Daily · 2026-07-28
🔴 FastJson RCE Active Exploitation, 🔴 Arista/Fortinet CISA KEV Adds, 🎯 Dysphoria Botnet 200K Devices, 🎯 EY Breach Claimed by ShinyHunters, ⚠️ Certighost AD CS PoC, 📋 Wyden Urges Legacy VPN Purge
FastJson RCE zero-day actively exploited against US firms with no patch available; CISA adds Arista VeloCloud (CVSS 10.0) and Fortinet FortiOS to KEV; Dysphoria DDoS botnet reaches 200K devices using blockchain C2; ShinyHunters claims Ernst & Young breach with July 31 deadline; Certighost AD CS PoC exploit enables domain takeover; Nvidia launches Open Secure AI Alliance with 40+ partners.
FastJson CVE-2026-16723 is the day's defining story because it pairs active exploitation with no available patch. The unauthenticated remote code execution works under default configuration, targets US financial services, healthcare, and retail, and Alibaba has not shipped a fix for the 1.x branch. Organizations processing untrusted JSON have two options: migrate to FastJson 2.x or enable SafeMode. FastJson CVE-2026-16723: Critical RCE Actively Exploited, No Patch Available
CISA's KEV additions frame the patch problem differently. Arista VeloCloud carries a CVSS 10.0 command injection with no workaround and an internet-facing design, while the Fortinet entry is a patch bypass that restores persistence on already-compromised devices. Together they cover both ends of an incident: full takeover and quiet re-entry. The Clop campaign against PTC Windchill and FlexPLM adds a ransomware layer to the same theme, with extortion emails already in the wild.
The public Certighost proof of concept matters for anyone who has not patched Active Directory Certificate Services. A low-privilege user can impersonate a domain controller and extract the krbtgt secret, and the fix is two weeks old.
Watchlist: internet-exposed FastJson 1.x services, Arista VCO versions before 5.2.3.14, and unexpected certificate requests that predate the July 14 AD CS patch.