Russian Spies Read Your Inbox for Five Months

Zimbra is an email and collaboration platform used by governments and businesses worldwide. For at least five months in 2025, a Russian state-backed espionage group — tracked as TA488 by Proofpoint and CL-STA-1114 by Palo Alto Networks' Unit 42 — read Western mailboxes through a then-unknown flaw in Zimbra's webmail client, according to a joint advisory from the NSA, CISA, and partner agencies.

The flaw, CVE-2025-66376, is a stored cross-site scripting (XSS) vulnerability — a technique where attackers inject malicious code into a webpage that then runs inside another user's browser session. In this case, attackers sent crafted HTML emails that executed JavaScript the moment the message rendered. The victim did not need to click anything. Unit 42 calls this zero-click (requiring no interaction from the target whatsoever).

Once triggered, a payload called ZimReaper went to work silently. It stole saved passwords, two-factor recovery codes, and 90 days of the victim's emails, then packaged and sent the whole archive to attacker-controlled servers. It also created an app-specific password inside Zimbra, granting the attackers persistent email access without triggering two-factor prompts.

Targets spanned government, defence, transportation, and financial organisations in NATO member states, Ukraine, and the US — including nuclear installations.

Zimbra patched the flaw on 6 November 2025. CISA added it to its Known Exploited Vulnerabilities catalogue in March 2026.

What you should do: If your organisation uses Zimbra Collaboration, verify you are running version 10.0.18 or 10.1.13 or later. Patching closes the hole — but it does not undo any access already gained. Check for unexpected app-specific passwords inside Zimbra settings and rotate credentials for any account that may have been exposed.

Redis is an open-source database tool used widely by developers to store and retrieve data at high speed. On 23 July 2026, Redis shipped seven security updates after researchers published working proof-of-concept exploit code for critical memory flaws across multiple Redis versions, according to The Hacker News.

What makes this story notable: the vulnerabilities were discovered and exploited by AI agents running Moonshot AI's Kimi K3 model. The agents independently identified two attack paths — a double-free memory corruption bug in Redis Streams, and an out-of-bounds write (a flaw where a program writes data beyond the memory space it was allocated) in the RedisBloom module — and produced working exploit code for both.

No in-the-wild exploitation has been confirmed as of 24 July 2026. If you run Redis, upgrade to the patched release for your branch immediately.

CVE ID not confirmed in source — check the original advisory before acting.

PTC Windchill and FlexPLM are enterprise Product Lifecycle Management (PLM) platforms — software used by engineering, manufacturing, and supply chain teams to design and manage products from concept through to production. They are widely used in aerospace, defence, automotive, and medtech.

What it is: CVE-2026-12569 is a critical unsafe deserialization vulnerability (a flaw where an application processes attacker-supplied data as trusted executable instructions without verifying it first). Successful exploitation allows an unauthenticated attacker to execute arbitrary code on the vulnerable server, as reported by Bleeping Computer.

Who's at risk: Any organisation running internet-exposed Windchill or FlexPLM instances that has not applied the patches released from 17 June 2026. PTC serves over 30,000 customers globally.

CVSS: 9.3 (Critical — patch this week. This is actively being exploited.)

Root cause: The application deserializes attacker-controlled input without validating whether the resulting object is safe to process. Think of it like a mailroom that opens every parcel and assembles its contents without checking whether the instructions inside are legitimate or malicious. The server trusts the data structure entirely, allowing attackers to embed executable instructions inside a crafted request.

Attack vector: An unauthenticated attacker sends a specially crafted HTTP request to an internet-exposed Windchill or FlexPLM instance. The server deserializes the payload, executes the embedded code, and the attacker gains remote control. From there, Clop operators have been deploying JSP webshells (small server-side scripts that give persistent remote command access) to extract sensitive product design and manufacturing data.

Detection strategies: Look for unexpected JSP files in application directories. Monitor outbound connections from PLM servers to unfamiliar external IPs. Check for extortion emails arriving from support@cryptohox.com, a confirmed Clop contact address.

Recommended actions:

1. Apply PTC's security patches (available from 17 June 2026) immediately.
2. Place Windchill and FlexPLM instances behind a VPN or trusted access gateway — remove direct internet exposure.
3. If compromise is suspected, isolate the affected server, collect forensic logs, and rotate all exposed credentials before restoring service.

Microsoft is changing how Windows enterprise activation works, replacing a software-only trust model with hardware-backed verification using TPM (Trusted Platform Module — a dedicated security chip built into most modern computers that stores cryptographic keys and confirms the machine hasn't been tampered with), according to Help Net Security.

The change affects Windows Key Management Service (KMS), the on-premises tool organisations use to activate Windows across large fleets of machines. From August 2026, Windows Server 2025 will flag whether your KMS host is ready for hardware-based security. Mandatory enforcement arrives with the next Windows Server LTSC release.

What to do now: If you manage Windows servers, identify your KMS hosts and confirm whether the physical machines have TPM support. If they don't, hardware upgrades may be required before enforcement kicks in. Loop in your IT team and review Microsoft's rollout schedule ahead of the August readiness messaging.

FedRAMP 20X, the updated US framework governing cloud security for federal agencies, moves away from point-in-time annual audits and replaces them with continuously validated Key Security Indicators — machine-readable evidence that controls are actually working, not just documented. Under the old model, an organisation could describe a control and pass. Under 20X, it must prove the control holds up, repeatedly, on a short revalidation cycle. For cloud vendors serving US government clients, this is a fundamental shift in how compliance is structured. Full details at Bleeping Computer.