Security news, decoded.

Russian state-backed threat actors have been exploiting a critical zero-day vulnerability in Zimbra Collaboration Suite (CVE-2025-66376) to target U.S., Ukrainian, and other Western government and enterprise networks since July 2025. The flaw allows attackers to execute a so-called 'half-click' phishing attack—requiring only that a user view a malicious email within a vulnerable version of Zimbra webmail. This method bypasses traditional phishing defenses and enables adversaries to exfiltrate sensitive data. Multiple intelligence and cybersecurity agencies warn that the exploit is being used by the APT group Laundry Bear, with ties to Russian intelligence, to gather information for strategic advantage.

A Russian state-backed hacking group has been exploiting a zero-day vulnerability in Zimbra's webmail client to steal sensitive data, including email archives and two-factor authentication (2FA) recovery codes. The flaw, CVE-2025-66376, allows attackers to execute malicious JavaScript simply by viewing a crafted HTML email. This vulnerability was actively used between July 2025 and February 2026 against government and commercial organizations in Western countries, Ukraine, and other regions. Zimbra released patches for affected versions in November 2025, but users must manually review compromised accounts and invalidate stolen credentials.

Cisco Talos researchers have uncovered a new remote access trojan (RAT) named msaRAT, developed by the Chaos ransomware group. This Rust-based malware leverages the Chrome DevTools Protocol to create a stealthy command-and-control (C2) channel without direct network interaction. It begins with a deceptive MSI file posing as a Windows update, loading the payload into memory to facilitate ransomware deployment. The technique allows attackers to evade detection by routing traffic through legitimate browser processes. Organizations are advised to monitor for unusual curl commands, unauthorized MSI downloads, and signs of Chrome or Edge manipulation.

CISA has issued a warning that the Russian state-backed hacking group Laundry Bear, also known as Void Blizzard, is exploiting a recently patched vulnerability in Zimbra Collaboration Suite to conduct email theft campaigns. The flaw, tracked as CVE-2025-66376, is a cross-site scripting (XSS) issue in the Classic UI of the software. This allows attackers to inject malicious JavaScript into HTML emails, which executes automatically when viewed—enabling silent data exfiltration without user interaction. The threat actors have targeted multiple sectors, including defense, government, education, and technology, using this zero-click exploit alongside phishing techniques to steal sensitive information such as emails, passwords, and two-factor authentication tokens.

Researchers have identified a new cyberattack method where threat actors disguise malware as Notepad++ plugins to silently install malicious tools on victims' systems. The campaign, attributed to UAC-0099, involves delivering a ZIP file containing a legitimate version of Notepad++ alongside a harmful plugin called NppExport.dll. This plugin, known as LunchPoke, establishes persistence by creating scheduled tasks and downloading additional payloads like BurnyBear and MatchBoil V2. The attack leverages a reported vulnerability (CVE-2025-56383), though the Notepad++ team disputes its classification as a flaw. Security experts recommend updating Notepad++ to version 8.9.7 and WinRAR to 7.23 to mitigate risks.

In July 2026, the White House launched Gold Eagle, a federal initiative using frontier AI to detect and address software vulnerabilities before they are exploited. This marks a shift away from the outdated model of manual vulnerability discovery and patching. With AI capable of identifying complex flaws rapidly—and attackers exploiting them within hours—traditional patch management is no longer sufficient. The article outlines five key steps for modernizing security practices, including rethinking patch prioritization, reducing exposure, validating controls, preventing vulnerabilities early, and adapting to AI-driven threat landscapes.

Researchers discovered a sandbox escape vulnerability in Anthropic's Claude Cowork that allows an AI agent to break out of its Linux VM and access the host macOS system. The flaw, named SharedRoot, could let attackers read or write files across the user’s Mac, including sensitive data like SSH keys and cloud credentials. A proof-of-concept was demonstrated using a recently disclosed Linux kernel flaw (CVE-2026-46331) to gain elevated privileges within the VM. While Anthropic has shifted new sessions to cloud execution by default, users running Cowork locally remain at risk until additional mitigations are applied.

A China-linked cyber operation tracked as JadeProx has deployed a new Windows loader named TriBack Loader to target government, healthcare, and education institutions in Asia and Latin America. The threat actors have leveraged multiple unpatched vulnerabilities including CVE-2018-11511, CVE-2021-24139, CVE-2021-31755, and CVE-2021-32305—each rated with a high CVSS score of 9.8—to gain initial access. Once inside, they used DLL sideloading techniques to execute malicious payloads and deliver post-exploitation tools like AdaptixC2 and Beagle. Sophos and Group-IB have identified spear-phishing campaigns and domain infrastructure linked to the activity, urging organizations to patch exposed Java interfaces and monitor for suspicious file patterns.

A critical authentication bypass flaw, CVE-2026-16232, in Check Point’s SmartConsole has been actively exploited in the wild. The vulnerability affects Security Management and Multi-Domain Management systems, allowing attackers to gain full administrative access without credentials. Check Point issued a security advisory on July 22, 2026, confirming active exploitation and urging immediate patching. The flaw was added to CISA’s Known Exploited Vulnerabilities catalog with a three-day window for remediation. Affected versions include R82.10, R82, R81.20, and others, all of which require installing the latest Jumbo Hotfix. Rapid7 advises checking for signs of compromise, especially in exposed environments.

A critical nine-year-old race condition vulnerability, tracked as CVE-2026-64600 and dubbed RefluXFS, has been discovered in the Linux kernel's XFS filesystem. This flaw enables local attackers to overwrite protected files and escalate privileges to root. The issue affects systems using an XFS filesystem with reflink enabled—common in major enterprise Linux distributions—and running kernel versions 4.11 or newer. Standard security measures like SELinux and container isolation do not prevent exploitation due to the low-level nature of the flaw. A patch was issued on July 16, and users are urged to update their kernels immediately.

Researchers uncovered a large-scale cyber campaign where attackers leveraged compromised GitHub repositories to deploy malicious workflows targeting cPanel and WebHost Manager (WHM) servers. Between July 12 and 13, 2026, ten Packagist packages linked to a legitimate PHP developer were used to distribute malicious GitHub Actions workflows. These workflows trigger GitHub-hosted runners that download payloads exploiting CVE-2026-41940, an authentication bypass flaw in cPanel and WHM. The attacks aim to steal credentials, configuration files, and sensitive data from vulnerable systems. This incident highlights how supply chain vulnerabilities can be weaponized at scale.

A critical authentication bypass vulnerability (CVE-2026-16232) in Check Point Security Management and Multi-Domain Security Management is currently being exploited by attackers. This flaw allows unauthenticated users to gain admin-level access through SmartConsole, enabling them to modify security policies and configurations. Check Point has issued hotfixes for supported versions—R81.20, R82, and R82.10—and advised customers to restrict access to trusted IPs if immediate patching isn't possible. CISA has added this flaw to its Known Exploited Vulnerabilities catalog, requiring U.S. federal agencies to act by July 25.

A critical zero-day vulnerability in Check Point's products has been actively exploited in the wild. CVE-2026-16232 impacts Security Management and Multi-Domain Management, enabling attackers to bypass authentication and gain full administrative control through SmartConsole. The flaw was confirmed by Check Point, which reported that only a limited number of customers with exposed management interfaces were affected. Patches and IoCs are available, and CISA added the flaw to its KEV catalog, urging immediate remediation.

Check Point Software has released a fix for a critical zero-day vulnerability affecting its SmartConsole interface, which is currently being exploited in real-world attacks. The flaw, identified as CVE-2026-16232, enables unauthenticated attackers to bypass authentication and gain administrative privileges by stealing an application token. Once inside, adversaries can alter security policies and configurations on affected systems like the Security Management Server and Multi-Domain Security Management Server (MDS). The vulnerability requires that the server’s IP be accessible over the internet and that Trusted Client restrictions are disabled. CISA has added the issue to its list of known exploited vulnerabilities and directed U.S. federal agencies to apply patches by July 25. Organizations are strongly advised to update or implement mitigations such as restricting Trusted Clients to specific IPs.

A long-standing Linux kernel vulnerability, tracked as CVE-2026-64600 and dubbed RefluXFS, has been disclosed. This flaw enables an unprivileged local user to overwrite root-owned files on XFS filesystems and achieve persistent root access. The issue affects default installations of Red Hat Enterprise Linux, Fedora Server, and Amazon Linux, among others. The vulnerability stems from a race condition in the XFS filesystem when reflink is enabled (reflink=1). A patch was merged into the Linux kernel on July 16, and updated kernels are now being distributed by major vendors. Exploitation requires specific conditions involving XFS configuration and file placement. While no active exploitation has been reported, systems meeting these criteria should apply updates immediately.

Check Point has issued security updates addressing multiple vulnerabilities in its Security Management and Multi-Domain Security Management products, including a critical flaw currently being actively exploited. The most severe issue, CVE-2026-16232 (CVSS score: 9.3), allows unauthenticated attackers to bypass authentication and gain full administrative access via the SmartConsole login process. This could enable attackers to alter security policies and configurations remotely. The flaw impacts several versions of Check Point's software, including R77.30 through R82.10. A patch is available, and users are advised to apply the latest Jumbo hotfix immediately. CISA has also added this vulnerability to its KEV catalog, mandating federal agencies to remediate by July 25, 2026.

A recent study reveals that many open source security fixes involve multiple patches, creating a window of vulnerability between the initial and final commits. Researchers analyzed 1,646 CVEs with more than one patch in the National Vulnerability Database and found that some fixes are incomplete or delayed, exposing users to potential attacks. For example, CVE-2012-0038 required two separate commits to fully resolve an integer overflow issue. Automated detection tools failed to identify these partial fixes accurately, highlighting a critical gap in current vulnerability management practices.

Unit 42 has uncovered a sustained espionage campaign attributed to Russian threat groups Void Blizzard and LAUNDRY BEAR, exploiting a critical vulnerability in Zimbra Collaboration Suite (CVE-2025-66376). Attackers used zero-click phishing emails to inject malicious JavaScript payloads into unpatched systems, stealing login credentials, email archives, and search histories. The flaw is being actively exploited against government, defense, and financial organizations in NATO countries, Ukraine, CIS nations, and parts of Africa. Palo Alto Networks recommends updating Zimbra and leveraging Cortex Advanced Email Security to mitigate risks.

Researchers have revealed a critical local privilege escalation (LPE) vulnerability in the snap-confine component of Ubuntu, allowing unprivileged users to escalate their privileges to root on default desktop installations. Tracked as CVE-2026-8933 (CVSS score: 7.8), this flaw affects Ubuntu Desktop versions 24.04, 25.10, and 26.04. The vulnerability arises from a race condition during sandbox initialization, enabling attackers to manipulate file permissions and inject malicious rules into system directories. This could lead to full system compromise. To mitigate the risk, users are advised to update their systems with the latest patches for snapd.

A recent log entry revealed an ongoing attack targeting Geoserver through CVE-2024-36401, an X-Path expression evaluation flaw. The exploit attempts to execute arbitrary commands on vulnerable systems using the Rondo botnet. Attackers are deploying malicious shell scripts hosted remotely, leveraging multiple download methods such as wget and curl. This vulnerability allows unauthenticated attackers to run arbitrary code, making it critical for users to apply patches immediately.

A critical local privilege escalation vulnerability, CVE-2026-64600, has been discovered in the Linux kernel's XFS filesystem. Attackers with basic user access can exploit this flaw to overwrite protected files and gain full root privileges on affected systems, including those using SELinux in Enforcing mode. The issue affects a wide range of enterprise Linux distributions, including RHEL, Oracle Linux, Amazon Linux, and Fedora, especially when running an XFS root filesystem with reflink enabled. The vulnerability has existed since kernel version 4.11 (circa 2017) and may impact over 16 million systems globally. Immediate patching is strongly advised, as no effective workarounds exist.

A critical vulnerability in the Adobe Acrobat Chrome extension has been addressed following reports that it could allow attackers to silently access a user's WhatsApp Web session data. The flaw, named HermeticReader by Guardio Labs and tracked as CVE-2026-48294 (CVSS score: 7.4), is a universal cross-site scripting (UXSS) issue affecting all versions of the extension up to and including 26.5.2.2. Exploitation required user interaction but did not rely on phishing or malware installation—only visiting a maliciously crafted webpage was enough to trigger the attack. Attackers could use this to steal sensitive information such as chat lists, contact names, and message content from WhatsApp Web. Adobe has now issued a patch for the issue.

Researchers from Guardio uncovered a critical flaw in Adobe's widely used Chrome extension, which could have enabled silent theft of WhatsApp chat data and contacts. The vulnerability, classified as a UXSS cross-origin data disclosure issue (CVE-2026-48294), affected the Adobe Acrobat Chrome extension installed on around 329 million devices. Attackers could exploit it by luring users to a malicious website, bypassing the need for malware or device access. Adobe addressed the issue in June with a patch.

Oracle has issued its latest quarterly Critical Patch Update for July 2026, addressing a total of 1449 security vulnerabilities across numerous product lines. The majority—1235 of them—are related to third-party components embedded in Oracle software. Oracle E-Business Suite was the most affected, receiving 410 patches (nearly 28% of the total). Among the notable fixes are high-severity issues that could allow remote code execution if exploited. This update includes patches for Oracle Database, APEX, GoldenGate, SQL Developer, and other key tools. Qualys has also published several QIDs to help organizations detect and remediate these vulnerabilities.

Eclypsium has released a new infrastructure security report highlighting critical vulnerabilities affecting widely used networking and infrastructure devices. The inaugural July 2026 InfraTrust Pulse report outlines 61 advisories from 14 vendors, including six critical flaws and 26 remotely exploitable vulnerabilities. Several of these issues are being actively exploited by threat actors like Volt Typhoon and Salt Typhoon. Notably, SonicWall’s SMA1000 appliances (CVE-2026-15409 and CVE-2026-15410) were exploited before patches were available, while Fortinet’s FortiSandbox faced command injection flaws later added to CISA’s KEV catalog. Eclypsium emphasizes prioritizing vulnerabilities based on exploitability and exposure rather than just CVSS scores.

In Q2 2026, Rapid7 rolled out significant updates across its product suite aimed at improving detection, response, and compliance for security teams. Key innovations include Detection as Code for scalable threat detection, ransomware prevention integrated into Incident Command, and enhanced compliance solutions aligned with global regulations like NIS2 and HIPAA. Additionally, the company published critical threat research on actively exploited vulnerabilities in Oracle PeopleSoft, Palo Alto PAN-OS, and other widely used systems. These advancements reflect Rapid7’s commitment to simplifying security operations while addressing emerging cyber threats.