The Watch

The shared mechanism across these criticals is authentication bypass or its equivalent: no credentials, no user interaction, no malware to detect. That is the pattern detection engineering should key on. It splits into two tracks. Flaws to patch on a same-week clock, and one that changes forensic assumptions entirely.

The patch-now track

Check Point CVE-2026-16232 is the priority. The auth bypass grants full admin over Security Management and Multi-Domain servers. Exploitation is confirmed. A handful of customers have already been notified of compromise. The CISA remediation deadline is July 25 — Saturday. Apply the jumbo hotfix for R81.20/R82/R82.10, restrict Trusted Clients, and treat the management plane as potentially already touched. Review admin-action logs for the pre-patch window, not just patch status.

FreePBX (GHSA-37j8-fhxx-9vhp, CVSS v4 9.3) is unauthenticated RCE via the UCP Node server on ports 8001/8003. Attackers inject Asterisk Manager Interface actions to run commands as the asterisk user. A second SQL-injection path via crafted SIP Caller ID headers can rewrite admin credentials outright. Patch to UCP 17.0.9 and modules 16.0.11/17.0.6. Until then, firewall 8001/8003 externally and filter SIP 'From' header content.

Two more belong in this cycle. Windmill CVE-2026-29059 — an unauthenticated path traversal leaking the SUPERADMIN_SECRET token — was patched in January and only came under attack afterward. Rotate the secret and review for pre-patch admin abuse. Windows Event Logging RCE (CVE-2026-50502) lands in the current patch cycle.

The assume-compromise track: RefluXFS

RefluXFS (CVE-2026-64600) breaks the forensic model. It is a race condition in XFS reflink handling triggered by concurrent O_DIRECT writes, corrupting on-disk blocks directly. A filesystem-allocation bug, not a memory-safety one. That placement matters. It sits below KASLR, SMEP, SMAP, SELinux enforcing, seccomp and container isolation, grants passwordless root, survives reboot, and leaves zero kernel logs. The vulnerable path has existed since kernel v4.11 in 2017, exposing an estimated 16.4M systems on RHEL, Oracle Linux, Amazon Linux and Fedora running the default reflink=1.

Sources diverge on remediation readiness. Cyberpresso reports vendor kernels are already available for RHEL, Oracle, AlmaLinux, Rocky and Fedora. TLDR InfoSec describes the vendor fix as still pending. Resolve that against the relevant distro advisories before assuming a patch exists. Either way, there is no live-patch workaround. Patching requires a reboot. Because kernel logs stay silent, file-integrity monitoring on SUID-root binaries and /etc/passwd is the only detection path.

The smart move

Run the two tracks in parallel. Same-week patching for Check Point, FreePBX, Windmill and the Windows fix. A prioritized RefluXFS reboot campaign on internet-facing, multi-tenant and CI-runner Linux, where an unprivileged local foothold most easily meets untrusted users. RefluXFS is the silent escalation partner for any initial access, including a compromised webmail box. Treat it as the second half of every foothold you find.

The target set explains itself. Organizations that adopted on-prem, non-Big-Tech webmail — Zimbra, Roundcube, Horde, MDaemon, SOGo — did so for compliance or data-sovereignty reasons. Those platforms draw less security research and carry more legacy code. That is why they became the preferred targets in Operation RoundPress, a Russian pattern documented since the 2022 invasion. The control that satisfied the auditor widened the attack surface.

What the advisory actually says

CISA, NSA, FBI, the Dutch MIVD and AIVD, and the UK NCSC jointly attribute exploitation of CVE-2025-66376 to Laundry Bear (Void Blizzard / TA488). The bug is a stored XSS abusing the CSS @import feature to inject code into the webmail client. It is a 'half-click' bug: the victim opens the email, nothing more. Link-rewriting, click-time protection and safe-link gateways are irrelevant. There is no link. The payload, Ulej ('Beehive'), harvests credentials, session tokens, backup 2FA codes, browser-saved passwords and 90 days of mailbox history.

The timeline is the point. The fix shipped in November 2025. Exploitation traces to at least July 2025. The patch date is the floor of the compromise-assessment window, not the end of it. And this is not one team. A separate GRU-linked cluster, TA458, runs parallel webmail operations using three zero-days and two n-days, which Proofpoint assesses as distinct from APT28/TA422. At least two independent Russian services are working this surface.

Why patching alone loses

Ulej steals live session tokens and backup 2FA codes. MFA does not protect a stolen session. An organization that patches to the November build without hunting leaves the harvested sessions valid. That is the line between exposure and breach. For any Zimbra host live between July and November 2025, the posture is compromise assessment: hunt for the Ulej implant, look for anomalous CSS @import in stored mail, and check for unexplained session-token and 2FA-backup access. Where exposure is confirmed, invalidate every session, regenerate backup 2FA codes, then rotate any credential that transited those inboxes.

The smart move

Inventory every webmail instance against the RoundPress target list, not just Zimbra. Treat the sovereignty-driven platforms as higher-scrutiny assets, not lower. The compliance rationale that put them on-prem is the reason they need more monitoring. This tracks the broader pattern in today's intelligence: the patch calendar and the exploitation calendar have decoupled, and the 'patched but late' window is where nation-state actors do their harvesting.

The consequential item this cycle is not a CVE. It's a capability demonstration that resets how EDR should be treated as a control. SpecterOps researcher Adam Chester built a harness called Day Shift: Codex CLI looped with Binary Ninja over MCP, pointed at Palo Alto's Cortex XDR. Working entirely from local files, no cloud access, the LLM extracted 9,350 DSE rules, 4,209 BIOC rules, 6,358 YARA signatures, 7 ML models with working execution harnesses, and CLIPS-based behavioral detections. The vendor's production detection logic, in cleartext.

This was not theoretical. The decrypted rules show Cortex XDR blocks the standard credential-dumping command reg save HKLM\SAM. An allowlisted output path lets an attacker run the identical command undetected. Chester claims the same pipeline has already been run against every major EDR vendor. That claim is unverified, but the technique is repeatable. His next tool, 'Upside Down,' lets a model test extracted rules and iterate evasions offline against a defender's specific stack before touching a real environment.

The economics moved too

The AI Security Institute's testing shows open-weight models closing the gap with closed frontier models. The lag is down to 4-7 months from 6-10, at far lower cost. DeepSeek V4-Pro runs a cyber-range engagement at $1.19, with refusals bypassed by simple retry and safeguards strippable from the weights. GLM-5.2 matched Anthropic's Opus 4.5 on a 32-step, ~20-human-hour attack chain at $46, against $85 for the closed frontier baseline. Moonshot's Kimi K3 found 23 of 26 fresh vulnerabilities on a private benchmark. A downloadable, unlogged model hunting vulnerabilities at near-frontier quality means the remediation window is now the attacker's automated scan interval.

The active complement: Sandworm_Mode

CrowdStrike's Sandworm_Mode is the operational bookend. A self-propagating strain hunting credentials, API keys and secrets inside AI coding assistants, cloud environments and CI/CD pipelines, engineered to blend into normal AI-agent traffic. Attribution is unknown, so it reads as a live, unattributed threat. The detection problem matches the one msaRAT (Chaos ransomware's RAT) poses by running C2 through Chrome DevTools Protocol and Cloudflare Workers: JA3 fingerprints and beaconing heuristics are blind to it. The signal has to come from endpoint behavior and identity, activity with no corresponding human authentication trail.

The smart move

No EDR allowlist exception is secret anymore. Output-path and execution exceptions for credential-access, LSASS and SAM/SYSTEM techniques are now discoverable across every agent regardless of vendor, and Cortex XDR patch status for the reg save HKLM\SAM bypass is the specific line item. Pipelines now carry Sandworm_Mode-style secret theft masked as agent noise. Same-week is the implied baseline for internet-facing patch SLAs, on the assumption that exploitation of fresh CVEs is now automated.