Certighost Exploit Lets Low-Privileged Active Directory Users Impersonate a Domain Controller
Researchers published a working exploit on July 24 for a flaw dubbed Certighost that lets a low-privileged Active Directory user obtain a certificate for a Domain Controller and authenticate as that machine, then use the resulting Kerberos credential to pull the krbtgt secret through DCSync and take over an entire domain. Tracked as CVE-2026-54121 with a CVSS score of 8.8, the bug lives in an AD CS enrollment fallback that let a certification authority trust a requester-supplied directory server without first confirming it was a real Domain Controller. Microsoft patched the issue on July 14, and organizations running an Enterprise CA are urged to apply that update on AD CS hosts, since exploitation needs only network access and a standard domain account.
OnTrac notifies customers of data breach after network hack
Parcel delivery company OnTrac is notifying customers that hackers breached its corporate network and accessed files between March 20 and 22, though the exact data elements exposed were redacted in the notification sample shared with regulators. The company brought in a third-party specialist to scope the intrusion and says it took steps to ensure the accessed data was “re-secured and not distributed,” language that suggests some form of agreement was reached with the attackers. Affected individuals are being offered a year of free credit monitoring and identity protection, and as of the notification no ransomware or extortion group had publicly claimed responsibility for the attack.
CISA, FBI warn that Iran-linked hackers are expanding target set for water, energy
CISA and the FBI updated a joint advisory warning that Iran-affiliated hackers are broadening their campaign against internet-exposed programmable logic controllers used in water, energy, and other municipal infrastructure, expanding beyond earlier Rockwell Automation targets to include Schneider Electric and Siemens devices. The agencies said the threat groups have already disrupted sites by exploiting default credentials, insecure remote access, and unpatched firmware, in one case using Dropbear SSH to gain remote access to a targeted system. Organizations were urged to change default passwords, enforce multifactor authentication, patch promptly, and place these devices behind a VPN, proxy, or firewall rather than exposing them directly to the internet.
Ransomware Group Threatening to Leak Data Stolen From Coca-Cola’s Fairlife
The Anubis ransomware group has claimed credit for the attack that forced Coca-Cola subsidiary Fairlife to suspend U.S. dairy production, listing the companies on its leak site and claiming to have encrypted servers and exfiltrated a terabyte of confidential data. The group gave Coca-Cola roughly a week to pay before the stolen data is published, and offered to help restore systems quickly if a ransom is paid. Active since late 2024, Anubis has previously drawn scrutiny for a wiper feature that can permanently destroy victim files even after a double-extortion attack, raising the stakes for organizations weighing whether to negotiate.
Ubuntu snap-confine Vulnerability Enables Local Root Access
Qualys researchers disclosed a high-severity race condition in Ubuntu’s snap-confine component, tracked as CVE-2026-8933, that lets any local user gain full root access on default installations of Ubuntu Desktop 24.04, 25.10, and 26.04. The flaw traces back to a 2025 hardening change that moved snap-confine from a set-user-ID-root binary to a set-capabilities model, leaving a narrow window during sandbox setup where an attacker can mount a FUSE filesystem and plant symlinks to redirect root-owned writes, then drop a malicious udev rule to force systemd-udevd to execute commands as root. Canonical has released patches, and administrators are urged to update snapd immediately since the affected package ships by default across employee workstations and servers alike.
