Threat Brief — 2026-07-28 — SVG-to-root, kernel race, and a billing mega-breach

Two critical unauthenticated RCE paths demand immediate patching: a TeamCity flaw allowing OS command execution without login, and a published Linux kernel use-after-free exploit that escalates any local user to root. A 1.26-million-record healthcare billing breach adds to this week's steady drip of major data disclosures. On the research side, the SVG-to-Microsoft-root attack first reported on July 24 gets fresh technical detail, and APT32 tradecraft surfaces around registry-based persistence.

Top items

• Critical TeamCity RCE without authentication (CVE-2026-63077KEV·R). JetBrains is urging on-premise TeamCity customers to patch immediately — the flaw allows arbitrary OS command execution without any login. CI/CD servers are prime targets for supply-chain compromise, making this a high-priority fix. (src: The Hacker News)

• Published Linux kernel exploit: CVE-2026-53264 (CVSS 7.8) — use-after-free race in net/sched. STAR Labs has published a working exploit that turns an ordinary local user into root on CentOS Stream 9. The researcher states AI assisted in developing the race-condition exploit. A public exploit is already available. (src: The Hacker News)

• MCBS medical billing breach exposes 1.26 million people. Medical Computer Business Services disclosed that a 2025 network breach exposed sensitive personal and medical information for over 1.2 million individuals — one of the larger healthcare-sector breaches this quarter. (src: BleepingComputer)

• SVG-to-root on Microsoft servers — new technical detail. A 1-pixel SVG file was sufficient to gain full control over Microsoft production servers via a graphics-handling flaw. This is a developing story first reported 2026-07-24 by The Hacker News; the new detail highlights just how trivial the payload was. (src: SecurityLab; first reported 2026-07-24 by The Hacker News)

• APT32 stealth persistence via binary registry and NTUSER.MAN. New analysis of APT32 (OceanLotus) tradecraft reveals multi-stage system hijacking using the binary registry and NTUSER.MAN files for covert remote control — a reminder that seemingly benign registry artifacts can hide full C2 chains. (src: SecurityLab)

• EV charging station root compromise for $130 in parts. A vulnerability accessible through the charging gun lets an attacker gain root on the station, turning ubiquitous public infrastructure into a potential attack surface. (src: SecurityLab)

• Residential TV set-top boxes double as proxy laundering nodes for IPIDEA. Compromised set-top boxes stream 4K content for the owner while simultaneously routing dirty traffic through the IPIDEA proxy network — a low-detection model that turns consumer devices into criminal infrastructure. (src: SecurityLab)

Themes

AI on both sides of the fence. AI-assisted exploit development (the Linux kernel race), AI for defence (Microsoft's MAI-Cyber-1 scoring 95.95% on CyberGym at half the cost), and AI as a proposed criminal sentencing aggravator in Russian legislative amendments — all in the same news cycle. The offensive-defensive AI arms race is producing tangible results on both ends simultaneously.

OT/IoT attack surface keeps widening. EV charging stations and residential TV set-top boxes join this week's already-covered IoT botnet and scam-infrastructure stories. Ubiquitous connected hardware is increasingly dual-use: functional for the owner, profitable for the attacker.