Security.io Daily Headlines — Tuesday, July 28, 2026
Five equally weighted developments: what happened and the leadership decision each creates.
Audio publishing scaffold ready
The transcript is published now. The player will activate when the verified MP3 is added.
Episode transcript
593 words · Sponsor after story threeThis is Max Vogal from Security.io with today’s Daily Headlines for Tuesday, July 28, 2026. Here are the top five security developments shaping today’s decisions—what happened, why each matters now, and the leadership action to consider.
Actively exploited Arista flaw exposes the SD-WAN control plane
What happened
Arista disclosed CVE-2026-16812 on 27 July, confirmed active exploitation and published three observed attack-source IP addresses. Unauthenticated command injection in on-premises VeloCloud Orchestrator is under active exploitation, carries a three-day federal remediation deadline and requires compromise assessment beyond installing the fixed release.
The leadership decision
Security leaders should inventory every on-premises VCO instance and record its version and web-interface exposure. Direct network engineering to produce a versioned VCO inventory and confirm exposure paths immediately. Preserve available evidence before upgrading, then restrict the interface and deploy the correct fixed release.
Fastjson 1.x exploitation turns dependency discovery into an emergency
What happened
CVE-2026-16723 affects Fastjson 1.2.68 through 1.2.83 in Spring Boot executable fat-JAR deployments. Imperva reports attacks across multiple sectors, while maintainers recommend SafeMode, a noneautotype build or migration to Fastjson2. Fastjson maintainers published the CVE-2026-16723 advisory on July 21, 2026 for versions 1.2.68 through 1.2.83.
The leadership decision
Security leaders should search source, build and runtime inventories for Fastjson 1.x. Assign application security and Java platform teams to combine software composition analysis, repository searches, container inspection and runtime process evidence. Prioritise applications that both run as Spring Boot fat JARs and parse untrusted JSON with Fastjson 1.x.
Fairlife confirms data theft while restoring US production
What happened
A 27 July company update confirms both production recovery and data theft following the Fairlife ransomware event disclosed on 16 July. Product safety and quality were unaffected, but the categories and population of data taken remain undisclosed.
The leadership decision
Security leaders should confirm whether Fairlife disruption creates material supplier or inventory dependencies. Use the Fairlife update to review ransomware recovery measures for production environments. Require business continuity, manufacturing operations and security to define separate acceptance criteria for safe production, restored technology, investigated data exposure and complete incident closure.
MCBS breach extends healthcare exposure through seven clients
What happened
MCBS, a medical billing and revenue-cycle business associate, reported a hacking incident affecting 1,261,464 people. The US health department lists 1,261,464 people affected by the MCBS network-server incident, while the medical billing company's notice links the compromise to seven healthcare organisations.
The leadership decision
Security leaders should check vendor and data-flow inventories for MCBS relationships. Healthcare CISOs should determine immediately whether MCBS appears in contracts, data-flow diagrams, integration inventories or subprocessor lists. Affected entities should reconcile their records with the provider's notice and HHS entry, document notification decisions and ensure patient support does not rely on unverified criminal claims.
Origin Energy says approximately 900,000 customers were affected
What happened
Origin Energy's 28 July update says information belonging to approximately 900,000 current and former customers was accessed. The company is notifying affected customers and warns that criminals may exploit the incident through impersonation and scams.
The leadership decision
Security leaders should check fraud controls for impersonation using breached utility-account information. Direct fraud, identity and customer-support teams to model how Origin's confirmed data classes could be used in social engineering. Strengthen verification procedures that rely on names, addresses, dates of birth or partial account information.
That’s Security.io Daily Headlines for Tuesday, July 28, 2026. Full reporting, sources, executive actions and today’s comic are available in the complete edition at Security.io. I’m Max Vogal. Thanks for listening.