Today’s digest splits cleanly into two buckets: flaws already being exploited in the wild, and critical flaws patched just ahead of the first public exploit. An Australian energy utility confirms a breach, a known ransomware affiliate is caught mid-reconnaissance, a network appliance zero-day earns a CISA deadline, and two vendors — JetBrains and, separately, Zoom — beat attackers to the patch on unauthenticated flaws that would otherwise have been trivial to weaponize. Here’s what changed since yesterday’s digest.
Breach watch: Origin Energy confirms a data breach touching roughly 900,000 customer accounts
Australian energy giant Origin Energy confirmed a data breach after a threat actor contacted a local newspaper, The Australian, with samples of what it claimed was stolen customer data. Origin’s investigation, first disclosed July 22 and updated July 28–29, confirmed unauthorized access to customer names, addresses, dates of birth, phone numbers, account information, and partial payment details — the last four digits of credit cards, or a bank’s BSB and last three account digits. The attacker initially claimed to have stolen records on 2 million customers; Origin’s own count puts the confirmed figure at roughly 900,000 current and former accounts. Reporting since suggests the threat actor agreed not to publish the data after further contact with Origin, though that outcome is unconfirmed by the company itself. BleepingComputer · SecurityWeek · TechRepublic
A breach that surfaces via a journalist’s inbox rather than your own detection stack is the worst-case discovery path — it means the exfiltration itself produced no alert your team acted on. If your logging can’t answer “did any account pull an unusual volume of customer PII this month” without a hacker forcing the question, that’s the gap this incident points at.
Ransomware watch: Velvet Tempest is caught staging Termite ransomware with ClickFix and a new CastleRAT backdoor
Researchers linked a wave of intrusions to Velvet Tempest (also tracked as DEV-0504), a ransomware affiliate with a history tied to Conti and LockBit-linked campaigns, now serving as an access broker for Termite ransomware. The chain starts with ClickFix — a fake “Chrome update failed” or CAPTCHA lure that tricks a victim into copying a PowerShell one-liner and pasting it into the Windows Run dialog themselves — followed by legitimate Windows utilities abused to drop DonutLoader, which in turn deploys the previously undocumented CastleRAT backdoor. Termite, the ransomware this activity is staging for, has previously claimed high-profile victims including supply-chain software provider Blue Yonder and Australian IVF group Genea. BleepingComputer · VPNCentral
ClickFix keeps showing up as the initial-access technique of choice precisely because it skips every control built for malicious attachments or links — the victim runs the payload themselves, believing they’re fixing something. If your detection doesn’t specifically alert on powershell.exe or cmd.exe launched from the Run dialog shortly after a browser visits a newly registered or low-reputation domain, this campaign is a concrete reason to add it.
Vulnerability watch: An actively exploited, maximum-severity command injection zero-day hits Arista VeloCloud Orchestrator
Arista Networks patched CVE-2026-16812, a CVSS 10.0 operating system command injection vulnerability in on-premises deployments of VeloCloud Orchestrator (VCO), its SD-WAN management platform — and confirmed it was already being exploited in the wild before the fix shipped. The flaw lets an unauthenticated remote attacker reach privileged internal functionality that was never meant to be internet-facing, gaining full command execution on the orchestrator host and, from there, over every SD-WAN deployment it manages. Observed exploitation involves scanning for publicly reachable orchestrator endpoints and delivering payloads via ordinary HTTP GET or POST requests. The flaw is fixed in VCO 5.2.3.14, 6.1.3.4, and 6.4.2.4 and later; 7.0.0.1 and newer releases were never vulnerable. CISA added the bug to its Known Exploited Vulnerabilities catalog, giving federal agencies until August 10, 2026 to patch. The Hacker News · BleepingComputer · SecurityWeek
A management plane for your entire SD-WAN fabric being reachable and unauthenticated is exactly the kind of appliance that belongs behind a VPN or allowlist, not on the open internet — if you run VCO on-prem, patch immediately and, in the meantime, check your access logs for GET/POST requests to orchestrator endpoints from IPs outside your known management ranges.
Research watch: AI helps a researcher turn a Linux kernel race condition into a working root exploit
STAR Labs researcher Lee Jia Jie published a working local privilege-escalation exploit for CVE-2026-53264 (CVSS 7.8), a use-after-free race condition in the Linux kernel’s network traffic-control subsystem (net/sched), demonstrated against a CentOS Stream 9 build. The bug stems from mismatched locking: one code path reads entries under an RCU lock while another can free the same entry without waiting out the RCU grace period, opening a race window where the kernel keeps using memory that’s already been released. Lee said AI tooling meaningfully sped up the work — assisting with vulnerability discovery, generating a KASAN proof-of-concept, and optimizing the timing of the race window. The exploit is local-only, requiring unprivileged user namespaces, specific kernel config options (CONFIG_NET_ACT_GACT, CONFIG_NET_CLS_FLOWER), and a hardcoded ROP chain — not something reachable remotely. The upstream fix landed June 1, 2026 and has since been backported to stable kernel branches. The Hacker News · Infosecurity Magazine · GBHackers
This isn’t a remote threat by itself, but it’s a preview of a trend worth tracking: AI-assisted research is shortening the gap between “theoretical race condition” and “working root exploit with a hardcoded ROP chain.” Treat it as one more argument for staying current on kernel patch levels rather than assuming local-privesc bugs are low priority because they need a foothold first — the foothold is usually the easy part.
Also noted: JetBrains patches an unauthenticated remote code execution flaw in TeamCity before it’s exploited
JetBrains disclosed and patched CVE-2026-63077 (CVSS 9.8), a critical vulnerability in TeamCity On-Premises that let an unauthenticated attacker with HTTP(S) access to a server bypass authentication and execute arbitrary operating system commands — no login required. Researcher Antoni Tremblay reported it privately on July 10 through JetBrains’ coordinated disclosure process; JetBrains published its advisory July 27 and says it has no evidence of active exploitation. Fixed versions are 2025.11.7 and 2026.1.3; a dedicated security patch plugin is available for anyone on 2017.1 or later who can’t upgrade immediately. TeamCity Cloud customers are unaffected. The Hacker News · JetBrains Blog · Help Net Security
A CI/CD server is one of the highest-value targets on any network — compromise it and you control what gets built and shipped. This one got fixed before a public PoC forced the issue; if your TeamCity On-Premises instance isn’t on 2025.11.7 or 2026.1.3 yet, that’s a same-week patch, not a next-sprint one.
Final thought
Line up today’s stories and the difference between “patched in time” and “patched too late” is stark: JetBrains closed an unauthenticated RCE in TeamCity before any known exploitation, while Arista’s VeloCloud Orchestrator flaw was already being hit in the wild by the time a fix shipped. The gap between disclosure and exploitation keeps shrinking, which means the real control isn’t reacting faster to CVE announcements — it’s reducing how much of your internet-facing management infrastructure needs a same-day patch cycle in the first place. If you want help mapping which of your externally reachable systems carry that kind of risk, see our how-to guides or book a discovery call.