Daily · 2026-07-30
🔴 Laundry Bear Exchange OWA Zero-Day, 🎯 SonicWall Credential Stuffing, ⚠️ Chrome 151 Patches 370 Vulns, 🛡️ AI Agent Permissions, 📋 SBOM Guidance Update
Russian Laundry Bear exploits Exchange OWA zero-day for OWAReaper backdoor; SonicWall credential stuffing hits 30 orgs in 2 days; Chrome 151 patches 370 vulnerabilities (7 critical); VMware ESXi VM escape (CVE-2026-47876); Health-ISAC warns of ShinyHunters healthcare targeting; STAC4749 Teams-to-ransomware campaign; CISA adds Cisco FMC to KEV.
Laundry Bear's Exchange OWA campaign is the day's defining story. The group exploited CVE-2026-42897, an XSS flaw patched in May, to deploy the OWAReaper backdoor through a half-click exploit: opening a crafted email executes JavaScript in the browser context. Government targets in the US and Europe plus telecom, financial, and aerospace companies now face persistent mailbox access, and because the email itself is the weapon, conventional phishing defenses do not stop it. Laundry Bear (Void Blizzard) Zimbra Zero-Click Espionage
The VMware updates deserve the same urgency. CVE-2026-47876 is an out-of-bounds write in the VMXNET3 adapter that lets a guest with local admin privileges execute code on the host, breaking the guest-host boundary, and two vCenter flaws are critical. Patch the hypervisor plane before the workload plane. Chrome 151 fixing 370 vulnerabilities in one release is a signal about browser complexity rather than a single action item, and it lands at the same moment as a SonicWall credential stuffing campaign that compromised 30 organizations in 41 hours.
Watchlist: Exchange servers on pre-May builds, ESXi hosts yet to receive the VMXNET3 fix, and SonicWall accounts without MFA enforced.