Russian intelligence services are actively exploiting internet-connected IP cameras to monitor military logistics, troop movements, and weapons shipments in NATO countries and Ukraine. According to a cybersecurity advisory from the Netherlands' AIVD and MIVD, these attacks are ongoing and involve using exposed devices with weak or default credentials. The compromised cameras provide real-time surveillance capabilities, including targeting assistance in active conflict zones. Cybersecurity firm Censys estimates over 87,000 vulnerable cameras are accessible online in Europe and Ukraine, many running outdated software with known exploits like CVE-2016-7407 and CVE-2021-39275. Defenders are urged to secure their networks by disabling public access, updating firmware, changing default passwords, and limiting camera visibility.
A critical vulnerability in ServiceNow's AI Platform, CVE-2026-6875, is now being actively exploited by attackers, according to threat intelligence firm Defused. The flaw allows unauthenticated users to break out of a sandbox and execute arbitrary code remotely. Despite patches being issued on July 13, real-world attacks were detected just days later. ServiceNow urges all users to apply the latest security updates immediately.
A new vulnerability in 7-Zip, tracked as CVE-2026-14266, allows attackers to execute arbitrary code during the extraction of specially crafted XZ files. The flaw stems from a heap-based buffer overflow in the way 7-Zip handles XZ chunked data. Trend Micro’s Zero Day Initiative disclosed the issue on July 15, and a fix was included in version 26.02, released on June 25. The vulnerability requires user interaction—specifically, opening a malicious file—but does not allow remote exploitation over the network. While no public exploits or proof-of-concepts have been observed yet, users are strongly advised to update to 7-Zip 26.02 or later to mitigate the risk.
Two recently patched WordPress vulnerabilities, known as WP2Shell (CVE-2026-60137 and CVE-2026-63030), are currently being actively exploited in the wild. These flaws allow attackers to execute arbitrary code without authentication on affected installations. The vulnerabilities impact WordPress versions 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1. Patches were released in versions 6.9.5 and 7.0.2, and automatic updates have been enabled for affected sites. Cybersecurity firms including Hexastrike and WatchTowr have confirmed real-world exploitation attempts, with proof-of-concept exploits appearing soon after disclosure.
F5 has issued patches for a severe vulnerability in NGINX that could allow remote code execution under certain conditions. The flaw, tracked as CVE-2026-42533, was addressed on July 15 in nginx versions 1.30.4 (stable) and 1.31.3 (mainline), along with NGINX Plus 37.0.3.1. Attackers can exploit this by sending specially crafted HTTP requests to trigger a heap buffer overflow in the worker process.
While primarily a denial-of-service vector, the vulnerability may enable remote code execution if address space layout randomization (ASLR) is disabled or bypassed. This occurs due to a misalignment in the script engine’s two-pass evaluation of regex-based map directives used in string expressions. A researcher named Stan Shaw argues that the flaw provides a method to bypass ASLR itself, potentially making it more dangerous than F5 acknowledges.
F5 rates the vulnerability as high severity, with a CVSS v4 score of 9.2. All versions from 0.9.6 up to 1.31.2 are affected, spanning over a decade of NGINX usage. While mitigation options exist—like using named captures instead of numbered ones—Shaw warns these do not fully resolve the issue. He recommends upgrading immediately to the latest stable or mainline releases.
A new threat actor, tracked as UTA0533, has been actively exploiting two undisclosed vulnerabilities in SonicWall Secure Mobile Access (SMA) 1000 series devices since June 22, 2026. These zero-days—CVE-2026-15409 (CVSS 10.0) and CVE-2026-15410 (CVSS 7.2)—were used to gain root access and deploy custom malware on compromised appliances. Researchers from Volexity discovered the attacks during an incident response investigation and confirmed that the vulnerabilities were chained together to allow arbitrary command execution. SonicWall has since released patches for both issues. Attackers leveraged these flaws to install persistent backdoors, steal credentials, and maintain long-term access to vulnerable systems.
Researchers at OX Security discovered a SQL injection flaw in IBM App Connect Enterprise and IBM Integration Bus for z/OS, tracked as CVE-2026-3602. This vulnerability enables attackers to create arbitrary files on a victim's system through a maliciously crafted SQL file. If exploited successfully, it can lead to remote command execution and full system compromise. The flaw requires user interaction, typically via social engineering tactics to lure victims into importing the malicious file. IBM has released patches for affected versions of its software.
This week's security highlights include two actively exploited zero-day vulnerabilities in SonicWall Secure Mobile Access appliances (CVE-2026-15409, CVE-2026-15410), which have been patched and require immediate firmware upgrades. Additionally, the latest WordPress 7.0.2 update resolves one critical and one high-severity flaw, both labeled as urgent for remediation. Other notable developments include new AI-driven attack methods, phishing trends, and a surge in ransomware activity via email vectors.
7-Zip has issued version 26.02 to resolve a high-risk remote code execution (RCE) vulnerability that could let attackers run malicious code through specially crafted XZ-compressed files. The flaw, identified by researcher Landon Peng and detailed in ZDI-26-444, stems from improper handling of available space during decompression, leading to potential heap-based buffer overflows. While no active exploitation has been reported yet, the lack of an automatic update mechanism means users must manually upgrade to mitigate risks. Given 7-Zip’s widespread use, unpatched systems remain exposed to targeted attacks involving malicious archives.
Public proof-of-concept exploits have emerged for the critical 'wp2shell' remote code execution vulnerabilities in WordPress Core, urging immediate action from site administrators. The vulnerabilities, CVE-2026-63030 and CVE-2026-60137, allow unauthenticated attackers to execute arbitrary code on affected installations running versions 6.9.x and 7.0.x. These flaws can be exploited without prior authentication and affect default setups with no additional plugins required. The WordPress security team has activated forced auto-updates to address the issue, recommending users upgrade to version 7.0.2 or 6.9.5 as soon as possible.
WordPress has issued a security update in version 7.0.2 to resolve two significant vulnerabilities, including one critical flaw. The issues—CVE-2026-60137 (SQL injection) and another related to REST API batch-route confusion leading to potential remote code execution—were reported by multiple researchers. Sites running WordPress 6.9 or 6.8 are impacted, with updated versions 6.9.5 and 6.8.6 available. As a temporary workaround, administrators can restrict access to the batch API via plugins or WAF rules, though full protection requires applying the latest updates.
A critical remote code execution flaw, CVE-2026-63030, has been patched in WordPress Core following a GitHub Security Advisory issued on July 17, 2026. The vulnerability allowed unauthenticated attackers to execute arbitrary code via the REST API batch endpoint, potentially leading to full site compromise. It affected versions 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1. Fixes are now available in 6.9.5, 7.0.2, and 7.1 Beta 2. Although no active exploitation has been reported yet, the lack of authentication requirements and widespread use of WordPress make this a high-risk issue. Immediate patching is strongly advised.
A newly discovered vulnerability in WordPress Core allows unauthenticated attackers to execute arbitrary code on affected installations. The flaw, named wp2shell, impacts versions 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1. WordPress addressed the issue in versions 6.9.5 and 7.0.2, which were released on July 17, 2026. The vulnerability can be triggered via the REST API’s batch endpoint and requires no authentication or specific configuration. While no exploitation attempts have been observed yet, administrators are strongly advised to update immediately to mitigate risk.
A critical memory exhaustion flaw in OpenSSL could allow attackers to freeze server resources using just 11 bytes of malicious TLS traffic. The issue, dubbed HollowByte, affects older versions of OpenSSL and was quietly patched in June without a CVE identifier or official advisory. Affected versions include all prior releases before OpenSSL 4.0.1, 3.6.3, 3.5.7, 3.4.6, and 3.0.21. The vulnerability allows attackers to exhaust server memory by tricking the software into allocating large buffers based on forged message lengths. This can lead to out-of-memory conditions even without hitting connection limits. OpenSSL classified the fix as a 'bug or hardening' change, meaning it did not receive a formal security rating or public tracking. However, Okta's Red Team warns that standard defenses like rate limiting will not prevent this attack due to how glibc manages memory. Users are advised to update to the latest stable versions immediately.
A critical remote code execution vulnerability (CVE-2026-58644) in Microsoft SharePoint Server is being actively exploited in the wild. The flaw affects on-premises versions including SharePoint Enterprise Server 2016, SharePoint Server 2019, and Subscription Edition. Attackers can exploit it without authentication due to unsafe deserialization of untrusted data. Microsoft has issued urgent security updates, and CISA added the issue to its KEV list. Organizations are advised to apply the July 14, 2026 patches immediately and monitor for signs of exploitation using tools like Microsoft Defender and AMSI.
A newly discovered Go-based botnet named NadMesh has emerged, actively scanning for misconfigured AI and DevOps services to extract sensitive credentials like AWS keys and Kubernetes tokens. The threat actor’s dashboard reportedly lists over 3,800 unique AWS keys harvested from vulnerable systems. QiAnXin's XLab identified the malware based on a string reference to 'n4d mesh controller' in its codebase.
The botnet focuses on popular open-source tools such as ComfyUI, Ollama, n8n, Open WebUI, Langflow, Gradio, Jenkins, Docker API, and Redis—services often deployed without proper firewall protections. It exploits weak configurations, default credentials, and unauthenticated endpoints to gain access. Once inside, it collects cloud credentials stored in environment files, Kubernetes service accounts, and Docker configuration files.
Researchers note that while the botnet uses multiple vectors—including Docker remote code execution and Jenkins script console exploitation—the largest portion of its activity involves exploiting MCP (Model Context Protocol) servers using the executecommand tool. However, many of these services lack robust authentication mechanisms, making them easy targets.
Organizations are urged to secure exposed services by enabling authentication, restricting public access, and applying available patches for known vulnerabilities like CVE-2026-39987 and CVE-2026-41176.
A critical remote code execution vulnerability in Microsoft SharePoint, tracked as CVE-2026-58644, has been actively exploited just days after its disclosure. The flaw, rated with a CVSS score of 9.8, allows authenticated attackers with Site Owner privileges to inject and execute arbitrary code on affected servers. Microsoft addressed the issue during its July 2026 Patch Tuesday release. CISA has added the vulnerability to its Known Exploited Vulnerabilities catalog, urging immediate patching for SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Enterprise Server 2016.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent warning for government agencies to address two actively exploited vulnerabilities in Fortinet’s FortiSandbox threat detection platform. These flaws, CVE-2026-39808 and CVE-2026-25089, enable unauthenticated attackers to execute arbitrary code remotely without user interaction. CISA added both to its catalog of known exploited vulnerabilities and requires federal agencies to apply patches by July 19. Threat intelligence firm Defused confirmed ongoing exploitation attempts, prompting immediate action from administrators.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a critical remote code execution vulnerability affecting Microsoft SharePoint Server to its list of known exploited vulnerabilities. The flaw, tracked as CVE-2026-58644, allows attackers with site owner privileges to execute arbitrary code remotely. Patches were issued on July 14, 2026, but the vulnerability had already been actively exploited before fixes became available. Affected products include SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Enterprise Server 2016. CISA urges organizations to apply updates immediately to prevent potential breaches.
Researchers from Palo Alto Networks' Unit 42 have uncovered a chain of three zero-day vulnerabilities in Siemens ROX II industrial switches, which could allow attackers to gain full root access and maintain persistent control over the devices. The flaws—CVE-2025-40948, CVE-2025-40947, and CVE-2025-40949—range from arbitrary file disclosure to command injection and system persistence. Siemens has issued security advisories recommending an update to firmware version V2.17.1. These vulnerabilities underscore the need for strong input validation and secure coding practices in operational technology (OT) environments.
This week’s ThreatsDay highlights a surge in malicious activity involving game cheat spyware, fast-spreading ransomware, and new exploit techniques. Researchers discovered 11 malicious NuGet packages posing as game utilities that download a Python payload named pepesoft.exe. Meanwhile, the financially motivated threat group UAT-11795 is distributing Starland RAT and WLDR agent through trojanized installers for popular software like MobaXterm and Zoom. Additionally, a new ransomware family called Spirals encrypted an entire network within 24 hours after breaching an IIS web server. CISA also added two actively exploited vulnerabilities—CVE-2026-46817 and CVE-2023-4346—to its KEV catalog. These developments underscore the importance of patching known flaws and scrutinizing seemingly benign downloads.
n8n, the workflow automation platform, addressed a critical vulnerability in its Enterprise edition that allowed attackers to impersonate users from different token issuers. The flaw, tracked as CVE-2026-59208, stemmed from improper validation of the iss (issuer) field in JSON Web Tokens (JWTs), allowing a valid token from one issuer to log in as a user from another. This issue only affects n8n Enterprise instances configured to trust multiple external issuers. The fix was deployed on June 24, with updated versions 2.27.4 and 2.28.1. Affected organizations are advised to upgrade immediately or disable the token exchange feature if patching is delayed.
A newly discovered technique called agent data injection (ADI) allows attackers to manipulate AI agents into performing unintended actions without altering their core tasks. By corrupting the factual data these systems rely on—such as sender names, button IDs, or tool execution logs—researchers demonstrated how an AI can be tricked into clicking 'Buy Now' instead of 'Read More', executing arbitrary code from GitHub comments, or merging malicious pull requests. The vulnerability affects widely used tools including Claude in Chrome, Google’s Antigravity, Nanobrowser, and OpenAI’s Codex. While no active exploitation has been reported yet, the researchers confirmed the issue with vendors like OpenAI, Google, and Anthropic. Defenses such as random ID tagging and source tracking were shown to reduce risk, but full protection remains challenging due to the nature of how language models interpret structured data.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has directed federal agencies to apply patches for a critical vulnerability in Oracle E-Business Suite by July 18, due to active exploitation in real-world attacks. The flaw, identified as CVE-2026-46817, resides in the File Transmission feature of Oracle Payments and enables unauthenticated attackers to gain control of affected systems through simple HTTP-based attacks. Oracle issued fixes during its May 2026 Critical Security Patch Update, emphasizing the urgency of applying these updates. Threat intelligence firm Defused confirmed that malicious actors have already begun exploiting this vulnerability, with no public proof-of-concept code currently available.
Splunk and Zoom have issued patches for multiple critical and high-severity vulnerabilities affecting their products. Splunk addressed three key issues—CVE-2026-20296, CVE-2026-20297, and CVE-2026-20298—in updated versions of Splunk Enterprise, while also fixing third-party component bugs like those in Golang and OpenSSL. Meanwhile, Zoom resolved four vulnerabilities, including the critical CVE-2026-53412, which could enable remote account takeovers. Both companies advise users to update immediately to secure their systems.
F5 has issued an urgent security update addressing eight vulnerabilities affecting its NGINX and BIG-IP products. Among them is CVE-2026-42533, a critical heap buffer overflow flaw with a CVSS score of 9.2 that could allow attackers to restart the NGINX worker process or execute code under specific conditions. The vulnerabilities span both open-source and enterprise offerings, including NGINX Plus, NGINX Open Source, and BIG-IP. These issues range from potential memory leaks and denial-of-service risks to unauthorized configuration changes. While no evidence of real-world exploitation was reported, users are strongly advised to apply the available patches immediately.
Researchers at ESET have identified nearly a dozen outdated UEFI shim bootloaders signed by Microsoft that could allow attackers to bypass Secure Boot protections. These shims, used to enable Linux distributions to boot securely, were not updated by some vendors and remained trusted despite known vulnerabilities. Microsoft revoked the affected shims on June 2026 Patch Tuesday, assigning them CVE identifiers CVE-2026-8863 and CVE-2026-10797. Attackers could exploit these flaws to execute malicious code during the boot process, undermining Secure Boot even when enabled.
Zoom has issued security updates addressing a critical vulnerability affecting its Windows-based products, which could have allowed attackers to take over user accounts remotely. The flaw, identified as CVE-2026-53412 with a CVSS score of 9.8, impacts the Zoom Desktop Client, Zoom VDI Client, and Zoom Meeting SDK for Windows. According to Zoom’s advisory, an unauthenticated attacker could exploit this issue through network access without prior authentication. In addition to this critical flaw, three other high-severity vulnerabilities were also resolved in the latest releases.
Trend Micro, Tanium, ESET, and Tenable have issued urgent security updates to address multiple severe flaws in their products. These include a critical path traversal vulnerability (CVE-2026-15265) in Tenable Agent that could enable remote code execution, a high-severity local privilege escalation in ESET's Inspect Connector for Windows, and a denial-of-service flaw in Tanium Server. Trend Micro also addressed a privilege escalation issue in Cleaner One Pro. While no active exploitation has been reported, these vulnerabilities underscore the importance of timely patching to prevent potential attacks.
New research reveals that financial support for open-source projects leads to increased development activity, including more commits and reported issues. The study focused on funded projects such as the Python Package Index and curl, showing a significant rise in contributions following maintenance contracts. However, the number of contributors remained largely unchanged, highlighting ongoing challenges in expanding maintainer bases. This insight offers guidance for organizations investing in open-source sustainability.
Zoom has issued security updates to fix a critical vulnerability that could allow unauthenticated attackers to take over user accounts. The flaw, tracked as CVE-2026-53412 with a severity score of 9.8, impacts several Windows-based products including older versions of Zoom Workplace, the VDI Client, and the Meeting SDK. Users are advised to update their software immediately to prevent potential exploitation. In addition to this high-profile issue, the latest patches also resolve three other high-severity flaws related to privilege escalation.
Two zero-day vulnerabilities in SonicWall SMA1000 Series devices—CVE-2026-15409 (CVSS 10.0) and CVE-2026-15410—are currently being actively exploited in attacks. The flaws allow unauthenticated attackers to create tunnels to internal services and escalate privileges to root. Rapid7’s MDR team detected real-world exploitation before official disclosure. Both issues are now listed in CISA’s KEV catalog. Affected versions include multiple firmware builds of models 6210, 7210, and 8200v. SonicWall has issued patches; users are urged to update immediately to prevent compromise.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent warning about actively exploited vulnerabilities in Microsoft SharePoint, including the zero-day flaw CVE-2026-56164. This privilege escalation bug allows unauthenticated attackers to execute malicious actions remotely and was recently patched by Microsoft. CISA added it to its Known Exploited Vulnerabilities catalog and urges organizations to apply updates immediately. Additional critical flaws like CVE-2026-55040 and CVE-2026-58644 were also addressed in recent security updates. These issues could lead to remote code execution and data theft if left unpatched.
A new research project demonstrates how AI can automate the discovery of exploitable vulnerabilities in production software. Using a custom pipeline combining code scanning and large language models, the team at Intruder identified a critical SQL injection flaw in the Creative Mail WordPress Plugin (CVE-2026-3985). The vulnerability allows unauthenticated attackers to extract sensitive data like admin hashes and secret tokens from vulnerable sites. The flaw was exploited using a multi-step attack chain that bypasses traditional detection methods. The plugin has been removed from the WordPress store pending a fix. Users should disable it immediately if running alongside WooCommerce.
Mozilla, Google, Adobe, and Broadcom have issued urgent security updates to resolve multiple high-risk flaws in their software. Mozilla fixed two critical issues in Firefox (CVE-2026-15718, CVE-2026-15719), noting that exploit code is publicly available but no active attacks have been reported. Google patched 15 vulnerabilities in Chrome, including two severe use-after-free bugs in Ozone (CVE-2026-15764, CVE-2026-15765). Adobe addressed 88 total vulnerabilities across several products, with eight critical flaws in ColdFusion alone. Broadcom resolved a critical authentication bypass issue in VMware Avi Load Balancer (CVE-2026-47865). While none of the flaws are currently being exploited, users are strongly advised to apply the patches immediately.
A security researcher known as Chaotic Eclipse has published a proof-of-concept (PoC) exploit for a new Windows elevation of privilege vulnerability dubbed LegacyHive. The flaw resides in the Windows User Profile Service and enables attackers to load arbitrary hive files, potentially escalating privileges. Notably, the exploit works across all supported desktop and server versions of Windows, even those updated with the July 2026 Patch Tuesday release. This follows ongoing tensions between the researcher and Microsoft over premature disclosures of other vulnerabilities.
Fortinet, Ivanti, and ServiceNow have issued patches for a total of 15 vulnerabilities affecting their products. Among them is a critical remote code execution flaw in ServiceNow's AI platform (CVE-2026-6875), which could be exploited without authentication. Ivanti addressed two issues in its Xtraction tool (CVE-2026-14902 and CVE-2026-14903), involving open redirect and path traversal risks. Fortinet published 11 advisories covering multiple products like FortiOS and FortiSandbox, fixing high-severity bugs that could lead to information disclosure and unauthorized access. None of the companies reported active exploitation of these flaws.
A critical vulnerability in the Cursor IDE allows attackers to execute arbitrary code on Windows systems by placing a malicious git.exe file in the root of a cloned repository. When opened, Cursor automatically executes this file without any user interaction or warnings, potentially leading to full system compromise. The flaw was reported to Cursor in December 2025 but remains unpatched as of July 2026. Multiple other vendors have faced similar issues, with some dismissing the risk entirely. Users are advised to use workarounds such as AppLocker rules or virtual machines until a fix is available.
Microsoft addressed over 570 vulnerabilities in its July 2026 Patch Tuesday update, including two actively exploited flaws—CVE-2026-56155 and CVE-2026-56164—and one previously disclosed issue, CVE-2026-50661. Among these, CVE-2026-56164 is a critical elevation of privilege vulnerability in SharePoint Server that allows remote exploitation with low complexity. Attackers are already leveraging this flaw, prompting urgent calls for patching. Microsoft also warned about another unpatched Windows EoP vulnerability, CVE-2026-56155, which affects ADFS and is being used in real-world attacks. CISA and other agencies have emphasized the need for rapid remediation and additional hardening measures.
