Anthropic Restores Fable & Mythos, Proposes Jailbreak Severity Criteria; Adobe ColdFusion and Campaign Classic Critical Flaws Addressed; Oracle E-Business Suite Critical Flaw Exploited

After disabling its Fable 5 and Mythos 5 models on June 12 in response to a US Department of Commerce (DOC) export control directive, Anthropic announced on June 30 that the export control was lifted, and that both models would soon become available again. This federal restriction had obligated Anthropic to prevent access to these models by any foreign national, citing concern for national security following Amazon's report of a method to bypass the safeguards that keep the models from identifying and exploiting cyber vulnerabilities. In the meantime, an open letter signed by hundreds of executives and technical leaders had criticized the directive and urged the DOC to reconsider. Mythos 5 was reopened to certain US organizations on June 26, and Fable 5 became globally available again on July 1 "on the Claude Platform, Claude.ai, Claude Code, and Claude Cowork." Anthropic determined that the reported jailbreak technique, now fixed, "did not expose any unique Mythos-level cyber capabilities," and notes in their redeployment announcement that there is currently no standard way to rate the severity of an AI jailbreak; the company proposes four assessment criteria: 1. The degree of capability gained relative to existing tools, 2. The breadth of offensive tasks the gained capability applies to, 3. The ease of leveraging the jailbreak into an attack, and 4. The availability of the jailbreak technique. The company has also launched a HackerOne program for researchers to submit Fable 5 jailbreaks for review.

On Tuesday, June 30, Adobe published security bulletins addressing 12 vulnerabilities: 10 rated critical and one rated important in Adobe ColdFusion, and one critical vulnerability in Adobe Campaign Classic. Of the vulnerabilities in ColdFusion, six have CVSS scores of 10.0: two unrestricted upload of file with dangerous type issues, three improper input validation issues, and a path traversal issue, all of which could lead to arbitrary code execution; the Campaign Classic vulnerability, an incorrect authorization issue that can lead to arbitrary code execution, also received a CVSS score of 10.0. According to reports, the critical path traversal ColdFusion flaw, CVE-2026-48282, is being actively exploited. KEVIntel founder Ryan Dewhurst reported that the flaw was under exploitation within hours of its disclosure. The vulnerability affects ColdFusion versions 2025.9, 2023.20, and earlier. In a related story, last week Adobe announced that as of July 14, 2026, the company "is moving from monthly to twice-monthly publication of Adobe Security Bulletins and Advisories on the second and fourth Tuesday of each month."

Last week, threat intelligence firm Defused reported that a known critical vulnerability in Oracle E-Business Suite is being actively exploited. CVE-2026-46817 is an unauthorized HTTP takeover issue affecting the file transmission component of the Oracle Payments product in Oracle E-Business Suite. It has three associated weakness enumerations, including improper privilege management, improper authentication, and missing authentication for critical function. Oracle released a patch for the vulnerability in May; at the time, it was noted that the vulnerability can be remotely exploited without authentication. Defused CEO and founder Simo Kohonen told CyberScoop that the company observed six instances of exploitation on its honeypots in a two-hour window.

In a July 1, 2026 blog, the UK's National Cyber Security Centre (NCSC) shared the answers they received when they asked pentesters "What can organisations do to make your job harder?" Their top answers were to build systems that are secure by design, to segment networks, and to implement logging and monitoring. Systems that are secure by design make it easier to implement fixes. NCSC notes that "One of the clearest examples of 'secure by design' is the adoption of network segmentation, particularly where it has been considered as part of the system design rather than added later." Once systems are secure by design and properly segmented, "logging and monitoring become far more effective." It's also important to make sure logging and monitoring systems are focusing on the right data, and that they are responding to the information gathered effectively. The bottom line: build in security from the start rather than tacking it on as an afterthought.

Over the past week, the US Cybersecurity and Infrastructure Security Agency (CISA) added two more vulnerabilities to the Known Exploited Vulnerabilities (KEV) catalog, both with three-day mitigation windows for Federal Civilian Executive Branch (FCEB) agencies. CVE-2026-48558, added to the KEV on June 29, is a critical authentication bypass vulnerability in the SimpleHelp remote monitoring and management (RMM) tool, which stems from missing OIDC JWT signature verification. The vulnerability affects SimpleHelp versions 5.5.15 and prior, and 6.0 pre-release versions. CVE-2026-45659, added to KEV on July 1, is a high-severity deserialization of untrusted data vulnerability in Microsoft SharePoint Server. The flaw affects SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Enterprise Server 2016. Microsoft addressed the vulnerability in late May with an out-of-band update.

Canada's cryptologic intelligence and security agency, the Communications Security Establishment (CSE), has released an annual report on its research and operations, including disclosures of three "active cyber operations" authorized in a "two key" system by the Minister of National Defence and the Minister of Foreign Affairs under the CSE Act. These operations are described as efforts to "interfere with foreign online efforts that threaten Canada ... [and] relate to international affairs, defence or security, which includes economic interests." These actions are prohibited from interfering with the course of justice or democracy, and from negligently or deliberately causing death or bodily harm. One of the active cyber operations began with intelligence from the Cyber Centre, and resulted in the CSE disabling infrastructure and deleting data stolen by a Ransomware-as-a-Service (RaaS) group. The second mentioned action disrupted and diminished operational viability for foreign online brokers of synthetic opioids and precursors. The third action targeted a violent extremist group's online presence, and "successfully undermined the group’s credibility and limited their ability to radicalize and recruit new members." These actions are unrelated to the warrant summarized in NewsBites Vol. 28, No. 46, obtained by the Canadian Security Intelligence Service (CSIS) to access Canadian devices in order to disrupt foreign-run botnets in May 2024.

A July report from Citizen Lab details their finding that the phone of investigative journalist and former Member of European Parliament Stelios Kouloglou was infected with Pegasus spyware in October 2022 and March 2023 while he served on the European Parliament's PEGA Committee, which was established to "investigate infringements and maladministration in application of EU law in relation to the use of Pegasus and equivalent spyware surveillance software." Citizen Lab writes that "Through forensic analysis of his device, we found that the attackers could have had access to confidential documents and committee deliberations." They add that evidence "suggest[s] a Pegasus customer with authorization to spy in multiple European countries is responsible." Analysis found Kouloglou received notifications from Apple that his device was likely being targeted with spyware. The alerts are not delivered in real time and Kouloglou does not remember receiving them. Pegasus spyware was discovered by Citizen Lab in 2016. It has "evolving" capabilities, including the ability to infect both iOS and Android devices, gather information from targeted devices' microphones and cameras and harvest other data, including messages, contacts, web browsing history, and photos. The PEGA Committee produced recommendations for the European Commission to address the use of spyware in the EU. These include establishing a special task force dedicated to protecting the 2024 European elections; investigating and reporting on the shortcomings in implementation and enforcement of relevant Union laws and creating a roadmap to correct them; setting up an EU Tech Lab; conducting an in-depth investigation into the export licenses granted for the use of spyware; and promptly coming forward with legislative proposals on the basis of this recommendation. The recommendations have largely gone unheeded.

In a Form 8-K filing with the US Securities and Exchange Commission, AdaptHealth has disclosed a cybersecurity incident that resulted in data theft. The company was contacted by a threat actor on June 15, 2026. Based on information at hand, as of June 27 AdaptHealth believes the threat actor accessed the company's "cloud-based business applications, including certain internal patient management systems and document storage platforms." The company has also confirmed that the threat actor exfiltrated "a stored password file associated with insurance billing" and accessed some external electronic health record system portals. The compromised data include "passwords associated with insurance billing and certain personally identifiable information and protected health information of patients." AdaptHealth has "determined that the incident is material due to the nature and potential volume of the data that is at risk." It appears the initial vector of intrusion was "a successful social engineering attack that compromised a user session associated with a third-party contractor." AdaptHealth provides home medical equipment, as well as supplies for diabetes treatment and sleep therapy.

Healthcare device manufacturer Medtronic has begun notifying patients that their personal information may have been compromised in an April 2026 breach. According to the notification letters, Medtronic became aware of suspicious activity on its corporate IT systems on April 15, 2026. A subsequent investigation conducted with the assistance of third-party experts determined that threat actors had accessed some systems between April 13 and April 19. When Medtronic first disclosed the incident in late April, it said that product, manufacturing, and distribution operations were not affected. Medtronic says that the compromised data include names, contact information, dates of birth, Social Security numbers, and health-related information. The letter is being sent to more than 3.8 million individuals.

The US Department of Homeland Security (DHS) is investigating unauthorized access to its Homeland Security Information Network (HSIS), according to sources in contact with Nextgov. HSIN is a network used by federal, state, local, territorial, tribal, international, and private-sector partners to "send requests securely between agencies, manage operations, coordinate planned event safety and security, respond to incidents," and share information in the interests of community safety and the missions of organizations across defense, intelligence, emergency management and services, critical infrastructure, law enforcement, public health, and cyber sectors. HSIN's website mentions the use of the network for coordinating intelligence during large events, crises, and natural disasters. The Office of Intelligence and Analysis within the DHS has reportedly assessed that a threat actor targeted HSIN servers and a collaborative SharePoint system between late May and early June 2026; an official DHS spokesperson has stated that "there is no indication that classified networks were impacted, and the system remains operational for our partners."