More Information

With today’s emerging threats, traditional radar and electronic warfare (EW) systems that rely on static threat libraries face a critical vulnerability: mode-agile emitters operating in non-traditional modes that cannot be matched against predefined databases. A cognitive RF system addresses this challenge through artificial intelligence and machine learning techniques, enabling autonomous perception, reasoning, and response to unknown threats in the RF spectrum. This white paper reviews the architecture of cognitive AI/ML radar and EW systems, including key functional blocks such as RF acquisition, AI-driven analysis and inferencing, waveform synthesis, and RF generation. It also examines the challenges of training these systems — from acquiring real-world and simulated signal datasets to performing hardware-in-the-loop (HIL) and system-in-the-loop (SIL) testing — and describes how closed-loop testbeds can iteratively develop, validate, and improve the AI/ML algorithms needed to counter unknown threats.

Apple released new updates for macOS Sequoia and macOS Sonoma, extending security and maintenance support to Macs that haven’t moved to macOS Tahoe.

The updates are available through Software Update on supported Macs. Apple hasn’t identified any major new consumer features, which points to releases focused on security, stability, performance, and compatibility.

Users can install the updates by opening System Settings, selecting General, and choosing Software Update. A Mac will only offer the update that applies to its currently installed operating system.

The new releases give Mac owners another reason to stay current even when they aren’t ready or able to install macOS Tahoe. Some Macs can’t run Tahoe, while businesses and other users may remain on an older version because of software, hardware, or management requirements.

Apple has historically maintained the current version of macOS alongside two earlier releases. The company doesn’t promise a fixed support period, however, and older versions generally receive security and compatibility fixes rather than new features.

Updates for macOS Sequoia and macOS Sonoma keep older Macs secure and compatible while Apple puts most new features into macOS Tahoe and macOS 27 Golden Gate.

Apple introduced macOS 27 at WWDC on June 8 and released the first developer beta later that day. The company followed with the first public beta on July 13.

Security details may follow

Apple hasn’t posted complete security documents for the new Sequoia and Sonoma updates. The company often publishes or expands those documents after an operating system update becomes available.

The previous updates, macOS Sequoia 15.7.7 and macOS Sonoma 14.8.7, arrived on May 11 with security fixes for both operating systems. Apple also released Safari 26.5.2 on June 29 for Sequoia and Sonoma.

Safari 26.5.2 fixed WebKit and web extension vulnerabilities that could expose sensitive information, move data across website boundaries, escape web-content restrictions, or crash Safari and related processes.

The separate Safari update showed why older macOS versions still need active maintenance. A Mac doesn’t have to run Apple’s newest operating system to face the same browser and WebKit threats.

Most users running macOS Sequoia or macOS Sonoma should install the applicable update. People who depend on specialized software, drivers, security tools, or managed enterprise systems may want to confirm compatibility before updating.

Hackers are actively exploiting a vulnerability in the FastJson open-source Java library, allowing remote code execution without user interaction or elevated privileges.

The security issue affects FastJson versions 1.2.68 through 1.2.83 and is leveraged in attacks targeting various organizations in the U.S.

The malicious activity was observed last week by the agentic security company ThreatBook, and researchers at the business protection company Imperva confirmed that it was “targeting a wide range of organizations, across Financial Services, Healthcare, Computing, Retail, Business, and other industries.”

“Attacks are currently almost entirely targeting US-based organizations, with a few attacks in Singapore and Canada, although this will likely continue to expand globally,” Imperva says.

FastJson is an open-source Java library developed by Alibaba, used for serializing Java objects to JSON, and vice versa.

The project has 25,600 stars and 6,400 forks on GitHub, and is especially prevalent in Chinese enterprise software and projects built on Alibaba’s platform.

CVE-2026-16723 was discovered by FearsOff, an offensive security company, which published a technical write-up earlier this month.

The researchers explain that the flaw stems from the library’s type-resolution logic, which performs attacker-controlled resource lookups before enforcing AutoType restrictions. This creates a path for executing code remotely in Spring Boot fat-JAR deployments.

By abusing @type processing, the researchers were able to load and execute malicious classes without AutoType enabled or requiring third-party gadget chains.

No fix available

In its security bulletin, Alibaba confirmed the critical severity of the vulnerability and warned that it is exploitable on “the most common Spring Boot deployment model.”

“The only deployment prerequisite is that the target runs as a Spring Boot executable fat-jar (i.e., launched via java -jar xxx.jar),” reads Alibaba’s security advisory.

The vendor notes that specifying a target class during deserialization does not mitigate CVE-2026-16723, as attackers can embed malicious payloads within ‘Object’ or ‘Map’ fields.

The vulnerable type-resolution logic is not present in fastjson2, which uses an allowlist-first model for polymorphic deserialization and doesn’t rely on the @JSONType annotation as a trust signal.

Also, FastJson versions 1.2.60 and earlier, and any non-fat-JAR deployments, aren’t affected either.

Developers using a version within the affected spectrum are urged to immediately enable SafeMode or switch to a non-impacted build.

Currently, there’s no fix issued for CVE-2026-16723. Imperva has also noted that FastJson 1.x is no longer actively maintained, so it’s unlikely it will receive a security update.

Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen.

The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection.

Get the whitepaper

Firefighters in France are confronting a phenomenon never seen in the region before: fire clouds. It’s a sign of the intensity of the blazes burning—and how climate change is upping the odds that they appear.

A wave of fires has swept over France and Spain, sending hundreds of thousands fleeing. Firefighters on the frontlines are facing what a spokesperson for the French firefighter association told AFP called an “operational impossibility”—in other words, a “natural force beyond our control.”

As evidence of how out of control the wildfires in France are, look no further than the skies where the blazes have, in some cases, created their own weather. To form a fire cloud—what meteorologists call a pyrocumulonimbus or the even more metal-sounding cumulonimbus flammagenitus—you first need heat, which fires have in spades.

But just as important are dry conditions near the ground and cool, relatively moist conditions aloft in the atmosphere. As superheated smoke rises miles above the flames and into the cool atmosphere, water vapor condenses around the particles of ash to form water droplets. (Yes water vapor and water droplets are two different things.) As the air keeps rising, those water droplets eventually become ice crystals.

At this point, the smoke and water droplets have created a cloud, but unfortunately one that’s unlikely to provide much relief in the form of rain. Instead, these towering fire clouds can unleash lightning strikes that can start more fires and generate powerful downdrafts that reach the ground to fan flames further. At their worst, pyrocumulonimbus clouds can even spawn tornadoes.

Pyrocumulonimbus clouds have been documented in the US, Canada, and Australia, among a handful of other locations. But until now, there were no documented fire clouds in France. While the country is no stranger to wildfires, the size and ferocity of this summer’s blazes is well outside the normal.

Last week was France’s single most destructive week for wildfires over the past 20 years, according to data from the European Forest Fire Information System. It more than doubled the previous record during that period, which coincides with accurate satellite data. This isn’t an isolated bad week either. More than 220,000 acres have burned across the country so far, six times the annual average. That’s 61,000 acres higher than the previous yearly record.

If that sounds like a familiar trend, well, it unfortunately is. Burning fossil fuels has heated the planet up, making explosive wildfires more common and destructive around the world. A 2024 study found the incidence of extreme fires globally more than doubled from 2003 to 2023. Six of the seven most extreme years have happened since 2016.

After a slight weekend reprieve as temperatures dipped, they’re expected to rocket back up above 104 degrees Fahrenheit (40 degrees Celsius) in France and 108 degrees Fahrenheit in Spain later this week. That means firefighters will have to contend with more extreme fire weather—including the possibility of clouds created by the blazes themselves.

After getting his hands on a rope driver module from the Apollo project era that had a big ‘Scrapped Module’ stamped on it, [Mike Stewart] was naturally left curious as to what exactly had failed in this module. Originally destined for the Apollo Guidance Computer, these Raytheon-manufactured modules were the pinnacle of space-grade high-tech of the 1960s, with requisite acceptance testing so as to not endanger a very expensive space mission.

The cool part here is that the acceptance documents for the module in question (B16-B17) have been scanned in and can be found on the Internet Archive. With the part itself being potted and very much inaccessible, this document helpfully lays out the expected measurements on the module’s pins, as well as schematics and mechanical drawings. Unfortunately the reasons for the rejection were not recorded, so replicating the failing test results is required to understand the reason.

A slight complication here is that the testing procedure doesn’t just involve hooking up a multimeter for some voltage and capacitance measurements. There are also temperature and voltage extremes, and vibration tolerance involved, which would be somewhat complex to test, but most of all risk damaging a historical artefact. Thus a somewhat conservative testing procedure was chosen, even if this may not reveal the actual fault.

As noted in the video, sometimes modules were also rejected because someone simply dropped it on the floor along the way. However, generally if a module was found to be faulty they would open it to diagnose said fault, with a closer look at this module indeed revealing suspicious marks in the potting compound where it was apparently opened and conceivably repaired. This also might explain why they also put the ‘For engineering use only’ on it.

With multiple of such locations visible in the potting compound, these locations were mapped to the schematics for the module, to get some idea of what may have been accessed. After this, basic testing was performed on the module, as per the acceptance testing document.

Along the way an error was detected in said document, in the form of the wrong pin number. In table 4-2 the input pin 269 was mistakenly listed as having output pin number 169 when it should have been pin 168. Pin 169 is chassis ground, so this was presumably fixed in a later version of the document.

After all the testing with just stationary, room-temperature conditions, everything appeared to check out. This means that likely this was indeed a repaired module that got subsequently used for engineering purposes rather than installed in flight-ready hardware. The only issue found was that channels were out of calibration, but whether this was an original flaw or due to the module being half a century old is hard to tell in the absence of repair logs.

Overall it’s an exciting opportunity to document another part of history, since so many of the details pertaining to these original modules and related technologies got lost or muddled over the decades.

Arista has patched a maximum-severity command injection vulnerability in on-premises VeloCloud Orchestrator deployments that is being actively exploited in attacks.

The vulnerability, tracked as CVE-2026-16812, is an unauthenticated OS command injection flaw with severity scores of 10.0, the maximum score that can be given to flaws.

VeloCloud Orchestrator, also known as VCO, is a centralized management platform used to configure, monitor, and manage VeloCloud SD-WAN deployments and associated edge devices.

According to an Arista security advisory published Monday, the vulnerability allows remote attackers to access privileged functionality that was intended only for internal use and should not be remotely accessible.

“Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator,” Arista warned.

The company says VCO is supposed to be exposed by default, with no configuration option that can prevent this exposure. Attackers only require network access to the VCO web interface, and no VCO tenant or operator credentials are needed to exploit the flaw.

Arista says CVE-2026-16812 was discovered externally and is known to be actively exploited, but has not shared when the attacks began, who is behind them, or how the vulnerability is being exploited. BleepingComputer has contacted the company with these questions.

The following VeloCloud Orchestrator on-premises versions are affected:

• VCO 5.2.x releases before 5.2.3.14
• VCO 6.1.x releases before 6.1.3.4
• VCO 6.4.x releases before 6.4.2.4
• VCO 7.0.x releases before 7.0.0.1

VeloCloud Orchestrator Hosted and Dedicated deployments were patched before the advisory was published and are not affected. VeloCloud Gateway and VeloCloud Edge products are also not vulnerable to the flaw.

The company says the flaw is fixed in VCO versions 5.2.3.14, 6.1.3.4, and 6.4.2.4 and later. The affected software list also indicates that VCO 7.0.0.1 and later releases are not vulnerable.

Arista warns that end-of-support software versions have not been assessed to determine if they are vulnerable. Customers running unsupported release trains are advised to contact the Arista Technical Assistance Center to discuss available upgrade options.

The U.S. Cybersecurity and Infrastructure Security Agency has also added CVE-2026-16812 to its Known Exploited Vulnerabilities catalog, confirming that the flaw is being used in attacks.

CISA has ordered U.S. federal civilian executive branch agencies to mitigate the vulnerability by Thursday, July 30, 2026, as required by Binding Operational Directive 22-01.

Indicators of compromise

While patches are being deployed, administrators should restrict access to the VCO web interface to administrative networks, monitor for connections from known malicious IP addresses, and review recent administrator activity for unusual changes.

Arista shared three IP addresses that were seen exploiting the vulnerability:

• 8.19.75.217
• 206.72.242.124
• 206.72.242.162

Administrators are advised to block these IP addresses and review their logs for previous connections. However, it is possible that devices could have been compromised from other IPs, so this list is not definitive.

Organizations should review VCO logs for signs of exploitation, including:

• Unusual web requests containing encoded characters, URL-like path components, references to local or internal services, or abnormally high request rates
• Connections from known malicious IP addresses
• Unexpected outbound HTTP or HTTPS traffic from the VCO host
• Unauthorized configuration changes or privileged maintenance activity
• Unexpected command execution, file creation, database exports, or archive files
• Suspicious access to VCO databases, configuration data, device inventories, credentials, certificates, or cryptographic keys

If compromise is suspected, organizations should preserve all logs and filesystem timestamps before remediation.

Potentially affected organizations should rotate credentials, review administrator activity, validate managed devices, and consider restoring or replacing compromised instances.

As successful exploitation can compromise both the orchestrator host and the data it manages, installing the security update may not be enough for systems that have already been breached.

Arista warns that compromising a VeloCloud Orchestrator instance could also give attackers access to VeloCloud Edge devices as well.

Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen.

The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection.

Get the whitepaper

Peacock Premium will be included with YouTube Premium in the US at no extra cost starting in early 2027. The deal, announced on Sunday by NBCUniversal and YouTube, is Peacock’s largest wholesale distribution partnership to date and immediately expands its reach to millions of existing YouTube Premium subscribers. Peacock Premium currently costs $10.99 per month on its own. YouTube Premium recently increased to $16 per month for individuals and $27 for families.

The bundle gives YouTube Premium subscribers access to Peacock’s full catalogue: NFL Sunday Night Football, the Olympics, NBA, MLB, Premier League, WNBA, and college sports alongside series including The Office, Saturday Night Live, Law & Order: SVU, Love Island USA, and blockbuster Universal films. Subscribers can upgrade to the ad-free Peacock Premium Plus tier. Peacock Premium will also be available as a standalone add-on through YouTube Primetime Channels starting later this summer.

The partnership extends well beyond the bundle. NBCUniversal’s multi-year distribution deal with YouTube TV, the largest and fastest-growing pay TV provider in the US, is renewed. NBC Sports will produce select live sporting events for YouTube. Some live events from NBCUniversal will stream on NBC Sports’ YouTube channel. The deal also expands Universal+ and Hayu to YouTube Premium subscribers in select international markets and deepens the companies’ advertising technology collaboration through FreeWheel. Google has been rebuilding its products around AI and engagement, and bundling a major streaming service with YouTube Premium turns the subscription from an ad-removal tool into a full entertainment package.

Peacock just turned its first quarterly profit, six years after launch. The YouTube bundle accelerates its next growth phase by trading per-subscriber revenue for scale. Alphabet raised its capex guidance to $205 billion this year as it invests across AI and content, and the Peacock deal positions YouTube Premium as a competitor to Apple One and Amazon Prime’s bundled offerings. “This partnership brings NBCUniversal’s world-class content to YouTube’s unmatched scale,” said Comcast co-CEO Mike Cavanagh. For YouTube, the value is retention: subscribers who get NFL, Premier League, and The Office alongside ad-free YouTube are much harder to cancel.