Daily Cyber Digest - July 11, 2026
July 11 roundup: Progress ShareFile emergency shutdown, U-Boot FIT signature flaws, Ghostcommit AI code-review attack, ACSC CMS exploitation alert, and RedHook Android RAT.
Published
July 12, 2026Item Count
5 itemsTLP Protocol
TLP:clearBriefing Items
Rank #1 · advisory · high · medium confidence
BleepingComputerProgress orders emergency ShareFile Storage Zone Controller shutdown
Progress Software emailed ShareFile customers running on-premises Storage Zone Controllers to immediately power down the hosting Windows servers over a credible external security threat, and temporarily disabled affected account access as a precaution.
There is no patch available, so organizations running the hybrid on-premises component must treat manual shutdown as the only mitigation while Progress investigates, an operationally disruptive step for enterprise file-sharing workflows.
#2 · vulnerability · high
BleepingComputerBinarly discloses six U-Boot FIT signature verification flaws
Firmware security firm Binarly disclosed six vulnerabilities in U-Boot's FIT (Flattened Image Tree) signature verification; four can crash devices while two could let an attacker run code before signature checks complete, with no fixed stable release at disclosure.
U-Boot underpins routers, cameras, and data-center management chips, so signature-verification bypasses undermine secure boot trust across a very broad hardware base that is slow to patch.
#3 · research · medium
BleepingComputerGhostcommit hides prompt injection in PNGs to fool AI code reviewers
UMKC ASSET Research Group researchers demonstrated Ghostcommit, a pull-request attack that embeds exfiltration instructions in a PNG image that text-based AI reviewers like CodeRabbit and Bugbot never open, then relies on a coding agent to later read .env secrets and encode them into committed source.
It exposes a structural blind spot in AI-assisted code review and shows the agent harness, not the model, often decides whether secrets leak, pushing teams toward multimodal review and runtime monitoring of agent file access.
#4 · advisory · high
Australian Cyber Security CentreACSC warns of large-scale CMS exploitation deploying webshells
The Australian Signals Directorate's ACSC warned of a global campaign scanning for and exploiting numerous CMS and plugin flaws across WordPress, Craft CMS, MaxSite CMS, MetInfo CMS, and Joomla JCE to deploy webshells, with many small- and medium-sized Australian businesses already impacted.
Webshells give persistent access for credential theft, service disruption, and lateral movement, and the broad list of exploited plugin CVEs makes patch hygiene and unused-component removal urgent for any public website operator.
#5 · malware · medium
BleepingComputerRedHook Android RAT abuses Wireless ADB for shell-level access
A new version of the RedHook Android banking trojan abuses the Android Wireless Debugging (Wireless ADB) mechanism to obtain shell-level privileges without a computer connection, letting it silently grant permissions and expand on-device control.
Turning a legitimate developer debugging feature into an autonomous privilege-escalation path raises the risk for banking-app users and complicates mobile detection that assumes ADB requires a physical USB tether.
Executive snapshot
July 11 was dominated by defensive urgency across very different layers of the stack. Progress Software escalated a ShareFile Storage Zone Controller issue to an emergency shutdown with no patch available, while Binarly disclosed six U-Boot FIT signature verification flaws that chip away at boot-trust guarantees on a huge base of embedded and server hardware. Alongside those infrastructure concerns, researchers demonstrated Ghostcommit, an AI-code-review blind spot that hides prompt-injection payloads inside images, and Australia’s ACSC warned that attackers are actively deploying webshells through a long list of CMS and plugin vulnerabilities. A refreshed RedHook Android trojan rounded out the day by abusing Wireless ADB for shell-level access. The common thread is trust: file-sharing controllers, firmware signatures, automated code reviewers, website plugins, and mobile debugging features all became control-plane risks when their trust assumptions were bypassed or removed.
Notable items
The ShareFile advisory stands out because mitigation currently means taking production file-sharing infrastructure offline rather than applying a fix, which forces an availability-versus-risk decision on defenders with little public detail to weigh. The U-Boot findings matter for the long tail: signature-verification weaknesses in a bootloader embedded across routers, cameras, and data-center management chips undermine secure boot in places that rarely receive timely firmware updates. Ghostcommit is important less for any single leaked secret than for what it reveals about AI-assisted development — text-only reviewers never open image files, and the surrounding agent tooling, not the underlying model, often decides whether credentials are exfiltrated. The ACSC alert is the most immediately actionable for the broadest audience, naming specific exploited WordPress, Craft, MaxSite, MetInfo, and Joomla components and confirming that small and medium businesses are already being compromised with webshells. RedHook shows attackers continuing to weaponize legitimate platform features, converting Android’s Wireless Debugging into an autonomous privilege-escalation path that does not need a tethered computer.
Watchlist
Organizations running ShareFile Storage Zone Controllers should confirm affected servers are powered down and watch Progress channels for a root-cause statement and a supported remediation path. Hardware and firmware teams should inventory U-Boot usage, track vendor advisories for FIT signature fixes, and treat unverified boot images as untrusted until patched builds ship. Engineering organizations adopting AI coding agents should add multimodal review that inspects image and non-text assets, restrict agent access to credential files, and monitor runtime behavior when an agent reads .env or secrets it had no reason to touch. Website operators should prioritize patching the CMS plugins named by ACSC, remove unused components, make web directories read-only where possible, and hunt for unexpected file creation and child-process spawning that indicate webshell activity. Mobile defenders and banking-app providers should watch for RedHook-style abuse of Wireless Debugging, review whether developer options are unnecessarily enabled on managed devices, and update detections that assume ADB requires a physical connection.