Hello everyone! I'm going to start a weekly series called Branch61G Weekly. Branch61G is DeepTempo's internal threat research team!
I'm aiming at posting every Tuesday morning but as we all know that can move a little bit as start-up life can be quite busy at times.
But the whole goal of this series is to give a little insight on the attacks, breaches, or zero-days I've seen the past week and talk a bit about what they mean to security and ways in which they work so you can detect them, but also provide insight into how DeepTempo can be a long term solution to many of these attacks. So, without further ado, let's jump into it!
SharePoint CVE-2026-50522
The most pressing story this week is Microsoft SharePoint Server CVE-2026-50522. CVSS 9.8. Critical deserialization of untrusted data in on-prem SharePoint. Microsoft patched it in the July 2026 Patch Tuesday set, tagged exploitability as more likely, and CISA put it in KEV with a short federal fix window. WatchTowr is already seeing active exploitation after a public PoC dropped.
The useful part for defenders is what happens after the first hit. Attackers pull SharePoint machine keys in a single request. Defused Cyber has described .NET deserialization payloads aimed at a SharePoint sign-in endpoint, with captured requests carrying no auth material in the traffic they saw. Once those IIS machine keys leave, persistence survives the patch. The next session can still look like legitimate SharePoint access.
A lot of stacks treat "patched" as closed. That is the dodge. Signature packs written for last week's CVE string do not catch reuse of stolen trust. If you only ship the KB and skip key rotation on exposed assets, you papered over the entry and left the persistence path open.
Qilin via PAN-OS CVE-2026-0257
And in a separate incident, that same edge problem showed up again with Palo Alto. Arctic Wolf tracked multiple June intrusions where Qilin, also tracked as Agenda, started with CVE-2026-0257 on PAN-OS portal and gateway components. CVSS 7.8. An authentication bypass. When authentication override cookies are enabled with specific certificate configurations, an unauthenticated attacker can stand up an SSL VPN session with no valid user credentials. From identity and VPN logs, that can look like a normal remote user.
Then the affiliate playbook gets boring in a dangerous way.
Endpoint rules waiting for a known Qilin hash are late. The early miss is a VPN session that looked authenticated, then lateral movement that blends into admin tooling.
Hermes at Thailand Ministry of Finance
Separately, on the AI side, Hermes ran unattended against Thailand Ministry of Finance systems after an operator already had a web shell. Hunt.io and Bob Diachenko found the agent's own logs on a web server with directory listing left on, plus about 585 files and 470 MB of tooling. Hermes is an open source assistant from Nous Research. People use it for mail and chores over Telegram or Slack. This was not a Hermes vulnerability.
The operator flipped YOLO mode, a documented setting. That kills the human approval step before risky commands. A hardline blocklist still stops the agent from wiping its own host. Everything else in the loop runs without a person clicking yes. The recovered turns show the shape.
There is no malware family name for that loop. No vendor account to ban. Hash based EDR is built to match a binary. This match never arrives.
Fairlife / Anubis
Different attack, same week. On the confirmed breach side, Coca Cola confirmed Anubis stole Fairlife data, encrypted Nutanix systems, disrupted production across a dairy subsidiary with four U.S. plants and more than a billion in retail sales, and the stolen files are now public after the extortion timer expired. Coca Cola disclosed the ransomware event in an SEC filing on July 16, reported to authorities, and did not negotiate. Anubis claimed about a terabyte. The company confirmed unauthorized access, data taken, and temporary production suspension.
Once ransomware is encrypting Nutanix, the detection problem already happened upstream. The miss is earlier. By the time the plant is down, the alert list already failed.
What this week means
That is a week of stolen trust, VPN sessions that look valid, AI grinding the interior with no hash to match, and confirmed theft after the early signals were already gone. Four separate incidents. The same detection gap keeps showing up. The attacks are not waiting for your signature pack to catch up.
This continues because detections are broken for attacks that do not match a named playbook. DeepTempo is already part of the change that has to come next. LogLM is a foundation model trained as an encoder on network metadata. It understands normal deeply enough that novel attacks become legible from behavior alone. You do not need a signature written for that exact CVE or malware family first.
Walk those four back through the wire. On SharePoint, once stolen machine keys turn into odd admin paths, first seen destinations, or persistence traffic off a host that never behaved that way, LogLM flags the sequence even if the CVE string is brand new. On Qilin, the PAN-OS VPN session that then fans out with PsExec style lateral movement over admin shares is a behavioral fingerprint. A foundation model does not need the Qilin name. It needs the deviation from that host's normal remote access and interior reach. On Hermes, the AI agent grinding root scans, Hadoop touches, and mailbox paths against a ministry baseline is recon at machine speed. LogLM is built to read that shape. On Fairlife, the signal is upstream of the encryptor. Staging volumes, odd admin paths, and exfil cadence leaving Nutanix connected environments before production goes down.
That is the generalizability. New attack, same behavioral grammar. DeepTempo's LogLM catches what the rulebook has never named yet.
AI SOCs are only as good as the detections that feed them. When a zero day or a novel sequence slips past those detections, the rest of the stack has nothing left to reason over.
Sources for this week include The Hacker News coverage of SharePoint CVE-2026-50522, Qilin via PAN-OS CVE-2026-0257, and the Hermes Thailand Ministry of Finance case, plus BleepingComputer reporting on the Coca Cola Fairlife / Anubis breach confirmation.
