Qualys Threat Research Unit disclosed CVE-2026-8933 on July 21, a local privilege escalation vulnerability in snap-confine, the enforcement component responsible for building the execution environment for Snap applications on Ubuntu. The flaw originates in a security hardening change Canonical made in July 2025, when snap-confine was shifted from a set-uid-root binary to a set-capabilities model intended to enforce least privilege. That change caused snap-confine to run with the effective user ID of the calling user while retaining near-root capabilities, and during sandbox initialization the binary creates temporary files under /tmp that are initially owned by the unprivileged calling user before ownership is transferred to root. The race window between creation and ownership transfer is where the vulnerability lives. Qualys documented a two-stage exploitation chain. First, an attacker mounts a FUSE filesystem over the temporary scratch directory immediately after creation, bypassing the mount namespace isolation that snap-confine applies later. Second, the attacker places a symlink pointing to an arbitrary target file. When snap-confine attempts to create a sandbox file, the open call follows the symlink and writes to the attacker's chosen target. A second race condition then widens file permissions to 0666 before snap-confine calls fchown to transfer ownership to root. To bypass AppArmor, the exploit targets the /run/udev path, which holds read-write access in AppArmor's default policy, and drops a malicious rules file that causes systemd-udevd to execute attacker-controlled commands as root. Qualys built a working proof of concept. Canonical released patched snapd packages and coordinated disclosure on July 21. Ubuntu Security Advisory USN-7726-1 covers the fix. No exploitation in the wild has been reported.

Between June 17 and June 19, 2026, attackers ran an automated credential stuffing campaign against Chick-fil-A's website and mobile application, using email and password combinations sourced from prior breaches at other companies. Chick-fil-A detected suspicious login activity during the attack window and conducted an investigation, determining on July 13 that unauthorized parties had accessed information in some Chick-fil-A One accounts. Breach notifications were sent to customers and filed with state attorneys general across ten states. The total number of affected accounts has not been disclosed nationally. Texas filings confirm 2,182 affected residents, and Massachusetts filings confirm 39. Data potentially exposed from compromised accounts includes names, email addresses, phone numbers, home addresses, birth months and days, Chick-fil-A One membership numbers, Mobile Pay numbers and QR codes, stored gift card balances, and the last four digits of any linked payment card. Chick-fil-A responded by forcing logouts on affected accounts, removing stored payment methods, and resetting passwords. The company confirmed that its own password database was not compromised and that attackers did not obtain full card numbers. Chick-fil-A offers multi-factor authentication through a verified mobile phone number for Chick-fil-A One accounts but does not require it. The credential stuffing attack succeeded against accounts where MFA had not been enabled, allowing automated bots to attempt logins without triggering an MFA challenge.

The CISA federal remediation deadline for CVE-2026-16232 falls today, July 25. The vulnerability is an authentication bypass in Check Point's SmartConsole management platform that allows an unauthenticated remote attacker to obtain an application login token and authenticate with full administrative privileges, enabling modification of firewall security policies and configurations. Check Point confirmed active exploitation against customers whose management servers were directly exposed to the internet without Trusted Client IP restrictions in place. The Jumbo Hotfix for R81.20, R82, and R82.10 was released July 22. This brief covered CVE-2026-16232 as the lead story in Issue 92 yesterday. Today's relevance is twofold: the deadline itself, and the post-patch investigation question. Patching closes the authentication bypass. It does not undo any policy changes an attacker made to firewall rules during the exploitation window before the patch was applied. Check Point published indicators of compromise for the attacks. Organizations that have not yet reviewed those indicators against their management logs are running patched firewalls that may have been reconfigured by an attacker who is no longer able to get back in, but whose changes are still enforced.