (graph databases) were theoretically at risk. Microsoft's own internal databases (Entra ID, Teams, Copilot) could have been compromised.

Microsoft's response was exceptional: Hotfix deployed within 48 hours of the November 2025 report. Permanent architectural fix rolled out across all regions by July 2026. No unauthorized access was detected beyond Wiz's research team testing.

Why this matters: Cloud infrastructure vulnerabilities expose all tenants simultaneously. Vendor transparency and continuous security testing are not optional. This research was discovered partly using Wiz's Atlas AI system, the first public confirmation of AI discovering a critical cloud infrastructure vulnerability.

Full technical breakdown and lessons for your cloud architecture:

Azure Cosmos DB CosmosEscape: How a Sandbox Escape Exposed Every Customer's Databases Exploration of Azure Cosmos DB critical vulnerability, CosmosEscape, highlighting the risks of shared infrastructure in cloud computing.

30+ water systems across Minnesota just went down in a coordinated cyberattack.

Braham's water plant went offline. Plymouth lost comms at water towers. South St. Paul and Maple Plain lost automated controls.

All four municipalities switched to manual operation and maintained services, but this incident reveals a critical infrastructure risk that most organisations don't talk about: external operational technology exposure.

Here's what happened: Iranian-affiliated cyber actors (preliminary attribution by US investigators) targeted SCADA and PLC systems at these utilities. The attackers didn't need zero-day exploits. They're using known-vulnerabilities like CVE-2021-22681 (Rockwell Automation Logix, CVSS 9.8, no patch available, actively exploited). They found these systems by scanning the internet for exposed devices.

The pattern is nationwide: FBI and EPA just warned that similar PLC exploitation is happening across at least seven US states. This is not Minnesota-specific.

The lesson: Most operators don't know their full external footprint. Many have internet-exposed SCADA systems they didn't intentionally expose. Attackers find them via public scanning tools. Then exploitation follows.

External asset discovery and continuous monitoring aren't luxuries for critical infrastructure. They're foundational defence.

Read the full incident breakdown and what it means for your organization:

Minnesota Water Systems Under Attack: How External Asset Visibility Stops Critical Infrastructure Breaches Explore how External Asset Visibility (EAV) is crucial in safeguarding Minnesota's water systems from cyber attacks.

A Cisco firewall management vulnerability just got worse. CVE-2026-20316 contains hard-coded credentials built directly into the FMC web interface. An unauthenticated attacker can use them to log in remotely and gain access to sensitive data.

But here's the critical part: Cisco confirmed this flaw chains with other FMC vulnerabilities to escalate privileges. Low-privilege access becomes full compromise.

Active exploitation is already happening. The US federal government (FCEB) has set a mandatory patching deadline of August 1, 2026 for civilian agencies. If you operate Cisco FMC, this is not optional.

Why this matters for your organization: Your firewall is perimeter infrastructure. If attackers gain access via static credentials, they're inside your network. This is why continuous visibility of your internet-exposed management interfaces is critical.

Full technical breakdown and detection guide:

Cisco FMC Static Credentials Zero-Day Exploited in Live Attacks Cisco FMC static credentials vulnerability CVE-2026-20316 actively exploited. Immediate patching needed by August 1 deadline. Exploit details and remediation steps.

WordPress just got hit with a critical vulnerability that affects hundreds of millions of sites, and it requires zero plugins, zero custom config, and zero authentication to exploit.

The 'wp2shell' vulnerability chain (CVE-2026-63030 + CVE-2026-60137) is a dual-flaw RCE that abuses the WordPress REST API batch processor. Attackers can inject SQL commands, bypass all auth checks, and execute arbitrary code on any default WordPress installation running versions 6.8 to 7.0.1.

The kicker: exploitation started within 24 hours of disclosure. We're seeing dozens of IP addresses scanning for vulnerable sites, deploying web shells, and creating backdoor admin accounts. By Saturday morning, tens of thousands of attempts were already underway.

WordPress shipped patches (7.0.2, 6.9.5, 6.8.6) and enabled forced auto-updates, but unpatched sites remain high-risk. If your site was internet-facing and unpatched between July 19-21, assume compromise and hunt for web shells.

We've published a detection and incident response guide for web platform teams.

Read the full breakdown:

WordPress wp2shell Critical RCE Chain Exploited in Mass Attacks: Immediate Patching Required Discover the wp2shell vulnerability affecting millions of WordPress sites. Explore the critical Remote Code Ex*****on (RCE) flaw and learn how to protect your site from mass attacks.

Your AI coding assistant just became an attack vector.

AWS Kiro (their agentic IDE for AI-driven development) has a prompt injection flaw (CVE-2026-10591) that bypasses its entire safety boundary. Here's how it works: an attacker embeds hidden malicious instructions in a web page. A developer asks Kiro to "summarize this page." Kiro reads the hidden instructions, rewrites its own MCP (Model Context Protocol) configuration file without asking for approval, and silently executes attacker-controlled code on the developer's machine with full developer privileges.

No approval prompt. No warning. Just code ex*****on.

This is a supply-chain attack vector hiding in plain sight. Developer machines are infrastructure. Compromise one, and you're inside the build pipeline, version control, deployment systems, and cloud credentials.

Kiro versions prior to v0.11.130 are vulnerable. Update immediately. We've written a detection and response guide for platform engineers.

Read the full analysis:

Not Found Platform 7D, New Station Street, Leeds, LS1 4BT, United Kingdom
 Mon-Fri, 9:00-17:00Contact: [email protected] +44 (0)1138805336Last updated: 23 June 2026‍©2026 DarkInvader, All Rights Reserved

Cl0p ransomware just found a new goldmine: internet-exposed PTC Windchill deployments.

They're chaining two vulnerabilities: a pre-authentication info-disclosure flaw in FlexPLM WSDL plus CVE-2026-12569, a critical RCE in Windchill's login servlet. This gives unauthenticated remote code ex*****on. No credentials required. No prior access needed.

Once inside, they're deploying web shells, staging engineering designs and intellectual property, then extorting manufacturers with double-extortion tactics. Aerospace, automotive, defence contracting: all prime targets.

This is exactly why external attack surface visibility matters. Many organisations don't even know where all their Windchill instances are. We just mapped a live attack chain.

Read the full technical breakdown and detection guide: www.darkinvader.io/blog/clop-windchill-flexplm-rce-cve-2026-12569-ransomware

Your attack surface is bigger than you think.

It is not limited to the assets listed in your internal inventory.

It can include forgotten subdomains, exposed services, vulnerable applications, leaked credentials, supplier-related risks, impersonation domains and external threats developing across the dark web.

DarkInvader continuously discovers and monitors your organisation’s external exposure, helping security teams understand what is visible, identify the risks that matter most and take action before attackers do.

Because you cannot protect what you cannot see.

See your organisation from an attacker’s perspective:

DarkInvader | External Attack Surface Management Platform AI-powered External Attack Surface Management. DarkInvader identifies exposed assets, prioritises critical risks and provides intelligence to improve security.

Russian state-backed threat actors just deployed a zero-click phishing attack against Western organisations, and no one has to click anything for it to work.

The NCSC, NSA, and 16 international partners just exposed LAUNDRY BEAR's 'beehive' exploit, which targets Zimbra Collaboration Suite via CVE-2025-66376. Viewing a malicious email in ZCS webmail is enough. The attack steals credentials, CSRF tokens, 2FA codes, and months of email history, silently.

What makes this different: Traditional phishing requires user interaction. This doesn't. It highlights why continuous visibility into your email infrastructure and the threats targeting it is now table stakes.

Read the full breakdown on how to detect, respond, and defend:

Russian State-Backed Threat Actors Deploy Zero-Click Phishing Against Western Organisations: How to Detect and Defend NCSC alerts to Russian state-backed LAUNDRY BEAR zero-click attacks on Zimbra email platforms. Learn detection signals and patching priorities for your organisation.