The Lyceum: Cyber Intelligence Daily — Jul 27, 2026

The weekend’s strongest signals came from systems people are trained to trust: Fortinet firewalls, self-hosted GitLab servers, hotel Wi-Fi and healthcare billing providers. None marks a wholly new era, but together they force an uncomfortable operational assumption: the security boundary may already be collecting credentials, rendering attacker-controlled code or redirecting users before anyone notices.

• CVE-2026-12569 — PTC Windchill and FlexPLM: patch status was not stated in the retrieved results; actively exploited and listed in CISA’s Known Exploited Vulnerabilities catalog, with no CVSS score in the supplied backbone; unauthenticated remote attackers can exploit improper input validation.
• CVE-2026-20230 — Cisco Unified Communications Manager: patch status was not stated; actively exploited and listed in CISA’s catalog, with no CVSS score in the supplied backbone; successful exploitation threatens enterprise communications infrastructure.
• CVE-2026-20262 — Cisco Catalyst SD-WAN Manager: patch status was not stated; reported as a zero-day in CISA’s catalog, with no CVSS score in the supplied backbone; compromise could expose the control plane used to manage branch and data-center routing.
• CVE-2026-35273 — Oracle PeopleSoft Enterprise PeopleTools: patch status was not stated; actively exploited and listed in CISA’s catalog, with no CVSS score in the supplied backbone; missing authentication can expose sensitive enterprise functions to remote attackers.
• CVE-2026-10520 — Ivanti Sentry: patch status was not stated; actively exploited and listed in CISA’s catalog, with no CVSS score in the supplied backbone; vulnerable appliances may permit unauthenticated remote code execution.

Your firewall is supposed to guard the keys, not quietly photocopy them.

Russian-language publication Xakep reports that further analysis of the operation known as FortiBleed identified records associated with 86,644 Fortinet devices across 194 countries, up from roughly 73,000 when researcher Bob Diachenko found an exposed attacker server in June. According to Xakep, the dataset contained device addresses, administrative credentials and configuration-like records; researchers including Kevin Beaumont reportedly found that some credentials still worked. (xakep.ru)

A device’s appearance in the dataset does not prove that its owner’s internal network was breached. What the measurement does suggest, however, is an industrialized process for finding Fortinet appliances, testing credentials and packaging access for later use.

That changes the remediation decision. Patching closes a software flaw; it does not make a stolen password secret again. Organizations that find a FortiGate appliance or credential in an external leak should rotate local and directory-linked passwords, terminate virtual private network sessions, review configuration changes and require phishing-resistant multifactor authentication.

The operation is separate from the FortiSandbox vulnerabilities that the U.S. Cybersecurity and Infrastructure Security Agency added to its Known Exploited Vulnerabilities catalog on July 16. The federal remediation deadline for those flaws is August 6. If FortiBleed credentials begin appearing in named ransomware investigations, the observable shift will be clear: this was not merely credential collection, but a functioning market for initial access. (bleepingcomputer.com)

Depthfirst has released working proof-of-concept code that turns a malicious Jupyter Notebook commit into command execution on a self-managed GitLab server.

The attack chain combines memory-corruption flaws in Oj, the JSON parser GitLab uses, with GitLab’s notebook-diff renderer. An authenticated project member can commit a specially constructed notebook and trigger processing by opening its changes. Depthfirst demonstrated commands running as GitLab’s git service account—an identity that may have access to source code, deployment credentials, Rails secrets and continuous-integration data. (GitLab’s “Bug Fix” Now Has a Working Server-Takeover Exploit)

There is no CVE and no NVD score for the chain. GitLab shipped the relevant dependency update on June 10 as a bug fix rather than documenting the full server-takeover path as a security vulnerability. Depthfirst says it has not observed exploitation, while The Hacker News reports that the exploit targets GitLab 18.11.3 on x86-64 and can be adapted to nearby builds by changing offsets. (GitLab’s “Bug Fix” Now Has a Working Server-Takeover Exploit)

Self-managed GitLab operators should move to 18.10.8, 18.11.5, 19.0.2 or later. Unsupported branches need an upgrade, not a wait-and-see strategy; no validated configuration-only workaround has been published.

If defenders adopt the fixed versions quickly, the exploit remains a sharp lesson in how file previews become server-side attack surfaces. If GitLab assigns a CVE, confirms exploitation or emergency scanners begin looking for vulnerable notebook renderers, it will have crossed into a live patch race. (GitLab’s “Bug Fix” Now Has a Working Server-Takeover Exploit)

The next Microsoft 365 phishing page on a business trip may arrive without a phishing email.

BleepingComputer reports that ReliaQuest identified attackers compromising Wi-Fi gateways at hotels and conference venues, then altering Domain Name System settings—the internet’s address book—to redirect travelers toward counterfeit Microsoft login pages. ReliaQuest observed affected infrastructure in several U.S. cities, India and Saudi Arabia, with travelers from finance, healthcare, energy, legal services and retail among the targets.

Some attempts reportedly abuse Microsoft’s device-code authentication. Instead of stealing a second authentication factor, the attacker persuades the victim to approve a session the attacker already initiated. ReliaQuest said the router-focused tradecraft resembles campaigns associated with APT28, the Russian military intelligence-linked group, but did not establish attribution.

The practical change is that public Wi-Fi can become part of the deception itself. Typing the correct address no longer guarantees that the network will take you there. Organizations can reduce that risk with always-on full-tunnel virtual private networks, encrypted DNS in strict mode and removal of Microsoft Entra device-code authentication where it is unnecessary.

Non-adoption looks like successful logins from unfamiliar locations shortly after employee travel, followed by mailbox access or session-token abuse. If the same compromised gateways begin redirecting banking, cloud-console or identity-provider traffic, hotel infrastructure will have become a general-purpose credential interception platform rather than a Microsoft-specific campaign.

A payment card expires. A medical history and Social Security number do not.

SecurityWeek reports that the U.S. Department of Health and Human Services breach tracker now lists 1,261,464 people affected by the attack on Medical Computer Business Services, an Atlanta-area billing and revenue-management provider. MCBS says an unauthorized party accessed or removed files between September 22 and September 26, 2025, and that the company completed its review on May 28, 2026.

According to MCBS, the affected files may contain names, addresses, Social Security numbers, birth dates, insurance identifiers, diagnoses, treatment information and details about physical or mental conditions. SecurityWeek identifies seven healthcare organizations as affected MCBS clients.

The PEAR ransomware group claims it stole more than three terabytes of data, but that volume remains an attacker assertion. MCBS says it has found no evidence that the information has been used for identity theft.

The lasting risk is medical-identity fraud: false insurance claims, unfamiliar treatments and convincing messages that borrow real clinical details. Recipients should consider freezing their credit and scrutinizing insurance explanations of benefits, rather than relying only on conventional monitoring. Additional client disclosures would be the clearest signal that the confirmed count is still incomplete.

The sole validated item without confirmed English-language coverage—Xakep’s Russian-language FortiBleed investigation—leads this issue rather than being buried here. No second fresh foreign-language report in the supplied validation set cleared the same evidentiary bar.

A firewall photocopying the keys, a GitLab notebook opening a shell, and hotel Wi-Fi sending the sales team into a counterfeit Microsoft lobby: three perfectly normal pieces of infrastructure having deeply abnormal weekends.

Meanwhile, the factory password on ESAFENET CDG 3 is apparently still doing its best impression of a security control.

Patch the boring things.

Forward this to the person who still calls public Wi-Fi “good enough.” (GitLab’s “Bug Fix” Now Has a Working Server-Takeover Exploit)