Security news, decoded.

Ivanti is leveraging large language models (LLMs) to enhance its vulnerability detection and remediation efforts. Recently, an LLM identified a critical vulnerability, CVE-2026-10520, in Ivanti’s Sentry mobile gateway, which was rated as maximum severity with a CVSS score of 10 out of 10. The company has begun integrating advanced AI models into its security red teams to uncover and fix flaws that traditional tools miss. Ivanti’s CISO, Daniel Spicer, shared insights on how the initiative is progressing, highlighting successes in both identifying and resolving vulnerabilities using models from Anthropic and OpenAI.

A critical SQL injection vulnerability in WordPress Core, tracked as CVE-2026-63030, is currently being actively exploited. Dubbed 'wp2shell' by researchers, this flaw allows unauthenticated attackers to achieve remote code execution through the REST API. Attackers are already probing systems using crafted requests that attempt to inject malicious payloads into database queries. If you're running WordPress, check your exposure at https://wp2shell.com and assume compromise if vulnerable. Immediate patching is strongly recommended.

A server used by a malware operator was left unsecured, allowing researchers at Rapid7 to recover a full toolkit containing lure templates, test files, and documentation. The data reveals an AI-assisted approach to crafting phishing attacks that exploit CVE-2025-33053 (CVSS 8.8), a WebDAV vulnerability patched in June 2025. The campaign targeted Mexican users via a fake government ID lookup site, delivering infostealers through malicious .scr files disguised as PDFs. Researchers found evidence suggesting the attackers used open-source AI coding tools to automate parts of their workflow, including generating phishing content and testing multiple signed binaries for potential hijack opportunities.

Threat intelligence firm Defused has confirmed that attackers are actively exploiting CVE-2026-6875, a severe pre-authentication remote code execution flaw in ServiceNow's AI Platform. This vulnerability allows unauthenticated users to bypass the script sandbox and execute arbitrary code on affected systems. Discovered by Searchlight Cyber researchers, the flaw was patched by ServiceNow in late June 2026, but exploitation in the wild began shortly after the public disclosure on July 13. Attackers are using payloads targeting the /assessmentthanks.do endpoint, employing a novel method for sandbox escape compared to the original proof-of-concept. Organizations running self-hosted instances should apply the latest security updates immediately.

Two critical zero-day vulnerabilities in SonicWall secure remote access appliances were actively exploited by a threat actor for several weeks before being patched. According to Volexity, attackers used CVE-2026-15409 and CVE-2026-15410 to deploy custom malware like KnuckleBall and gain unauthorized access to systems. SonicWall issued hotfixes on July 14 after the exploitation was discovered as early as June 22. CISA has also added these flaws to its Known Exploited Vulnerabilities catalog.

A critical remote code execution vulnerability in WordPress Core has been actively exploited in the wild, allowing unauthenticated attackers to execute arbitrary code on vulnerable installations. The flaw, known as wp2shell, combines two issues—CVE-2026-63030 and CVE-2026-60137—to enable full system compromise without authentication or plugins. Proof-of-concept exploits are already circulating, and early signs of real-world attacks have emerged. Meanwhile, SonicWall Secure Mobile Access (SMA) appliances were targeted with zero-day exploits before patches were publicly available. Two vulnerabilities, CVE-2026-15409 and CVE-2026-15410, allowed attackers to achieve arbitrary command execution. Both flaws have now been addressed by SonicWall. Organizations running these products should prioritize patching immediately to mitigate risks.

This week saw multiple major cybersecurity incidents and patches. Ernst & Young disclosed a data breach via a compromised third-party IT support platform, potentially exposing sensitive client and employee data. Jscrambler suffered a supply chain attack where stolen credentials led to the distribution of malicious npm packages. Meanwhile, Coca-Cola's subsidiary Fairlife confirmed a ransomware attack that disrupted U.S. dairy production. In terms of vulnerabilities, Microsoft addressed 622 flaws in its largest-ever Patch Tuesday update, including two actively exploited issues (CVE-2026-56164 and CVE-2026-56155). WordPress issued emergency fixes for two critical RCE flaws (CVE-2026-63030 and CVE-2026-60137), while SonicWall released hotfixes for two zero-day vulnerabilities (CVE-2026-15409 and CVE-2026-15410) being exploited by ransomware groups.

Russian intelligence services are actively exploiting internet-connected IP cameras to monitor military logistics, troop movements, and weapons shipments in NATO countries and Ukraine. According to a cybersecurity advisory from the Netherlands' AIVD and MIVD, these attacks are ongoing and involve using exposed devices with weak or default credentials. The compromised cameras provide real-time surveillance capabilities, including targeting assistance in active conflict zones. Cybersecurity firm Censys estimates over 87,000 vulnerable cameras are accessible online in Europe and Ukraine, many running outdated software with known exploits like CVE-2016-7407 and CVE-2021-39275. Defenders are urged to secure their networks by disabling public access, updating firmware, changing default passwords, and limiting camera visibility.

A critical vulnerability in ServiceNow's AI Platform, CVE-2026-6875, is now being actively exploited by attackers, according to threat intelligence firm Defused. The flaw allows unauthenticated users to break out of a sandbox and execute arbitrary code remotely. Despite patches being issued on July 13, real-world attacks were detected just days later. ServiceNow urges all users to apply the latest security updates immediately.

A new vulnerability in 7-Zip, tracked as CVE-2026-14266, allows attackers to execute arbitrary code during the extraction of specially crafted XZ files. The flaw stems from a heap-based buffer overflow in the way 7-Zip handles XZ chunked data. Trend Micro’s Zero Day Initiative disclosed the issue on July 15, and a fix was included in version 26.02, released on June 25. The vulnerability requires user interaction—specifically, opening a malicious file—but does not allow remote exploitation over the network. While no public exploits or proof-of-concepts have been observed yet, users are strongly advised to update to 7-Zip 26.02 or later to mitigate the risk.

Two recently patched WordPress vulnerabilities, known as WP2Shell (CVE-2026-60137 and CVE-2026-63030), are currently being actively exploited in the wild. These flaws allow attackers to execute arbitrary code without authentication on affected installations. The vulnerabilities impact WordPress versions 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1. Patches were released in versions 6.9.5 and 7.0.2, and automatic updates have been enabled for affected sites. Cybersecurity firms including Hexastrike and WatchTowr have confirmed real-world exploitation attempts, with proof-of-concept exploits appearing soon after disclosure.

F5 has issued patches for a severe vulnerability in NGINX that could allow remote code execution under certain conditions. The flaw, tracked as CVE-2026-42533, was addressed on July 15 in nginx versions 1.30.4 (stable) and 1.31.3 (mainline), along with NGINX Plus 37.0.3.1. Attackers can exploit this by sending specially crafted HTTP requests to trigger a heap buffer overflow in the worker process. While primarily a denial-of-service vector, the vulnerability may enable remote code execution if address space layout randomization (ASLR) is disabled or bypassed. This occurs due to a misalignment in the script engine’s two-pass evaluation of regex-based map directives used in string expressions. A researcher named Stan Shaw argues that the flaw provides a method to bypass ASLR itself, potentially making it more dangerous than F5 acknowledges. F5 rates the vulnerability as high severity, with a CVSS v4 score of 9.2. All versions from 0.9.6 up to 1.31.2 are affected, spanning over a decade of NGINX usage. While mitigation options exist—like using named captures instead of numbered ones—Shaw warns these do not fully resolve the issue. He recommends upgrading immediately to the latest stable or mainline releases.

A new threat actor, tracked as UTA0533, has been actively exploiting two undisclosed vulnerabilities in SonicWall Secure Mobile Access (SMA) 1000 series devices since June 22, 2026. These zero-days—CVE-2026-15409 (CVSS 10.0) and CVE-2026-15410 (CVSS 7.2)—were used to gain root access and deploy custom malware on compromised appliances. Researchers from Volexity discovered the attacks during an incident response investigation and confirmed that the vulnerabilities were chained together to allow arbitrary command execution. SonicWall has since released patches for both issues. Attackers leveraged these flaws to install persistent backdoors, steal credentials, and maintain long-term access to vulnerable systems.

Researchers at OX Security discovered a SQL injection flaw in IBM App Connect Enterprise and IBM Integration Bus for z/OS, tracked as CVE-2026-3602. This vulnerability enables attackers to create arbitrary files on a victim's system through a maliciously crafted SQL file. If exploited successfully, it can lead to remote command execution and full system compromise. The flaw requires user interaction, typically via social engineering tactics to lure victims into importing the malicious file. IBM has released patches for affected versions of its software.

This week's security highlights include two actively exploited zero-day vulnerabilities in SonicWall Secure Mobile Access appliances (CVE-2026-15409, CVE-2026-15410), which have been patched and require immediate firmware upgrades. Additionally, the latest WordPress 7.0.2 update resolves one critical and one high-severity flaw, both labeled as urgent for remediation. Other notable developments include new AI-driven attack methods, phishing trends, and a surge in ransomware activity via email vectors.

7-Zip has issued version 26.02 to resolve a high-risk remote code execution (RCE) vulnerability that could let attackers run malicious code through specially crafted XZ-compressed files. The flaw, identified by researcher Landon Peng and detailed in ZDI-26-444, stems from improper handling of available space during decompression, leading to potential heap-based buffer overflows. While no active exploitation has been reported yet, the lack of an automatic update mechanism means users must manually upgrade to mitigate risks. Given 7-Zip’s widespread use, unpatched systems remain exposed to targeted attacks involving malicious archives.

Public proof-of-concept exploits have emerged for the critical 'wp2shell' remote code execution vulnerabilities in WordPress Core, urging immediate action from site administrators. The vulnerabilities, CVE-2026-63030 and CVE-2026-60137, allow unauthenticated attackers to execute arbitrary code on affected installations running versions 6.9.x and 7.0.x. These flaws can be exploited without prior authentication and affect default setups with no additional plugins required. The WordPress security team has activated forced auto-updates to address the issue, recommending users upgrade to version 7.0.2 or 6.9.5 as soon as possible.

WordPress has issued a security update in version 7.0.2 to resolve two significant vulnerabilities, including one critical flaw. The issues—CVE-2026-60137 (SQL injection) and another related to REST API batch-route confusion leading to potential remote code execution—were reported by multiple researchers. Sites running WordPress 6.9 or 6.8 are impacted, with updated versions 6.9.5 and 6.8.6 available. As a temporary workaround, administrators can restrict access to the batch API via plugins or WAF rules, though full protection requires applying the latest updates.

A critical remote code execution flaw, CVE-2026-63030, has been patched in WordPress Core following a GitHub Security Advisory issued on July 17, 2026. The vulnerability allowed unauthenticated attackers to execute arbitrary code via the REST API batch endpoint, potentially leading to full site compromise. It affected versions 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1. Fixes are now available in 6.9.5, 7.0.2, and 7.1 Beta 2. Although no active exploitation has been reported yet, the lack of authentication requirements and widespread use of WordPress make this a high-risk issue. Immediate patching is strongly advised.

A newly discovered vulnerability in WordPress Core allows unauthenticated attackers to execute arbitrary code on affected installations. The flaw, named wp2shell, impacts versions 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1. WordPress addressed the issue in versions 6.9.5 and 7.0.2, which were released on July 17, 2026. The vulnerability can be triggered via the REST API’s batch endpoint and requires no authentication or specific configuration. While no exploitation attempts have been observed yet, administrators are strongly advised to update immediately to mitigate risk.

A critical memory exhaustion flaw in OpenSSL could allow attackers to freeze server resources using just 11 bytes of malicious TLS traffic. The issue, dubbed HollowByte, affects older versions of OpenSSL and was quietly patched in June without a CVE identifier or official advisory. Affected versions include all prior releases before OpenSSL 4.0.1, 3.6.3, 3.5.7, 3.4.6, and 3.0.21. The vulnerability allows attackers to exhaust server memory by tricking the software into allocating large buffers based on forged message lengths. This can lead to out-of-memory conditions even without hitting connection limits. OpenSSL classified the fix as a 'bug or hardening' change, meaning it did not receive a formal security rating or public tracking. However, Okta's Red Team warns that standard defenses like rate limiting will not prevent this attack due to how glibc manages memory. Users are advised to update to the latest stable versions immediately.

A critical remote code execution vulnerability (CVE-2026-58644) in Microsoft SharePoint Server is being actively exploited in the wild. The flaw affects on-premises versions including SharePoint Enterprise Server 2016, SharePoint Server 2019, and Subscription Edition. Attackers can exploit it without authentication due to unsafe deserialization of untrusted data. Microsoft has issued urgent security updates, and CISA added the issue to its KEV list. Organizations are advised to apply the July 14, 2026 patches immediately and monitor for signs of exploitation using tools like Microsoft Defender and AMSI.

A newly discovered Go-based botnet named NadMesh has emerged, actively scanning for misconfigured AI and DevOps services to extract sensitive credentials like AWS keys and Kubernetes tokens. The threat actor’s dashboard reportedly lists over 3,800 unique AWS keys harvested from vulnerable systems. QiAnXin's XLab identified the malware based on a string reference to 'n4d mesh controller' in its codebase. The botnet focuses on popular open-source tools such as ComfyUI, Ollama, n8n, Open WebUI, Langflow, Gradio, Jenkins, Docker API, and Redis—services often deployed without proper firewall protections. It exploits weak configurations, default credentials, and unauthenticated endpoints to gain access. Once inside, it collects cloud credentials stored in environment files, Kubernetes service accounts, and Docker configuration files. Researchers note that while the botnet uses multiple vectors—including Docker remote code execution and Jenkins script console exploitation—the largest portion of its activity involves exploiting MCP (Model Context Protocol) servers using the executecommand tool. However, many of these services lack robust authentication mechanisms, making them easy targets. Organizations are urged to secure exposed services by enabling authentication, restricting public access, and applying available patches for known vulnerabilities like CVE-2026-39987 and CVE-2026-41176.

A critical remote code execution vulnerability in Microsoft SharePoint, tracked as CVE-2026-58644, has been actively exploited just days after its disclosure. The flaw, rated with a CVSS score of 9.8, allows authenticated attackers with Site Owner privileges to inject and execute arbitrary code on affected servers. Microsoft addressed the issue during its July 2026 Patch Tuesday release. CISA has added the vulnerability to its Known Exploited Vulnerabilities catalog, urging immediate patching for SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Enterprise Server 2016.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent warning for government agencies to address two actively exploited vulnerabilities in Fortinet’s FortiSandbox threat detection platform. These flaws, CVE-2026-39808 and CVE-2026-25089, enable unauthenticated attackers to execute arbitrary code remotely without user interaction. CISA added both to its catalog of known exploited vulnerabilities and requires federal agencies to apply patches by July 19. Threat intelligence firm Defused confirmed ongoing exploitation attempts, prompting immediate action from administrators.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a critical remote code execution vulnerability affecting Microsoft SharePoint Server to its list of known exploited vulnerabilities. The flaw, tracked as CVE-2026-58644, allows attackers with site owner privileges to execute arbitrary code remotely. Patches were issued on July 14, 2026, but the vulnerability had already been actively exploited before fixes became available. Affected products include SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Enterprise Server 2016. CISA urges organizations to apply updates immediately to prevent potential breaches.

Researchers from Palo Alto Networks' Unit 42 have uncovered a chain of three zero-day vulnerabilities in Siemens ROX II industrial switches, which could allow attackers to gain full root access and maintain persistent control over the devices. The flaws—CVE-2025-40948, CVE-2025-40947, and CVE-2025-40949—range from arbitrary file disclosure to command injection and system persistence. Siemens has issued security advisories recommending an update to firmware version V2.17.1. These vulnerabilities underscore the need for strong input validation and secure coding practices in operational technology (OT) environments.

This week’s ThreatsDay highlights a surge in malicious activity involving game cheat spyware, fast-spreading ransomware, and new exploit techniques. Researchers discovered 11 malicious NuGet packages posing as game utilities that download a Python payload named pepesoft.exe. Meanwhile, the financially motivated threat group UAT-11795 is distributing Starland RAT and WLDR agent through trojanized installers for popular software like MobaXterm and Zoom. Additionally, a new ransomware family called Spirals encrypted an entire network within 24 hours after breaching an IIS web server. CISA also added two actively exploited vulnerabilities—CVE-2026-46817 and CVE-2023-4346—to its KEV catalog. These developments underscore the importance of patching known flaws and scrutinizing seemingly benign downloads.

n8n, the workflow automation platform, addressed a critical vulnerability in its Enterprise edition that allowed attackers to impersonate users from different token issuers. The flaw, tracked as CVE-2026-59208, stemmed from improper validation of the iss (issuer) field in JSON Web Tokens (JWTs), allowing a valid token from one issuer to log in as a user from another. This issue only affects n8n Enterprise instances configured to trust multiple external issuers. The fix was deployed on June 24, with updated versions 2.27.4 and 2.28.1. Affected organizations are advised to upgrade immediately or disable the token exchange feature if patching is delayed.

A newly discovered technique called agent data injection (ADI) allows attackers to manipulate AI agents into performing unintended actions without altering their core tasks. By corrupting the factual data these systems rely on—such as sender names, button IDs, or tool execution logs—researchers demonstrated how an AI can be tricked into clicking 'Buy Now' instead of 'Read More', executing arbitrary code from GitHub comments, or merging malicious pull requests. The vulnerability affects widely used tools including Claude in Chrome, Google’s Antigravity, Nanobrowser, and OpenAI’s Codex. While no active exploitation has been reported yet, the researchers confirmed the issue with vendors like OpenAI, Google, and Anthropic. Defenses such as random ID tagging and source tracking were shown to reduce risk, but full protection remains challenging due to the nature of how language models interpret structured data.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has directed federal agencies to apply patches for a critical vulnerability in Oracle E-Business Suite by July 18, due to active exploitation in real-world attacks. The flaw, identified as CVE-2026-46817, resides in the File Transmission feature of Oracle Payments and enables unauthenticated attackers to gain control of affected systems through simple HTTP-based attacks. Oracle issued fixes during its May 2026 Critical Security Patch Update, emphasizing the urgency of applying these updates. Threat intelligence firm Defused confirmed that malicious actors have already begun exploiting this vulnerability, with no public proof-of-concept code currently available.

Splunk and Zoom have issued patches for multiple critical and high-severity vulnerabilities affecting their products. Splunk addressed three key issues—CVE-2026-20296, CVE-2026-20297, and CVE-2026-20298—in updated versions of Splunk Enterprise, while also fixing third-party component bugs like those in Golang and OpenSSL. Meanwhile, Zoom resolved four vulnerabilities, including the critical CVE-2026-53412, which could enable remote account takeovers. Both companies advise users to update immediately to secure their systems.

F5 has issued an urgent security update addressing eight vulnerabilities affecting its NGINX and BIG-IP products. Among them is CVE-2026-42533, a critical heap buffer overflow flaw with a CVSS score of 9.2 that could allow attackers to restart the NGINX worker process or execute code under specific conditions. The vulnerabilities span both open-source and enterprise offerings, including NGINX Plus, NGINX Open Source, and BIG-IP. These issues range from potential memory leaks and denial-of-service risks to unauthorized configuration changes. While no evidence of real-world exploitation was reported, users are strongly advised to apply the available patches immediately.

Researchers at ESET have identified nearly a dozen outdated UEFI shim bootloaders signed by Microsoft that could allow attackers to bypass Secure Boot protections. These shims, used to enable Linux distributions to boot securely, were not updated by some vendors and remained trusted despite known vulnerabilities. Microsoft revoked the affected shims on June 2026 Patch Tuesday, assigning them CVE identifiers CVE-2026-8863 and CVE-2026-10797. Attackers could exploit these flaws to execute malicious code during the boot process, undermining Secure Boot even when enabled.

Zoom has issued security updates addressing a critical vulnerability affecting its Windows-based products, which could have allowed attackers to take over user accounts remotely. The flaw, identified as CVE-2026-53412 with a CVSS score of 9.8, impacts the Zoom Desktop Client, Zoom VDI Client, and Zoom Meeting SDK for Windows. According to Zoom’s advisory, an unauthenticated attacker could exploit this issue through network access without prior authentication. In addition to this critical flaw, three other high-severity vulnerabilities were also resolved in the latest releases.

Trend Micro, Tanium, ESET, and Tenable have issued urgent security updates to address multiple severe flaws in their products. These include a critical path traversal vulnerability (CVE-2026-15265) in Tenable Agent that could enable remote code execution, a high-severity local privilege escalation in ESET's Inspect Connector for Windows, and a denial-of-service flaw in Tanium Server. Trend Micro also addressed a privilege escalation issue in Cleaner One Pro. While no active exploitation has been reported, these vulnerabilities underscore the importance of timely patching to prevent potential attacks.

New research reveals that financial support for open-source projects leads to increased development activity, including more commits and reported issues. The study focused on funded projects such as the Python Package Index and curl, showing a significant rise in contributions following maintenance contracts. However, the number of contributors remained largely unchanged, highlighting ongoing challenges in expanding maintainer bases. This insight offers guidance for organizations investing in open-source sustainability.

Zoom has issued security updates to fix a critical vulnerability that could allow unauthenticated attackers to take over user accounts. The flaw, tracked as CVE-2026-53412 with a severity score of 9.8, impacts several Windows-based products including older versions of Zoom Workplace, the VDI Client, and the Meeting SDK. Users are advised to update their software immediately to prevent potential exploitation. In addition to this high-profile issue, the latest patches also resolve three other high-severity flaws related to privilege escalation.

Two zero-day vulnerabilities in SonicWall SMA1000 Series devices—CVE-2026-15409 (CVSS 10.0) and CVE-2026-15410—are currently being actively exploited in attacks. The flaws allow unauthenticated attackers to create tunnels to internal services and escalate privileges to root. Rapid7’s MDR team detected real-world exploitation before official disclosure. Both issues are now listed in CISA’s KEV catalog. Affected versions include multiple firmware builds of models 6210, 7210, and 8200v. SonicWall has issued patches; users are urged to update immediately to prevent compromise.