The Lyceum: Cyber Intelligence Daily — Jul 17, 2026

Today's story is speed and spillover. CISA spent the last 24 hours cramming more actively-exploited bugs into its "patch this now" catalog — SharePoint, Fortinet, and an ancient Cisco flaw that refuses to die — while a ransomware crew reminded everyone that a dairy brand can go dark just as fast as a software company. The quieter thread underneath: the most useful early warnings are still surfacing first in Ukrainian and Russian channels, where Sandworm's new Signal-based lures and a fresh CERT-UA toolkit disclosure are circulating before Western feeds catch up.

• CVE-2026-58644 — Microsoft SharePoint, all supported on-prem versions: patched, but exploited as a zero-day first; now in CISA KEV, with a July 19 deadline. Remote code execution — treat exposed farms as targets, not maybes.
• CVE-2026-39808 — Fortinet FortiSandbox: actively exploited, CVSS 9.8. OS command injection lets an unauthenticated attacker run commands via crafted HTTP requests. KEV due July 19.
• CVE-2026-25089 — Fortinet FortiSandbox / FortiSandbox Cloud: actively exploited, now in KEV alongside its sibling above.
• CVE-2008-4128 — Cisco IOS 12.4: actively exploited, CVSS 9.3. An eighteen-year-old CSRF flaw on 871-series routers, freshly added to KEV.
• ACR Stealer: info-stealer with two live intrusion chains — a ClickFix WebDAV/Python loader route and an MSHTA-to-PowerShell route hiding payloads inside images. Increased activity per Microsoft.
• Tailscale SSH root-access flaw (TS-2026-009): insecure argument handling could escalate an attacker to root on affected systems. Patch available, no confirmed in-the-wild exploitation yet.

SharePoint admins have had a rotten week, and it just got worse. A freshly disclosed flaw, CVE-2026-58644, was exploited as a zero-day before Microsoft patched it — meaning the comforting fantasy that defenders get a quiet window before attackers show up wasn't invited to this party. (CVE-2026-21509: Microsoft Office Zero-Day Active Exploit | Orca Security)

SecurityWeek reports Microsoft patched the bug after attackers had already used it, and CISA has now added it to the Known Exploited Vulnerabilities catalog with a July 19 deadline. The flaw affects every supported on-premises SharePoint version and enables remote code execution. Crucially, it lands alongside earlier exploited SharePoint issues like CVE-2026-56164 — which turns this from "one bad bug" into sustained pressure on on-prem SharePoint. (CVE-2026-21509: Microsoft Office Zero-Day Active Exploit | Orca Security)

If it succeeds as a campaign, half-patched farms become prime targets and defenders lose the ability to reason about intrusions one CVE at a time. The signal to watch: if incident responders start reporting chaining between the older July SharePoint bugs and this new one, every organization running exposed collaboration servers needs to assume post-exploitation, not just patch the obvious hole.

Security products becoming the emergency is always extra grim — a little like discovering your smoke detector is on fire. CISA ordered federal agencies on Thursday to patch two actively exploited Fortinet FortiSandbox flaws — CVE-2026-25089 and CVE-2026-39808 — by July 19. (CVE-2026-21509: Microsoft Office Zero-Day Active Exploit | Orca Security)

Fortinet's advisory describes CVE-2026-39808 as an OS command injection bug rated CVSS 9.8, allowing an unauthenticated attacker to run code via crafted HTTP requests. FortiGuard's PSIRT index also lists CVE-2026-25089 affecting FortiSandbox and FortiSandbox Cloud lines. This is the class of issue defenders dread most: internet-facing security infrastructure, no authentication required, and confirmation someone is already using it outside the lab. Your security stack can become the initial-access broker when it sits exposed and unpatched.

If this succeeds for attackers, the appliance meant to catch malware becomes the doorway for it. The observable signal: watch for ransomware crews being publicly linked to these flaws — that's the point where opportunists pile in and the story escalates from advisory to active campaign.

If you've ever grabbed a Core Power shake or a carton of Fairlife ultra-filtered milk, you're looking at a brand that just went dark across the entire United States. (Ransomware Hits Coca-Cola's Fairlife — All U.S. Dairy Production Suspended)

The Coca-Cola Company disclosed on July 16 — in a Form 8-K filing with the SEC — that its Fairlife dairy subsidiary identified unauthorized access to a portion of its systems, including production-related systems, in connection with a ransomware event. U.S. production is temporarily suspended; the company says product quality, safety, and Canadian production were not affected. Fairlife is one of Coca-Cola's major brands, with an estimated $4 billion in annual sales. As of now, no data theft has been confirmed, no extortion demand disclosed, and no ransomware group has claimed the attack.

Ransomware that shuts down physical production lines — not just IT — is the nightmare that keeps food-sector security teams awake. Past incidents at Arizona Beverages and food distributor UNFI dragged into weeks-long outages and empty shelves. The signal to watch: if a ransomware group claims credit and posts stolen data within the next 72 hours, this shifts from disruption to double-extortion — and becomes a template for pressuring manufacturers by hitting production first, negotiations second.

Ukraine's national cybersecurity agency posted a warning on July 16 that Russia's most destructive hacking group has added a new social-engineering trick — and it's aimed at ordinary messaging apps.

Ukraine's State Service of Special Communications (SSSCIP), via its official Telegram channel, said CERT-UA is observing new techniques from Sandworm — the GRU unit (also tracked as APT44) behind the 2015 and 2016 Ukrainian power-grid attacks. Attackers are using Signal to send messages persuading users to install an app disguised as an "antivirus protection" tool; once installed, it quietly harvests files from Windows or Android devices. Since spring 2026, the group has also begun compromising ordinary websites to use as staging infrastructure — a shift from attacker-owned domains to hijacked legitimate sites that are far harder to block. (CISA’s Emergency Alert: Actively Exploited SharePoint and FortiSandbox Bugs Requ)

This makes malware delivery harder to spot at the network level, because traffic to a compromised legitimate site looks perfectly normal. No UAC designation has been assigned in the available advisory text yet — but CERT-UA is Tier 1, the primary public record of GRU tradecraft. If you run Signal in any organization touching Ukrainian government or defense work, treat unsolicited "security tool" download requests as hostile. The observable signal: whether CERT-UA follows with indicators, which would mean the tactic is widespread enough to hunt, not just read about.

Russia's leading security publication Xakep reported on July 16 that a working exploit for the Windows "LegacyHive" zero-day is now public. This matters because our prior issue flagged LegacyHive's PoC as live for under 48 hours — and the trigger was explicit: if a public exploit lands, weaponization moves fast on widely-deployed Windows components. Western defenders should treat this as the front edge of a patch emergency that hasn't hit English-language wires yet. Source: Xakep.ru — Russian. No English-language coverage confirmed at time of publication.

Xakep also reported that Apple has filed suit against OpenAI, claiming a former employee exploited a vulnerability to steal trade secrets. If accurate, it's a notable insider-threat-meets-vulnerability story between two of tech's largest players — and the kind of legal action that tends to surface technical detail about exactly how the bug was abused. Worth tracking for the forensic specifics as English coverage develops. Source: Xakep.ru — Russian. No English-language coverage confirmed at time of publication.

Somewhere a Fairlife bottling line sits idle while attackers rifle through it, a FortiSandbox meant to catch malware quietly serves as the front door, and a Cisco router old enough to vote just got flagged as a live threat. The lesson of the day is that "patch it later" now shares a calendar with "milk is out of stock" — and the most useful warning about tomorrow's grid attack is currently sitting in a Ukrainian Telegram channel that most Western SOCs won't read until it's a headline. (Ransomware Hits Coca-Cola's Fairlife — All U.S. Dairy Production Suspended)

Stay paranoid.

Forward this to the friend who still thinks Signal is automatically safe.