The Lyceum: Cyber Intelligence Daily — Jul 14, 2026

The attackers who don't need zero-days are the ones winning this week. Europe just named and sanctioned Russia's GRU hackers in a first-of-its-kind joint action, while Microsoft mapped a year-long Salesforce heist that never touched a single platform flaw and 148 npm packages quietly turned student browsers into a botnet. The through-line: trusted connections — OAuth apps, signed installers, AI agents with repo access — are now the softest doors in the building.

• CVE-2026-45659 — Microsoft SharePoint Server: actively exploited, CVSS 8.8, added to CISA KEV July 1. Remote code execution via deserialization of untrusted data; attributed in part to Storm-2603, a Warlock ransomware operator.
• CVE-2026-56291 — Balbooa Forms (Joomla): actively exploited, KEV-listed. Unrestricted file upload allowing unauthenticated webshell deployment.
• CVE-2026-48939 — iCagenda (Joomla): actively exploited, KEV-listed. Unrestricted upload of dangerous file types.
• CrashStealer: macOS infostealer using a signed, Apple-notarized dropper to pass Gatekeeper; steals credentials, keychain data, and crypto wallets.
• Three AI-framework RCE PoCs: Langflow 1.9.0, Flowise 3.1.3, and MCPJam Inspector all published to Exploit-DB on the same day.

(Housekeeping: CVE-2026-21509, the Microsoft Office zero-day flagged as must-cover, was patched via emergency out-of-band update in January 2026 and is already in KEV — this is not a fresh event. If you somehow never applied it, stop reading and go do it.)

If you've wondered whether Western governments would ever do more than write strongly-worded advisories about Russian state hacking, Monday was a meaningful answer.

The European Union and the United Kingdom jointly sanctioned dozens of Russian individuals and entities, attributing a large-scale espionage and sabotage campaign — including a failed attack on Poland's power grid — to Russia's FSB, with France and Germany co-signing the attribution. It's the first joint EU-UK cyber sanctions package of its kind.

The timing is deliberate. The same day, CISA and allies from nine countries warned that Russian state hackers are targeting poorly configured routers to reach critical infrastructure — an advisory that names concrete hardening steps (disable SNMPv1/v2, use SNMPv3 with strong authentication, disable Cisco Smart Install) any network team can act on now.

What changes if this sticks: sanctions gain operational value for defenders only when the named entities surface in threat feeds as identifiable infrastructure operators. What to watch: whether the sanctioned names appear as attributable command-and-control operators — and whether Russia responds with retaliatory activity that makes that router advisory a pre-attack warning rather than routine guidance.

The most unsettling breach story of the week isn't about a zero-day. It's about attackers walking through the front door and staying for twelve months. (ShinyHunters Spent a Year Inside Salesforce Without Hacking Salesforce)

Microsoft mapped a year-long campaign — observed between mid-2025 and mid-2026 — by attackers whose methods align with the data-extortion group ShinyHunters, who moved through corporate Salesforce environments without exploiting a single platform flaw. They used three paths: trusted OAuth apps (the "allow this app to access your Salesforce data" integrations), stolen vendor tokens, and misconfigured guest access. Sign-in monitoring stayed quiet the entire time, because every login looked legitimate. (ShinyHunters Spent a Year Inside Salesforce Without Hacking Salesforce)

The attack exploited the trust OAuth is designed to create. Once inside, they exfiltrated data over months through authorized application channels — no brute force, no alerts. ShinyHunters is the same crew linked to the Ticketmaster breach.

What failure looks like for defenders: never auditing connected apps until data shows up on a leak site. Microsoft's blog includes the fix — review your OAuth integrations, tighten guest access, and put anomaly detection on export activity. If you run Salesforce, do the audit this week. The signal to watch: if these three paths appear in public threat feeds with indicators, ShinyHunters has moved from targeted to commodity, and every SaaS admin is on the clock.

Supply chain attacks usually detonate when you install the malicious package. This one waited.

Per The Hacker News, 148 npm packages disguised as student web proxies — the tools kids use to slip past school filters — carried code that never ran at install time. It waited inside working proxy sites, activating only when visitors loaded the page, at which point their browsers were silently recruited into a DDoS botnet (a swarm of hijacked machines used to flood targets with traffic).

The cleverness is in the timing. Most scanners inspect what a package does when you install it. This campaign stayed dormant through that window and activated later, in the browsers of end users who never touched the original package.

Why it matters: it's a working proof-of-concept for supply chain attacks that evade install-time scanning by design. The signal to watch: if this browser-activation technique migrates from student proxies to packages targeting enterprise developer toolchains, the stakes jump from nuisance to serious.

Mac users have long operated on a comfortable assumption: Apple's security model makes malware hard to run. CrashStealer challenges it directly.

BleepingComputer reports that this new macOS infostealer disguises itself as Apple's crash-reporting tool to steal credentials, keychain data, and crypto wallets. The critical detail from BleepingComputer: it uses a signed and Apple-notarized dropper to pass Gatekeeper, the system meant to block untrusted software. Notarization means Apple's own automated checks scanned and approved the file before it was weaponized.

The disguise is smart. When your Mac crashes, a dialog asks if you want to send a report to Apple — a fake version of that dialog is a near-perfect lure, because you're already in a disrupted, slightly anxious state and clicking to make it go away.

The fastest mitigation is Apple revoking the notarization certificate. The signal to watch: whether signed-dropper techniques spread to other macOS families — and if notarization can be gamed at scale, Gatekeeper's promise gets a lot thinner.

Russia's leading security publication Xakep reports that a researcher is disputing the safety of Microsoft's fix for the RoguePlanet vulnerability, arguing the patch itself introduces new risk. The claim hasn't surfaced in any English-language outlet as of this morning. If the analysis holds, this is a rare patch-creates-new-vulnerability scenario — the kind of thing that turns "you're protected now" into "you may have made it worse" for anyone who applied the update. Worth tracking closely, because a bad patch is harder to reason about than an unpatched flaw. (Microsoft admits AI is exploiting Windows 11 bugs in hours, warns against delayi)

Source: Xakep.ru (Хакер) — Russian. No English-language coverage confirmed at time of publication.

Somewhere a supermarket vendor's server got popped and took Lidl's shoppers down with it, a fake "send report to Apple?" dialog is quietly draining crypto wallets, and 148 packages promising students a way around the school firewall turned their browsers into a rented army. The most honest villain of the week isn't a zero-day — it's the OAuth prompt you clicked "allow" on eighteen months ago and never thought about again. Watch your connected apps like they owe you money.

Forward this to the friend who still thinks Macs don't get malware.