Daily · 2026-07-21
🔴 CVE-2026-6875 ServiceNow RCE, 🎯 HollowGraph Iran C2, ⚠️ HollowByte OpenSSL DoS, 🍷 LegacyHive Windows Zero-Day, 🎯 JadePuffer EncForge Ransomware
ServiceNow AI sandbox escape under active exploitation; HollowByte OpenSSL DoS silently patched; LegacyHive Windows zero-day unpatched; Iranian HollowGraph C2 uses M365 calendar; JadePuffer deploys AI-specific ransomware.
The ServiceNow AI sandbox escape is the day's defining story because of the speed. Exploited in the wild four days after patches shipped, with the captured payload matching the published PoC, CVE-2026-6875 turns disclosure into an exploitation race. Hosted instances were auto-patched; self-hosted customers have no excuse for delay.
Two infrastructure flaws frame the rest of the day. LegacyHive gives non-admin users code execution at the next admin logon on fully patched Windows, with only unofficial fixes available. Januscape, a 16-year-old KVM use-after-free, reaches guest-to-host on Intel and AMD and therefore every major KVM cloud; kernel updates are the only control. HollowByte's 11-byte OpenSSL memory-exhaustion trigger was patched silently, so assume older OpenSSL is vulnerable until verified.
The AI thread continues to move. JadePuffer's EncForge is the first ransomware built to encrypt model checkpoints and vector databases, and the week of sandbox escapes shows AI coding agents can be broken out through the trust boundary between workspace files and host tooling. Zimbra's 10.1.20 bundle also closes a command injection and several XSS flaws worth scheduling.
Watchlist: ServiceNow self-hosted patch status, kernel and OpenSSL versions, and M365 calendar activity, where HollowGraph runs C2 through far-future calendar events.