Critical Vulnerabilities Demand Immediate Action: ColdFusion CVSS 10.0, Defender Privilege Escalation, and a New AI Supply Chain Attack Class

Public Sector

Published on

July 9, 2026

Table of Contents

Threat Assessment Level: ELEVATED State government networks face a convergence of actively exploited critical vulnerabilities, a novel developer supply chain attack technique, and persistent ransomware targeting that demands immediate leadership attention. Three new additions to CISA's Known Exploited Vulnerabilities (KEV) catalog — including a maximum-severity Adobe ColdFusion flaw — carry mandatory remediation deadlines. Meanwhile, a fundamentally new attack class targeting AI coding assistants has emerged, and ransomware operators continue to refresh their targeting of government entities even as no new victims have been publicly claimed this week. This is not a theoretical risk briefing. These vulnerabilities are being exploited now, against systems commonly found in state agency environments. <h2> What Changed </h2> <table> <thead> <tr> <th> Date </th> <th> Event </th> <th> Significance </th> </tr> </thead> <tbody> <tr> <td> 2026-07-07 </td> <td> CISA adds CVE-2026-48282 (Adobe ColdFusion, CVSS 10.0) to KEV </td> <td> Mandatory patch deadline triggered; active exploitation confirmed in state agency environments </td> </tr> <tr> <td> 2026-07-07 </td> <td> CISA adds CVE-2026-48908 (Joomla SP Page Builder, CVSS 9.8) to KEV </td> <td> Unauthenticated RCE via file upload; actively targeted </td> </tr> <tr> <td> 2026-07-07 </td> <td> 6 ICS advisories issued (Siemens, Hitachi Energy, Digi International) </td> <td> Utility coordination infrastructure affected </td> </tr> <tr> <td> 2026-07-09 </td> <td> Microsoft patches CVE-2026-50656 "RoguePlanet" (Defender LPE, CVSS 7.8) </td> <td> Public PoC available; compromises the antivirus engine itself </td> </tr> <tr> <td> 2026-07-09 </td> <td> Wiz discloses "GhostApproval" AI coding assistant sandbox escape </td> <td> New attack class — CVE-2026-12958, CVE-2026-50549 issued </td> </tr> <tr> <td> Ongoing </td> <td> Play, AiLock, and Nightspire ransomware groups update operational profiles </td> <td> No new state/local government victims claimed this cycle; anomalous quiet period may indicate active pre-encryption dwell </td> </tr> <tr> <td> Ongoing </td> <td> APT41, Volt Typhoon, VOID MANTICORE nation-state activity continues </td> <td> Active state government exploitation campaigns and critical infrastructure pre-positioning confirmed </td> </tr> </tbody> </table> Threat level continuity note: The assessment remains ELEVATED, unchanged from the prior cycle. While no new ransomware incidents against state/local government were confirmed today, the combination of CVSS 10.0 exploitation, public privilege escalation PoC, and a novel supply chain vector sustains this posture. Escalation to HIGH would be triggered by confirmed exploitation of ColdFusion or Defender vulnerabilities within state networks. <h2> Threat Timeline </h2> <table> <thead> <tr> <th> Date </th> <th> Actor / Campaign </th> <th> Event </th> <th> Impact </th> </tr> </thead> <tbody> <tr> <td> 2026-06-12 </td> <td> VOID MANTICORE (Iranian IRGC) </td> <td> Breach of California water utility </td> <td> Confirmed destructive capability against U.S. critical infrastructure </td> </tr> <tr> <td> 2026-07-01 </td> <td> China-nexus (UAT-7810) </td> <td> CVE-2026-45659 (SharePoint RCE) added to CISA KEV </td> <td> Confirmed exploitation against government targets </td> </tr> <tr> <td> 2026-07-07 </td> <td> Unknown actors </td> <td> CVE-2026-48282 (ColdFusion) & CVE-2026-48908 (Joomla) added to KEV </td> <td> Active exploitation in state agency environments </td> </tr> <tr> <td> 2026-07-08 </td> <td> APT41 </td> <td> State government exploitation campaign updated in threat feeds </td> <td> Ongoing targeting of state government networks </td> </tr> <tr> <td> 2026-07-09 </td> <td> Researchers (MSNightmare) </td> <td> RoguePlanet PoC published for CVE-2026-50656 </td> <td> SYSTEM-level privilege escalation via Defender engine </td> </tr> <tr> <td> 2026-07-09 </td> <td> Wiz Research </td> <td> GhostApproval disclosure </td> <td> Six AI coding tools vulnerable to sandbox escape </td> </tr> </tbody> </table> <h2> Key Threat Analysis </h2> <h3> 1. Adobe ColdFusion CVE-2026-48282 — The Most Urgent Patch This Week </h3> This is a path traversal to arbitrary code execution vulnerability scoring the maximum CVSS 10.0. It requires no authentication, no user interaction, and affects ColdFusion versions 2025.9 and 2023.20 and earlier. CISA's KEV addition confirms active exploitation. Why this matters for state government: ColdFusion remains embedded in legacy citizen-facing portals across state agencies — tax filing systems, permit applications, benefits portals. Many of these instances were deployed years ago and may not be on current patch cycles. An attacker exploiting this vulnerability gains full code execution on the web server with no prerequisites. ATT&CK Techniques: T1190 (Exploit Public-Facing Application), T1059.003 (Windows Command Shell), T1083 (File and Directory Discovery) <h3> 2. Microsoft Defender "RoguePlanet" — CVE-2026-50656 </h3> A race condition in Microsoft Defender's Malware Protection Engine (mpengine.dll) allows local privilege escalation to SYSTEM. The public proof-of-concept (published on GitHub by "MSNightmare") has been tested successfully on fully-patched Windows 10 and Windows 11 systems. Microsoft deployed the fix in engine version 1.1.26060.3008 via automatic update. Why this matters: This vulnerability compromises the security tool itself. An attacker who has achieved initial access on any endpoint can escalate to SYSTEM privileges by exploiting the antivirus engine — the very component meant to detect them. If auto-update is blocked by policy, GPO misconfiguration, or network segmentation, endpoints remain vulnerable. ATT&CK Techniques: T1068 (Exploitation for Privilege Escalation), T1211 (Exploitation for Defense Evasion) <h3> 3. GhostApproval — A New Attack Class Targeting Developer Workflows </h3> Wiz Research disclosed a symlink-based technique that tricks AI coding assistants into writing files outside their designated sandbox. Demonstrated attacks include writing attacker SSH keys to ~/.ssh/authorized_keys, achieving persistent access without malware, network callbacks, or any traditional indicator of compromise. Affected tools: Amazon Q, Claude Code, Cursor, Google Antigravity, Augment Code, Windsurf CVEs issued: CVE-2026-12958 (AWS Language Server, patched in v1.69.0), CVE-2026-50549 (Cursor, patched in v3.0) Why this matters: State development teams increasingly use AI coding assistants for application modernization. The attack requires only that a developer clones or opens a malicious repository — no exploit, no malware download. Traditional EDR and network monitoring will not detect this. Developer workstations typically have elevated access to CI/CD pipelines, source code repositories, and deployment credentials. ATT&CK Techniques: T1059.006 (Python execution), T1547.004 (SSH Authorized Keys persistence), T1036 (Masquerading via symlink), T1195.001 (Supply Chain Compromise) <h3> 4. ICS/OT Advisory Cluster — Utility Coordination at Risk </h3> Six ICS advisories issued on July 7 affect products commonly found in state government utility coordination networks: <ul> <li> Siemens SINEC OS / RUGGEDCOM — Multiple vulnerabilities in industrial network management </li> <li> Digi International PortServer TS — Authentication bypass enabling restricted access </li> <li> Hitachi Energy e-mesh EMS — Buffer overflow in energy management systems </li> <li> Hitachi Energy PROMOD V — Insecure HTTP transmission of sensitive data </li> </ul> These products are deployed in the OT/ICS environments that state agencies use for water system oversight, transportation management, and energy distribution coordination. <h3> 5. Ransomware Posture — Quiet but Not Safe </h3> No new state/local government ransomware victims were claimed this cycle. However, three government-targeting ransomware groups — Play , AiLock , and Nightspire — all updated their operational profiles in threat intelligence feeds within the past 72 hours. WARLOCK SPIDER (operators of AiLock) and REVENANT SPIDER remain active. Akira and LockBit5 continue to list government among their target sectors. This quiet period is anomalous and should not be interpreted as reduced risk. Ransomware operators typically maintain 7-21 day dwell times before encryption. Active feed updates without public victim claims may indicate targeting in progress. <h3> 6. Nation-State Persistent Threats </h3> <table> <thead> <tr> <th> Actor </th> <th> Nexus </th> <th> Last Activity </th> <th> Concern </th> </tr> </thead> <tbody> <tr> <td> APT41 </td> <td> China </td> <td> 2026-07-08 (campaign update) </td> <td> Active state government exploitation campaign </td> </tr> <tr> <td> Volt Typhoon / Salt Typhoon </td> <td> China </td> <td> Ongoing (long dwell-time) </td> <td> Pre-positioning in critical infrastructure </td> </tr> <tr> <td> UAT-7810 </td> <td> China </td> <td> 2026-07-01 (SharePoint exploitation) </td> <td> ORB network expansion for government targeting </td> </tr> <tr> <td> VOID MANTICORE </td> <td> Iran (IRGC) </td> <td> 2026-06-12 (water utility breach) </td> <td> Demonstrated destructive capability </td> </tr> <tr> <td> APT28 </td> <td> Russia </td> <td> 2026-07-06 (last update) </td> <td> SMOKELOADER campaigns active </td> </tr> </tbody> </table> <h2> Predictive Analysis </h2> <table> <thead> <tr> <th> Scenario </th> <th> Probability </th> <th> Timeframe </th> <th> Basis </th> </tr> </thead> <tbody> <tr> <td> Additional exploitation of ColdFusion CVE-2026-48282 against state agencies </td> <td> 70% </td> <td> 7 days </td> <td> CVSS 10.0 + KEV listing + confirmed active exploitation + legacy state deployments </td> </tr> <tr> <td> Ransomware group claims new state/local government victim </td> <td> 50% </td> <td> 7 days </td> <td> Play, AiLock, Nightspire all operationally active with recent feed updates </td> </tr> <tr> <td> GhostApproval technique weaponized in real-world attacks </td> <td> 40% </td> <td> 30 days </td> <td> Public PoC, trivial to replicate, affects widely-used tools </td> </tr> <tr> <td> RoguePlanet (CVE-2026-50656) incorporated into post-exploitation toolkits </td> <td> 60% </td> <td> 14 days </td> <td> Public PoC on GitHub, SYSTEM-level escalation, high utility for attackers </td> </tr> <tr> <td> China-nexus actor leverages SharePoint RCE (CVE-2026-45659) for new state gov intrusion </td> <td> 35% </td> <td> 30 days </td> <td> Confirmed exploitation pattern + APT41 active campaign </td> </tr> </tbody> </table> <h2> SOC Operational Guidance </h2> <h3> Immediate Detection Priorities </h3> <ol> <li> ColdFusion Exploitation (CVE-2026-48282) </li> </ol> <ul> <li> Hunt hypothesis: Attackers are exploiting path traversal in ColdFusion to achieve code execution on legacy citizen portals. </li> <li> Monitor: Web application logs for path traversal patterns (../, ..%2f, %252e%252e) targeting ColdFusion endpoints. Alert on cmd.exe or powershell.exe spawned as child processes of ColdFusion service accounts. </li> <li> ATT&CK: T1190, T1059.003, T1083 </li> <li> Detection: WAF rules for path traversal + endpoint detection for unusual process trees from ColdFusion runtime processes. </li> </ul> <ol start="2"> <li> Defender Engine Integrity (CVE-2026-50656) </li> </ol> <ul> <li> Hunt hypothesis: Attackers with initial access are exploiting the Defender engine race condition to escalate to SYSTEM. </li> <li> Monitor: Defender engine version across all endpoints — any system running mpengine.dll versions prior to 1.1.26060.3008 is vulnerable. Alert on unexpected SYSTEM-level process creation that correlates with Defender engine activity. </li> <li> ATT&CK: T1068, T1211 </li> <li> Detection: SCCM/Intune compliance query for engine version. Sysmon Event ID 1 (process creation) with parent process matching Defender service and unexpected child processes. </li> </ul> <ol start="3"> <li> Joomla SP Page Builder Exploitation (CVE-2026-48908) </li> </ol> <ul> <li> Hunt hypothesis: Unauthenticated attackers are uploading web shells via the SP Page Builder file upload function. </li> <li> Monitor: HTTP POST requests to SP Page Builder upload endpoints. Alert on new .php files appearing in Joomla upload directories. Monitor for web shell indicators (T1505.003). </li> <li> ATT&CK: T1190, T1505.003, T1059.004 </li> <li> Detection: File integrity monitoring on Joomla directories. WAF rules blocking unauthenticated file uploads to known vulnerable endpoints. </li> </ul> <ol start="4"> <li> Ransomware Precursor Activity </li> </ol> <ul> <li> Hunt hypothesis: Ransomware operators (Play, AiLock, Nightspire) are conducting reconnaissance or lateral movement within state networks prior to encryption. </li> <li> Monitor: Unusual SMB/RPC lateral movement (T1021.002), mass file enumeration (T1083), Volume Shadow Copy deletion (T1490), and credential dumping (T1003). </li> <li> ATT&CK: T1021.002, T1486 (precursors), T1490, T1003 </li> <li> Detection: Behavioral analytics for lateral movement velocity. Alert on vssadmin delete shadows or equivalent. Monitor for Cobalt Strike/Sliver beaconing patterns. </li> </ul> <ol start="5"> <li> AI Coding Tool Sandbox Escape (GhostApproval) </li> </ol> <ul> <li> Hunt hypothesis: Malicious repositories are being used to trigger symlink-based file writes outside AI coding assistant sandboxes on developer workstations. </li> <li> Monitor: Symlink creation in repository working directories that point outside the project folder. Unexpected modifications to ~/.ssh/authorized_keys, .bashrc, or cron directories on developer machines. </li> <li> ATT&CK: T1547.004, T1036, T1195.001 </li> <li> Detection: EDR rules for symlink creation followed by file writes to sensitive system paths. Git hook monitoring for suspicious repository content. </li> </ul> <h3> Threat Hunting Queries (Conceptual) </h3> // ColdFusion exploitation - process tree anomaly process_parent_name:"coldfusion*" AND process_name:("cmd.exe" OR "powershell.exe" OR "certutil.exe") // Defender engine version compliance gap software_name:"Microsoft Malware Protection Engine" AND version:<"1.1.26060.3008" // Ransomware precursor - lateral movement burst event_type:"network_connection" AND dest_port:(445 OR 135) AND unique_dest_count:>10 AND timeframe:<"5m" // GhostApproval - symlink to sensitive paths file_operation:"symlink_create" AND target_path:("/home/*/.ssh/*" OR "C:\\Users\\*\\.ssh\\*") <h2> Sector-Specific Defensive Priorities </h2> <h3> Financial Services (Tax/Revenue Systems, Treasury) </h3> <ul> <li> Priority 1: Patch ColdFusion immediately — tax filing portals and revenue systems commonly run on ColdFusion backends. CVE-2026-48282 provides unauthenticated RCE. </li> <li> Priority 2: Validate Defender engine updates on all financial processing workstations — these handle sensitive taxpayer data and are high-value targets for privilege escalation. </li> <li> Priority 3: Review Oracle EBS patch status — financial/ERP systems are secondary targets once initial access is achieved. </li> <li> Key risk: Data exfiltration of taxpayer PII (SSN, financial records) following ColdFusion exploitation. </li> </ul> <h3> Energy (Utility Coordination, Grid Oversight) </h3> <ul> <li> Priority 1: Assess exposure to ICSA-26-188-05 (Siemens SINEC OS/RUGGEDCOM) and ICSA-26-188-07 (Digi PortServer TS) in utility coordination networks. </li> <li> Priority 2: Review Hitachi Energy e-mesh EMS and PROMOD V deployments for buffer overflow and insecure transmission vulnerabilities. </li> <li> Priority 3: Maintain heightened monitoring for VOID MANTICORE TTPs — the June 12 California water utility breach confirms Iranian destructive capability against U.S. infrastructure. </li> <li> Key risk: Manipulation of control systems (T0831) or unauthorized command messages (T0855) in energy management infrastructure. </li> </ul> <h3> Healthcare (Health & Human Services, Medicaid Systems) </h3> <ul> <li> Priority 1: Inventory and patch any ColdFusion-based benefits portals or eligibility systems — these contain protected health information (PHI) subject to HIPAA. </li> <li> Priority 2: Ransomware preparedness — healthcare/HHS systems are high-value ransomware targets due to service restoration urgency. Validate offline backup integrity for Medicaid and benefits databases. </li> <li> Priority 3: Ensure Defender engine updates have propagated to clinical and case management workstations that may have restricted update policies. </li> <li> Key risk: Ransomware encryption of benefits processing systems during open enrollment periods. </li> </ul> <h3> Government (Courts, Elections, Law Enforcement, DMV) </h3> <ul> <li> Priority 1: ColdFusion and Joomla patching across all citizen-facing portals — court filing systems, DMV appointment portals, and public records searches. </li> <li> Priority 2: Credential theft defense — ensure Entra ID conditional access policies restrict device-code OAuth flow (DEBULL technique from prior cycle remains active). Monitor for AiTM phishing targeting government email accounts. </li> <li> Priority 3: Election infrastructure isolation — verify that election systems are segmented from general government networks where ColdFusion/Joomla vulnerabilities may exist. </li> <li> Key risk: Nation-state espionage (APT41, Volt Typhoon) targeting policy data, law enforcement intelligence, and election infrastructure. </li> </ul> <h3> Aviation/Logistics (Transportation, Public Transit) </h3> <ul> <li> Priority 1: Review Digi International PortServer TS deployments in transportation management systems — authentication bypass (ICSA-26-188-07) enables unauthorized access. </li> <li> Priority 2: Assess Siemens RUGGEDCOM exposure in transit SCADA/communications infrastructure. </li> <li> Priority 3: Monitor for Volt Typhoon pre-positioning indicators in transportation control networks — this actor specifically targets transportation infrastructure for strategic disruption capability. </li> <li> Key risk: Disruption of public transit operations or traffic management systems through ICS vulnerability exploitation. </li> </ul> <h2> Prioritized Defense Recommendations </h2> <h3> IMMEDIATE (Within 24 Hours) </h3> <table> <thead> <tr> <th> Priority </th> <th> Team </th> <th> Action </th> </tr> </thead> <tbody> <tr> <td> 1 </td> <td> IT Ops </td> <td> Patch or isolate all Adobe ColdFusion instances — verify versions newer than 2025.9/2023.20 are deployed. Any internet-facing ColdFusion not patched within 24 hours must be taken offline. CVE-2026-48282 is CVSS 10.0 and under active exploitation. </td> </tr> <tr> <td> 2 </td> <td> IT Ops / Endpoint </td> <td> Verify Microsoft Defender engine auto-update to version 1.1.26060.3008+ across all managed endpoints via SCCM/Intune compliance reporting. Public PoC for RoguePlanet (CVE-2026-50656) enables SYSTEM-level privilege escalation. Flag any endpoints where auto-update is blocked. </td> </tr> <tr> <td> 3 </td> <td> SOC </td> <td> Deploy detection rules for ColdFusion exploitation — monitor for path traversal patterns in web logs and anomalous child processes spawned by ColdFusion service accounts. </td> </tr> <tr> <td> 4 </td> <td> Executive / IR </td> <td> Confirm ColdFusion patch status across all agencies — this is a leadership decision point. Agencies with unpatched ColdFusion face imminent risk of compromise. </td> </tr> </tbody> </table> <h3> 7-DAY </h3> <table> <thead> <tr> <th> Priority </th> <th> Team </th> <th> Action </th> </tr> </thead> <tbody> <tr> <td> 5 </td> <td> IT Ops </td> <td> Inventory and patch all Joomla instances with SP Page Builder — CVE-2026-48908 (CVSS 9.8) enables unauthenticated RCE. Remove the extension if not business-critical. </td> </tr> <tr> <td> 6 </td> <td> DevOps </td> <td> Audit AI coding assistant usage — update Amazon Q Language Server (≥1.69.0), Cursor (≥v3.0). Disable symlink following in workspace configurations. Brief developers on GhostApproval risk from untrusted repositories. </td> </tr> <tr> <td> 7 </td> <td> OT/ICS </td> <td> Assess ICS advisory applicability — review ICSA-26-188-05 (Siemens RUGGEDCOM) and ICSA-26-188-07 (Digi PortServer TS) against state utility coordination network inventories. Apply patches or implement compensating controls. </td> </tr> <tr> <td> 8 </td> <td> SOC </td> <td> Implement ransomware precursor hunting — deploy behavioral detection for lateral movement velocity, shadow copy deletion, and credential dumping. Maintain elevated monitoring given anomalous quiet period from active ransomware groups. </td> </tr> <tr> <td> 9 </td> <td> IAM </td> <td> Revalidate Entra ID conditional access policies — confirm device-code OAuth flow restrictions are enforced (DEBULL technique mitigation from prior cycle). </td> </tr> </tbody> </table> <h3> 30-DAY </h3> <table> <thead> <tr> <th> Priority </th> <th> Team </th> <th> Action </th> </tr> </thead> <tbody> <tr> <td> 10 </td> <td> CISO </td> <td> Establish AI coding assistant security policy — require security review before new AI development tools are adopted. Include symlink/sandbox escape testing in tool evaluation criteria. </td> </tr> <tr> <td> 11 </td> <td> CISO / Procurement </td> <td> Evaluate alternative OSINT sources — 14+ days of OSINT degradation has created a structural intelligence gap, particularly for legislative monitoring (PIR-003). Budget allocation for replacement source needed by Day 151. </td> </tr> <tr> <td> 12 </td> <td> IT Ops / Architecture </td> <td> Conduct ColdFusion modernization assessment — legacy ColdFusion deployments represent recurring critical risk. Develop migration roadmap to supported platforms for citizen-facing applications. </td> </tr> <tr> <td> 13 </td> <td> OT/ICS </td> <td> Commission segmentation review of utility coordination networks — ensure ICS/SCADA systems are properly isolated from IT networks where web application vulnerabilities may provide initial access. </td> </tr> <tr> <td> 14 </td> <td> IR / Executive </td> <td> Update incident response playbooks — incorporate RoguePlanet (Defender compromise) scenario and GhostApproval (developer workstation compromise) scenario into tabletop exercises. </td> </tr> </tbody> </table> <h2> IOC Blocking Guidance </h2> The following indicators are derived from active threat intelligence collection and should be incorporated into blocking and detection rules: <h3> Network Indicators </h3> <table> <thead> <tr> <th> Type </th> <th> Value </th> <th> Context </th> </tr> </thead> <tbody> <tr> <td> IPv4 </td> <td> 105.112.116[.]71 </td> <td> APT-associated infrastructure </td> </tr> <tr> <td> Domain </td> <td> ftp.cantablew[.]top </td> <td> C2 infrastructure </td> </tr> <tr> <td> Domain </td> <td> ftp.duct-master[.]com </td> <td> C2 infrastructure </td> </tr> <tr> <td> Domain </td> <td> microsft-auth.duckdns[.]org </td> <td> Credential phishing / C2 </td> </tr> <tr> <td> Domain </td> <td> www.xoilac365ll[.]cc </td> <td> Malicious infrastructure </td> </tr> </tbody> </table> <h3> File Indicators (SHA-256) </h3> <table> <thead> <tr> <th> Hash </th> <th> Context </th> </tr> </thead> <tbody> <tr> <td> 2f7042e955dda68b77b23d9783159eb42699d5c17ec08edf0c1020b21a606eca </td> <td> Malware sample </td> </tr> <tr> <td> b775c45641d3bef0bf1efd6ee05d71e10ea8b6d1e143e44494ec1d0f9cdc40f5 </td> <td> Malware sample </td> </tr> <tr> <td> 5b9b8f4ca9dd4574e7233679e2c5b7b61132c571e54d4410876088f73d51062f </td> <td> Malware sample </td> </tr> <tr> <td> bed0ffa9df6a196d672c2e310c3be28b2c0797b04c4d740accb93fa889be8a03 </td> <td> Malware sample </td> </tr> <tr> <td> 821386b587ea4f3074cc1cffb972c24a3bed4e6efe67b9a64c9dfc06e8f0bf25 </td> <td> Malware sample </td> </tr> <tr> <td> dee7624eda362b657770a1b26ab5295ffa36dff0164e7e50caf1de20b0bf3016 </td> <td> Malware sample </td> </tr> <tr> <td> 3715362196b8842d4413cd14a3ee6f7d2b1c1ce22adf17803c6af809a72a7d4d </td> <td> Malware sample </td> </tr> <tr> <td> 460dc1b2a5f58fa05628824d111d636ca2c9df771a1c3b02313717b09ac2c36c </td> <td> Malware sample </td> </tr> <tr> <td> 1a95b0beb91bcfb7c73fb11adddef7b9cc3e1da00878ae356426b8ff7d0ca5d6 </td> <td> Malware sample </td> </tr> </tbody> </table> <h3> File Indicators (MD5 / SHA-1) </h3> <table> <thead> <tr> <th> Type </th> <th> Hash </th> <th> Context </th> </tr> </thead> <tbody> <tr> <td> MD5 </td> <td> ab41589e1ed328680f6a6ed9f29394e5 </td> <td> Malware sample </td> </tr> <tr> <td> SHA-1 </td> <td> 6e6561231c6cfc32c5631aeecc0928ff2b14265c </td> <td> Malware sample </td> </tr> <tr> <td> SHA-1 </td> <td> 788dd28fd49610d6047cbb15dbf1186afffdfbaf </td> <td> Malware sample </td> </tr> <tr> <td> SHA-1 </td> <td> 815a8d2feb5615ae7f0b5befd206af0b0160614c </td> <td> Malware sample </td> </tr> <tr> <td> SHA-1 </td> <td> 87a1f93986aa1500b85aeff16b0b71c29ea116ea </td> <td> Malware sample </td> </tr> <tr> <td> SHA-1 </td> <td> 89810e2d80281d42f855fac813786758ee16e323 </td> <td> Malware sample </td> </tr> <tr> <td> SHA-1 </td> <td> b85ee287bfe52c6b2d9b41758b5e0d08679d5b39 </td> <td> Malware sample </td> </tr> <tr> <td> SHA-1 </td> <td> f49faa4a64f8ac0e38983e606075b25dfcfc9ad4 </td> <td> Malware sample </td> </tr> <tr> <td> SHA-1 </td> <td> f8b16d5764ee1e78c1ef333017ad383ffe76fcdc </td> <td> Malware sample </td> </tr> <tr> <td> SHA-1 </td> <td> aee2d40fc023584efc551714aacf0e1854dbafa5 </td> <td> Malware sample </td> </tr> </tbody> </table> Additional IOCs for the campaigns discussed in this report are available through Anomali ThreatStream Next-Gen and partner feeds. <h2> Bottom Line </h2> The message today is straightforward: patch ColdFusion now, verify Defender updates, and get visibility into your AI development tooling. The convergence of a CVSS 10.0 vulnerability under active exploitation, a privilege escalation PoC targeting your endpoint security engine, and a novel supply chain attack class affecting developer workflows creates a compressed decision window. ColdFusion exploitation against state agencies is not hypothetical — it is confirmed and ongoing. Every hour an unpatched instance remains internet-facing is an hour of unnecessary exposure. For leadership: this is a week where the patch management process earns its investment — or fails visibly. Confirm agency compliance within 24 hours. For the 30-day horizon, the GhostApproval disclosure signals that AI-assisted development tools are now part of your attack surface whether you've formally adopted them or not. Policy must catch up to reality. The threat actors targeting state government — APT41, Volt Typhoon, Play, AiLock, VOID MANTICORE — have not paused. Neither should your defenses. Anomali CTI Desk | 2026-07-09 | TLP:GREEN For questions or additional context on any finding in this bulletin, contact your Anomali intelligence team.

FEATURED RESOURCES

July 8, 2026

Anomali Cyber Watch

Public Sector

Critical Vulnerabilities and Novel Attack Techniques Threaten State Government Networks

July 8, 2026

Anomali Cyber Watch

Iran Conflict Cyber Escalation: AI-Autonomous Ransomware Emerges as Critical Infrastructure Faces Coordinated Threat Surge

July 9, 2026

Anomali Cyber Watch

The Calm Before the Storm: Iranian Cyber Operations Enter Peak Danger Phase During Geneva Talks

Explore All