WordPress core had a pre-auth RCE that affected default installs and let an anonymous HTTP request run code. 6.9.5 and 7.0.2 fixed the issue on July 17, 2026, covering 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1. The flaw was reachable in core with no plugins required, so exposed sites faced direct remote code-execution risk until patched.

WordPress shipped 6.9.5 and 7.0.2, closing a pre-auth RCE in core for 6.9.0-6.9.4 and 7.0.0-7.0.1 sites. The update bundle also enabled forced updates through the auto-update system. Unpatched installations face code-execution risk from an anonymous request even on a default install with no plugins.

The ShinyHunters extortion gang is running an ongoing social engineering campaign against employee Microsoft Entra, Okta, and Google SSO accounts, creating a path into connected business systems. The group uses vishing and SSO compromise to reach SaaS platforms and steal data for extortion. The operation has been active since last year and has increasingly focused on medtech companies. A successful login can expose multiple downstream services, broadening the blast radius of a single account takeover.

Abbott Laboratories confirmed a cyber incident involving unauthorized access to a limited number of internal systems in its Cancer Diagnostics business. The company said the event did not affect operations, products, manufacturing, lab operations, or its ability to serve patients, limiting the immediate business impact. The incident is important because it involved a named healthcare company and internal systems tied to a diagnostics unit, even though Abbott says broader systems were not affected.

The SuccessKey-linked ViteVenom campaign is targeting Vite developers with seven malicious npm packages and a blockchain-based C2 path that delivers a RAT. The operation matters because it uses typosquatted package names and public-chain infrastructure to make takedown and detection harder while enabling credential harvesting and file exfiltration.

A cluster of seven malicious npm packages has targeted the Vite frontend ecosystem, delivering a blockchain-backed RAT loader that can harvest credentials and exfiltrate files. The packages were published between June 29 and July 3, 2026, while linked activity was detected back to February 27, 2026. The operation uses a four-tier C2 chain across Tron, Aptos, and Binance Smart Chain to hide payload pointers on public blockchains. The loader runs at import time, reducing detection opportunities and enabling persistent backdoor injection on developer systems.

HollowByte is a new OpenSSL DoS flaw that lets unauthenticated attackers exhaust memory on affected servers with an 11-byte payload. The bug affects server-side TLS handshake handling, where OpenSSL trusts a declared message size before validating the incoming body. OpenSSL has fixed and backported the issue to 4.0.1, 3.6.3, 3.5.7, 3.4.6, and 3.0.21, and operators are being urged to upgrade immediately.

The OpenSSL team silently fixed HollowByte, a no-CVE DoS flaw in OpenSSL servers, and backported the patch to older releases. The fix lands in OpenSSL 4.0.1 and was also backported to 3.6.3, 3.5.7, 3.4.6, and 3.0.21. Organizations running OpenSSL-backed services should move to a fixed release because the bug can be triggered with a tiny 11-byte payload.

The NadMesh botnet is actively hunting exposed AI services and stealing AWS keys and Kubernetes tokens, creating immediate cloud-account takeover risk. Its controller claims 3,811 unique AWS keys, showing the operation has already produced substantial loot. The targeting set includes ComfyUI, Ollama, n8n, Open WebUI, Langflow, and Gradio, plus exposed MCP, Docker, Jenkins, and Redis services. The activity matters because a single exposed host can yield cloud credentials, registry logins, and cluster access that extend far beyond the box itself.

The NadMesh campaign is repeatedly resampling exposed ComfyUI, Ollama, n8n, Open WebUI, Langflow, and Gradio systems, keeping pressure on internet-facing AI and admin services. Its automated queueing and rescan logic raise the odds of credential theft and later abuse of whatever it finds. The operation is notable because it is not a one-pass scan; it keeps returning to the same high-value hosts and subnets. That sustained targeting broadens exposure across teams that deployed AI tooling before hardening it.

Government organizations saw a sustained rise in ransomware during January-June 2026, reaching an average of one attack per day and increasing the risk of recurring disruption to public services. The measured total of 187 incidents was 13% higher than the prior half-year, showing a worsening trend rather than isolated events.

Ernst & Young disclosed a data breach after an unauthorized third party accessed a third-party support ticket system used by its IT personnel and downloaded documents that may contain client tax, personal, and financial data. The exposure window ran from March 28 to April 12, with anomalous activity detected on April 23 and disclosure on July 17, 2026. EY says it secured the platform, removed the unauthorized access, and has no indication of misuse or further exposure. The leak matters because the compromised tickets may include sensitive records tied to tax filings and client identity data.

23andMe disclosed a credential-stuffing breach that exposed data on 6.9 million customers, including genetic ancestry information. The unauthorized access ran from April 2023 to September 2023 before being disclosed in October 2023. The compromise turned account reuse into a large-scale privacy and identity risk, with stolen data later appearing for sale on the dark web.

The European Commission ordered Google to change Android assistant access and Search data-sharing terms under the Digital Markets Act, creating binding obligations across the EU. The decision expands rival AI assistants' reach into Android and requires anonymised Search data access for competitors. The order is enforceable now, with major implementation dates running into Android 18 and 1 August 2027.

A public LegacyHive zero-day against Windows User Profile Service can escalate privileges on up-to-date Windows systems, creating admin-level compromise risk. The exploit appeared hours after Microsoft's July 2026 Patch Tuesday and has no CVE ID yet. Testing showed the flaw can let non-admin users alter the classes registry hive and trigger automatic code execution when an administrator logs in. The PoC was later modified to require extra credentials, but it still gives attackers a usable starting point for weaponization.

Armenia detained Aleksandr Ermakov on June 28 on a U.S. extradition request tied to a REvil ransomware case, keeping a cybercrime suspect in custody while his identity is disputed.

The Gentlemen ransomware gang became the most-active ransomware-as-a-service operator over a three-month period, overtaking Qilin with 300 incidents. Its rise is linked to aggressive affiliate recruitment and a pre-packaged intrusion kit that lowers operator skill requirements. The shift increases competitive pressure across the ransomware market and may pull affiliates away from rival crews.

The ACR Stealer malware is actively stealing browser passwords, session tokens, and Microsoft 365 files from enterprise environments, turning ClickFix-style paste-and-run lures into credential and document theft. The activity spans late April to mid-June 2026 and uses both fileless and on-disk loader chains. Microsoft says the malware does not rely on a CVE and instead succeeds when a user pastes a command into the Run dialog.

A DoNot Team espionage campaign targeted Bangladesh's military and defence establishments, using spear-phishing RTF files to deliver a DLL implant and establish scheduled-task persistence. The operation relied on remote template injection, a VBA macro, and geofencing to deliver payloads only to intended victims. The implant disguised itself as OneDrive telemetry, profiled hosts, and beaconed to C2 over HTTPS, indicating a focused effort to maintain access and support intelligence collection.

GoSerpent is being used in cyber attacks against entities in Southeast Asia, with the activity focused on long-term access, intelligence gathering, and data exfiltration. The malware is aimed at government and diplomatic entities and can deploy follow-on tools for credential dumping and file collection. It also supports SOCKS5 proxying and remote access, helping operators hide traffic through compromised hosts. The toolset has expanded over time, with May 2026 activity adding new payloads for staged exfiltration.

U.S. prosecutors charged Zhuoying Chen and Haojie Zhang in a cyber investment fraud money-laundering case, exposing a network that allegedly moved at least $43 million in stolen proceeds.

Microsoft SharePoint CVE-2026-58644 is a critical RCE now confirmed actively exploited in the wild, exposing SharePoint Server to remote code execution. Microsoft fixed the flaw in July 2026 Patch Tuesday after describing it as a deserialization of untrusted data issue. CISA added it to the KEV catalog and ordered federal agencies to patch it within three days.

CISA added CVE-2026-58644 to its KEV catalog and ordered federal agencies to patch it within three days. The directive applies to an exploited Microsoft SharePoint remote code execution flaw and tightens remediation under BOD 26-04. The move accelerates federal response to a vulnerability with exploitation detected.

Microsoft released a record 622-CVE Patch Tuesday that includes two exploited flaws in SharePoint Server and Active Directory Federation Services, raising urgency for identity and collaboration systems. The top-priority fixes are CVE-2026-56164 and CVE-2026-56155, both elevation-of-privilege bugs already being used in attacks. Microsoft also bundled additional updates across Windows, Office, Edge, Azure, Defender, and developer tools. The release matters because defenders must triage a much larger-than-usual update set while attackers can immediately focus on the flaws already in use.

Microsoft released July 2026 Patch Tuesday updates that close at least 570 security holes in Windows and other software, expanding the remediation burden for defenders. The bundle includes nearly 60 critical vulnerabilities and three zero-days already exploited in the wild. It also covers issues such as CVE-2026-56155 in Active Directory Federation Services, CVE-2026-56164 in SharePoint, and CVE-2026-50661 in Windows BitLocker. The release is almost triple last month’s record patch count and adds operational risk during rollout.

SharePoint Server exploitation wave remains active across internet-exposed on-premises instances, with CVE-2026-32201, CVE-2026-45659, and CVE-2026-56164 used to bypass authentication, reach remote code execution, and enable IIS machine key theft, persistence, and malware deployment. CISA added the exploited CVEs to the Known Exploited Vulnerabilities Catalog and urged operators to apply Microsoft's latest patches, verify installation, enable AMSI and Microsoft Defender Antivirus detections, reduce direct internet exposure, block SharePoint Central Administration, and use a Layer 7 reverse proxy where needed.

Microsoft SharePoint Server exploitation remains active around CVE-2026-56164, an unauthenticated privilege-escalation flaw affecting on-premises deployments. Separate reporting on internet-exposed servers also tracks exploitation involving CVE-2026-32201 and CVE-2026-45659, alongside post-compromise behaviors such as IIS machine key theft, persistence, and malware deployment. Microsoft has issued SharePoint fixes, and CISA has pushed immediate hardening, monitoring, and intrusion hunting where patching cannot be completed at once. Federal agencies face a July 17 deadline to secure or discontinue affected systems under BOD 26-04.

SonicWall SMA1000 devices face active exploitation of CVE-2026-15409 and CVE-2026-15410, creating urgent risk for exposed appliances. CVE-2026-15409 is a CVSS 10.0 SSRF flaw and CVE-2026-15410 is a CVSS 7.2 code injection issue in the management console. SonicWall says both flaws are being actively exploited in zero-day attacks and urges customers to install the newly released hotfixes immediately. CISA KEV listing confirms the flaws are already being used in attacks.

CISA gave federal agencies until July 17 to secure or discontinue SharePoint servers affected by CVE-2026-56164, turning the remediation deadline into a mandatory federal action for exposed systems. The agency had already added CVE-2026-32201, CVE-2026-45659, and CVE-2026-56164 to the Known Exploited Vulnerabilities Catalog on April 14, July 1, and July 14. Agencies that cannot apply mitigations must discontinue the affected servers under BOD 26-04.

Group-IB reported a ClickLock macOS campaign that uses ClickFix paste-a-command lures and coercive app-killing loops to force victims to enter their system login password. The operation has reached at least 100 targets across 33 countries since May 2026, with more than half in Europe. Group-IB also said the orchestrator script uploaded to VirusTotal on June 9 had zero detections, while the malware hid the cursor, showed a fake Cloudflare progress animation, pulled modules from compromised sites, stole Keychain and wallet data, and exfiltrated through Telegram.