The Lyceum: Cyber Intelligence Daily — Jul 09, 2026

• Patch before Friday: CISA's four new KEV entries — Langflow, ColdFusion, and two Joomla page-builder flaws — carry a July 10 federal deadline that attackers won't respect over the weekend.
• Your security tools are the attack surface: Microsoft finally patched the month-old RoguePlanet Defender flaw, while new GodDamn ransomware blinds endpoint defenses via a vulnerable kernel driver before it encrypts.
• AI dev tooling is now a target class: a Langflow flaw hit the KEV list the same day fresh PoCs dropped against AI tooling and a GitHub agent flaw showed how one public issue can drain private repos.

Microsoft shipped fixes for CVE-2026-50656 (CVSS 7.8), a Defender privilege-escalation flaw in mpengine.dll that let a local attacker with a foothold jump to SYSTEM via a race condition — a public zero-day for roughly a month. Microsoft says the engine updates automatically, but that assumes endpoints are online and not throttled by maintenance policy. Confirm engines are on version 1.1.26060.3008 or later, especially anything offline during the exposure window. It's the fourth Defender flaw from researcher Chaotic Eclipse after BlueHammer, UnDefend, and RedSun.

Symantec's Threat Hunter Team flagged GodDamn, a new family assessed as a Beast rebrand, first seen in the wild May 21. It uses the PoisonX kernel driver in a BYOVD attack to kill security processes before the payload runs; operators were also seen using AnyDesk, PsExec, and a NirSoft credential toolkit. "BYOVD continues to be a huge threat to enterprises, enabling attackers to disable state-of-the-art endpoint security systems in seconds," said Expel's Marcus Hutchins. Watch Microsoft's Vulnerable Driver Blocklist and confirm your EDR vendor has PoisonX signatures.

CISA added four actively exploited flaws with a July 10 remediation deadline. Most significant: CVE-2026-55255 in Langflow — an authorization bypass chained with RCE to hijack AI flows and steal LLM provider keys and AWS credentials, a pivot into everything AI agents can touch. Also listed: CVE-2026-48282, an unauthenticated Adobe ColdFusion RCE reported exploited within two hours of disclosure, plus two Joomla page-builder flaws (CVE-2026-56290 and CVE-2026-48908) — one with a live Exploit-DB entry (EDB-52626). Treat any internet-facing instances as an emergency patch event.

Google patched 22 high-severity flaws across Extensions, Autofill, Payments, WebRTC, Forms, and Codecs (Chrome release). The headliner is CVE-2026-15132, an uninitialized-use bug in the V8 engine enabling sandboxed RCE via a crafted HTML page; no confirmed in-the-wild exploitation yet. Also fixed: CVE-2026-15110 (use-after-free in Extensions) and CVE-2026-15108 (integer overflow in the Extensions API). Update to 150.0.7871.115 or later — push via policy now rather than waiting for restarts.

Also live: Gitea Docker ≤ 1.26.2 flaw CVE-2026-20896 (CVSS 9.8) is being actively probed — it trusts the X-WEBAUTH-USER header from any IP, granting unauthenticated elevated access; audit app.ini for a REVERSE_PROXY_TRUSTED_PROXIES = * wildcard. Noma Labs disclosed GitLost, a prompt-injection flaw letting an attacker exfiltrate private-repo data via a crafted public issue — no CVE or GitHub fix yet; scope workflow tokens to a single repo. Fresh Exploit-DB RCE PoCs also hit Langflow 1.9.0 (52627) and MCPJam Inspector (52625).

• If CISA adds Chrome CVE-2026-15132 to KEV before Friday, it means exploitation was already live when Google shipped the patch, turning a routine browser refresh into an emergency.
• If Microsoft's Vulnerable Driver Blocklist doesn't add PoisonX soon, GodDamn's BYOVD trick stays a reusable skeleton key for any crew willing to license the driver.
• If a CVE is assigned to the Langflow or MCPJam Inspector PoCs within 48 hours, today's Exploit-DB drops move from research curiosity to active-campaign fuel, and every internal AI prototyping instance becomes a live target.