⚡ Daily Global Cyber Threat Intelligence Digest | July 28, 2026

Coverage window: July 27, 2026, 08:00 to July 28, 2026, 08:00 (UTC+8)
Audience: CISOs, SOC teams, IT/Cloud Security, Identity Security, and APAC defence teams

This edition includes only events first disclosed during the coverage window, or developments that received significant technical, victim-scope, official-confirmation, or operational-risk updates during the period.

Microsoft, NVD, CISA, affected-company disclosures, and original research were prioritised. Functional proofs of concept, third-party infection estimates, media synthesis, and attacker claims are presented separately from officially confirmed facts.

---

📝 Executive Summary — 10-Second Read

• 🔴 The functional proof of concept for Certighost CVE-2026-54121 is drawing widespread attention. An authenticated low-privilege domain user can obtain a certificate representing a domain controller in an unpatched AD CS environment, then progress through PKINIT, NT hash extraction, and DCSync to full domain takeover. The original PoC was disclosed on July 24, with further risk amplification during this coverage window. No credible source currently confirms in-the-wild exploitation.

• 🔴 A pre-authentication RCE exploit for vBulletin CVE-2026-61511 has been released publicly. An unauthenticated request can pass attacker-controlled template values into PHP eval(). Although the public exploit contains an easily corrected character error, Internet-facing legacy versions should be updated immediately.

• 🟠 XLab estimates that the Dysphoria botnet has grown to more than approximately 200,000 bots. The botnet uses Ethereum ENS, Solana SNS, and obfuscated blockchain data to resolve C2 infrastructure, and provides DDoS and traffic-relay capabilities.

• 🔴 The latest cross-filing analysis suggests that the DentaQuest breach may affect more than 23.4 million people. The final count remains uncertain, but potentially exposed data includes Social Security numbers, Medicaid/Medicare identifiers, and diagnosis, treatment, and billing information.

• 🟠 Coca-Cola confirmed that some data was taken during the Fairlife ransomware incident. Most affected United States production has resumed. Anubis claims to have stolen approximately 1 TB, but the volume and contents have not been confirmed by the company.

---

🚨 Major Incidents

1. Certighost CVE-2026-54121: Low-Privilege Account Can Escalate to AD Domain Takeover

Original technical disclosure/PoC: July 24, 2026
Update during this window: Widely reported on July 27, with increased focus on enterprise operational risk
Microsoft CVSS v3.1: 8.8 — High
Analyst operational priority: 🔴 Critical for unpatched Enterprise CA environments
Exploitation status: Functional PoC available; no confirmed in-the-wild exploitation
Affected scope: Unpatched Windows domains using Microsoft Active Directory Certificate Services

CVE-2026-54121 is an improper-authorisation vulnerability in Microsoft Active Directory Certificate Services.

An authenticated low-privilege domain user can manipulate certificate-enrolment and directory-mapping information associated with a machine identity, causing the enterprise CA to issue a certificate representing a privileged computer account, including a domain controller.

The public PoC demonstrates the following attack path:

Low-privilege domain account
        ↓
Manipulate certificate request / machine-account identity mapping
        ↓
Obtain a certificate representing a domain controller
        ↓
Authenticate via PKINIT as the DC machine account
        ↓
Extract related Kerberos / NT authentication material
        ↓
Perform DCSync
        ↓
Obtain krbtgt or other domain credentials
        ↓
Full domain takeover

Why This Is Not Ordinary Privilege Escalation

Although exploitation requires an authenticated low-privilege account, the starting condition can be satisfied by many common enterprise scenarios:

• An employee account compromised through phishing or an infostealer.
• A contractor or temporary user.
• A misconfigured service account.
• A standard domain account obtained through lateral movement.
• A dormant account that remains valid despite long-term inactivity.

The official CVSS score is High, but in environments with an Enterprise CA and delayed patching, the complete chain can produce domain-wide impact. It should therefore receive a Critical operational priority.

Immediate Actions

1. Deploy Microsoft’s July 2026 security update for CVE-2026-54121 immediately.

2. Inventory all:

   • Enterprise CAs.
   • Offline or disaster-recovery CAs.
   • Test and legacy CAs.
   • Domain controllers with delayed patching.
   • Low-privilege accounts that can still submit certificate requests.

3. Hunt for low-privilege accounts suddenly submitting, modifying, or repeatedly resubmitting machine-certificate requests.

4. Monitor abnormal certificate requests that ultimately map to a domain-controller identity.

5. Hunt for unexpected PKINIT authentication, computer-account certificate authentication, and DCSync.

6. Monitor the CA performing unexpected directory/RPC-related lookups against workstations or non-domain-controller hosts.

7. If successful exploitation is suspected:

   • Preserve CA and DC logs.
   • Revoke suspicious certificates.
   • Investigate affected machine accounts.
   • Review krbtgt and other privileged accounts.
   • Assess whether a controlled krbtgt password rotation is required.
   • Do not close the incident merely because the patch has been installed.

Primary Sources

• Microsoft MSRC — CVE-2026-54121
• NVD — CVE-2026-54121
• BleepingComputer — Certighost PoC and Domain-Takeover Chain

---

2. vBulletin CVE-2026-61511: Public Route Can Trigger PHP `eval()` RCE

Technical disclosure update: July 27, 2026
Analyst operational priority: 🔴 Critical for vulnerable Internet-facing forums
Exploitation status: Public exploit available; no credible source currently confirms in-the-wild exploitation
Affected scope: Vulnerable self-hosted deployments of vBulletin 5.x through 5.7.5, and 6.x through 6.2.1

CVE-2026-61511 affects vBulletin’s runtime-template processing flow.

An unauthenticated attacker can use:

ajax/render/pagenav

to pass an attacker-controlled:

pagenav[pagenumber]

value into the {vb:math} template tag.

Although the backend runMaths() function removes or restricts alphabetic characters, it still permits:

• Numbers.
• Parentheses.
• String concatenation.
• XOR.
• Other operators sufficient to reconstruct PHP expressions.

The attacker-controlled content can ultimately reach PHP eval(), resulting in unauthenticated remote code execution.

The public exploit contains a character error that prevents the original code from succeeding directly, but the correction is trivial and does not affect the underlying vulnerability.

Patch Status

vBulletin provided security fixes for supported branches in late June and released vBulletin 6.2.2 on July 1.

• vBulletin 6.x deployments should upgrade to 6.2.2 or later.
• Environments running 6.2.1, 6.2.0, or 6.1.6 should verify the corresponding branch-specific patch.
• Legacy 5.x deployments should confirm support status and prioritise migration to a supported release.
• vBulletin Cloud customers were reportedly remediated by the vendor.

Immediate Actions

1. Update vBulletin Core, not only plugins or themes.

2. Hunt for abnormal POST requests to ajax/render/pagenav.

3. Alert on pagenav[pagenumber] values containing large numbers of parentheses, XOR operators, concatenation symbols, or abnormal length.

4. Monitor PHP/web-server processes launching:

   • Shells.
   • PowerShell.
   • curl/wget.
   • Download utilities.
   • Unexpected external connections.

5. Hunt for:

   • New PHP web shells.
   • Modified templates.
   • Newly created administrators.
   • New scheduled tasks.
   • Unexpected plugin or extension files.

6. Forums that were publicly exposed and not updated promptly should undergo a compromise assessment.

Primary Sources

• SSD Secure Disclosure — vBulletin Runtime Template Pre-auth RCE
• The Hacker News — Public Exploit Reporting

---

🎯 Threat Activity

3. Dysphoria: Large DDoS Botnet Uses Blockchain-Based C2 Resolution

Observation period: Continuously evolving since Q1 2026
Update during this window: Further public reporting on infection scale and C2 architecture
Research estimate: XLab estimates the bot count has exceeded approximately 200,000
Primary capabilities: DDoS, traffic relaying, and possible residential-proxy services

The Dysphoria botnet tracked by QiAnXin XLab evolved from the jackskid/fbot family and has increasingly split into variants with different DDoS and traffic-relay capabilities.

Rather than embedding a fixed C2 address directly in samples, Dysphoria uses:

• Ethereum Name Service.
• Solana Name Service.
• Blockchain RPC endpoints or gateways.
• Encrypted data disguised as IPv6 strings.
• Custom byte transformations.

These mechanisms dynamically recover the real command-and-control infrastructure.

This design allows operators to update destinations through blockchain records after conventional domains or C2 servers are taken down.

Affected Targets

• Internet-facing routers.
• Cameras, NVRs, and NAS devices.
• IoT equipment that has remained unpatched for extended periods.
• Residential proxy networks.
• Enterprise services that may become DDoS targets.

Recommended Actions

1. Update the firmware of all publicly exposed routers, cameras, NVRs, NAS devices, and IoT equipment.

2. Disable Internet-facing Telnet, SSH, ADB, and unnecessary management services.

3. Change default passwords and limit management access to internal networks or VPNs.

4. Monitor abnormal ENS/SNS resolution, blockchain RPC/gateway access, and subsequent connections to unknown C2 infrastructure.

5. Build behavioural detections for:

   • UDP floods.
   • TCP floods.
   • High-frequency proxy forwarding.
   • Abnormal outbound relaying.
   • Sudden increases in blockchain-name resolution.
   • Long-lived outbound connections from IoT devices.

6. Confirm that externally facing services have DDoS mitigation, rate limiting, and upstream scrubbing capacity.

Primary Sources

• CNCERT / Qi-Anxin Wangshen — Risk Advisory on the Widespread Propagation of the Dysphoria Botnet
• BleepingComputer — Dysphoria Botnet Analysis

---

4. Compromised Public Wi-Fi Gateways Combine DNS Hijacking with Device-Code OAuth Abuse

Status: Carry-over
Original research: July 23, 2026
Update during this window: Further media reporting on July 27
Observed regions: Hotels, conference venues, and shared spaces in the United States, India, and Saudi Arabia
Attribution status: Similarities to APT28/FrostArmada tradecraft, but insufficient evidence for formal attribution

ReliaQuest observed attackers compromising public Wi-Fi captive-portal gateways and modifying DNS settings on gateways or SOHO routers to redirect users towards attacker-controlled Microsoft-themed lure infrastructure.

This is not merely a conventional fake Microsoft sign-in page.

The core flow directly observed by researchers involved abuse of Microsoft device-code authentication:

User connects to compromised public Wi-Fi
        ↓
DNS is modified
        ↓
User is redirected to attacker-controlled Microsoft-themed lure
        ↓
Attacker initiates device-code authentication flow
        ↓
User approves the sign-in on the legitimate Microsoft authorisation page
        ↓
Microsoft issues OAuth tokens to the attacker-controlled client
        ↓
Attacker obtains an MFA-satisfied session

The attack chain does not necessarily require direct password interception.

Even if an employee uses a passkey or FIDO2, approving a device-code flow initiated by the attacker may still give the attacker a valid OAuth session.

Attribution Limitations

Some techniques resemble previous FrostArmada activity attributed to APT28.

However, this activity differs in:

• Attack infrastructure.
• Captive-portal targeting.
• Some TTPs.
• Victim environments.

The more accurate current assessment is therefore:

The attacker reused, imitated, or independently adopted tradecraft similar to FrostArmada.

The activity should not be formally attributed to APT28.

Recommended Actions

For Enterprises and Users

1. Privileged personnel should prefer mobile hotspots or enterprise-managed cellular connectivity in public locations.

2. Use Conditional Access to require:

   • A compliant device.
   • A managed device.
   • An approved client application.
   • Sign-in risk evaluation.
   • Location-aware access controls.

3. Restrict or disable Microsoft device-code flow where there is no business requirement.

4. Restrict user consent and OAuth application consent.

5. Monitor:

   • Device-code sign-ins.
   • Abnormal client IDs.
   • Unfamiliar OAuth sessions.
   • New token issuance after public-network sign-ins.
   • Sessions used across different regions within a short period.

6. Educate users not to approve a device-code request they did not initiate, even when the authorisation page is hosted on a legitimate Microsoft domain.

7. Use encrypted DNS, while recognising that a compromised gateway may still intercept or block the traffic.

For Venue Operators

1. Update captive-portal, gateway, and SOHO-router firmware.
2. Rotate administrator credentials.
3. Disable Internet-facing management.
4. Monitor changes to DNS settings, resolver configuration, and portal redirects.
5. Maintain a known-good baseline for gateway configuration.

Primary Sources

• ReliaQuest — DNS Poisoning Tactics Expand to Hospitality
• SecurityWeek — Public Wi-Fi Gateway Reporting

---

🔐 Data Breach / Ransomware

5. DentaQuest: Latest Analysis Suggests Potential Impact May Exceed 23 Million People

Status: Carry-over breach; significant affected-population update during this window
Original incident announcement: Around July 16, 2026
Update during this window: Cross-regulatory filing and deduplication analysis on July 27
Confirmed intrusion period: May 17 to May 20, 2026
Analyst impact assessment: 🔴 High

DentaQuest states that an unauthorised actor accessed its network between May 17 and May 20.

Potentially affected information includes:

• Names.
• Addresses.
• Social Security numbers.
• Member identification numbers.
• Medicaid/Medicare numbers.
• Dental or vision service providers.
• Diagnosis information.
• Treatment information.
• Billing information.

Evidence Tiers for the Affected Population

Public figures currently differ:

• State attorney-general filings total at least approximately 4.5 million people.
• Media reporting indicates that DentaQuest has confirmed at least approximately 15 million people.
• After deduplicating and consolidating multiple filings, the potential impact may exceed 23.4 million people.

Therefore:

23.4 million is a potential-impact estimate, not a confirmed final breach count.

Even if the final figure is lower, the incident involves difficult-to-replace medical and government identity data, creating risks that may persist for years.

Recommended Actions

For Notified Individuals

1. Activate the credit-monitoring and identity-restoration services provided by the company.

2. Consider placing a credit freeze.

3. Monitor medical-insurance, benefits, and Explanation of Benefits records.

4. Be alert to phishing/vishing impersonating:

   • Dentists.
   • Insurance companies.
   • Medicare.
   • Medicaid.
   • Billing departments.
   • Identity-monitoring services.

5. Do not trust a caller simply because they know diagnosis details, member numbers, or treatment information.

For Healthcare and Insurance Organisations

1. Monitor for fraudulent medical claims and insurance fraud.
2. Do not use SSNs, dates of birth, or member IDs as the sole means of identity verification.
3. Use out-of-band verification for account changes and benefit applications.
4. Monitor credential stuffing, account-recovery abuse, and abnormal provider claims.

Primary Sources

• DentaQuest — Notice of Data Breach
• California Attorney General — DentaQuest Breach Notification
• SecurityWeek — DentaQuest Scale Analysis

---

6. Fairlife: Coca-Cola Confirms Data Exfiltration in Ransomware Incident

Major update during this window: July 27, 2026
Company confirmation: Some data was taken; most affected United States production has resumed
Attacker claim: Anubis claims to have stolen approximately 1 TB
Confirmation status: Data volume and contents have not been verified by Coca-Cola
Analyst impact assessment: 🟠 Medium to High

Coca-Cola’s latest confirmation states that the Fairlife ransomware incident affected not only production-related systems in the United States, but also involved some data being taken by the attackers.

The company states that:

• Most affected United States production has resumed.
• Canadian production was not affected.
• Product quality and safety were not affected.
• Investigation and recovery efforts remain ongoing.

The Anubis ransomware group claims that it:

• Encrypted some systems.
• Stole approximately 1 TB of confidential data.
• May publish data to pressure the victim.

Coca-Cola has currently confirmed only that some data was taken. It has not confirmed:

• The claimed 1 TB volume.
• The specific data types.
• All claims made by Anubis.
• The complete impact on employees, suppliers, or customers.

Recommended Actions

1. Fairlife/Coca-Cola supply-chain partners should be alert to spear-phishing using genuine contracts, invoices, production, or logistics information.

2. Rotate the following if shared with Fairlife-facing platforms:

   • Service accounts.
   • API keys.
   • Vendor-portal credentials.
   • MFT credentials.
   • Remote-support accounts.

3. Review supply-chain portals, ERP, MFT, and remote-support accounts for abnormal sign-ins.

4. Verify any changes to payment methods, beneficiary accounts, or logistics information.

5. Until the company provides further confirmation, do not treat the attacker’s claim of 1 TB or specific data contents as established fact.

Primary Sources

• The Coca-Cola Company — Technology Disruption Involving fairlife Operations
• SecurityWeek — Coca-Cola Confirms Fairlife Data Theft

---

👀 Developments to Watch

• Certighost: Whether genuine in-the-wild exploitation emerges, and whether malicious certificate requests, DC impersonation, or DCSync indicators are added to public detection content.
• vBulletin CVE-2026-61511: Whether mass scanning, web-shell deployment, or large-scale forum compromise emerges rapidly after release of the public exploit.
• Dysphoria: Primary infection vectors, affected device models, and whether the botnet begins launching larger DDoS attacks.
• DentaQuest: Final affected population, complete dataset, and any threat-actor attribution still require official confirmation.
• Fairlife: The types of data taken and the scope of impact on employees, suppliers, or business partners.
• CISA KEV: Based on the catalogue snapshot as of July 28, 2026, 08:00 (UTC+8), no new entries were identified during this window. Existing KEV items still require continued remediation according to their deadlines.

KEV Source

• CISA Known Exploited Vulnerabilities Catalogue

---

✅ Today’s Priority Actions

P0 | Immediate

1. Confirm that every Microsoft Enterprise CA has received the CVE-2026-54121 update.
2. Inventory every Internet-facing vBulletin deployment and upgrade to a supported, patched version.
3. Begin compromise assessments for CAs and vBulletin systems that were publicly exposed and not patched promptly.
4. Restrict Microsoft device-code authentication and review abnormal device-code sign-ins from the previous seven days.
5. Confirm DDoS protection, upstream scrubbing, and restrictions on IoT/router management interfaces.

P1 | Next 24–72 Hours

1. Hunt for abnormal machine-certificate requests, PKINIT, DCSync, and krbtgt access.
2. Hunt for vBulletin template abuse, web-server child processes, and new PHP files.
3. Monitor abnormal ENS/SNS resolution, blockchain RPC access, and subsequent connections to unknown C2 infrastructure.
4. Review new OAuth sessions, abnormal client IDs, and cross-region token reuse for users who connected through public Wi-Fi.
5. Establish monitoring for healthcare, insurance, supply-chain, and payment-change fraud related to DentaQuest and Fairlife.

P2 | Within This Week

1. Build a complete asset inventory covering Enterprise CAs, public Web applications, captive portals, IoT, and supplier platforms.

2. Add certificate issuance, OAuth consent, device-code flow, and machine identity to identity threat detection.

3. Establish the following controls for every public Web platform:

   • Core-software inventory.
   • Version verification.
   • Web-shell hunting.
   • Credential rotation.
   • Named incident-response owner.

4. Stop treating a legitimate Microsoft authorisation page, signed certificate, blockchain name, or genuine medical data as sufficient evidence of trust.

---

📌 Final Assessment

The incidents in this coverage window once again show attackers abusing the mechanisms enterprises trust most:

• AD CS certificate trust.
• PHP template engines.
• Public Wi-Fi DNS.
• Microsoft OAuth device-code authentication.
• Blockchain-based name resolution.
• Healthcare and supply-chain identity data.

Certighost shows how a low-privilege domain account can escalate through the certificate trust chain to full domain takeover. The public Wi-Fi activity shows that even when users do not enter a password on a fake site, they can still surrender a valid session by approving a malicious OAuth flow.

Today’s defensive conclusion is:

Do not verify only whether authentication succeeded. Verify why the certificate, OAuth client, device-code request, network path, and identity data were trusted in the first place.