Daily Cyber News: Update 07 — English headline pending

Government, defense, diplomatic, academic and policy organizations were compromised by a Windows backdoor that placed its native command channel inside Microsoft 365. By July 2026, the campaign had reached approximately 350 endpoints across eight countries. Investigators identified 10 confirmed and five probable affected institutional environments and linked the activity to China with high confidence.

Key context: Tailored phishing emails and fake software installers delivered the malware.

Additional detail: That use of common cloud services can make malicious traffic blend with legitimate business activity.

For more cybersecurity news and the full Daily Cyber newsletter, visit DailyCyber.News.
Cybersecurity training, courses, books, and resources: BareMetalCyber.com.

Topics: cybersecurity news, cybersecurity, cyber risk, phishing, malware, microsoft 365, windows.

Daily Cyber News: Enterprise file-sharing gateways exposed by maximum-severity flaw

Organizations using Kiteworks Email Protection Gateway face remote takeover if exposed appliances remain below version 9.4.1. Kiteworks released updates covering 126 vulnerabilities. The most serious is a maximum-severity chain that requires no login or user interaction and can let an attacker execute code before gaining full administrative control of the appliance.

Key context: The wider update also fixes 11 critical weaknesses involving authentication, account takeover and access control.

Additional detail: Nearly 400 Kiteworks instances were tracked as exposed to the internet, although their patch status was unknown.

For more cybersecurity news and the full Daily Cyber newsletter, visit DailyCyber.News.
Cybersecurity training, courses, books, and resources: BareMetalCyber.com.

Topics: cybersecurity news, cybersecurity, cyber risk, Enterprise, file-sharing, gateways, exposed, maximum-severity, flaw.

Daily Cyber News: AI-led attack reaches root access in seconds through helpdesk system

A Dutch vulnerability disclosure nonprofit suffered data access and exfiltration after an AI-powered attack chained two previously unknown flaws in its Zammad helpdesk system. Used together, the weaknesses allowed session hijacking, remote code execution and privilege escalation from the Zammad user to root within seconds. The attacker then reached other services before the response team intervened.

Key context: Network segmentation and rapid containment limited deeper movement, but investigators are still assessing the damage.

Additional detail: Support platforms should be treated as connected business systems because they may contain sensitive conversations and credentials.

For more cybersecurity news and the full Daily Cyber newsletter, visit DailyCyber.News.
Cybersecurity training, courses, books, and resources: BareMetalCyber.com.

Topics: cybersecurity news, cybersecurity, cyber risk, remote code execution, privilege escalation, vulnerability, AI-led, attack, reaches, root.