July 19, 2026 weekly
The Week Proof-of-Concept Became Mass Exploitation Overnight
SonicWall SMA1000 and WordPress core suffered pre-auth RCEs that moved from proof-of-concept to mass exploitation within hours, with the first attributed to Inc ransomware and UTA0533. Call-stack spoofing techniques defeating Intel CET shipped in commercial C2 frameworks like Nighthawk 1.0 and UnwindRaven, closing a defensive gap. Kimi K3, an open-weight frontier model, was jailbroken within hours of release to generate malware and CBRN detail despite guardrails. Finland's Supo confirmed a multi-year FSB Center 16 campaign targeting critical infrastructure via exposed SNMP and Cisco Smart Install devices.