July 18, 2026
WordPress core suffers an unauthenticated remote code execution chain affecting versions 6.9.0–6.9.4 and 7.0.0–7.0.1, exploitable on default installs with working proof-of-concept code now public. Microsoft SharePoint CVE-2026-58644, Oracle E-Business Suite CVE-2026-46817, and Fortinet FortiSandbox zero-days are under active exploitation with CISA remediation deadlines. Finland's security service revealed a multi-year Russian FSB campaign targeting critical infrastructure via internet-exposed legacy devices like Cisco Smart Install. NadMesh Go botnet harvests cloud credentials from exposed AI services including Langflow, Ollama, and Gradio, claiming over 3,800 unique AWS keys and Kubernetes tokens.
July 15, 2026
Microsoft shipped a record 622 CVEs in July 2026, with two already under active exploitation in Active Directory and SharePoint, prompting immediate patching guidance. ESET identified 11 forgotten Microsoft-signed UEFI bootkit shims that bypass Secure Boot and survive OS reinstalls, enabling persistent firmware-level attacks. A jailbroken Gemini was exploited by a Russian fraudster to deploy a working C2 server and credential-stealing botnet in six minutes, demonstrating AI's collapsing timeline for attack infrastructure deployment. Cursor IDE has an unpatched arbitrary-code-execution flaw allowing malicious repositories to auto-execute code, and xAI's Grok Build CLI exfiltrated entire Git repositories to Google Cloud storage before uploads stopped.
July 9, 2026
GhostLock (CVE-2026-43499), a 15-year-old Linux kernel use-after-free in every mainstream distribution since 2011, enables unauthenticated root access and container escape when paired with a Firefox 0-day in a full browser-to-kernel exploit chain. GhostApproval symlink flaws in six AI coding assistants (Amazon Q Developer, Claude Code, Cursor, Google Antigravity, Windsurf, Augment) allow booby-trapped repositories to redirect file writes and achieve RCE via misleading confirmation dialogs. CISA added actively-exploited Adobe ColdFusion (CVE-2026-48282) and Langflow auth-bypass flaws to its KEV catalog, with the Langflow issue matching the JADEPUFFER operator's exploitation from the prior week. AI agents are lowering the barrier for less-skilled attackers: hallucination-squatting registers fake package names that models invent, delivering malware to developers, while researchers demonstrate that agents scanning untrusted code for bugs can instead execute the attacker's payload on the analyst's machine.
June 24, 2026
Critical vulnerabilities hit domain controllers as CVE-2026-41089 (Netlogon RCE) and Onelogon (Zerologon bypass) emerge, while FortiBleed credential-harvesting campaign reaches Finnish organizations after compromising 110M+ credentials from 430K+ Fortinet devices. Major supply-chain threats include Klue OAuth attacks affecting LastPass, malicious npm packages impersonating PostCSS, and Cordyceps malicious pull requests targeting Azure/Google/Apache projects; Anthropic's Mythos model discovered Squidbleed (Heartbleed-style flaw in Squid) and vulnerabilities in classified US systems.
June 20, 2026
FortiBleed has compromised ~86,644 internet-facing FortiGate devices in a credential-harvesting campaign, while a leaked GitHub token gave FulcrumSec access to Novo Nordisk, exfiltrating 1.3TB including unreleased drug formulas and internal AI models. Mastra npm packages were trojanized by Sapphire Sleet (North Korea–nexus), and multiple AI infrastructure flaws emerged: SearchLeak (CVE-2026-42824) in Microsoft 365 Copilot, Pickle in the Middle in Google Vertex AI, and vulnerabilities in LiteLLM. Ransomware gangs including Qilin, Gentlemen, and DragonForce continue dominating the threat landscape with EDR-killing tradecraft and cloud-based C2 abuse.
June 19, 2026
FortiBleed exposed working SSL-VPN credentials for 70,000+ Fortinet devices across 194 countries via industrialized hash-cracking by a Russian-speaking group, while a forgotten GitHub token cost Novo Nordisk 1.3TB of drug formulas and internal AI models. Critical vulnerabilities in NGINX (CVE-2026-42530), Cisco SD-WAN and ISE, Splunk, and Joomla are under active exploitation, alongside AI pipeline supply-chain attacks hitting Mastra, JetBrains Marketplace, and Google Vertex AI. The AtomicArch campaign compromised ~1,500 Arch Linux AUR packages with Rust infostealers and eBPF rootkits.
June 18, 2026
A critical vulnerability blitz dominates this digest: Oracle PeopleSoft CVE-2026-35273, Splunk CVE-2026-20253, and an unpatched Microsoft Defender RoguePlanet zero-day are actively exploited, with ShinyHunters and other threat actors targeting higher education and enterprise networks. The AI/security layer has emerged as a major attack surface, exemplified by Microsoft 365 Copilot SearchLeak (one-click data exfiltration), Google Vertex AI cross-tenant RCE, and the Novo Nordisk breach that exposed proprietary AI model checkpoints and training infrastructure as ransomware extortion payload—underscoring that AI IP is now a strategic target.