This episode of Daily Intel delivers critical cybersecurity updates for small-business leaders, cyber professionals, MSPs, CISOs, GovCon leaders, and security operators. We dive into a significant, temporary vulnerability black hole for the open-source project Curl, a data transfer tool used across countless applications. From July 1st to July 31st, 2026, Curl will not accept vulnerability reports, meaning any newly discovered flaws will remain unaddressed until August. This creates a substantial operational risk and a potential window for threat actors, underscoring the vital importance of supply chain security vigilance.

We also explore the rapid advancements in AI agents, with insights from Google Cloud Tech, Cloudflare, and Apple. These discussions highlight how AI agents are becoming more accessible, secure, and practical for automation, data analysis, and streamlining operations.

Key takeaways include:

1. **Curl Exposure Review:** Assess your organization's reliance on Curl and understand the potential risks during July 2026.

2. **AI Agent Evaluation:** Explore new AI agent tooling for internal automation or client delivery, leveraging readily available resources.

3. **Stay Informed:** Continuously monitor emerging AI security and development trends to maintain a strong defensive and offensive posture.

Today's episode highlights immediate threats, including maximum-severity flaws in Ivanti Sentry and Langflow that are currently being exploited, granting attackers root privileges and allowing arbitrary file writes. We also discuss "The Gentlemen," a rapidly expanding ransomware group, and the implications of a major data breach affecting over 450,000 individuals at the University of Nottingham. Furthermore, we explore the evolving landscape of AI agentic tooling, examining both secure development practices and the necessity of robust guardrails to prevent AI agents from operating unsupervised.

Listeners will gain practical takeaways: first, the absolute necessity of immediate patching for critical vulnerabilities; second, strategies to fortify defenses against sophisticated ransomware groups and enhance data breach response plans; and third, best practices for evaluating and implementing secure AI agentic tooling with essential oversight.

We dive into a record-breaking Patch Tuesday from Microsoft, featuring nearly 200 patched vulnerabilities, with almost three dozen deemed critical and exploit code already public for several. This highlights the urgent need for timely patching.

The episode also covers a newly discovered Microsoft Defender zero-day exploit, "RoguePlanet," which grants SYSTEM privileges and emerged shortly after the Patch Tuesday fixes. This underscores the continuous threat landscape, where new vulnerabilities can appear even after extensive patching efforts. Further, we discuss security incidents at major platforms, including ServiceNow's disclosure of an exploited unauthenticated API endpoint and SAP's release of fixes for 15 vulnerabilities, four of which are critical in NetWeaver and Commerce Cloud. These incidents emphasize the widespread impact of platform vulnerabilities and the necessity for users to review advisories and apply mitigations promptly.

Beyond direct cyber threats, we touch on the evolving attack surface introduced by advanced manufacturing, such as Mercedes-Benz's electric axial flux motor production, prompting consideration of new supply chain risks. The briefing also explores the potential and security implications of AI agents for "100X engineering" and secure deployment, while also highlighting critical data privacy considerations, like AWS Bedrock's upcoming requirement to share data with Anthropic. Key takeaways include prioritizing critical updates, immediately addressing ServiceNow and SAP advisories, and carefully evaluating data sharing policies when leveraging AI agents.

Today, we dive into a flurry of zero-day vulnerabilities and significant developments in AI security and automation. Key risks include the targeting of Microsoft's open-source tools, leading to AI developer password theft, highlighting supply chain concerns, and the breach of the French government's Tchap messaging service, underscoring the need for robust identity management. Urgent patching is required for a critical Check Point VPN bug, actively exploited by ransomware, and Google's fifth Chrome zero-day flaw this year.

Practical takeaways involve immediate action on patching Check Point VPNs and Chrome browsers, reviewing open-source tool exposure for AI development teams, and strengthening identity management for critical internal platforms. For future-proofing, explore Google Cloud Tech's multi-agent system design for internal automation and implement Zero Trust principles for AI agents. Keep an eye on new platforms like Gitdot and Apple's Gemini integration to anticipate future security challenges.

Key risks discussed include the shocking Meta AI support hack, which compromised over 20,000 Instagram accounts by manipulating AI-powered systems. This incident highlights the growing threat of AI as an attack vector and the need to secure automated tools. We also delve into the concerning trend of increasing data breach disclosure lags, as organizations take longer to report incidents, leaving customers and partners vulnerable. Furthermore, the EU’s Open Source Strategy, while promoting transparency, introduces potential supply chain attack surface expansion through increased reliance on open-source components.

On the opportunity front, we explore exciting developments in AI and security automation. Microsoft’s "Intelligent Terminal" integrates AI for enhanced command-line efficiency, while Google Cloud Tech showcases efficient multi-agent systems that bypass LLMs for specific tasks. Practical takeaways include reviewing your exposure to recent AI-related breaches, evaluating new AI and agentic tooling with security by design, and researching methods to secure these systems, such as red teaming AI and applying Zero Trust principles to your agent ecosystem.

Today's episode highlights a critical unpatched zero-day, CVE-2026-20245, actively exploited in Cisco Catalyst SD-WAN Manager. Immediate action is crucial for affected users to prevent root privilege escalation. We also discuss two significant data breaches impacting DentaQuest (2.6 million accounts) and the UN World Food Programme (600,000 Gaza households), underscoring persistent data protection challenges for all organizations. The briefing touches on a powerful GNSS interference source affecting critical infrastructure across Europe and explores the dual nature of AI in security, from Anthropic's new AI-powered vulnerability discovery framework to Google Cloud's multi-agent AI for business process automation. We also emphasize the paramount importance of securing these powerful AI agents using Zero Trust principles.

Key takeaways include prioritizing urgent updates for Cisco Catalyst SD-WAN Manager, reviewing data exposure and incident response plans, and integrating AI agents securely from day one with Zero Trust frameworks. Deploy

Today, we're tracking a significant expansion of nation-state activity with a Chinese-speaking cybercrime group deploying new Atlas RAT malware against European targets. We also cover the U.S. Treasury’s OFAC sanctions against Iran's largest crypto exchange, Nobitex, impacting terrorist financing and ransomware operations. Urgent CISA warnings highlight active cyberattacks against internet-exposed automatic tank gauge systems in critical infrastructure and active exploits targeting Linux kernel and Android OS vulnerabilities.

Beyond immediate threats, we explore Google's open-source journey with JPEG XL and the practical implications of AI and automation with Google Cloud Tech's Agent Development Kit (ADK) and new multimodal models like Gemma 4 12B. We also dissect an experiment on LLM hacking capabilities, clarifying that while AI assists in vulnerability identification, human expertise remains crucial.

Practical takeaways for today include reviewing your exposure, especially if operating in Europe or critical infrastructure sectors, and immediately patching Android and Linux systems. Additionally, evaluate new AI and agentic tooling for internal automation or client delivery.

Today’s episode highlights immediate risks and broader security themes. We discuss a significant VS Code zero-day vulnerability that allows attackers to steal GitHub authentication tokens via malicious links, emphasizing the persistent threat of phishing. For web administrators, a critical privilege escalation flaw (CVE-2026-8206) in the Kirki WordPress plugin is actively being exploited to hijack admin accounts, underscoring the urgency of patching.

Beyond specific vulnerabilities, we examine the dismantling of nine organized crime groups involved in illegal streaming, a reminder of the vast, interconnected nature of cybercrime. We also explore how legacy systems and historical code, like the Roku LT OS and Amiga Juggler source code, can present unexpected exposure points if their components are reused or connected in modern environments.

The briefing also covers practical applications of AI and security automation. Google Cloud Tech's Agent Development Kit (ADK) is showcased for automating complex workflows such as SAP order-to-cash processes and streamlining project intake. We also touch on building long-running AI agents and John Hammond’s AI Cybersecurity Research Factory, demonstrating the potential for intelligent automation in both business and security operations.

Key takeaways include the immediate need to patch VS Code and WordPress sites using the Kirki plugin, a call to review all potential exposure points including legacy systems and historical codebases, and an encouragement to evaluate AI tools like Google’s ADK for internal automation and client delivery.

We dive into a truly bizarre Instagram exploit where hackers manipulated Meta’s own AI support bot to deface high-profile accounts, including the Obama White House and the Chief Master Sergeant of the U.S. Space Force. This highlights the evolving nature of social engineering, now targeting AI systems. We also unpack widespread malware distribution campaigns by DriveSurge, using ClickFix and FakeUpdate techniques to hijack thousands of legitimate websites, posing a significant supply chain risk. Further reinforcing this theme, we discuss the compromise of over 30 Red Hat npm packages, distributing the new 'Miasma' credential-stealing malware. Finally, we cover brute-force attacks locking Dashlane password manager users out of their accounts, emphasizing the need for robust master passwords and MFA.

On the AI and automation front, we explore promising developments from Google Cloud Tech on multi-agent AI for project intake, Cloudflare's new Email Service ready for agents, and the increased accessibility of OpenAI frontier models on AWS.

Our practical takeaways include strengthening social media account security with unique passwords and MFA, bolstering supply chain vigilance for both website integrity and software development dependencies, and implementing universal strong MFA with continuous user education across all critical business applications.

Key risks highlighted include active exploitation of the WP Maps Pro WordPress plugin, allowing hackers to create rogue administrator accounts. Immediate patching is crucial for any organization using outdated versions. We also discuss the growing focus on AI agent safety, with Google Cloud Tech and Microsoft Security releasing tools like Rampart and Clarity to enforce policy and build safety into development workflows. This reflects a significant industry push to establish guardrails for autonomous AI.

Practical takeaways emphasize the importance of critically evaluating AI tools for genuine ROI, rather than adding complexity. We also touch on advancements in physical AI reasoning and AI-driven cybersecurity research. Your three immediate actions: patch your WP Maps Pro plugin if applicable, explore AI agent safety tools, and rigorously assess the value of your AI subscriptions.