🚨 CISA KEV 1[−]
20 Jul KEVwp2shell (CVE-2026-63030, CVE-2026-60137): Frequently asked questions about remote code execution chain in WordPress CoreAn unauthenticated attacker can chain two WordPress Core vulnerabilities, CVE-2026-63030 and CVE-2026-60137, to achieve remote code execution against affected WordPress installations. Multiple security firms have confirmed active in-the-wild exploitation within days of public dis…TENABLE.COM
🐛 COMMON VULNERABILITIES AND EXPOSURES 85[−]
20 JulCritical NGINX Vulnerability Can Crash Workers and May Allow Remote Code ExecutionF5 has shipped fixes for a critical nginx flaw that lets a remote, unauthenticated attacker trigger a heap buffer overflow in the worker process with crafted HTTP requests. CVE-2026-42533 was patched on July 15 in nginx 1.30.4 (stable) and 1.31.3 (mainline), and in NGINX Plus 37.…THEHACKERNEWS.COM
20 Jul KEVWP2Shell WordPress Vulnerabilities Exploited in the WildExploitation of the new WordPress vulnerabilities tracked as CVE-2026-60137 and CVE-2026-63030 started soon after disclosure. The post WP2Shell WordPress Vulnerabilities Exploited in the Wild appeared first on SecurityWeek .SECURITYWEEK.COM
20 JulCVE-2026-63815 f2fs: bound i_inline_xattr_size for non-inline-xattr inodesInformation published.MSRC.MICROSOFT.COM
20 JulCVE-2026-53386 iio: adc: ti-ads1298: add bounds check to pga_settings indexInformation published.MSRC.MICROSOFT.COM
20 JulCVE-2026-63810 block: Avoid mounting the bdev pseudo-filesystem in userspaceInformation published.MSRC.MICROSOFT.COM
20 JulCVE-2026-53392 NFSv4/flexfiles: reject zero filehandle version countInformation published.MSRC.MICROSOFT.COM
20 JulCVE-2026-53374 drm/amdgpu: zero-initialize GART table on allocationInformation published.MSRC.MICROSOFT.COM
20 JulCVE-2026-53376 drm/amdkfd: Add upper bound check for num_of_nodesInformation published.MSRC.MICROSOFT.COM
20 JulCVE-2026-63806 KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned()Information published.MSRC.MICROSOFT.COM
20 JulCVE-2026-63833 ntfs3: reject direct userspace writes to reserved $LX* xattrsInformation published.MSRC.MICROSOFT.COM
20 JulCVE-2026-63826 fbdev: fix use-after-free in store_modes()Information published.MSRC.MICROSOFT.COM
20 JulCVE-2026-63829 net: ip_gre: require CAP_NET_ADMIN in the device netns for changelinkInformation published.MSRC.MICROSOFT.COM
20 JulCVE-2026-53375 drm/amdgpu/vce: Prevent partial address patchesInformation published.MSRC.MICROSOFT.COM
20 JulCVE-2026-53393 nfsd: reset write verifier on deferred writeback errorsInformation published.MSRC.MICROSOFT.COM
20 JulCVE-2026-63809 bpf: use kvfree() for replaced sysctl write bufferInformation published.MSRC.MICROSOFT.COM
20 JulCVE-2026-63803 hdlc_ppp: sync per-proto timers before freeing hdlc stateInformation published.MSRC.MICROSOFT.COM
20 JulCVE-2026-63834 batman-adv: tp_meter: restrict number of unacked list entriesInformation published.MSRC.MICROSOFT.COM
20 JulCVE-2026-53391 NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addrInformation published.MSRC.MICROSOFT.COM
20 JulCVE-2026-63822 wifi: ath11k: fix warning when unbindingInformation published.MSRC.MICROSOFT.COM
20 JulCVE-2026-53397 nfsd: fix posix_acl leak on SETACL decode failureInformation published.MSRC.MICROSOFT.COM
20 JulCVE-2026-63836 batman-adv: tp_meter: avoid divide-by-zero for dec_cwndInformation published.MSRC.MICROSOFT.COM
20 JulCVE-2026-63796 ocfs2: reject oversized group bitmap descriptorsInformation published.MSRC.MICROSOFT.COM
20 JulCVE-2026-63812 f2fs: fix incorrect FI_NO_EXTENT handling in __destroy_extent_node()Information published.MSRC.MICROSOFT.COM
20 JulCVE-2026-63801 tipc: fix slab-use-after-free Read in tipc_aead_decrypt_doneInformation published.MSRC.MICROSOFT.COM
20 JulCVE-2026-63828 apparmor: mediate the implicit connect of TCP fast open sendmsgInformation published.MSRC.MICROSOFT.COM
20 JulCVE-2026-53382 media: vidtv: fix NULL pointer dereference in vidtv_mux_push_siInformation published.MSRC.MICROSOFT.COM
20 JulCVE-2026-63795 9p: avoid putting oldfid in p9_client_walk() error pathInformation published.MSRC.MICROSOFT.COM
20 JulCVE-2026-63808 exfat: fix potential use-after-free in exfat_find_dir_entry()Information published.MSRC.MICROSOFT.COM
20 JulCVE-2026-45784 rust-openssl: Potential out-of-bounds write in `CipherCtxRef::cipher_update_inplace` for AES-KW-PAD ciphersInformation published.MSRC.MICROSOFT.COM
20 JulCVE-2026-62389 ws < 8.21.1 Default maxFragments Allows Memory Exhaustion DoSInformation published.MSRC.MICROSOFT.COM
20 JulCVE-2026-63805 crypto: nx - fix nx_crypto_ctx_exit argumentInformation published.MSRC.MICROSOFT.COM
20 JulCVE-2026-63816 f2fs: atomic: fix UAF issue on f2fs_inode_info.atomic_inodeInformation published.MSRC.MICROSOFT.COM
20 JulCVE-2026-63825 gcov: use atomic counter updates to fix concurrent access crashesInformation published.MSRC.MICROSOFT.COM
20 JulCVE-2026-63853 drm/amdgpu/vcn: set no_user_fence for VCN v4.0 enc ringInformation published.MSRC.MICROSOFT.COM
20 JulCVE-2026-53402 fbdev: fbcon: fix out-of-bounds read in err_out of fbcon_do_set_font()Information published.MSRC.MICROSOFT.COM
20 JulCVE-2026-63819 f2fs: fix to do sanity check on f2fs_get_node_folio_ra()Information published.MSRC.MICROSOFT.COM
20 JulCVE-2026-53401 fbdev: omap2: fix use-after-free in omapfb_mmapInformation published.MSRC.MICROSOFT.COM
20 JulCVE-2026-63811 f2fs: read COW data with the original inode during atomic writeInformation published.MSRC.MICROSOFT.COM
20 JulCVE-2026-53403 fbdev: Fix fb_new_modelist to prevent null-ptr-deref in fb_videomode_to_varInformation published.MSRC.MICROSOFT.COM
20 JulCVE-2026-53368 f2fs: fix fsck inconsistency caused by incorrect nat_entry flag usageInformation published.MSRC.MICROSOFT.COM
20 JulCVE-2026-53400 i2c: core: fix adapter registration raceInformation published.MSRC.MICROSOFT.COM
20 JulCVE-2026-63871 Bluetooth: ISO: Fix data-race on iso_pi fields in hci_get_route callsInformation published.MSRC.MICROSOFT.COM
20 JulCVE-2026-63872 esp: fix page frag reference leak on skb_to_sgvec failureInformation published.MSRC.MICROSOFT.COM
20 JulCVE-2026-53399 nfsd: release layout stid on setlease failureInformation published.MSRC.MICROSOFT.COM
20 JulCVE-2026-63858 netfilter: nf_tables: add hook transactions for device deletionsInformation published.MSRC.MICROSOFT.COM
20 JulCVE-2026-63818 f2fs: validate orphan inode entry countInformation published.MSRC.MICROSOFT.COM
20 JulCVE-2026-63832 wifi: mt76: add wcid publish check in mt76_sta_addInformation published.MSRC.MICROSOFT.COM
20 JulCVE-2026-53387 iio: light: veml6075: add bounds check to veml6075_it_ms indexInformation published.MSRC.MICROSOFT.COM
20 JulCVE-2026-63835 batman-adv: v: prevent OGM aggregation on disabled hardifInformation published.MSRC.MICROSOFT.COM
20 JulCVE-2026-63807 KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping levelInformation published.MSRC.MICROSOFT.COM
20 JulCVE-2026-53384 serial: 8250_dw: unregister 8250 port if clk_notifier_register() failsInformation published.MSRC.MICROSOFT.COM
20 JulCVE-2026-63830 net: skmsg: preserve sg.copy across SG transformsInformation published.MSRC.MICROSOFT.COM
20 JulCVE-2026-53388 fuse: re-lock request before replacing page cache folioInformation published.MSRC.MICROSOFT.COM
20 JulCVE-2026-63794 KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT pathInformation published.MSRC.MICROSOFT.COM
20 JulCVE-2026-63821 wifi: rtw88: usb: fix memory leaks on USB write failuresInformation published.MSRC.MICROSOFT.COM
20 JulCVE-2026-63824 KEYS: fix overflow in keyctl_pkey_params_get_2()Information published.MSRC.MICROSOFT.COM
20 JulCVE-2026-63798 irqchip/imgpdc: Fix resource leak, add missing chained handler cleanup on removeInformation published.MSRC.MICROSOFT.COM
20 JulCVE-2026-63823 keys: Pin request_key_auth payload in instantiate pathsInformation published.MSRC.MICROSOFT.COM
20 JulCVE-2026-63800 pNFS: Fix use-after-free in pnfs_update_layout()Information published.MSRC.MICROSOFT.COM
20 JulCVE-2026-63797 rpmsg: char: Fix use-after-free on probe error pathInformation published.MSRC.MICROSOFT.COM
20 JulCVE-2026-63817 f2fs: validate compress cache inode only when enabledInformation published.MSRC.MICROSOFT.COM
20 JulCVE-2026-63804 gfs2: fix use-after-free in gfs2_qd_deallocInformation published.MSRC.MICROSOFT.COM
20 JulCVE-2026-63831 mac802154: llsec: add skb_cow_data() before in-place cryptoInformation published.MSRC.MICROSOFT.COM
20 JulCVE-2026-63802 blk-cgroup: fix UAF in __blkcg_rstat_flush()Information published.MSRC.MICROSOFT.COM
20 JulCVE-2026-53385 vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_writeInformation published.MSRC.MICROSOFT.COM
20 JulCVE-2026-53390 ksmbd: fix out-of-bounds read in smb_check_perm_dacl()Information published.MSRC.MICROSOFT.COM
20 JulCVE-2026-63814 f2fs: validate ACL entry sizes in f2fs_acl_from_disk()Information published.MSRC.MICROSOFT.COM
20 JulCVE-2026-53383 ksmbd: reject non-VALID session in compound request branchInformation published.MSRC.MICROSOFT.COM
20 JulCVE-2026-53398 NFSD: Fix SECINFO_NO_NAME decode error cleanupInformation published.MSRC.MICROSOFT.COM
20 JulCVE-2026-63827 apparmor: fix use-after-free in rawdata dedup loopInformation published.MSRC.MICROSOFT.COM
20 JulNew 7-Zip Vulnerability Could Let Crafted XZ Archives Run Code During ExtractionOpening a crafted XZ archive in 7-Zip could let an attacker run code on the machine. The flaw, CVE-2026-14266, is a heap-based buffer overflow in how the archiver processes XZ chunked data, and Trend Micro's Zero Day Initiative (ZDI) detailed it on July 15. A fix shipped on June …THEHACKERNEWS.COM
20 JulCritical ServiceNow code execution flaw now exploited in attacksAttackers have begun exploiting a critical vulnerability (CVE-2026-6875) in the ServiceNow AI Platform, according to threat intelligence company Defused. [...]BLEEPINGCOMPUTER.COM
20 JulCVE-2026-42533: Critical NGINX Bug Could Turn HTTP Requests Into Server TakeoversF5 fixes critical nginx flaw CVE-2026-42533 that can crash servers and, in some cases, allow remote code execution through crafted HTTP requests. F5 released patches for a critical nginx vulnerability, tracked as CVE-2026-42533 (CVSS score of 9.2), that can allow an unauthenticat…SECURITYAFFAIRS.COM
20 JulFrom a Single Alert to 1,000 Files: Inside an Exposed WebDAV Malware Delivery LabExecutive summary An MDR alert recently led our team to an exposed server that was doing more than hosting payloads. It was functioning as a fully operational malware delivery lab. Containing over 1,000 artifacts, the infrastructure served as a QA hub where attackers systematical…RAPID7.COM
20 JulSonicWall Zero-Days Exploited to Deliver Custom Malware for Weeks Before PatchThe zero-days CVE-2026-15409 and CVE-2026-15410 were exploited by a threat actor tracked by Volexity as UTA0533. The post SonicWall Zero-Days Exploited to Deliver Custom Malware for Weeks Before Patch appeared first on SecurityWeek .SECURITYWEEK.COM
20 Jul KEVServiceNow pre-auth RCE exploited in the wild (CVE-2026-6875)Attackers have begun exploiting CVE-2026-6875, a critical pre-authentication vulnerability in the ServiceNow AI Platform, according to threat intelligence firm Defused. About the vulnerability ServiceNow AI is a Platform-as-a-Service that lets organizations build and automate dig…HELPNETSECURITY.COM
20 JulCVE-2026-50650 .NET Framework Elevation of Privilege VulnerabilityUpdated product information in the Software Update table. This is an informational change only.MSRC.MICROSOFT.COM
20 JulExploitation in the Wild of wp2shellWiz Research has identified exploitation of "wp2shell", a critical pre-auth RCE vulnerability chain impacting WordPress Core (CVE-2026-63030 & CVE-2026-60137). Attackers are deploying persistent webshells on vulnerable servers. Organizations should prioritize patching or applying…WIZ.IO
20 JulWordPress Exploitation Underway (CVE-2026-63030), (Mon, Jul 20th)Last week, Searchlight Cyber released details about a vulnerability they are calling "wp2shell". The vulnerability was initially announced without a CVE number. But now has been assigned CVE-2026-63030. Many WordPress plugin vulnerabilities are never assigned CVE numbers. But wp2…ISC.SANS.EDU
20 JulCVE-2024-44000 (LiteSpeed Cache Account Takeover) Ranks in June’s Top ThreatsSensor Intel Series: July 2026 CVE TrendsF5.COM
20 Jul KEVServiceNow’s sandbox escape RCE hole now exploited in the wildA sandbox security hole that could lead to remote code execution (RCE), patched last week by ServiceNow, is being actively exploited in the wild, according to a report from threat intel firm Defused . The report, posted on X, said the firm is “observing in-the-wild exploitation o…CSOONLINE.COM
20 Jul'WP2Shell' Opens Millions of WordPress Sites to Remote TakeoverBarely three days after disclosure, attackers are widely chaining together CVE-2026-60137 and CVE-2026-63030 to lob exploit attempts against one of the largest attack surfaces on the Internet.DARKREADING.COM
⚠️ VULNERABILITY DISCLOSURE 38[−]
20 JulWordpress RCE, New Windows 0-day and Coca-Cola's Fairline ransomedNew Windows zero-day, Coca-Cola's Fairlife hit by ransomware, and a core WordPress RCE David Shipley covers a new Windows zero-day disclosure from "Nightmare Eclipse" called LegacyHive, a local privilege escalation flaw in the Windows User Profile Service that could be weaponized…CYBERSECURITYTODAY.LIBSYN.COM
20 JulNearly half of open-source AI projects never reach productionOpen models are moving into production across more organizations, and the work of securing those deployments increasingly extends beyond the model weights. Mozilla’s The State of Open Source AI 2026 identifies deployment, governance and operational tooling as persistent obstacles…HELPNETSECURITY.COM
20 JulWorld's Largest AI Model Repository Hugging Face Breached by Autonomous AI AgentIn an ironic twist, open-source artificial intelligence (AI) platform Hugging Face revealed that it was the victim of a hack perpetrated by an autonomous AI agent system. The company said it detected and responded to the incident targeting its production infrastructure earlier la…THEHACKERNEWS.COM
20 JulMeet Dusseldorf, Microsoft’s open-source out-of-band security platformOut-of-band vulnerabilities surface when an application quietly reaches out to an external system during an attack, and capturing that traffic calls for infrastructure that many researchers assemble on their own. A new open-source project from Microsoft supplies that infrastructu…HELPNETSECURITY.COM
20 JulRisky Bulletin: Hacker wipes Romania's entire land registry databaseA hacker wipes Romania’s entire land registry database, Magnet Forensics sues a former employee for leaking an iPhone exploit, an autonomous AI agent hacked Hugging Face, and an unauthenticated remote code execution bug was finally found in WordPress.RISKY.BIZ
20 JulSOCs face a human challenge as AI speeds alerts and threatsSecurity operations centers (SOCs) have spent years struggling under the weight of growing alert volumes, expanding attack surfaces, and chronic staffing shortages. Now artificial intelligence is adding a new complication: not just more information, but more machine-generated inf…CSOONLINE.COM
20 Jul KEVClaude Mythos FAQ: Capabilities, access, competitors, implications1. What is Claude Mythos? Claude Mythos is an advanced AI model developed by Anthropic and is optimized for cybersecurity and healthcare applications. Mythos 5 was originally released in April to a small group of vetted technology partners ahead of a planned wider rollout. Anthro…CSOONLINE.COM
20 JulHow agentic endpoint security shuts down IDE-based supply chain attacksAttention shifts from EDR to Agentic Endpoint Security to close visibility gaps that AI can exploit.CYBERSECURITYDIVE.COM
20 JulChrome 150 Update Patches Severe Memory Safety BugsThe fresh security update resolves six critical and high-severity use-after-free vulnerabilities. The post Chrome 150 Update Patches Severe Memory Safety Bugs appeared first on SecurityWeek .SECURITYWEEK.COM
20 JulThe Windows 10 hangover is becoming a security problemWindows 11 now runs on 78.8% of Windows devices after Microsoft ended support for Windows 10 on 14 October 2025, according to Lansweeper. Windows 10 still accounts for 16.9% of devices and no longer receives security updates, leaving newly discovered vulnerabilities unpatched. “T…HELPNETSECURITY.COM
20 JulAI Agents Turned Into Attackers: Hugging Face Reveals Autonomous Intrusion CampaignHugging Face says an autonomous AI agent breached part of its production infrastructure and accessed internal data and service credentials. Hugging Face is one of the world’s leading open-source AI companies. It provides a platform where developers and organizations can bui…SECURITYAFFAIRS.COM
20 JulVolexity Uncovers Zero-Day Campaign Targeting SonicWall VPN AppliancesUnknown hackers exploited two SonicWall SMA 1000 zero-days to gain root access on VPN appliances before patches became available. Volexity published its findings after conducting an incident response investigation involving a compromised organization whose SonicWall SMA 1000 seri…SECURITYAFFAIRS.COM
20 JulRussian-Speaking Hacker Uses Google Gemini CLI to Control Botnet of Eight Dental Clinic PCsA solo Russian-speaking threat actor known as "bandcampro" outsourced a chunk of their operations to Google's open-source Gemini CLI artificial intelligence (AI) and commandeered a live botnet. The findings come from an analysis of 200 Gemini CLI session logs between March 19 and…THEHACKERNEWS.COM
20 JulAI Security at Scale, CMMC phase II paused, and the Weekly Enterprise News - ESW #468Interview with Keith Hollender, CEO and Co-Founder of Arcova Why AI Security Is Becoming an Execution Problem, Not Just a Governance Problem As enterprises move from AI experimentation to adoption at scale, security leaders are under pressure to enable innovation without introduc…YOUTUBE.COM
20 JulEstée Lauder discloses data breach tied to Oracle E-Business Suite attacksThe Estée Lauder Companies is notifying current and former employees that their personal information was stolen after attackers compromised the company's Oracle E-Business Suite (EBS) human resources environment in August 2025. The intrusion is linked to the wider Oracle EBS expl…CYBERINSIDER.COM
20 JulCapital One Open Sources AI-Powered ‘VulnHunter’ Security ToolThe agentic security tool identifies potentially exploitable code flaws, traces attack paths, and recommends targeted remediations. The post Capital One Open Sources AI-Powered ‘VulnHunter’ Security Tool appeared first on SecurityWeek .SECURITYWEEK.COM
20 JulHugging Face breached by autonomous AI agentHugging Face, the widely used platform for sharing open-source machine learning models and datasets, has disclosed a security breach it says was carried out by an autonomous AI agent system. How the attack unfolded In a blog post published Thursday (July 16), the company said tha…HELPNETSECURITY.COM
20 JulNew ACR Stealer campaigns use WebDAV, MSHTA to evade detectionMicrosoft has issued a warning about a recent surge in ACR Stealer activity that uses ClickFix-style social engineering to steal credentials, browser data, and sensitive business documents. In a new report, Microsoft researchers detailed two separate campaigns observed between la…CSOONLINE.COM
20 JulHugging Face discloses breach linked to autonomous AI agentThe Hugging Face artificial intelligence repository disclosed that attackers gained access to internal datasets and credentials after breaching its production infrastructure using an autonomous AI agent system. [...]BLEEPINGCOMPUTER.COM
20 JulNew Index Tracks Material Breaches — And Refuses to Add Up the LossesLongtime cybersecurity executive Richard Bird built the resource for security experts, journalists, policymakers, and everyday citizens. The post New Index Tracks Material Breaches — And Refuses to Add Up the Losses appeared first on SecurityWeek .SECURITYWEEK.COM
20 JulCritical 7-Zip Flaw Allows Code Execution by Opening Crafted XZ-Compressed Files. Update it now!7-Zip fixed a vulnerability that could let attackers run code by tricking users into opening malicious XZ-compressed archive files. 7-Zip released version 26.02 to address a remote code execution vulnerability in its handling of XZ-compressed data. The flaw, discovered by researc…SECURITYAFFAIRS.COM
20 JulPatch now: WordPress REST API bug allows remote code executionOrganizations running recent versions of WordPress are being asked to patch a newly detailed pre-authentication remote code execution (RCE) vulnerability affecting the platform’s built-in REST Batch API. The flaw, dubbed wp2shell, enables attackers to execute arbitrary code again…CSOONLINE.COM
20 Jul20th July – Threat Intelligence ReportFor the latest discoveries in cyber research for the week of 20th July, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES Ernst & Young, a global accounting and professional services company, has disclosed a data breach involving a compromised third-p…RESEARCH.CHECKPOINT.COM
20 JulOpenSSL Silently Fixes ‘HollowByte’ DoS VulnerabilityAttackers could send waves of malicious payloads to trigger buffer pre-allocations that are not freed, exhausting server memory. The post OpenSSL Silently Fixes ‘HollowByte’ DoS Vulnerability appeared first on SecurityWeek .SECURITYWEEK.COM
20 JulBroken Promises of Anonymity: Four Months Later, Still No Transparency. Now We’re Seeking Accountability.On March 18, 2026, Navigate360 learned that 8.3 million anonymous tips had been exposed. The company’s response—and the silence of the programs that depend on its platform—has persisted for months. We’re now seeking accountability through state and federal regulators.…DATABREACHES.NET
20 Jul⚡ Weekly Recap: WordPress RCE, SonicWall 0-Days, AI Service Attacks, SharePoint 0-Day and MoreA single request should not be able to do this much. But this week, small inputs led to code execution, memory loss, stolen keys, and disabled security tools. The paths were often simple: exposed systems, weak checks, old drivers, fake prompts, and public code used for malware de…THEHACKERNEWS.COM
20 JulResearchers Build WordPress Exploit Using OpenAI's GPTA researcher who discovered a critical vulnerability in WordPress has used OpenAI’s latest model to develop an exploit chainINFOSECURITY-MAGAZINE.COM
20 JulItaly fines WINDTRE €1.7 million over security flaws behind two data breachesItaly’s data protection authority, the Garante per la Protezione dei Dati Personali, fined WINDTRE €1.7 million over “serious data security shortcomings” that let hackers breach its systems twice and exfiltrate personal data belonging to more than 365,000 custom…HELPNETSECURITY.COM
20 JulAI adoption and business acceleration are changing the expectations of technology risk managementAs AI becomes embedded in customer experiences, internal workflows, and throughout the supply chain, security leaders are being asked to do more than manage risk. They are being asked to help the business make more informed decisions and move faster. At the same time, AI has evol…CSOONLINE.COM
20 JulHackers are exploiting recently patched WordPress bugs, putting millions of websites at riskTwo critical security flaws in WordPress’ software have given hackers the chance to remotely take over tens of millions of websites, according to an estimate by a cybersecurity researcher.TECHCRUNCH.COM
20 JulResearchers trace SonicWall SMA1000 exploitation to late JuneMultiple threat actors, including INC ransomware, have targeted vulnerable firewall systems.CYBERSECURITYDIVE.COM
20 JulAI helped uncover WordPress ‘wp2shell’ RCE now exploited in attacksThe critical WordPress vulnerability chain known as “wp2shell” was discovered with substantial assistance from an AI model, which identified both the initial pre-authentication SQL injection and a complex path to remote code execution. Patchstack now says attackers are actively e…CYBERINSIDER.COM
20 JulMillions of Shark robot vacuums vulnerable to remote code executionMillions of internet-connected Shark robot vacuums may be vulnerable to a critical remote code execution (RCE) flaw that could allow attackers to take over devices, access onboard cameras, and retrieve sensitive data stored on the robots. Independent security researcher ‘to…CYBERINSIDER.COM
20 JulDirector of Commerce AI standards office out after three monthsThe Center for AI Standards and Innovation has quietly become a key hub for the federal government to assess potential threats and harms that AI systems pose. The post Director of Commerce AI standards office out after three months appeared first on CyberScoop .CYBERSCOOP.COM
20 JulMore AI Bugs, Less Security?AI is exceptionally good at identifying code patterns that lead to crashes and other common programming mistakes. That capability can dramatically increase the number of reported bugs. Finding more bugs doesn't necessarily reduce real-world cyber risk. If the proportion of high-i…YOUTUBE.COM
20 JulBehind the friendly face.Hugging Face reports an autonomous AI-powered breach. Ernst & Young discloses a client data breach. Attackers are actively exploiting a critical ServiceNow flaw. Ransomware gangs sharpen their tactics against law firms. Capital One open-sources an AI security tool. Text salting f…THECYBERWIRE.COM
20 JulEstée Lauder discloses data breach via Oracle E-Business flawCosmetics giant Estée Lauder is notifying customers of a data breach after hackers exploited a flaw in Oracle E-Business Suite that the company used for human resources (HR) operations. [...]BLEEPINGCOMPUTER.COM
20 JulSonicWall SMA1000 flaws exploited as zero-days to push custom malwareTwo recently disclosed SonicWall SMA1000 vulnerabilities were exploited in zero-day attacks for weeks, allowing threat actors to install custom malware on vulnerable VPN appliances. [...]BLEEPINGCOMPUTER.COM
📋 SECURITY BULLETINS 1[−]
20 JulWindows KB5121767 OOB update fixes shutdowns on some Dell PCsMicrosoft has released emergency updates to fix a known issue causing some Dell PCs to shut down after installing the July 2026 Windows 11 security updates. [...]BLEEPINGCOMPUTER.COM
📢 SECURITY ADVISORIES 13[−]
20 JulRussian Intelligence Hacks IP Cameras to Spy on Military Logistics Across NATO States and UkraineAt least one Russian intelligence service is systematically hijacking internet-connected security cameras across Europe and Ukraine, using the feeds to watch military transport routes, weapons shipments bound for Kyiv, and the locations of Ukrainian troops. That is the finding of…THEHACKERNEWS.COM
20 JulBanning AI Won't Stop ItHighly regulated industries have often been slower to adopt AI because regulations and risk concerns create uncertainty. But organizations are increasingly realizing they can't delay forever. Cybersecurity and risk teams are shifting from acting solely as gatekeepers to becoming …YOUTUBE.COM
20 JulDutch Intelligence Warns Russia Uses Hacked IP Cameras for Military EspionageDutch intelligence says Russia hacks IP cameras to monitor NATO military logistics and weapons shipments to Ukraine. The Netherlands’ AIVD and MIVD, the civilian and military intelligence services, published a joint advisory on July 10 confirming that at least one Russian i…SECURITYAFFAIRS.COM
20 JulHackers were inside South Korea's diplomat training system for 9 monthsUnidentified hackers compromised an online education system used by South Korea's diplomatic academy, stealing personal information belonging to former and current employees of the country's Ministry of Foreign Affairs.THERECORD.MEDIA
🔥 INCIDENT REPORTING 16[−]
20 JulMore alerts are making your team slower, and an outcome-based SOC fixes thatIn this Help Net Security video, Thom Langford, EMEA CTO, Rapid7, explains why piling on more security alerts makes a SOC slower to respond. Attackers log in with stolen credentials and use trusted tools like PowerShell instead of custom malware. He shares a case where attackers …HELPNETSECURITY.COM
20 JulHugging Face Hacked in Autonomous AI AttackTargeting production infrastructure, the attack compromised internal datasets and service credentials. The post Hugging Face Hacked in Autonomous AI Attack appeared first on SecurityWeek .SECURITYWEEK.COM
20 JulErnst & Young Data Breach Affects Personal, Financial InformationHackers stole names, addresses, Social Security numbers, credit/debit card numbers, and other information from a third-party management platform. The post Ernst & Young Data Breach Affects Personal, Financial Information appeared first on SecurityWeek .SECURITYWEEK.COM
20 JulHugging Face confirms breach affected internal datasets and credentials, urges users to take actionHugging Face is urging users to rotate any access tokens stored on the platform and review account activity.TECHCRUNCH.COM
20 JulSoftware provider to more than 2,000 US hospitals says hackers stole employee and customer dataCraneware, which is headquartered in Edinburgh and listed on London's AIM market, told investors it detected unauthorized access to a “subset” of its data environment and has since brought in outside forensic investigators.THERECORD.MEDIA
20 JulJadePuffer Returns With Ransomware Designed to Wipe AI ModelsJadePuffer follow-up campaign deployed ENCFORGE locker built to destroy AI model artifactsINFOSECURITY-MAGAZINE.COM
20 JulHackers stole ‘significant’ amount of data from tech firm relied on by thousands of US hospitals and pharmaciesEdinburgh-based tech firm Craneware said customer data was stolen during a cyberattack. The company makes software that thousands of U.S. hospitals, pharmacies, and clinics rely on for billing patients, potentially exposing health data.TECHCRUNCH.COM
20 JulHealthcare giant Abbott probes two cyber incidents amid extortion claimsExtortion groups ShinyHunters and ShadowByt3$ claim they stole vast amounts of patient data. Those allegations have not been verified.MALWAREBYTES.COM
20 JulRomania races to restore land registry after cyberattack disrupts property marketRomania's land registry agency is still recovering from a cyberattack it called "the most serious technical incident in the institution's history."THERECORD.MEDIA
20 JulPaidwork breach exposes sensitive data of 23 million userData belonging to more than 23 million users has been exposed following a breach at Paidwork, a platform that pays people for completing online microtasks. Paidwork markets itself as a way to earn money through simple tasks like watching ads, testing apps, and completing surveys,…HELPNETSECURITY.COM
20 JulHollowGraph Malware Hides C2 and Stolen Files in Microsoft 365 Events Dated 2050A newly discovered espionage implant has been using a hijacked Microsoft 365 calendar as its command channel, planting operator instructions and smuggling out stolen files as attachments on calendar events dated to the year 2050. Group-IB, which named the malware HollowGraph, say…THEHACKERNEWS.COM
20 JulHugging Face discloses an autonomous agentic breach.Abbott Laboratories investigates another alleged breach. FBI arrests a Florida man accused of spreading malware through video games.THECYBERWIRE.COM
20 JulHackers steal customer data from major hospital software vendorThe breach is another reminder of how vulnerable the healthcare industry is to supply-chain attacks.CYBERSECURITYDIVE.COM
20 JulNew HollowGraph malware uses Microsoft Graph for stealthy C2 commsA malicious component dubbed HollowGraph uses the calendar feature in compromised Microsoft 365 mailboxes as a command-and-control channel to receive attacker commands and exfiltrate stolen data. [...]BLEEPINGCOMPUTER.COM
20 JulSuno - 55,282,226 breached accountsIn November 2025, AI music generation tool Suno suffered a data breach that later came to light in July the following year . The data contained over 55M unique email addresses. Phone numbers were also present where they had been used as the sign-up method. Although representing a…HAVEIBEENPWNED.COM
20 JulJadePuffer agentic attacks now target AI model data with ransomwareThe JadePuffer autonomous AI agent has upgraded with custom malware called EncForge that focuses on encrypting AI assets, such as training datasets, vector databases, and model checkpoints. [...]BLEEPINGCOMPUTER.COM
🕵️ THREAT INTELLIGENCE 8[−]
20 JulISC Stormcast For Monday, July 20th, 2026 https://isc.sans.edu/podcastdetail/10014, (Mon, Jul 20th)(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.ISC.SANS.EDU
20 JulA forensic tool for backdoored code completions in AI assistantsDevelopers lean on AI coding assistants for a growing share of their daily work, letting the tools predict the next few lines and accepting many suggestions with a quick glance. Those tools learn from large collections of code, and some of that code can be tampered with before tr…HELPNETSECURITY.COM
20 JulProduct showcase: ZoneAlarm Mobile Security adds customizable content filtering to mobile securityZoneAlarm Mobile Security is a security app from Check Point designed to protect mobile devices against phishing, malicious websites, unsafe networks, and fraudulent links. It is available for iPhone, iPad, Android, and can run on Apple silicon Macs through the App Store. Getting…HELPNETSECURITY.COM
20 JulOn Flock License Plate Tracking CamerasA recent story of a writer who was mistakenly identified, tracked, and arrested using data from Flock cameras has gone viral. The New Jersey plates that were allegedly stolen from the LA dealer were 34 03 DTM , not 34 10 DTM . But when the police report was created and the plate …SCHNEIER.COM
20 JulWhy blocking AI models won’t stop the cyber threats they createAI companies can find vulnerabilities and write patches. But only the government can build the long-term defense strategy America needs. The post Why blocking AI models won’t stop the cyber threats they create appeared first on CyberScoop .CYBERSCOOP.COM
20 JulNeo Emerges From Stealth With $100M to Control and Secure Enterprise AI SoftwareNeo raised money across seed and Series A funding rounds from Andreessen Horowitz, Bessemer Venture Partners, and others. The post Neo Emerges From Stealth With $100M to Control and Secure Enterprise AI Software appeared first on SecurityWeek .SECURITYWEEK.COM
20 JulHOLLOWGRAPH malware turns Microsoft 365 calendars into an espionage channelMicrosoft 365 calendars have become a hiding place for espionage malware, with commands and stolen files stashed inside appointments dated to the year 2050, researchers from Group-IB discovered. Targeted campaign tied to Iranian espionage activity The malware, which Group-IB call…HELPNETSECURITY.COM
20 JulThe Odyssey piracy scams surface hours after its theatrical debutChristopher Nolan’s The Odyssey had barely reached theaters before scammers began targeting people searching for pirated copies, according to Malwarebytes. Within hours of the film’s release, researchers found two separate scams running on cloned piracy sites: fake br…HELPNETSECURITY.COM
🌐 CYBER THREAT LANDSCAPE 8[−]
20 JulSleeperGem Uses Three Malicious RubyGems Packages to Target Developer MachinesCybersecurity researchers have flagged a new software supply chain attack codenamed SleeperGem targeting the Ruby ecosystem after three malicious gems were published to RubyGems with the end goal of serving additional payloads. The rogue gems are listed below - git_credential_man…THEHACKERNEWS.COM
20 JulA week in security (July 13 – July 19)A list of topics we covered in the week of July 13 to July 19 of 2026MALWAREBYTES.COM
20 JulFake games spread stealers with RenPy Loader, MSBuild and EtherHidingWe look into how attackers are using the legitimate Ren'Py game engine to spread a malware loader that ultimately delivers Amatera Stealer.MALWAREBYTES.COM
20 JulNew HollowGraph Malware Hijacks Microsoft 365 Calendars for Covert C2 CommunicationsResearchers have linked HollowGraph malware to the Cavern framework after discovering its use of Microsoft 365 calendars and Microsoft Graph APIs as a stealthy C2 channelINFOSECURITY-MAGAZINE.COM
20 JulOdyssey piracy scams appear within hours of the movie’s releaseThe release of The Odyssey has already sparked a wave of piracy scams, from fake browser errors to malware masquerading as movie files.MALWAREBYTES.COM
20 JulExposed Server Reveals AI-Assisted Phishing Toolkit Behind WebDAV Malware CampaignA malware operator left its delivery server wide open, and Rapid7 pulled down the whole toolkit: 1,048 files spanning lure templates, filename-spoofing tests, execution experiments, droppers, builder notes, and two campaign chains. One was already live against Windows users in Me…THEHACKERNEWS.COM
20 JulAttackers Combo Up Evasion Tactics for BEC Phishing"The TFF Trap" uses fileless techniques and loaders with low detection rates to deploy various RATs and stealers, including Agent Tesla, Remcos, XWorm, and Best Private Logger.DARKREADING.COM
20 JulFakeGit Campaign Uses 7,600 GitHub Repositories to Spread SmartLoader MalwareCybersecurity researchers have discovered nearly 7,600 malicious GitHub repositories, out of which more than 800 pose as artificial intelligence (AI) skills or Model Context Protocol (MCP) servers to deliver a malware family known as SmartLoader as part of an ongoing campaign cod…THEHACKERNEWS.COM
🎙️ PODCASTS 1[−]
20 JulSponsored: Thinkst on building companies that don’t suckIn this Risky Business sponsor interview Casey Ellis chats with Haroon Meer from Thinkst about building companies customers don’t hate. Haroon explains why Thinkst still offers Canary tokens for free and why it has avoided annual price hikes on its paid products. They talk about …RISKY.BIZ
📡 INFOSEC NEWS 20[−]
20 JulYour attack surface is bigger than you thinkNew data reveals where attack surfaces are hiding the most risk.CYBERSECURITYDIVE.COM
20 JulThe secret problem in AI infrastructure: Why MCP security starts with secretsAI changes how infrastructure is accessed. Here's what to secure.CYBERSECURITYDIVE.COM
20 JulThe ACLU Is Arming Lawyers to Expose State Surveillance SecretsA new toolkit for attorneys in Massachusetts targets the technologies police use—and conceal—to build criminal cases, from facial recognition to AI-written police reports.WIRED.COM
20 JulApps Marketed to US Troops Are Shipping Chinese and Russian CodeA first-of-its-kind analysis found more than one in eight apps built for US service members carried foreign code—some from firms in nations the Pentagon designates as adversaries.WIRED.COM
20 JulPolice Chiefs Cite TfL Hack in Push for Cybercrime Risk OrdersTwo chiefs of UK policing agencies said the Transport for London prosecution demonstrates the need for Cybercrime Risk OrdersINFOSECURITY-MAGAZINE.COM
20 JulMicrosoft confirms Windows Server Update Services sync delaysMicrosoft is working to fix a known issue affecting Windows Server Update Services (WSUS) servers, which has caused synchronization problems for more than a week. [...]BLEEPINGCOMPUTER.COM
20 JulMythos Didn't Break Your Security Program. Your Exposure Window Could.The industry spent the initial months after Anthropic's April 7 Mythos reveal focused on volume. How many new CVEs would Mythos add to an already overloaded pipeline? How quickly would the flood of AI-driven discovery overwhelm triage capabilities? How long would it take adversar…THEHACKERNEWS.COM
20 JulCybersecurity Keeps Events 'Uneventful'From the World Cup to the United States' 250th celebration, this year's event calendar has been packed with high-profile gatherings that drew global audiences, intense scrutiny, and enormous security demands.DARKREADING.COM
20 JulWatch Flock Safety CEO Garrett Langley discuss the future of surveillance at TechCrunch Disrupt 2026Flock Safety sits right at the center of the debate over where the line should be drawn between privacy and public safety. That’s why we’re bringing Flock’s founder and CEO Garrett Langley to the stage to speak about those very issues.TECHCRUNCH.COM
20 JulCruciferra Crypter Uses Process Ghosting to Evade DetectionCruciferra crypter used process ghosting and 90 custom ciphers to hide payloads for multiple actorsINFOSECURITY-MAGAZINE.COM
20 JulAn AI SOC Evaluation Guide for Security LeadersChoosing an AI SOC platform requires understanding how it will perform in your own environment, not just during an evaluation. Prophet Security shares a practical framework for assessing AI SOC solutions, including how to validate accuracy, operating models, long-term reliability…BLEEPINGCOMPUTER.COM
20 Jul2026 ISO and CSA STAR certificates are now available with two additional servicesAmazon Web Services (AWS) successfully completed an onboarding audit with no findings for ISO 9001:2015, 27001:2022, 27017:2015, 27018:2019, 27701:2019, 20000-1:2018, and 22301:2019, and Cloud Security Alliance (CSA) STAR Cloud Controls Matrix (CCM) v4.0. EY Certify Point auditor…AWS.AMAZON.COM
20 JulMore than 1,000 domains illegally streaming World Cup games seized, DOJ saysOver the course of the World Cup tournament, the Department of Justice seized more than 1,000 domains for illegally streaming games.THERECORD.MEDIA
20 JulIndia says allegedly leaked nuclear plant files pose no safety riskDocuments that the World Leaks cybercrime group claimed to leak from the Kudankulam Nuclear Power Plant do not contain information pertaining to safety or security, Indian officials said.THERECORD.MEDIA
20 JulCISOs Feel the Heat Over AI RiskJob pressures have increased as companies run headlong into AI adoption, causing 26% of top security executives to consider leaving their position.DARKREADING.COM
20 JulFlock Safety kills acoustic system designed to detect 'human distress'"Community consultation" is one of the reasons automated license plate reader (ALPR) company Flock Safety cited in its decision to drop voice-oriented tech from a gunshot detection system.THERECORD.MEDIA
20 JulRemediating Vulnerabilities With LLMs: Inside Ivanti's Automation PushIvanti CSO Daniel Spicer says frontier models have shown surprising effectiveness in early stages; but cost and human-in-the-loop viability remain open questions.DARKREADING.COM
20 JulIntroducing the Amazon GuardDuty investigation agent: on-demand AI-powered threat assessmentThe new Amazon GuardDuty investigation agent (now in public preview) investigates security findings across your Amazon Web Services (AWS) environment, reducing investigation time from hours to minutes. GuardDuty is our managed threat detection service that continuously monitors y…AWS.AMAZON.COM
20 JulCursor, Codex, Gemini CLI, Antigravity hit by sandbox escapesResearchers escaped the sandboxes in Cursor, Codex, Gemini CLI and Antigravity by having the AI agent write files that trusted host tools later run. Multiple CVEs, patches, and Google downgrading two Antigravity findings. [...]BLEEPINGCOMPUTER.COM
20 JulHackers steal $23.7 million in crypto from Ostium in off-chain attackThe Ostium trading platform announced that an attacker stole $23.75 million from its liquidity provider vault last week, after compromising off-chain infrastructure used to feed prices into the protocol. [...]BLEEPINGCOMPUTER.COM