Today’s digest is a study in attackers moving faster than defenders can react: a VPN appliance zero-day that ran undetected for weeks before anyone noticed, a GitLab exploit chain hiding inside a routine bug-fix release, an AI agent left running unattended to burrow through a government network, and a ransomware group with a deadline that lands tomorrow morning. Here’s what changed since yesterday’s digest.
Vulnerability watch: SonicWall SMA1000 zero-days were exploited for weeks before anyone knew — and the CISA remediation deadline has already passed
CVE-2026-15409, a CVSS 10.0 unauthenticated server-side request forgery in the SMA1000 Appliance Work Place interface, and CVE-2026-15410, a high-severity local privilege escalation that lets an attacker with access to an internal service on port 8188 run commands as root, were chained together to compromise internet-facing SonicWall SMA1000 appliances. Rapid7’s MDR team and Volexity traced intrusions back to June 22 — roughly three weeks before SonicWall disclosed either flaw — with attackers using the pair to open unauthenticated WebSocket tunnels into services that should only be reachable from the appliance itself, including CouchDB and the device’s own management console. Compromised appliances were seized to drop a Python tool called KNUCKLEBALL and a web shell named ORANGETAIL that only responds to requests carrying a specific browser identification string. Both CVEs were added to CISA’s Known Exploited Vulnerabilities catalog with a remediation deadline of July 17, which has now passed; SonicWall has shipped patches for the 6210, 7210, and 8200v models. BleepingComputer · Tenable · Help Net Security
A three-week gap between first exploitation and public disclosure means patching alone won’t tell you whether you were already compromised. If you run SMA1000 appliances, treat the July 17 KEV deadline as already missed: confirm the patch is applied, then hunt for ORANGETAIL’s distinctive user-agent pattern and unexpected WebSocket connections to localhost-only services in your appliance logs going back to late June.
Vulnerability watch: A public GitLab exploit lets any user with push access run commands as git — and the fix shipped six weeks ago disguised as a routine bug fix
Security researchers at depthfirst published a working proof-of-concept on July 24 for an exploit chain in GitLab’s built-in Jupyter notebook diff renderer, ipynbdiff. The renderer passes repository-controlled .ipynb JSON straight into Oj::Parser.usual.parse — a native C JSON parser — inside a long-lived Puma worker process. Two memory-corruption bugs in that parser do the rest: one overflows a fixed 1,024-byte nesting stack until it hijacks the parser’s callback, the other truncates an object key and leaks a live heap pointer directly into the rendered diff. An attacker with nothing more than push access to any project — no admin rights, no CI or runner access, no victim interaction — commits a handful of crafted notebooks, reads the leaked pointers from the commit diffs, and gets arbitrary command execution as the git user. GitLab fixed the underlying Oj gem on June 10, but listed the bump under routine bug fixes rather than in its security-advisory table, so most self-managed instances never flagged it for priority patching. Affected versions span CE/EE 15.2.0 through 18.10.7, 18.11.0 through 18.11.4, and 19.0.0 through 19.0.1. The Hacker News · Cybersecurity News
This is the second time in two days a “patch available” flaw turned out to still be sitting unapplied because it wasn’t labeled as security-relevant — yesterday it was a SharePoint token that outlived its patch, today it’s a fix GitLab didn’t flag as one. If you run self-managed GitLab, don’t rely on the security-advisory table alone: confirm you’re past 18.11.4 (or 19.0.1) regardless of how the release notes categorized the change, and check who has push access to projects you’d rather not see running arbitrary commands as git.
Threat actor tooling watch: A threat actor ran the open-source Hermes AI agent unattended against Thailand’s Ministry of Finance
Threat intelligence firm Hunt.io and researcher Bob Diachenko discovered three simultaneous open directories between July 9 and July 13 on a Hong Kong-hosted server, containing exploit code, web shells, HTTP tunneling tools, and hardcoded credentials targeting mail infrastructure and Apache Hadoop — all tied to an operation against Thailand’s Ministry of Finance. Logs recovered from the directories show the operator running the open-source Hermes AI agent in unattended “YOLO” mode, which bypasses the approval prompts that would normally gate potentially destructive commands. Left to run on its own, the agent executed LinPEAS, searched for privilege-escalation paths, enumerated services, and catalogued files belonging to the ministry’s Office of the Permanent Secretary for Finance. Researchers also found 62 variants of a previously undocumented Go implant the operator calls “Hades” staged on the same server, though no recovered artifact confirms it reached a ministry machine. The Ministry of Finance has not confirmed a breach. The Hacker News · Hunt.io · BleepingComputer
Running an agent “unattended” is the offensive mirror of what makes agentic tooling attractive on the defensive side — it trades human judgment for speed, and here that trade let one operator triage an entire government network’s worth of privilege-escalation paths without stopping to think. If your own detection coverage assumes a human attacker’s pacing and mistakes, incidents like this are a reason to test it against agent-driven recon that doesn’t pause, doesn’t sleep, and doesn’t second-guess itself.
Breach watch: Anubis ransomware gives Coca-Cola’s Fairlife until tomorrow morning to pay, after halting US production
Coca-Cola disclosed in a July 16 SEC filing that a ransomware attack had disrupted operations at its Fairlife dairy subsidiary, forcing a temporary suspension of production at US facilities while Canadian operations continued unaffected; the company said product quality and safety were not compromised. On July 20, the Anubis ransomware group claimed credit, stating it had encrypted Fairlife’s servers and exfiltrated roughly 1 TB of confidential data. The group’s leak-site post set no specific ransom figure — saying only that “a token agreement is all it takes” — but gave Coca-Cola until the morning of Monday, July 27 to negotiate before it publishes the stolen data. BleepingComputer · SecurityWeek · Cybersecurity Dive
A production line halted by ransomware is a reminder that attacks on OT-adjacent systems don’t need to touch a single sensor or PLC to shut down a factory — encrypting the IT systems that schedule, track, and route production is enough. If your incident response plan only covers data confidentiality, this is a good prompt to check whether it also accounts for a scenario where the fastest path back to shipping product is restoring from backup rather than negotiating a deadline.
Final thought
Three of today’s four stories share a pattern: a fix or a warning existed well before the public found out — SonicWall’s zero-days ran for three weeks before disclosure, GitLab’s patch shipped six weeks ago mislabeled as routine, and Fairlife’s ransom deadline was set the moment Anubis claimed the breach. The lesson isn’t “patch faster,” it’s that patch metadata and disclosure timing can’t be trusted at face value — verify version numbers directly, and assume any appliance exposed to the internet may have been compromised before you heard about the flaw that hit it. For more on defending against AI-agent-driven attacks like today’s Hermes incident, see our guide to AI-powered cyberattacks facing Israeli businesses or book a discovery call.