Daily cybersecurity briefing for CISOs and security leaders.

🎧 Listen to this episode

Today's episode covers 10 stories across 4 topic areas, including: NATO logistics, Ukrainian troops are top subjects of Russian camera hacks, advisory says; Iran abused mobile networks’ vulnerabilities to locate US military in the Middle East, report says; US unseals indictment against alleged operators of Russian bulletproof hosting service.

The Record (Recorded Future) · Jul 14 · Relevance: █████████░ 9/10

Why it matters to CISOs: Dutch intelligence confirms Russian state actors are systematically compromising internet-connected cameras across Europe to surveil NATO military logistics—a direct signal to CISOs in defense, logistics, and critical infrastructure sectors to audit physical security camera exposure.

📖 Read full article

TechCrunch Security · Jul 14 · Relevance: ████████░░ 8/10

Why it matters to CISOs: Iran's exploitation of SS7/telecom protocol weaknesses to geolocate US military personnel underscores that longstanding mobile network vulnerabilities are being weaponized in kinetic conflict contexts, with direct implications for enterprises with mobile-dependent workforces in high-risk regions.

📖 Read full article

The Record (Recorded Future) · Jul 14 · Relevance: ███████░░░ 7/10

Why it matters to CISOs: The DOJ indictment of operators behind Media Land and ML Cloud—a St. Petersburg-based bulletproof hosting operation that enabled major ransomware gangs—signals continued US law enforcement pressure on Russian cybercriminal infrastructure and may disrupt active threat actor operations.

📖 Read full article

The Hacker News · Jul 14 · Relevance: ████████░░ 8/10

Why it matters to CISOs: A novel OAuth client ID spoofing technique allows threat actors to silently validate stolen Entra ID credentials without triggering sign-in logs—directly undermining SIEM-based detection for credential compromise in Microsoft 365 environments used by virtually every enterprise.

📖 Read full article

BleepingComputer · Jul 14 · Relevance: ███████░░░ 7/10

Why it matters to CISOs: Progress Software's confirmation of a high-severity zero-day in ShareFile Storage Zone Controllers—which forced a four-day service shutdown—is a direct indicator event for enterprises relying on ShareFile for regulated file transfer, requiring immediate patch deployment and incident review.

📖 Read full article

CyberScoop · Jul 14 · Relevance: ████████░░ 8/10

Why it matters to CISOs: The first-ever Treasury sanction of a VPN service for enabling ransomware operations expands the compliance perimeter for enterprises—procurement and vendor risk teams must now screen anonymization infrastructure against OFAC lists, not just traditional software vendors.

📖 Read full article

CyberScoop · Jul 14 · Relevance: ████████░░ 8/10

Why it matters to CISOs: The White House's Gold Eagle initiative establishes a government-run AI threat intelligence clearinghouse that is already prioritizing vulnerability patches—CISOs should monitor whether participation or information-sharing obligations will extend to critical sectors.

📖 Read full article

Cybersecurity Dive · Jul 14 · Relevance: ███████░░░ 7/10

Why it matters to CISOs: SANS Institute research reveals a significant disconnect between senior security leaders who believe AI governance is adequate and frontline practitioners who report major control gaps—a board-level credibility risk for CISOs who have publicly endorsed AI security investments.

📖 Read full article

The Hacker News · Jul 15 · Relevance: █████████░ 9/10

Why it matters to CISOs: Actively exploited zero-days in SonicWall SMA 1000 remote access appliances—a CVSS 10.0 SSRF enabling unauthenticated remote command execution—demand immediate emergency patching across any enterprise using these widely deployed VPN/access gateways.

📖 Read full article

Help Net Security · Jul 15 · Relevance: █████████░ 9/10

Why it matters to CISOs: Two actively exploited zero-days—one in ADFS (CVE-2026-56155) and one in SharePoint (CVE-2026-56164)—within a 570+ CVE release driven by AI-assisted vulnerability discovery signals a permanent structural shift in patch triage volume that will strain enterprise security operations teams.

📖 Read full article

Jordan: Microsoft just shipped patches for over 570 CVEs in a single Patch Tuesday. That's not a typo. Five hundred and seventy. Two of them are actively exploited zero-days. And Microsoft is crediting the volume to AI-assisted bug hunting. If you're running a SOC today, your patch triage process just became structurally inadequate. That's not hyperbole—it's math. Welcome to the new normal.

Alex: Good morning. It's Wednesday, July 15th, 2026. This is Cleartext. I'm Alex Chen, here with Jordan Reeves. We've got a packed show today. Two nation-state surveillance campaigns that should change how you think about physical security and mobile devices. A novel OAuth attack that's invisible to your SIEM. A record-shattering Patch Tuesday we just mentioned. Treasury sanctioning a VPN provider for the first time ever. Two SonicWall zero-days with a perfect CVSS 10. And a governance gap on AI that might be more dangerous than the threats AI is supposed to help you stop. Let's get into it.

Jordan: I want to start with the two nation-state stories because they share a theme that I think CISOs underweight, which is physical-world intelligence collection enabled by cyber access. Dutch intelligence confirmed yesterday that at least one Russian intelligence agency is systematically compromising internet-connected cameras across Europe. The targets are NATO logistics operations and Ukrainian military personnel. They're watching trucks move. They're watching soldiers. This is ISR—intelligence, surveillance, reconnaissance—done through commodity IoT devices.

Alex: And this is exactly the kind of threat that falls between organizational chairs. Physical security owns the cameras. IT may or may not manage the network they sit on. The CISO owns neither but is accountable when something goes wrong. If you're in defense, logistics, critical infrastructure, or frankly any sector adjacent to NATO operations in Europe, you need an inventory of every internet-exposed camera in your environment. Today.

Jordan: The uncomfortable truth is most organizations don't even know how many cameras they have, let alone whether they're exposed. These aren't sophisticated zero-day attacks. This is scanning for default credentials and unpatched firmware on devices that nobody thinks of as part of the attack surface. It's basic, it's effective, and it's happening at scale.

Alex: And then pair that with the Iran story.

Jordan: Yeah. TechCrunch reported that Iranian government operatives exploited SS7 signaling vulnerabilities—the same ones the security community has been screaming about for a decade—to geolocate US military personnel in the Middle East. And this wasn't theoretical. This was used in the lead-up to and during active military operations. They located people and then they struck.

Alex: So for the CISO audience, the takeaway here isn't just military. If you have a mobile-dependent workforce operating in high-risk regions—energy sector, diplomatic, NGO, international business—SS7 vulnerabilities are not a telecom problem you can outsource. You need to understand the exposure and have compensating controls. Secure communications platforms, location obfuscation, device policies for high-risk travel.

Jordan: These two stories together paint a picture. Nation-states are building kill chains that start with cyber access to physical sensors—cameras, cell towers—and end with real-world consequences. The convergence of cyber and physical isn't future-tense anymore.

Alex: Let's pivot to the OAuth story because this one is technically subtle but operationally devastating. Two distinct threat actor groups are using OAuth client ID spoofing to validate stolen credentials against Microsoft Entra ID without generating sign-in log events.

Jordan: Let me make sure that lands. They're checking whether your stolen passwords work, and your SIEM doesn't see it. No failed login. No successful login. No log entry. Your SOC is blind.

Alex: If you're running detection rules based on sign-in telemetry—and virtually every enterprise is—you have a gap. This isn't a theoretical bypass. It's being actively weaponized. Your identity team needs to be coordinating with your detection engineering team right now to understand what OAuth flows are visible and which ones aren't.

Jordan: And this connects to a broader concern I have about the over-reliance on Microsoft-native telemetry for detection. When your detection strategy is built entirely on the vendor's logging, the vendor's logging gaps become your blind spots. This is a case study in that.

Alex: Now let's talk about the patch avalanche. Microsoft's July Patch Tuesday: 570-plus CVEs. Two actively exploited zero-days. CVE-2026-56155, an elevation of privilege in Active Directory Federation Services. CVE-2026-56164, a SharePoint flaw that CISA has separately flagged. Both confirmed exploited in the wild.

Jordan: The volume story is what matters strategically. Microsoft is attributing this to AI-accelerated vulnerability discovery. They're finding more bugs faster with AI tooling. That's good for security long-term. But short-term, it means your patch management team just got handed three times the historical volume in a single cycle.

Alex: This is a board conversation. If your patch SLA was built around historical averages of 100 to 150 CVEs per Patch Tuesday, your process doesn't scale to 570. You either need to invest in automation, accept more risk, or fundamentally rethink how you prioritize. There's no fourth option.

Jordan: And the ADFS zero-day is particularly nasty because ADFS is still load-bearing infrastructure for federated identity in a lot of enterprises that haven't fully migrated to modern auth. If you're still running ADFS, this is your wake-up call. Actually, your wake-up call was two years ago. This is your fire alarm.

Alex: Staying on the vulnerability front—SonicWall disclosed two zero-days in SMA 1000 series appliances. CVE-2026-15409 is a CVSS 10.0. Unauthenticated server-side request forgery leading to arbitrary command execution. Both are confirmed exploited in the wild.

Jordan: CVSS 10. Unauthenticated. Remote. On a remote access appliance that by design sits at the network edge. If you have SMA 1000 in your environment and you haven't patched as of this morning, stop listening to us and go patch.

Alex: That's not a joke. This is drop-everything severity. SonicWall has released patches. Deploy them.

Jordan: Can I make a broader observation? We keep seeing these edge appliances—VPNs, secure access gateways, file transfer tools—become the primary initial access vector. SonicWall, Ivanti, Citrix, Progress. The devices we bought to secure remote access have become the front door for attackers.

Alex: Which is a perfect segue to ShareFile. Progress Software confirmed a high-severity zero-day in ShareFile Storage Zone Controllers forced a four-day service shutdown. Patches are now available. If you're running on-premises Storage Zone Controllers, you need to patch immediately and conduct an incident review for the exposure window.

Jordan: Progress Software and zero-days. Where have I heard that before? The MOVEit echoes are loud here. Any organization using ShareFile for regulated file transfer needs to treat this as a potential data exposure event, not just a patching exercise.

Alex: Let's shift to governance and enforcement. Two stories that I think are more significant than they might appear at first glance. Treasury's OFAC designated a VPN service—1VPNS, also known as First VPN Service—for providing anonymization infrastructure to ransomware gangs. This is the first time Treasury has sanctioned a VPN provider.

Jordan: First ever. That's precedent-setting. They also hit the alleged Ukrainian administrator and a Belarusian national who was selling cryptors to obfuscate ransomware. This is the US government saying that infrastructure providers are not neutral parties. If you enable ransomware operations, you're a target for sanctions.

Alex: The downstream implication for CISOs is compliance. Your procurement and vendor risk teams now need to screen anonymization and privacy infrastructure against OFAC lists. Not just your traditional software vendors. If someone in your organization is using a sanctioned VPN service—even inadvertently—that's a sanctions violation.

Jordan: And the DOJ indictment of the Media Land and ML Cloud operators fits the same pattern. Three Russian nationals charged for running a St. Petersburg-based bulletproof hosting operation that enabled over $62 million in damages. The coordinated unsealing suggests international cooperation. The enforcement tempo against Russian cybercriminal infrastructure is real and sustained.

Alex: The second governance story is the White House's Gold Eagle initiative. This is a government-run AI threat intelligence clearinghouse that's now confirmed operational. It's already receiving intelligence on AI-related vulnerabilities and prioritizing patch guidance.

Jordan: I'm cautiously interested. The concept is sound—centralized AI-specific threat intel with prioritized patching guidance. The question is execution. Will this become a meaningful intelligence source, or another government portal nobody checks?

Alex: The thing I'm watching is whether participation becomes mandatory for critical sectors. If you're in critical infrastructure, financial services, healthcare—start tracking Gold Eagle now. Don't get surprised by a compliance obligation six months from now.

Jordan: And that connects directly to the SANS Institute research on AI governance gaps. The finding that matters: senior security leaders believe AI governance is adequate, but frontline practitioners report major control gaps. That's a credibility problem.

Alex: It's a board-level credibility risk. If you've told your board that your AI security posture is mature and your own team disagrees, you have an exposure that's not just technical—it's reputational and potentially liability-creating.

Jordan: CISOs need to pressure-test their own narratives. Talk to your practitioners. If there's a gap between what you're reporting up and what's happening on the ground, fix it before someone else finds it.

Alex: Let's close with the outlook. Jordan, what's the thread you're pulling on this week?

Jordan: The theme is convergence. Physical and cyber are converging in the surveillance stories. Patch volume and AI are converging in ways that break existing processes. Sanctions and criminal enforcement are converging on infrastructure providers, not just operators. The boundaries that CISOs used to rely on to scope their responsibilities are dissolving. If your security program is still organized around traditional categories—network, endpoint, identity, physical—you're organized for a threat landscape that no longer exists.

Alex: I'd add that the detection gap theme is critical. Between the OAuth spoofing attack bypassing sign-in logs and cameras being compromised for ISR, we're seeing adversaries who understand our detection architecture better than we do. The competitive advantage right now goes to defenders who are willing to question whether their visibility is actually as good as their dashboards suggest.

Jordan: Assume gaps. Hunt for them. Don't wait for your vendor to tell you what you can't see.

Alex: That's our show for Wednesday, July 15th, 2026. Show notes and links to every story we covered are at cleartext.fm. I'm Alex Chen.

Jordan: I'm Jordan Reeves. Go patch your SonicWall.

Cleartext is an automated daily podcast for CISOs and security leaders. Generated 2026-07-15.

Sources are pulled from: CyberScoop, The Record, SecurityWeek, Krebs on Security, Dark Reading, Cybersecurity Dive, BleepingComputer, Wired, Ars Technica, TechCrunch, Help Net Security, VentureBeat, Risky Business News, The Hacker News, CISA, and BankInfoSecurity.