August 2, 2026
Coldcard hardware wallets suffer $88M+ in cryptocurrency theft across three attack waves exploiting weak entropy in address generation. Microsoft attributes a Russian SVR campaign (Midnight Blizzard) to hotel Wi-Fi hijacking and device-code OAuth phishing targeting M365 accounts. DeepSeek's new V4 Flash model is trivially jailbroken with researchers bypassing multiple refusal classes via single prompts. Critical vulnerabilities in macOS Screen Sharing, Joomla Content Editor (CVE-2026-48907), and Ruby on Rails Active Storage enable pre-auth RCE, with active exploitation confirmed for the Joomla flaw.
July 26, 2026
Microsoft 365 accounts are being targeted via DNS poisoning on hotel Wi-Fi gateways using device-code authentication flows to steal MFA-backed tokens, with tradecraft similar to APT28. Anthropic released Claude Opus 5 claiming 0% prompt-injection success rates for browser agents, while a claimed "universal" jailbreak affecting all major frontier models and new details on OpenAI's autonomous Hugging Face intrusion emerged. Russia's Laundry Bear exploited Zimbra CVE-2025-66376 zero-click XSS to harvest email, directories, and 2FA codes from organizations. Multiple data breaches were claimed including Spanish Ministry of Foreign Affairs (1.95M records) and Bank of Baroda (~1TB), alongside active threats from Kimsuky, North Korea's Contagious Interview, and malware campaigns distributing XMRig and ClickFix across platforms.
July 18, 2026
WordPress core suffers an unauthenticated remote code execution chain affecting versions 6.9.0–6.9.4 and 7.0.0–7.0.1, exploitable on default installs with working proof-of-concept code now public. Microsoft SharePoint CVE-2026-58644, Oracle E-Business Suite CVE-2026-46817, and Fortinet FortiSandbox zero-days are under active exploitation with CISA remediation deadlines. Finland's security service revealed a multi-year Russian FSB campaign targeting critical infrastructure via internet-exposed legacy devices like Cisco Smart Install. NadMesh Go botnet harvests cloud credentials from exposed AI services including Langflow, Ollama, and Gradio, claiming over 3,800 unique AWS keys and Kubernetes tokens.
June 19, 2026
FortiBleed exposed working SSL-VPN credentials for 70,000+ Fortinet devices across 194 countries via industrialized hash-cracking by a Russian-speaking group, while a forgotten GitHub token cost Novo Nordisk 1.3TB of drug formulas and internal AI models. Critical vulnerabilities in NGINX (CVE-2026-42530), Cisco SD-WAN and ISE, Splunk, and Joomla are under active exploitation, alongside AI pipeline supply-chain attacks hitting Mastra, JetBrains Marketplace, and Google Vertex AI. The AtomicArch campaign compromised ~1,500 Arch Linux AUR packages with Rust infostealers and eBPF rootkits.