One story per event: coverage from every outlet, clustered by shared CVEs and signals.
On July 17, 2026, WordPress released version 7.0.2 patching a critical unauthenticated remote code execution vulnerability (CVE-2026-63030) and a related SQL injection flaw (CVE-2026-60137) in its REST API.
In mid‑July, a cyberattack targeted Nichirei, one of Japan’s largest frozen food producers, forcing the company to disconnect its IT systems and halting logistics and shipments. The attack disrupted the firm’s supply chain, affecting distribution of its products across the country.
A misconfigured web server with directory listing enabled left the tools and infrastructure of three threat actors publicly accessible, revealing their use of Evilginx to conduct adversary-in-the-middle phishing against Microsoft 365 accounts.
On 15 July 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2023-4346 affecting the KNX Association’s KNX Protocol Connection Authorization Option 1 and CVE-2026-46817 affecting Oracle’s E-Business Suite to its Known Exploited Vulnerabilities (KEV) catalogue, indicating ac
On July 16, 2026, Google released Chrome 150.0.7871.128/.129, which patches three critical use‑after‑free flaws in the CameraCapture, GPU and Network components.
Two members of the Scattered Spider cybercrime group, Thalha Jubair and Owen Flowers, were sentenced in a UK court to 5.5 years imprisonment for their role in a 2024 cyberattack on Transport for London that caused approximately £29 million in losses.
In July 2026, UK courts sentenced Owen Flowers and Thalha Jubair, members of the Scattered Spider group, to five and a half years imprisonment for their role in a 2024 cyberattack on Transport for London.
The ClickLock stealer targets macOS users, using fake system prompts and process killing to lock victims out of their machines until they enter a password, which is then exfiltrated along with cryptocurrency wallets.
Zoom released security updates for its Desktop Client for Windows addressing a critical flaw tracked as CVE-2026-53412 that could allow unauthenticated attackers to hijack user accounts.
Researchers at ESET identified eleven outdated Microsoft-signed UEFI shim bootloaders that can be abused to bypass Secure Boot on virtually any system, affecting both Windows and Linux devices.
A vulnerability in the Cursor AI IDE allows attackers to execute arbitrary code by placing a malicious git.exe file in the root of a repository that the IDE automatically runs.
A vulnerability in the Claude for Chrome extension allows malicious browser extensions to impersonate the Claude website and gain access to users' Gmail, Google Docs, and Calendar data.
ServiceNow patched a critical sandbox escape vulnerability (CVE-2026-6875) in its AI platform that could allow unauthenticated remote code execution. Fortinet and Ivanti also released security updates for multiple flaws in their respective products.
Progress Software confirmed that a previously unknown zero‑day vulnerability in its ShareFile product caused an outage affecting Storage Zone Controller customers. The company has issued a patch and is restoring access for those who apply the fix.
The ransomware group D1R posted on its Tor leak site that it had compromised Synopsys’ website and obtained a corporate client database, also claiming to have stolen data from Bosch, and threatened to release the information unless a ransom was paid.
Microsoft released its July 2026 Patch Tuesday update, addressing a record 622 CVEs across products such as SharePoint, Active Directory Federation Services, Hyper-V, RDP and BitLocker.
On July 13, the U.S. Treasury’s Office of Foreign Assets Control sanctioned the VPN provider 1VPNS and two individuals for allegedly facilitating ransomware attacks on critical infrastructure.
A use‑after‑free vulnerability in the Linux kernel’s epoll implementation, tracked as CVE-2026-46242, was disclosed with public proof‑of‑concept exploit code that enables any unprivileged local user to gain root privileges on affected Linux and Android systems.
Broadcom released patches for seven vulnerabilities in VMware Avi Load Balancer, including a critical authentication bypass (CVE-2026-47865) with a CVSS score of 9.8. The flaws could be exploited for authentication bypass, remote code execution, privilege escalation, and directory traversal.
CrashStealer is a newly discovered macOS infostealer identified by Jamf Threat Labs in early May It uses a signed application to bypass Gatekeeper, harvesting passwords, cryptocurrency wallets and other sensitive data before encrypting the stolen information with AES.
SAP released security patches for its NetWeaver platform addressing multiple memory corruption vulnerabilities, including a critical flaw (CVE-2026-44747) that could allow attackers to read, modify data and cause denial of service.
During an incident response on June 3, 2026, Huntress analysts discovered an AI-generated PowerShell script deployed on a compromised server to conduct Active Directory reconnaissance.
Russian state-sponsored APT groups are actively exploiting Cisco IOS flaws, including the CSRF vulnerability CVE-2008-4128 and CVE-2018-0171, to compromise routers in critical infrastructure networks.
Threat actor UNK_MassTraction, believed to be China‑aligned, has been exploiting vulnerabilities in Roundcube webmail (CVE‑2024‑42009 and CVE‑2025‑49113) to infiltrate university physics departments in the United States and Canada.
In April 2026, security researchers uncovered a large-scale malvertising operation that distributed the Vidar information stealer alongside the XMRig cryptocurrency miner.
Microsoft warned about GigaWiper, a modular Go-based backdoor for Windows that combines espionage and data-wiping capabilities. The malware has been observed in intrusions since at least 2024, allowing attackers remote access and destructive wiping of disks.
A contractor for the Cybersecurity and Infrastructure Security Agency posted dozens of internal credentials, including AWS GovCloud access keys, to a public GitHub repository where they remained exposed for approximately six months.
Chinese-linked threat actor UAT-7810 is expanding its Operational Relay Box (ORB) network by deploying new malware families such as LongLeash, DogLeash and JarLeash on SOHO routers from vendors like Ruckus and ASUS.
Progress Software identified a credible external security threat targeting ShareFile Storage Zone Controllers and instructed customers to immediately shut down the Windows servers running those controllers.
Researchers disclosed a critical remote code execution vulnerability in Veeam Backup & Replication that could be exploited by authenticated low‑privileged domain users to execute arbitrary code on backup servers.
A stored cross-site scripting (XSS) vulnerability was discovered in Zimbra's Classic Web Client, allowing attackers to execute arbitrary code when a malicious email is opened. The flaw could lead to account takeover without user interaction. Zimbra has released version 10.1.19 to patch the issue.
The Iran-linked Cavern Manticore APT deployed a modular command-and-control framework to infiltrate Israeli government agencies and IT service providers.
Threat actors have been actively exploiting unauthenticated remote code execution vulnerabilities in the Balbooa Forms and iCagenda Joomla extensions, allowing file upload and execution without authentication. The U.S.
Australian cyber authorities have issued an alert about a large‑scale exploitation campaign that targets vulnerabilities in popular content management systems such as WordPress and Joomla to install webshells on compromised sites.
An Armenian national, Karen Serobovich Vardanyan, was extradited from Ukraine to the United States and pleaded guilty to charges related to his involvement in Ryuk ransomware attacks targeting U.S. companies.
Armored Likho, a previously undocumented APT group, has been observed launching AI‑crafted phishing emails that deliver the BusySnake Stealer malware.
Angelo Martino, a former ransomware negotiator, was sentenced to 70 months in prison after pleading guilty to conspiring with the BlackCat/Alphv ransomware group to extort victims. The court found that he used his insider knowledge to assist the gang while betraying his clients.
The Gentlemen ransomware gang, operating under a ransomware‑as‑a‑service model, has infected approximately 580 organizations, with a focus on manufacturing firms. The group uses an affiliate network to distribute its malware and extort payments.
The Cybersecurity and Infrastructure Security Agency issued an advisory for three vulnerabilities in the Gardyn IoT Hub, including CVE-2026-13768, which permits unauthenticated remote code execution.
Researchers have demonstrated a technique called HalluSquatting that manipulates large language models into hallucinating malicious code packages, which are then fetched and executed by unsuspecting users or AI agents, enabling the creation of hidden botnets.
Microsoft released its June 2026 Patch Tuesday updates, fixing a record 208 vulnerabilities, including 38 critical flaws and several actively exploited zero-days such as CVE-2026-47291 in HTTP.sys and CVE-2026-41091.
Security researchers disclosed a missing authorization vulnerability (CVE-2026-13753) affecting HP Deskjet 2800 series printers that could allow unauthorized access to Wi‑Direct and SNMP functions.
Threat actors created hundreds of fake Go modules on GitHub, embedding loaders, stealers, RATs and cryptominers that were downloaded by developers and crypto‑currency users.
On July 8, Google released a Chrome 150 update that addressed 27 security vulnerabilities, including two critical use‑after‑free flaws. The update is available for desktop versions of Chrome and users are advised to install it promptly. No active exploitation of the flaws has been reported.
Researchers identified JadePuffer, an agentic AI‑powered ransomware that autonomously exploited a Langflow vulnerability (CVE-2025-3248) to steal credentials, move laterally, and encrypt data on a production database server.
Security researchers identified a new macOS infostealer dubbed PamStealer that is distributed as a fake version of the Maccy clipboard manager. The malware, written in Rust, targets Apple Silicon Macs and harvests credentials from browsers, password managers and other sources.
Microsoft released a security update that fixes the RoguePlanet elevation‑of‑privilege vulnerability in Windows Defender, tracked as CVE-2026-50656. The flaw allowed local attackers to gain SYSTEM privileges via a race condition in the Malware Protection Engine.
A new ransomware family called GodDamn, first observed in the wild on May 21, 2024, abuses a Microsoft‑co‑signed kernel driver named PoisonX to terminate security tools and facilitate encryption.
Palo Alto Networks released a security update addressing 13 vulnerabilities in its PAN-OS software, including a critical buffer overflow tracked as CVE-2026-0288.
Hackers exploited a zero‑day vulnerability in a third‑party system to gain unauthorized access to KDDI’s email platform serving multiple Japanese ISPs, compromising the personal data of roughly 12‑14 million users.