CERT/CC warns of an unpatched backdoor affecting Tenda routers.

Summary

By the N2K CyberWire staff

CERT/CC warns of an unpatched backdoor affecting Tenda routers.

The CERT Coordination Center (CERT/CC) warned yesterday of a zero-day vulnerability affecting multiple Tenda router firmware versions. The flaw (CVE-2026-11405) involves an undocumented authentication backdoor that grants administrative access to the device's web management interface, allowing anyone with a hidden password to bypass normal authentication regardless of the configured username or password. According to Rescana, public proof-of-concept code is available.

Tenda has not responded to CERT/CC's disclosure, and the flaw remains unpatched. The CERT recommends that organizations mitigate the flaw by disabling remote management on the devices and restricting local network exposure by changing the default LAN IP address.

The research breaks at Black Hat first. Be there this August.

If you follow the research, you already know a lot of it breaks at Black Hat first. Hundreds of peer-reviewed Briefings, more than a hundred hands-on Trainings, and the largest Business Hall in Black Hat's history, across AI, cyber conflict, resilience, and identity. Six days in Las Vegas, August 1–6. Prices increase July 17. Register now with code CYBERWIRE for $200 off your Briefings pass.

Maximum-severity ColdFusion flaw is under active exploitation.

Adobe continues to urge customers to immediately address six maximum-severity vulnerabilities in ColdFusion that received patches last week, one of which is now under active exploitation, Infosecurity Magazine reports. Researchers at KEVIntel observed exploitation of CVE-2026-48282, a path traversal flaw that does not require user interaction, within two hours of the vulnerability's disclosure.

Infosecurity Magazine notes that data from the ShadowServer Foundation shows 775 exposed ColdFusion instances online, though it's unclear how many of these are vulnerable.

Your crisis plan exists. But will it work under pressure?

Most organizations have a plan. Fewer have prepared for the decisions, tradeoffs, and uncertainty that come with a real crisis.

In a recent conversation with Dave Bittner, Courtney Guss of Semperis explains why compliance alone doesn't create resilience and how organizations can better prepare for the moments that matter most.

Listen now for practical guidance on strengthening your incident response program.

Canadian intelligence agencies hacked criminal groups.

Canada's Communications Security Establishment (CSE) has disclosed that the agency executed state-authorized hacks against three criminal groups in 2025, the Record reports. One of the operations disrupted an unnamed foreign extremist group that was "spreading violent ideology and seeking to recruit in Western countries, including Canada." Another hack "disrupted and diminished" the operations of a drug trafficking gang that was selling chemicals used to make fentanyl. The third operation targeted a major ransomware-as-a-service gang; the CSE says the hack "rendered the group’s infrastructure inoperable and deleted a large amount of stolen data that was being advertised for sale on the dark web." The agency also targeted ten significant ransomware gangs, conducting "authorized technical disruptions to make parts of their infrastructure unusable."

Notes.

Today's issue includes events affecting , and Canada the United States.

Attacks, Threats, and Vulnerabilities

New Januscape Linux flaw allows VM escape on Intel, AMD devices (BleepingComputer) A 16-year-old Linux kernel vulnerability, dubbed Januscape, allows attackers to escape a virtual machine and execute arbitrary code on the host.

US Army websites defaced with pro-Kurdish sentiments, insults to Trump (CyberScoop) At least two websites appear to be victim to 404 hijacking attacks. Army officials took the sites down after being contacted by CyberScoop.

Marketplace

Chinese AI models are gaining ground with U.S. companies as OpenAI, Anthropic costs surge (CNBC) Recent model releases from Chinese companies including DeepSeek and Z.ai are seen by many as highly competitive compared to leading U.S. frontier systems.

Legislation, Policy, and Regulation

U.S. Big Tech raises concerns over Seoul's proposed cloud security rules (Korea JoongAng Daily) Major players worry that new rules favor domestic firms, on the heels of a U.S. House report leveling accusations of “discriminatory attacks” against Coupang Inc.

Litigation, Investigation, and Law Enforcement

Spain collars alleged pro-Russia hacktivist after FBI tip-off (The Register) Palencia man suspected of links to CARR, Z-Pentest, and NoName057(16), plus helping a Ukrainian hacker flee to Russia

Industry Events

For a complete running list of events, please visit the Event Tracker.

Events

CSA Regulated Industries for Cloud & AI Summit 2026 (Virtual, Jul 16, 2026) Trust at Scale: Securing Cloud & AI in the World’s Most Regulated Industries As AI adoption and cloud modernization accelerate across energy, healthcare, government, and other highly regulated sectors, organizations face a critical question: how do you innovate at speed without compromising compliance, resilience, and trust? The Regulated Industries for Cloud & AI Summit brings together global leaders, practitioners, and policymakers to address the real-world security, governance, and regulatory challenges shaping mission-critical environments. This free, high-impact, one-day virtual event delivers actionable insights on building secure cloud and AI ecosystems, governing AI responsibly, managing third-party and supply chain risk, and preparing for emerging global regulations. If you are responsible for protecting critical infrastructure, sensitive data, or public trust, this is the forum to learn what’s working now—and what’s coming next.

Interviewing Essentials: Grow Interviewing Muscle with Mock Interviews on The Dev Difference Tool (Virtual, USA, Jul 17, 2026) This session will introduce members to The Dev Difference, a free mock interview tool designed to help candidates practice, build confidence, and prepare for real interviews.

Breaking Barriers: Navigating Your Early Career as Women in STEM (Virtual, USA, Jul 21, 2026) Starting a career in tech can feel exciting, challenging, and uncertain. This session is designed to help women in STEM navigate the early years of their careers with more clarity and confidence. You’ll hear from Hayley Murphy, Senior Campus Recruiter on CBRE’s Campus Digital & Technology team, along with women working in Digital & Technology at CBRE.

Tech for Good: When Moments Matter with Axon (Virtual, USA, Jul 28, 2026) This session will explore career pathways in mission-driven technology and give members a closer look at how technical teams at Axon build products that support public safety, accountability, and real-world impact.

Black Hat USA (Las Vegas, Nevada, USA, Aug 1 - 6, 2026) The premier cybersecurity event of the year returns to Mandalay Bay with a re-engineered, six-day program built to ignite innovation, push boundaries, and bring the global security community together like never before. This year’s event features four days of immersive, expert-led Trainings (August 1–4), followed by Summit Day on Tuesday, August 4, and a two-day main conference packed with groundbreaking Briefings, open-source tool demos in Arsenal, a dynamic Business Hall, and unlimited learning & networking opportunities.

Sponsor & Support

Grow your brand, generate leads, and fill your funnel.

With the industry's largest B2B podcast network, popular newsletters, and influential readers and listeners all over the world, companies trust N2K CyberWire to get the message out. Learn more.

Daily Briefing for 07.07.26

Top stories.

CERT/CC warns of an unpatched backdoor affecting Tenda routers.

Maximum-severity ColdFusion flaw is under active exploitation.

Canadian intelligence agencies hacked criminal groups.

Notes.

Attacks, Threats, and Vulnerabilities

Marketplace

Legislation, Policy, and Regulation

Litigation, Investigation, and Law Enforcement

Events