TruStage Network Shutdown, Zoom Account-Takeover Warning, and New Critical Bugs Lead July 16 Cybersecurity Threats

Top Stories

TruStage shuts down parts of its network after a cybersecurity incident

Insurance provider TruStage disclosed a cybersecurity incident and said it shut down parts of its network while recovery work continues, according to regional reporting from Channel 3000 and WKOW (Channel 3000, WKOW, Coverager).

Why it matters:
For defenders, network shutdowns at financial or insurance organizations usually mean one of three things: active containment, uncertainty around lateral movement, or concern over data-impacting activity. Even without technical details, the operational signal is strong: business disruption is already material.

What to do now: - Check third-party exposure if your firm integrates with TruStage or related service providers. - Review business continuity plans for insurers, brokers, and claims workflows. - Hunt for opportunistic phishing using the incident as social engineering bait.

Dutch police bust alleged €100 million investment fraud operation

Dutch police arrested multiple suspects tied to an international investment fraud operation believed to have defrauded victims of more than €100 million, with tens of thousands of victims affected, per BleepingComputer (source).

Why it matters:
This is not just a fraud story. Large-scale investment scams rely on infrastructure that often overlaps with broader cybercrime operations: spoofed domains, call-center tooling, payment laundering, fake apps, and credential collection.

What to do now: - Block newly registered finance-themed domains where possible. - Warn users about fake investment platforms and “account recovery” follow-ons. - Correlate helpdesk tickets mentioning crypto, investment withdrawals, or “advisor” outreach.

Zoom warns of a critical account takeover vulnerability

Zoom warned about a critical vulnerability in its Windows desktop client and SDK that could let an unauthenticated attacker hijack accounts, according to BleepingComputer (source).

Why it matters:
Zoom is deeply embedded in enterprise workflows. Account takeover risk affects meeting integrity, internal trust, recorded content, chat history, and social engineering opportunities against partners and executives.

What to do now: - Inventory Zoom desktop client and Windows SDK deployments. - Prioritize emergency patching for executive, support, and customer-facing user groups. - Review SSO and MFA enforcement for all Zoom accounts. - Monitor for unusual login locations, suspicious meeting changes, and abnormal token activity if available.

AsyncAPI npm packages were backdoored with credential-stealing malware

BleepingComputer reported that five malicious AsyncAPI package versions were published to npm in a supply-chain attack delivering a remote access trojan and information-stealing capabilities (source).

Why it matters:
This is a practical reminder that modern software risk often enters through CI/CD, package managers, and developer workstations rather than perimeter intrusion.

What to do now: - Audit package lockfiles and build logs for affected AsyncAPI versions. - Rotate developer credentials if those packages were installed or executed. - Rebuild artifacts from known-good dependencies. - Review npm token hygiene and enforce provenance or internal mirroring where possible.

Google Gemini CLI reportedly abused by a threat actor as a hacking tool

A Russian-speaking threat actor used Google’s open-source Gemini CLI as a hacking agent and to operate a small botnet, according to BleepingComputer (source).

Why it matters:
The story is less about one tool and more about defender assumptions. Open-source AI-assisted tooling can be repurposed for reconnaissance, script generation, automation, or operator convenience with little friction.

What to do now: - Update acceptable-use controls for AI-enabled CLI tools. - Log outbound use of developer agent frameworks where feasible. - Treat AI toolchains as dual-use utilities in threat models and egress reviews.

Critical Vulnerabilities

CVE-2026-56699: Wazuh Manager NDJSON injection via agent-controlled field

Wazuh Manager before 5.0.0-beta3 fails to properly escape DataValue.index when building OpenSearch bulk requests, allowing enrolled agents to inject arbitrary NDJSON operations under manager admin credentials (advisory).

Risk: CVSS 10.0
Impact: Document deletion, alert tampering, and cross-agent SIEM state manipulation.

Why it matters:
A monitoring platform being writable through trusted ingestion paths is a high-impact failure. If exploited, this could undermine alert fidelity and incident timelines.

Immediate actions: - Identify Wazuh Manager versions below 5.0.0-beta3. - Restrict which agents can enroll or communicate with the manager. - Review OpenSearch bulk write anomalies and alert/index integrity.

Technical Notes

Check package version:

/var/ossec/bin/wazuh-control info 2>/dev/null || wazuh-managerd -V

Search Wazuh and OpenSearch logs for unusual bulk activity:

grep -R "bulk" /var/ossec/logs/ /var/log/opensearch/ 2>/dev/null
grep -R '"delete"' /var/log/opensearch/ 2>/dev/null

Look for suspicious agent-originated inventory values that contain control characters or NDJSON breaks:

grep -R "DataValue.index" /var/ossec/logs/archives/ 2>/dev/null

CVE-2026-50148: Metabase RCE through Snowflake connection handling

Metabase disclosed a critical remote code execution flaw affecting multiple release tracks. A user who can add or edit a database connection can exploit behavior in the Snowflake JDBC driver to write arbitrary files on the Metabase host and later achieve code execution in the Metabase process (advisory).

Affected fixed versions: 1.54.24, 1.55.24, 1.56.25, 1.57.19, 1.58.14, 1.59.10, 1.60.4

Why it matters:
Metabase often has access to sensitive analytical datasets and runs with connectivity to core business systems. If connection editing is delegated broadly, exposure may be wider than expected.

Immediate actions: - Patch to the fixed version for your branch. - Remove database connection edit rights from non-admin users. - Review recent Snowflake connection changes and driver file modifications on disk.

Technical Notes

Check Metabase version:

java -jar metabase.jar version

Search for recent database connection changes in application logs:

grep -R "Snowflake" /var/log/metabase/ 2>/dev/null
grep -R "database" /var/log/metabase/ 2>/dev/null | grep -Ei "edit|update|create"

Look for unexpected driver file changes:

find /opt/metabase -type f -mtime -7 | sort
find / -type f \( -name "*.jar" -o -name "*.class" \) -mtime -7 2>/dev/null

CVE-2026-44986: Penpot profile takeover

Penpot fixed a critical flaw in version 2.14.5 that could allow a registered user to take over another non-blocked profile due to exposed invitation tokens and improper registration/session handling (advisory, release).

Risk: CVSS 9.9
Impact: Account takeover without password verification under certain conditions.

Immediate actions: - Upgrade to Penpot 2.14.5. - Invalidate active sessions after patching if practical. - Review invitation flows and admin-generated team invites for anomalies.

Technical Notes

If Penpot runs in containers, confirm deployed image tags:

docker ps --format "table {{.Names}}    {{.Image}}"
docker inspect <container> | grep -i image

Review reverse proxy and app logs for invitation and registration endpoints:

grep -R "/register" /var/log/nginx/ /var/log/traefik/ 2>/dev/null
grep -R "invitation" /var/log/ 2>/dev/null | head

CVE-2026-61451: Grav API plugin password reset token poisoning

The Grav API plugin before 1.0.4 failed to validate the origin of a client-supplied admin_base_url in password reset flows, enabling an attacker to poison reset links and capture valid reset tokens on an attacker-controlled host (advisory).

Risk: CVSS 9.6
Impact: Unauthenticated account takeover through poisoned password reset links.

Immediate actions: - Upgrade grav-plugin-api to 1.0.4 or later. - Review password reset requests and emails sent recently. - Enforce canonical application URLs at reverse proxy and application layers.

Technical Notes

Look for suspect password reset requests and unusual Origin or Referer values:

grep -R "/api/v1/auth/forgot-password" /var/log/nginx/ /var/log/apache2/ 2>/dev/null

Example suspicious pattern:

POST /api/v1/auth/forgot-password
Origin: https://attacker.example
Referer: https://attacker.example/reset

A defensive reverse proxy rule should normalize or reject untrusted origins. Example NGINX pattern:

if ($http_origin !~* ^https://admin\.example\.com$) { return 403; }
if ($http_referer !~* ^https://admin\.example\.com/) { return 403; }

CVE-2026-53513: Better Auth SSO plugin SSRF

Better Auth fixed a critical issue in @better-auth/sso before 1.6.11. When skipDiscovery: true was set, attacker-controlled OIDC endpoint URLs could be stored and later fetched during callback processing, enabling non-blind SSRF and possible account linking in some configurations (advisory, release).

Risk: CVSS 9.6
Impact: SSRF and potential account linkage abuse if trustEmailVerified: true is enabled.

Immediate actions: - Upgrade Better Auth to 1.6.11. - Audit SSO provider records for untrusted userinfo, token, and jwks endpoints. - Disable or tightly govern custom OIDC provider registration.

Technical Notes

Search configuration and records for risky settings:

grep -R "skipDiscovery" . 2>/dev/null
grep -R "trustEmailVerified" . 2>/dev/null

Example review targets:

{
  "skipDiscovery": true,
  "oidcConfig": {
    "userInfoEndpoint": "https://untrusted.example/userinfo",
    "tokenEndpoint": "https://untrusted.example/token",
    "jwksEndpoint": "https://untrusted.example/jwks"
  }
}

Monitor for outbound calls from auth services to unapproved hosts:

grep -R "userinfo\|jwks\|token" /var/log/ 2>/dev/null

What Defenders Should Do Today

1) Patch the highest-impact application flaws first

Start with: - Metabase: RCE risk if users can edit database connections. - Wazuh: SIEM integrity risk from agent-controlled bulk operations. - Penpot: Account takeover risk. - Grav API plugin: Password reset poisoning. - Better Auth: SSRF and identity abuse.

A practical priority order for many teams: 1. Internet-facing auth and reset flows 2. Admin and analytics platforms with code execution potential 3. Monitoring infrastructure that could be used to hide attacker activity 4. Developer and package ecosystem exposure

2) Contain dependency and developer workstation risk

In response to the AsyncAPI npm package incident: - Freeze builds that pull directly from public registries without pinning. - Validate lockfiles against approved versions. - Rotate npm, Git, CI, cloud, and SSH credentials used on impacted developer hosts. - Reissue build artifacts if suspicious dependencies were present.

3) Treat collaboration platforms as identity infrastructure

With Zoom warning of account takeover risk: - Confirm MFA is enforced for all users, not just admins. - Review app-integrated accounts and service users. - Audit session revocation and token invalidation workflows before an incident forces you to.

4) Prepare for follow-on phishing from breaking news

TruStage’s incident and the Dutch fraud case both create useful lures for attackers: - “Claims system outage” messages - “Identity verification” requests - “Investment recovery” offers - “Emergency Zoom security update” prompts

Push a short user advisory and tell staff what legitimate internal notifications will look like.

Defender Checklist

• [ ] Verify whether any TruStage-connected workflows need contingency handling.
• [ ] Patch Zoom clients and SDK deployments on Windows as vendor guidance becomes available from the reported warning (source).
• [ ] Upgrade Metabase to the fixed version in your supported branch.
• [ ] Upgrade or mitigate Wazuh Manager exposure and validate index integrity.
• [ ] Upgrade Penpot to 2.14.5.
• [ ] Upgrade Grav API plugin to 1.0.4 or later.
• [ ] Upgrade Better Auth to 1.6.11.
• [ ] Audit npm dependency trees for malicious AsyncAPI package versions.
• [ ] Rotate secrets used on any potentially exposed developer systems.
• [ ] Alert users to phishing themes tied to outages, account security, and investment scams.

Bottom Line

Today’s threat picture mixes operational disruption, identity risk, supply-chain compromise, and multiple critical application flaws. The fastest wins are straightforward: patch exposed software, tighten who can modify auth or database settings, inspect developer dependencies, and assume attackers will use today’s headlines as tomorrow’s phishing bait.

This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.