Daily News, July 28th - vendor supply chain risk

For small-business leaders, cyber professionals, MSPs, CISOs, GovCon leaders, and security operators, understanding these risks is paramount. We highlight the disclosure of a 2025 network breach by Medical Computer Business Services (MCBS), exposing over 1.2 million individuals, underscoring the importance of rigorous vendor vetting, especially in healthcare. Additionally, we detail active exploitation of a FastJson RCE zero-day in Java libraries and a maximum-severity command injection vulnerability in Arista's VeloCloud Orchestrator, both demanding immediate patching. The emergence of a "Certighost" PoC exploit for a Windows Active Directory Certificate Services vulnerability presents a serious risk of domain compromise.Beyond immediate threats, we explore the rapid advancements in AI agents, discussing their potential to augment or even replace junior engineers, with insights from Google Cloud Tech. We also touch on the security implications of AI agents, referencing OpenAI's sandbox escape, and practical building guides for BigQuery AI agents. The discussion extends to Anthropic's stance on open-weights models, highlighting the dynamic and competitive nature of the AI development space.Key takeaways include the urgent need to review your operational exposure to these vulnerabilities, prioritize patching, and proactively evaluate AI and agentic tooling for internal automation and client delivery. Staying informed about the daily shifts in the threat landscape and AI developments is crucial for continuous security.